Gitiles
Code Review Sign In
gerrit.openbmc.org / openbmc / bmcweb / bbf1a93eb6935c426deb0ecbcf3d8611b17aeb30 / . / http / http_connection.h
blob: 7e23de4786dc8c7171bd88f1b7d82a2e8bc10552 [file] [log] [blame]
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]1#pragma once
Adriana Kobylak0e1cf262019-12-05 13:57:57 -0600[diff] [blame]2#include "config.h"
3
Manojkiran Eda44250442020-06-16 12:51:38 +0530[diff] [blame]4#include "http_response.h"
5#include "logging.h"
Manojkiran Eda44250442020-06-16 12:51:38 +0530[diff] [blame]6#include "timer_queue.h"
7#include "utility.h"
8
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]9#include "authorization.hpp"
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]10#include "http_utility.hpp"
11
Ed Tanouse0d918b2018-03-27 17:41:04 -0700[diff] [blame]12#include <boost/algorithm/string.hpp>
Ed Tanous257f5792018-03-17 14:40:09 -0700[diff] [blame]13#include <boost/algorithm/string/predicate.hpp>
Ed Tanous8f626352018-12-19 14:51:54 -0800[diff] [blame]14#include <boost/asio/io_context.hpp>
Ed Tanous3112a142018-11-29 15:45:10 -0800[diff] [blame]15#include <boost/asio/ip/tcp.hpp>
Ed Tanous2f1ebcd2019-02-13 19:39:07 -0800[diff] [blame]16#include <boost/asio/ssl.hpp>
Ed Tanous3112a142018-11-29 15:45:10 -0800[diff] [blame]17#include <boost/beast/core/flat_static_buffer.hpp>
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500[diff] [blame]18#include <boost/beast/http.hpp>
Manojkiran Eda44250442020-06-16 12:51:38 +0530[diff] [blame]19#include <boost/beast/ssl/ssl_stream.hpp>
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500[diff] [blame]20#include <boost/beast/websocket.hpp>
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]21#include <security_headers.hpp>
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500[diff] [blame]22#include <ssl_key_handler.hpp>
23
Manojkiran Eda44250442020-06-16 12:51:38 +0530[diff] [blame]24#include <atomic>
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500[diff] [blame]25#include <chrono>
26#include <vector>
27
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]28namespace crow
29{
Ed Tanous257f5792018-03-17 14:40:09 -0700[diff] [blame]30
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]31inline void prettyPrintJson(crow::Response& res)
32{
Jason M. Bills193ad2f2018-09-26 15:08:52 -0700[diff] [blame]33 std::string value = res.jsonValue.dump(4, ' ', true);
Ed Tanousa29c9972018-11-29 15:54:32 -0800[diff] [blame]34 utility::escapeHtml(value);
35 utility::convertToLinks(value);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]36 res.body() = "<html>\n"
37 "<head>\n"
38 "<title>Redfish API</title>\n"
39 "<link rel=\"stylesheet\" type=\"text/css\" "
40 "href=\"/styles/default.css\">\n"
41 "<script src=\"/highlight.pack.js\"></script>"
42 "<script>hljs.initHighlightingOnLoad();</script>"
43 "</head>\n"
44 "<body>\n"
45 "<div style=\"max-width: 576px;margin:0 auto;\">\n"
46 "<img src=\"/DMTF_Redfish_logo_2017.svg\" alt=\"redfish\" "
47 "height=\"406px\" "
48 "width=\"576px\">\n"
49 "<br>\n"
50 "<pre>\n"
51 "<code class=\"json\">" +
52 value +
53 "</code>\n"
54 "</pre>\n"
55 "</div>\n"
56 "</body>\n"
57 "</html>\n";
Ed Tanous93ef5802019-01-03 10:15:41 -0800[diff] [blame]58 res.addHeader("Content-Type", "text/html;charset=UTF-8");
Ed Tanous257f5792018-03-17 14:40:09 -0700[diff] [blame]59}
60
Ed Tanous55c7b7a2018-05-22 15:27:24 -0700[diff] [blame]61#ifdef BMCWEB_ENABLE_DEBUG
Ed Tanouse0d918b2018-03-27 17:41:04 -0700[diff] [blame]62static std::atomic<int> connectionCount;
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]63#endif
Jennifer Leeacb7cfb2018-06-07 16:08:15 -0700[diff] [blame]64
Adriana Kobylak0e1cf262019-12-05 13:57:57 -0600[diff] [blame]65// request body limit size set by the BMCWEB_HTTP_REQ_BODY_LIMIT_MB option
66constexpr unsigned int httpReqBodyLimit =
67 1024 * 1024 * BMCWEB_HTTP_REQ_BODY_LIMIT_MB;
Jennifer Leeacb7cfb2018-06-07 16:08:15 -0700[diff] [blame]68
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]69constexpr uint64_t loggedOutPostBodyLimit = 4096;
70
71constexpr uint32_t httpHeaderLimit = 8192;
72
73// drop all connections after 1 minute, this time limit was chosen
74// arbitrarily and can be adjusted later if needed
75static constexpr const size_t loggedInAttempts =
76 (60 / timerQueueTimeoutSeconds);
77
78static constexpr const size_t loggedOutAttempts =
79 (15 / timerQueueTimeoutSeconds);
80
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]81template <typename Adaptor, typename Handler>
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500[diff] [blame]82class Connection :
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]83 public std::enable_shared_from_this<Connection<Adaptor, Handler>>
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]84{
85 public:
Ed Tanouscb13a392020-07-25 19:02:03 +0000[diff] [blame]86 Connection(Handler* handlerIn, const std::string& ServerNameIn,
