blob: 376eeec73d0fa9dd858f80f32ce8e79acef7404a [file] [log] [blame]
Ed Tanous7045c8d2017-04-03 10:04:37 -07001#pragma once
Ed Tanous75312982021-02-11 14:26:02 -08002#include "bmcweb_config.h"
Adriana Kobylak0e1cf262019-12-05 13:57:57 -06003
Nan Zhoud055a342022-05-25 01:15:34 +00004#include "authentication.hpp"
Ed Tanous04e438c2020-10-03 08:06:26 -07005#include "http_response.hpp"
Ed Tanous1abe55e2018-09-05 08:30:59 -07006#include "http_utility.hpp"
Ed Tanous04e438c2020-10-03 08:06:26 -07007#include "logging.hpp"
Ed Tanous04e438c2020-10-03 08:06:26 -07008#include "utility.hpp"
Ed Tanous1abe55e2018-09-05 08:30:59 -07009
Ed Tanous257f5792018-03-17 14:40:09 -070010#include <boost/algorithm/string/predicate.hpp>
Ed Tanous8f626352018-12-19 14:51:54 -080011#include <boost/asio/io_context.hpp>
Ed Tanous3112a142018-11-29 15:45:10 -080012#include <boost/asio/ip/tcp.hpp>
Ed Tanousd43cd0c2020-09-30 20:46:53 -070013#include <boost/asio/ssl/stream.hpp>
Ed Tanous5dfb5b22021-12-03 11:24:53 -080014#include <boost/asio/steady_timer.hpp>
Ed Tanous3112a142018-11-29 15:45:10 -080015#include <boost/beast/core/flat_static_buffer.hpp>
Ed Tanous918ef252022-05-25 10:40:41 -070016#include <boost/beast/http/parser.hpp>
17#include <boost/beast/http/read.hpp>
18#include <boost/beast/http/serializer.hpp>
19#include <boost/beast/http/write.hpp>
Manojkiran Eda44250442020-06-16 12:51:38 +053020#include <boost/beast/ssl/ssl_stream.hpp>
Gunnar Mills1214b7e2020-06-04 10:11:30 -050021#include <boost/beast/websocket.hpp>
Ed Tanousd32c4fa2021-09-14 13:16:51 -070022#include <boost/url/url_view.hpp>
Ed Tanous57fce802019-05-21 13:00:34 -070023#include <json_html_serializer.hpp>
Ed Tanous52cc1122020-07-18 13:51:21 -070024#include <security_headers.hpp>
Gunnar Mills1214b7e2020-06-04 10:11:30 -050025#include <ssl_key_handler.hpp>
26
Manojkiran Eda44250442020-06-16 12:51:38 +053027#include <atomic>
Gunnar Mills1214b7e2020-06-04 10:11:30 -050028#include <chrono>
29#include <vector>
30
Ed Tanous1abe55e2018-09-05 08:30:59 -070031namespace crow
32{
Ed Tanous257f5792018-03-17 14:40:09 -070033
Ed Tanous1abe55e2018-09-05 08:30:59 -070034inline void prettyPrintJson(crow::Response& res)
35{
Ed Tanous57fce802019-05-21 13:00:34 -070036 json_html_util::dumpHtml(res.body(), res.jsonValue);
37
Ed Tanousd9f6c622022-03-17 09:12:17 -070038 res.addHeader(boost::beast::http::field::content_type,
39 "text/html;charset=UTF-8");
Ed Tanous257f5792018-03-17 14:40:09 -070040}
41
Ed Tanous6fbdbca2021-12-06 14:36:06 -080042static int connectionCount = 0;
Jennifer Leeacb7cfb2018-06-07 16:08:15 -070043
Ed Tanous0260d9d2021-02-07 19:31:07 +000044// request body limit size set by the bmcwebHttpReqBodyLimitMb option
Ed Tanous6de264c2022-01-06 12:47:59 -080045constexpr uint64_t httpReqBodyLimit =
46 1024UL * 1024UL * bmcwebHttpReqBodyLimitMb;
Jennifer Leeacb7cfb2018-06-07 16:08:15 -070047
James Feist3909dc82020-04-03 10:58:55 -070048constexpr uint64_t loggedOutPostBodyLimit = 4096;
49
50constexpr uint32_t httpHeaderLimit = 8192;
51
Ed Tanous52cc1122020-07-18 13:51:21 -070052template <typename Adaptor, typename Handler>
Gunnar Mills1214b7e2020-06-04 10:11:30 -050053class Connection :
Ed Tanous52cc1122020-07-18 13:51:21 -070054 public std::enable_shared_from_this<Connection<Adaptor, Handler>>
Ed Tanous1abe55e2018-09-05 08:30:59 -070055{
56 public:
Ed Tanous5dfb5b22021-12-03 11:24:53 -080057 Connection(Handler* handlerIn, boost::asio::steady_timer&& timerIn,
Ed Tanous81ce6092020-12-17 16:54:55 +000058 std::function<std::string()>& getCachedDateStrF,
Ed Tanous5dfb5b22021-12-03 11:24:53 -080059 Adaptor adaptorIn) :
Ed Tanousceac6f72018-12-02 11:58:47 -080060 adaptor(std::move(adaptorIn)),
Ed Tanous5dfb5b22021-12-03 11:24:53 -080061 handler(handlerIn), timer(std::move(timerIn)),
62 getCachedDateStr(getCachedDateStrF)
Ed Tanous1abe55e2018-09-05 08:30:59 -070063 {
64 parser.emplace(std::piecewise_construct, std::make_tuple());
Ed Tanous1abe55e2018-09-05 08:30:59 -070065 parser->body_limit(httpReqBodyLimit);