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]87 std::function<std::string()>& get_cached_date_str_f,
Ed Tanous271584a2019-07-09 16:24:22 -0700[diff] [blame]88 detail::TimerQueue& timerQueueIn, Adaptor adaptorIn) :
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]89 adaptor(std::move(adaptorIn)),
Ed Tanous271584a2019-07-09 16:24:22 -0700[diff] [blame]90 handler(handlerIn), serverName(ServerNameIn),
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]91 getCachedDateStr(get_cached_date_str_f), timerQueue(timerQueueIn)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]92 {
93 parser.emplace(std::piecewise_construct, std::make_tuple());
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]94 parser->body_limit(httpReqBodyLimit);
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]95 parser->header_limit(httpHeaderLimit);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]96 req.emplace(parser->get());
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200[diff] [blame]97
98#ifdef BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]99 auto ca_available = !std::filesystem::is_empty(
100 std::filesystem::path(ensuressl::trustStorePath));
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]101 if (ca_available && persistent_data::SessionStore::getInstance()
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]102 .getAuthMethodsConfig()
103 .tls)
104 {
105 adaptor.set_verify_mode(boost::asio::ssl::verify_peer);
106 SSL_set_session_id_context(
107 adaptor.native_handle(),
108 reinterpret_cast<const unsigned char*>(serverName.c_str()),
Zbigniew Kurzynskicac94c52019-11-07 12:55:04 +0100[diff] [blame]109 static_cast<unsigned int>(serverName.length()));
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]110 BMCWEB_LOG_DEBUG << this << " TLS is enabled on this connection.";
111 }
112
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]113 adaptor.set_verify_callback([this](
114 bool preverified,
115 boost::asio::ssl::verify_context& ctx) {
116 // do nothing if TLS is disabled
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]117 if (!persistent_data::SessionStore::getInstance()
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]118 .getAuthMethodsConfig()
119 .tls)
120 {
121 BMCWEB_LOG_DEBUG << this << " TLS auth_config is disabled";
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200[diff] [blame]122 return true;
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]123 }
124
125 // We always return true to allow full auth flow
126 if (!preverified)
127 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]128 BMCWEB_LOG_DEBUG << this << " TLS preverification failed.";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]129 return true;
130 }
131
132 X509_STORE_CTX* cts = ctx.native_handle();
133 if (cts == nullptr)
134 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]135 BMCWEB_LOG_DEBUG << this << " Cannot get native TLS handle.";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]136 return true;
137 }
138
139 // Get certificate
140 X509* peerCert =
141 X509_STORE_CTX_get_current_cert(ctx.native_handle());
142 if (peerCert == nullptr)
143 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]144 BMCWEB_LOG_DEBUG << this
145 << " Cannot get current TLS certificate.";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]146 return true;
147 }
148
149 // Check if certificate is OK
150 int error = X509_STORE_CTX_get_error(cts);
151 if (error != X509_V_OK)
152 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]153 BMCWEB_LOG_INFO << this << " Last TLS error is: " << error;
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]154 return true;
155 }
156 // Check that we have reached final certificate in chain
157 int32_t depth = X509_STORE_CTX_get_error_depth(cts);
158 if (depth != 0)
159
160 {
161 BMCWEB_LOG_DEBUG
162 << this << " Certificate verification in progress (depth "
163 << depth << "), waiting to reach final depth";
164 return true;
165 }
166
167 BMCWEB_LOG_DEBUG << this
168 << " Certificate verification of final depth";
169
170 // Verify KeyUsage
171 bool isKeyUsageDigitalSignature = false;
172 bool isKeyUsageKeyAgreement = false;
173
174 ASN1_BIT_STRING* usage = static_cast<ASN1_BIT_STRING*>(
Ed Tanous23a21a12020-07-25 04:45:05 +0000[diff] [blame]175 X509_get_ext_d2i(peerCert, NID_key_usage, nullptr, nullptr));
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]176
177 if (usage == nullptr)
178 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]179 BMCWEB_LOG_DEBUG << this << " TLS usage is null";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]180 return true;
181 }
182
183 for (int i = 0; i < usage->length; i++)
184 {
185 if (KU_DIGITAL_SIGNATURE & usage->data[i])
186 {
187 isKeyUsageDigitalSignature = true;
188 }
189 if (KU_KEY_AGREEMENT & usage->data[i])
190 {
191 isKeyUsageKeyAgreement = true;