James Feist3909dc82020-04-03 10:58:55 -070066 parser->header_limit(httpHeaderLimit);
Kowalski, Kamil55e43f62019-07-10 13:12:57 +020067
68#ifdef BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION
Ed Tanous40aa0582021-07-14 13:24:40 -070069 prepareMutualTls();
70#endif // BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION
71
Ed Tanous40aa0582021-07-14 13:24:40 -070072 connectionCount++;
Ed Tanous6fbdbca2021-12-06 14:36:06 -080073
Ed Tanous40aa0582021-07-14 13:24:40 -070074 BMCWEB_LOG_DEBUG << this << " Connection open, total "
75 << connectionCount;
Ed Tanous40aa0582021-07-14 13:24:40 -070076 }
77
78 ~Connection()
79 {
John Edward Broadbent4147b8a2021-07-19 16:52:24 -070080 res.setCompleteRequestHandler(nullptr);
Ed Tanous40aa0582021-07-14 13:24:40 -070081 cancelDeadlineTimer();
Ed Tanous6fbdbca2021-12-06 14:36:06 -080082
Ed Tanous40aa0582021-07-14 13:24:40 -070083 connectionCount--;
84 BMCWEB_LOG_DEBUG << this << " Connection closed, total "
85 << connectionCount;
Ed Tanous40aa0582021-07-14 13:24:40 -070086 }
87
Ed Tanousecd6a3a2022-01-07 09:18:40 -080088 Connection(const Connection&) = delete;
89 Connection(Connection&&) = delete;
90 Connection& operator=(const Connection&) = delete;
91 Connection& operator=(Connection&&) = delete;
92
Ed Tanous40aa0582021-07-14 13:24:40 -070093 void prepareMutualTls()
94 {
Jonathan Doman83deb7d2020-11-16 17:00:22 -080095 std::error_code error;
96 std::filesystem::path caPath(ensuressl::trustStorePath);
97 auto caAvailable = !std::filesystem::is_empty(caPath, error);
98 caAvailable = caAvailable && !error;
Ed Tanous2c70f802020-09-28 14:29:23 -070099 if (caAvailable && persistent_data::SessionStore::getInstance()
100 .getAuthMethodsConfig()
101 .tls)
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100102 {
103 adaptor.set_verify_mode(boost::asio::ssl::verify_peer);
Ed Tanouse7d1a1c2020-09-28 09:36:35 -0700104 std::string id = "bmcweb";
Ed Tanous46ff87b2022-01-07 09:25:51 -0800105
Ed Tanous9eb808c2022-01-25 10:19:23 -0800106 const char* cStr = id.c_str();
Ed Tanous46ff87b2022-01-07 09:25:51 -0800107 // NOLINTNEXTLINE(cppcoreguidelines-pro-type-reinterpret-cast)
Ed Tanous9eb808c2022-01-25 10:19:23 -0800108 const auto* idC = reinterpret_cast<const unsigned char*>(cStr);
Ed Tanouse7d1a1c2020-09-28 09:36:35 -0700109 int ret = SSL_set_session_id_context(
Ed Tanous46ff87b2022-01-07 09:25:51 -0800110 adaptor.native_handle(), idC,
Ed Tanouse7d1a1c2020-09-28 09:36:35 -0700111 static_cast<unsigned int>(id.length()));
112 if (ret == 0)
113 {
114 BMCWEB_LOG_ERROR << this << " failed to set SSL id";
115 }
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100116 }
117
Ed Tanous002d39b2022-05-31 08:59:27 -0700118 adaptor.set_verify_callback(
119 [this](bool preverified, boost::asio::ssl::verify_context& ctx) {
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100120 // do nothing if TLS is disabled
Ed Tanous52cc1122020-07-18 13:51:21 -0700121 if (!persistent_data::SessionStore::getInstance()
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100122 .getAuthMethodsConfig()
123 .tls)
124 {
125 BMCWEB_LOG_DEBUG << this << " TLS auth_config is disabled";
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200126 return true;
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100127 }
128
129 // We always return true to allow full auth flow
130 if (!preverified)
131 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100132 BMCWEB_LOG_DEBUG << this << " TLS preverification failed.";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100133 return true;
134 }
135
136 X509_STORE_CTX* cts = ctx.native_handle();
137 if (cts == nullptr)
138 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100139 BMCWEB_LOG_DEBUG << this << " Cannot get native TLS handle.";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100140 return true;
141 }
142
143 // Get certificate
144 X509* peerCert =
145 X509_STORE_CTX_get_current_cert(ctx.native_handle());