192 }
193 }
194
195 if (!isKeyUsageDigitalSignature || !isKeyUsageKeyAgreement)
196 {
197 BMCWEB_LOG_DEBUG << this
198 << " Certificate ExtendedKeyUsage does "
199 "not allow provided certificate to "
200 "be used for user authentication";
201 return true;
202 }
Zbigniew Kurzynski09d02f82020-03-30 13:41:42 +0200[diff] [blame]203 ASN1_BIT_STRING_free(usage);
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]204
205 // Determine that ExtendedKeyUsage includes Client Auth
206
Ed Tanous23a21a12020-07-25 04:45:05 +0000[diff] [blame]207 stack_st_ASN1_OBJECT* extUsage =
208 static_cast<stack_st_ASN1_OBJECT*>(X509_get_ext_d2i(
209 peerCert, NID_ext_key_usage, nullptr, nullptr));
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]210
211 if (extUsage == nullptr)
212 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]213 BMCWEB_LOG_DEBUG << this << " TLS extUsage is null";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]214 return true;
215 }
216
217 bool isExKeyUsageClientAuth = false;
218 for (int i = 0; i < sk_ASN1_OBJECT_num(extUsage); i++)
219 {
220 if (NID_client_auth ==
221 OBJ_obj2nid(sk_ASN1_OBJECT_value(extUsage, i)))
222 {
223 isExKeyUsageClientAuth = true;
224 break;
225 }
226 }
Zbigniew Kurzynski09d02f82020-03-30 13:41:42 +0200[diff] [blame]227 sk_ASN1_OBJECT_free(extUsage);
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]228
229 // Certificate has to have proper key usages set
230 if (!isExKeyUsageClientAuth)
231 {
232 BMCWEB_LOG_DEBUG << this
233 << " Certificate ExtendedKeyUsage does "
234 "not allow provided certificate to "
235 "be used for user authentication";
236 return true;
237 }
238 std::string sslUser;
239 // Extract username contained in CommonName
240 sslUser.resize(256, '\0');
241
242 int status = X509_NAME_get_text_by_NID(
243 X509_get_subject_name(peerCert), NID_commonName, sslUser.data(),
244 static_cast<int>(sslUser.size()));
245
246 if (status == -1)
247 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]248 BMCWEB_LOG_DEBUG
249 << this << " TLS cannot get username to create session";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]250 return true;
251 }
252
253 size_t lastChar = sslUser.find('\0');
254 if (lastChar == std::string::npos || lastChar == 0)
255 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]256 BMCWEB_LOG_DEBUG << this << " Invalid TLS user name";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]257 return true;
258 }
259 sslUser.resize(lastChar);
260
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]261 session =
262 persistent_data::SessionStore::getInstance()
263 .generateUserSession(
264 sslUser, persistent_data::PersistenceType::TIMEOUT);
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]265 if (auto sp = session.lock())
266 {
267 BMCWEB_LOG_DEBUG << this
268 << " Generating TLS session: " << sp->uniqueId;
269 }
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]270 return true;
271 });
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200[diff] [blame]272#endif // BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION
273
Ed Tanous55c7b7a2018-05-22 15:27:24 -0700[diff] [blame]274#ifdef BMCWEB_ENABLE_DEBUG
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]275 connectionCount++;
276 BMCWEB_LOG_DEBUG << this << " Connection open, total "
277 << connectionCount;
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]278#endif
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]279 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]280
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]281 ~Connection()
282 {
283 res.completeRequestHandler = nullptr;
284 cancelDeadlineTimer();
Ed Tanous55c7b7a2018-05-22 15:27:24 -0700[diff] [blame]285#ifdef BMCWEB_ENABLE_DEBUG
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]286 connectionCount--;
287 BMCWEB_LOG_DEBUG << this << " Connection closed, total "
288 << connectionCount;
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]289#endif
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]290 }
291
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]292 Adaptor& socket()
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]293 {
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]294 return adaptor;
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]295 }
296
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]297 void start()
298 {
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]299
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]300 startDeadline(0);
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]301 // TODO(ed) Abstract this to a more clever class with the idea of an
302 // asynchronous "start"
303 if constexpr (std::is_same_v<Adaptor,
304 boost::beast::ssl_stream<
305 boost::asio::ip::tcp::socket>>)
306 {
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]307 adaptor.async_handshake(boost::asio::ssl::stream_base::server,
308 [this, self(shared_from_this())](
309 const boost::system::error_code& ec) {
310 if (ec)
311 {
312 return;
313 }
314 doReadHeaders();
315 });
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]316 }
317 else
318 {
319 doReadHeaders();
320 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]321 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]322
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]323 void handle()
324 {
325 cancelDeadlineTimer();
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]326
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]327 bool isInvalidRequest = false;
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]328
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]329 // Check for HTTP version 1.1.
330 if (req->version() == 11)
331 {
332 if (req->getHeaderValue(boost::beast::http::field::host).empty())
333 {
334 isInvalidRequest = true;
Ed Tanousde5c9f32019-03-26 09:17:55 -0700[diff] [blame]335 res.result(boost::beast::http::status::bad_request);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]336 }
337 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]338
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]339 BMCWEB_LOG_INFO << "Request: "
340 << " " << this << " HTTP/" << req->version() / 10 << "."
341 << req->version() % 10 << ' ' << req->methodString()
342 << " " << req->target();
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]343
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]344 needToCallAfterHandlers = false;
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]345
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]346 if (!isInvalidRequest)
347 {
348 res.completeRequestHandler = [] {};
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]349 res.isAliveHelper = [this]() -> bool { return isAlive(); };
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]350
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]351 req->ioService = static_cast<decltype(req->ioService)>(
352 &adaptor.get_executor().context());
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200[diff] [blame]353
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]354 if (!res.completed)
355 {
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]356 needToCallAfterHandlers = true;
357 res.completeRequestHandler = [self(shared_from_this())] {
358 self->completeRequest();
359 };
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]360 if (req->isUpgrade() &&
361 boost::iequals(
362 req->getHeaderValue(boost::beast::http::field::upgrade),
363 "websocket"))
364 {
365 handler->handleUpgrade(*req, res, std::move(adaptor));
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]366 // delete lambda with self shared_ptr
367 // to enable connection destruction
368 res.completeRequestHandler = nullptr;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]369 return;
370 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]371 handler->handle(*req, res);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]372 }
373 else
374 {
375 completeRequest();
376 }
377 }
378 else
379 {
380 completeRequest();
381 }
382 }
Ed Tanouse0d918b2018-03-27 17:41:04 -0700[diff] [blame]383
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]384 bool isAlive()
385 {
386
387 if constexpr (std::is_same_v<Adaptor,
388 boost::beast::ssl_stream<
389 boost::asio::ip::tcp::socket>>)
390 {
391 return adaptor.next_layer().is_open();
392 }
393 else
394 {
395 return adaptor.is_open();
396 }
397 }
398 void close()
399 {
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]400 if constexpr (std::is_same_v<Adaptor,
401 boost::beast::ssl_stream<
402 boost::asio::ip::tcp::socket>>)
403 {
404 adaptor.next_layer().close();
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200[diff] [blame]405#ifdef BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION
406 if (auto sp = session.lock())
407 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]408 BMCWEB_LOG_DEBUG << this
409 << " Removing TLS session: " << sp->uniqueId;
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200[diff] [blame]410 persistent_data::SessionStore::getInstance().removeSession(sp);
411 }
412#endif // BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]413 }
414 else
415 {
416 adaptor.close();
417 }
418 }
419
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]420 void completeRequest()
421 {
422 BMCWEB_LOG_INFO << "Response: " << this << ' ' << req->url << ' '
423 << res.resultInt() << " keepalive=" << req->keepAlive();
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]424
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]425 addSecurityHeaders(res);
426
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]427 if (needToCallAfterHandlers)
428 {
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]429 crow::authorization::cleanupTempSession(*req);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]430 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]431
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]432 if (!isAlive())
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]433 {
434 // BMCWEB_LOG_DEBUG << this << " delete (socket is closed) " <<
435 // isReading
436 // << ' ' << isWriting;
437 // delete this;
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]438
439 // delete lambda with self shared_ptr
440 // to enable connection destruction
441 res.completeRequestHandler = nullptr;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]442 return;
443 }
444 if (res.body().empty() && !res.jsonValue.empty())
445 {
446 if (http_helpers::requestPrefersHtml(*req))
447 {
448 prettyPrintJson(res);
449 }
450 else
451 {
452 res.jsonMode();
Jason M. Bills193ad2f2018-09-26 15:08:52 -0700[diff] [blame]453 res.body() = res.jsonValue.dump(2, ' ', true);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]454 }
455 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]456
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]457 if (res.resultInt() >= 400 && res.body().empty())
458 {
459 res.body() = std::string(res.reason());
460 }
Ed Tanous6295bec2019-09-03 10:11:01 -0700[diff] [blame]461
462 if (res.result() == boost::beast::http::status::no_content)
463 {
464 // Boost beast throws if content is provided on a no-content
465 // response. Ideally, this would never happen, but in the case that
466 // it does, we don't want to throw.
467 BMCWEB_LOG_CRITICAL
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]468 << this << " Response content provided but code was no-content";
Ed Tanous6295bec2019-09-03 10:11:01 -0700[diff] [blame]469 res.body().clear();
470 }
471
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]472 res.addHeader(boost::beast::http::field::server, serverName);
473 res.addHeader(boost::beast::http::field::date, getCachedDateStr());
474
475 res.keepAlive(req->keepAlive());
476
477 doWrite();
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]478
479 // delete lambda with self shared_ptr
480 // to enable connection destruction
481 res.completeRequestHandler = nullptr;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]482 }
483
484 private:
485 void doReadHeaders()
486 {
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]487 BMCWEB_LOG_DEBUG << this << " doReadHeaders";
488
489 // Clean up any previous Connection.
490 boost::beast::http::async_read_header(
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]491 adaptor, buffer, *parser,
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]492 [this,
493 self(shared_from_this())](const boost::system::error_code& ec,
494 std::size_t bytes_transferred) {
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]495 BMCWEB_LOG_ERROR << this << " async_read_header "
496 << bytes_transferred << " Bytes";
497 bool errorWhileReading = false;
498 if (ec)
499 {
500 errorWhileReading = true;
501 BMCWEB_LOG_ERROR
502 << this << " Error while reading: " << ec.message();
503 }
504 else
505 {
506 // if the adaptor isn't open anymore, and wasn't handed to a
507 // websocket, treat as an error
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]508 if (!isAlive() && !req->isUpgrade())
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]509 {
510 errorWhileReading = true;
511 }
512 }
513
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]514 cancelDeadlineTimer();
515
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]516 if (errorWhileReading)
517 {
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]518 close();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]519 BMCWEB_LOG_DEBUG << this << " from read(1)";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]520 return;
521 }
522
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]523 if (!req)
524 {
525 close();
526 return;
527 }
528
Ed Tanousdc7a7932020-08-17 15:04:58 -0700[diff] [blame]529 // Note, despite the bmcweb coding policy on use of exceptions
530 // for error handling, this one particular use of exceptions is
531 // deemed acceptible, as it solved a significant error handling
532 // problem that resulted in seg faults, the exact thing that the
533 // exceptions rule is trying to avoid. If at some point,
534 // boost::urls makes the parser object public (or we port it
535 // into bmcweb locally) this will be replaced with
536 // parser::parse, which returns a status code
James Feist5a7e8772020-07-22 09:08:38 -0700[diff] [blame]537
Ed Tanousdc7a7932020-08-17 15:04:58 -0700[diff] [blame]538 try
539 {
540 req->urlView = boost::urls::url_view(req->target());
541 req->url = req->urlView.encoded_path();
542 }
Ed Tanous92ccb882020-08-18 10:36:33 -0700[diff] [blame]543 catch (std::exception& p)
Ed Tanousdc7a7932020-08-17 15:04:58 -0700[diff] [blame]544 {
Ed Tanous3bcc0152020-08-25 07:47:29 -0700[diff] [blame]545 BMCWEB_LOG_ERROR << p.what();
Ed Tanousdc7a7932020-08-17 15:04:58 -0700[diff] [blame]546 }
Ed Tanous92ccb882020-08-18 10:36:33 -0700[diff] [blame]547
James Feist6964c982020-07-28 16:10:23 -0700[diff] [blame]548 crow::authorization::authenticate(*req, res, session);
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]549
550 bool loggedIn = req && req->session;
551 if (loggedIn)
552 {
553 startDeadline(loggedInAttempts);
554 BMCWEB_LOG_DEBUG << "Starting slow deadline";
555
James Feist5a7e8772020-07-22 09:08:38 -0700[diff] [blame]556 req->urlParams = req->urlView.params();
557
558#ifdef BMCWEB_ENABLE_DEBUG
559 std::string paramList = "";
560 for (const auto param : req->urlParams)
561 {
562 paramList += param->key() + " " + param->value() + " ";
563 }
564 BMCWEB_LOG_DEBUG << "QueryParams: " << paramList;
565#endif
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]566 }
567 else
568 {
569 const boost::optional<uint64_t> contentLength =
570 parser->content_length();
571 if (contentLength &&
572 *contentLength > loggedOutPostBodyLimit)
573 {
574 BMCWEB_LOG_DEBUG << "Content length greater than limit "
575 << *contentLength;
576 close();
577 return;
578 }
579
580 startDeadline(loggedOutAttempts);
581 BMCWEB_LOG_DEBUG << "Starting quick deadline";
582 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]583 doRead();
584 });
585 }
586
587 void doRead()
588 {
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]589 BMCWEB_LOG_DEBUG << this << " doRead";
590
591 boost::beast::http::async_read(
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]592 adaptor, buffer, *parser,
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]593 [this,
594 self(shared_from_this())](const boost::system::error_code& ec,
595 std::size_t bytes_transferred) {
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]596 BMCWEB_LOG_DEBUG << this << " async_read " << bytes_transferred
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]597 << " Bytes";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]598
599 bool errorWhileReading = false;
600 if (ec)
601 {
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]602 BMCWEB_LOG_ERROR
603 << this << " Error while reading: " << ec.message();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]604 errorWhileReading = true;
605 }
606 else
607 {
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]608 if (isAlive())
609 {
610 cancelDeadlineTimer();
611 bool loggedIn = req && req->session;
612 if (loggedIn)
613 {
614 startDeadline(loggedInAttempts);
615 }
616 else
617 {
618 startDeadline(loggedOutAttempts);
619 }
620 }
621 else
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]622 {
623 errorWhileReading = true;
624 }
625 }
626 if (errorWhileReading)
627 {
628 cancelDeadlineTimer();
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]629 close();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]630 BMCWEB_LOG_DEBUG << this << " from read(1)";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]631 return;
632 }
633 handle();
634 });
635 }
636
637 void doWrite()
638 {
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]639 bool loggedIn = req && req->session;
640 if (loggedIn)
641 {
642 startDeadline(loggedInAttempts);
643 }
644 else
645 {
646 startDeadline(loggedOutAttempts);
647 }
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]648 BMCWEB_LOG_DEBUG << this << " doWrite";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]649 res.preparePayload();
650 serializer.emplace(*res.stringResponse);
651 boost::beast::http::async_write(
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]652 adaptor, *serializer,
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]653 [this,
654 self(shared_from_this())](const boost::system::error_code& ec,
655 std::size_t bytes_transferred) {
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]656 BMCWEB_LOG_DEBUG << this << " async_write " << bytes_transferred
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]657 << " bytes";
658
James Feist54d8bb12020-07-20 13:28:59 -0700[diff] [blame]659 cancelDeadlineTimer();
660
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]661 if (ec)
662 {
663 BMCWEB_LOG_DEBUG << this << " from write(2)";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]664 return;
665 }
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]666 if (!res.keepAlive())
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]667 {
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]668 close();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]669 BMCWEB_LOG_DEBUG << this << " from write(1)";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]670 return;
671 }
672
673 serializer.reset();
674 BMCWEB_LOG_DEBUG << this << " Clearing response";
675 res.clear();
676 parser.emplace(std::piecewise_construct, std::make_tuple());
Gunnar Millsded2a1e2020-07-24 09:46:33 -0500[diff] [blame]677 parser->body_limit(httpReqBodyLimit); // reset body limit for
678 // newly created parser
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]679 buffer.consume(buffer.size());
680
681 req.emplace(parser->get());
682 doReadHeaders();
683 });
684 }
685
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]686 void cancelDeadlineTimer()
687 {
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]688 if (timerCancelKey)
689 {
690 BMCWEB_LOG_DEBUG << this << " timer cancelled: " << &timerQueue
691 << ' ' << *timerCancelKey;
692 timerQueue.cancel(*timerCancelKey);
693 timerCancelKey.reset();
694 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]695 }
696
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]697 void startDeadline(size_t timerIterations)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]698 {
699 cancelDeadlineTimer();
700
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]701 if (timerIterations)
702 {
703 timerIterations--;
704 }
Jan Sowinski2b5e08e2020-01-09 17:16:02 +0100[diff] [blame]705
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]706 timerCancelKey =
James Feistbe5dfca2020-07-22 08:54:59 -0700[diff] [blame]707 timerQueue.add([self(shared_from_this()), timerIterations,
708 readCount{parser->get().body().size()}] {
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]709 // Mark timer as not active to avoid canceling it during
710 // Connection destructor which leads to double free issue
711 self->timerCancelKey.reset();
712 if (!self->isAlive())
713 {
714 return;
715 }
Jan Sowinski2b5e08e2020-01-09 17:16:02 +0100[diff] [blame]716
James Feistbe5dfca2020-07-22 08:54:59 -0700[diff] [blame]717 bool loggedIn = self->req && self->req->session;
718 // allow slow uploads for logged in users
719 if (loggedIn && self->parser->get().body().size() > readCount)
720 {
721 BMCWEB_LOG_DEBUG << self.get()
722 << " restart timer - read in progress";
723 self->startDeadline(timerIterations);
724 return;
725 }
726
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]727 // Threshold can be used to drop slow connections
728 // to protect against slow-rate DoS attack
729 if (timerIterations)
730 {
James Feistbe5dfca2020-07-22 08:54:59 -0700[diff] [blame]731 BMCWEB_LOG_DEBUG << self.get() << " restart timer";
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]732 self->startDeadline(timerIterations);
733 return;
734 }
735
736 self->close();
737 });
James Feistcb6cb492020-04-03 13:36:17 -0700[diff] [blame]738
739 if (!timerCancelKey)
740 {
741 close();
742 return;
743 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]744 BMCWEB_LOG_DEBUG << this << " timer added: " << &timerQueue << ' '
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]745 << *timerCancelKey;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]746 }
747
748 private:
749 Adaptor adaptor;
750 Handler* handler;
751
Ed Tanousa24526d2018-12-10 15:17:59 -0800[diff] [blame]752 // Making this a std::optional allows it to be efficiently destroyed and
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]753 // re-created on Connection reset
Ed Tanousa24526d2018-12-10 15:17:59 -0800[diff] [blame]754 std::optional<
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]755 boost::beast::http::request_parser<boost::beast::http::string_body>>
756 parser;
757
Ed Tanous3112a142018-11-29 15:45:10 -0800[diff] [blame]758 boost::beast::flat_static_buffer<8192> buffer;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]759
Ed Tanousa24526d2018-12-10 15:17:59 -0800[diff] [blame]760 std::optional<boost::beast::http::response_serializer<
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]761 boost::beast::http::string_body>>
762 serializer;
763
Ed Tanousa24526d2018-12-10 15:17:59 -0800[diff] [blame]764 std::optional<crow::Request> req;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]765 crow::Response res;
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]766
767 std::weak_ptr<persistent_data::UserSession> session;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]768
769 const std::string& serverName;
770
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]771 std::optional<size_t> timerCancelKey;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]772
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]773 bool needToCallAfterHandlers{};
774 bool needToStartReadAfterComplete{};
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]775
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]776 std::function<std::string()>& getCachedDateStr;
777 detail::TimerQueue& timerQueue;
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]778
779 using std::enable_shared_from_this<
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]780 Connection<Adaptor, Handler>>::shared_from_this;
Ed Tanous3112a142018-11-29 15:45:10 -0800[diff] [blame]781};
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]782} // namespace crow