146 if (peerCert == nullptr)
147 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100148 BMCWEB_LOG_DEBUG << this
149 << " Cannot get current TLS certificate.";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100150 return true;
151 }
152
153 // Check if certificate is OK
Ed Tanous8a592812022-06-04 09:06:59 -0700154 int ctxError = X509_STORE_CTX_get_error(cts);
155 if (ctxError != X509_V_OK)
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100156 {
Ed Tanous8a592812022-06-04 09:06:59 -0700157 BMCWEB_LOG_INFO << this << " Last TLS error is: " << ctxError;
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100158 return true;
159 }
160 // Check that we have reached final certificate in chain
161 int32_t depth = X509_STORE_CTX_get_error_depth(cts);
162 if (depth != 0)
163
164 {
165 BMCWEB_LOG_DEBUG
166 << this << " Certificate verification in progress (depth "
167 << depth << "), waiting to reach final depth";
168 return true;
169 }
170
171 BMCWEB_LOG_DEBUG << this
172 << " Certificate verification of final depth";
173
174 // Verify KeyUsage
175 bool isKeyUsageDigitalSignature = false;
176 bool isKeyUsageKeyAgreement = false;
177
178 ASN1_BIT_STRING* usage = static_cast<ASN1_BIT_STRING*>(
Ed Tanous23a21a12020-07-25 04:45:05 +0000179 X509_get_ext_d2i(peerCert, NID_key_usage, nullptr, nullptr));
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100180
181 if (usage == nullptr)
182 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100183 BMCWEB_LOG_DEBUG << this << " TLS usage is null";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100184 return true;
185 }
186
187 for (int i = 0; i < usage->length; i++)
188 {
Ed Tanousca45aa32022-01-07 09:28:45 -0800189 // NOLINTNEXTLINE(cppcoreguidelines-pro-bounds-pointer-arithmetic)
190 unsigned char usageChar = usage->data[i];
191 if (KU_DIGITAL_SIGNATURE & usageChar)
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100192 {
193 isKeyUsageDigitalSignature = true;
194 }
Ed Tanousca45aa32022-01-07 09:28:45 -0800195 if (KU_KEY_AGREEMENT & usageChar)
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100196 {
197 isKeyUsageKeyAgreement = true;
198 }
199 }
Vernon Maueryb9378302021-06-16 14:06:57 -0700200 ASN1_BIT_STRING_free(usage);
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100201
202 if (!isKeyUsageDigitalSignature || !isKeyUsageKeyAgreement)
203 {
204 BMCWEB_LOG_DEBUG << this
205 << " Certificate ExtendedKeyUsage does "
206 "not allow provided certificate to "
207 "be used for user authentication";
208 return true;
209 }
210
211 // Determine that ExtendedKeyUsage includes Client Auth
212
Ed Tanous23a21a12020-07-25 04:45:05 +0000213 stack_st_ASN1_OBJECT* extUsage =
214 static_cast<stack_st_ASN1_OBJECT*>(X509_get_ext_d2i(
215 peerCert, NID_ext_key_usage, nullptr, nullptr));
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100216
217 if (extUsage == nullptr)
218 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100219 BMCWEB_LOG_DEBUG << this << " TLS extUsage is null";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100220 return true;
221 }
222
223 bool isExKeyUsageClientAuth = false;
224 for (int i = 0; i < sk_ASN1_OBJECT_num(extUsage); i++)
225 {
Ed Tanous4bac4a82022-01-07 09:37:55 -0800226 // NOLINTNEXTLINE(cppcoreguidelines-pro-type-cstyle-cast)
227 int nid = OBJ_obj2nid(sk_ASN1_OBJECT_value(extUsage, i));
228 if (NID_client_auth == nid)
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100229 {
230 isExKeyUsageClientAuth = true;
231 break;
232 }
233 }
Zbigniew Kurzynski09d02f82020-03-30 13:41:42 +0200234 sk_ASN1_OBJECT_free(extUsage);
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100235
236 // Certificate has to have proper key usages set
237 if (!isExKeyUsageClientAuth)
238 {
239 BMCWEB_LOG_DEBUG << this
240 << " Certificate ExtendedKeyUsage does "
241 "not allow provided certificate to "
242 "be used for user authentication";
243 return true;
244 }
245 std::string sslUser;
246 // Extract username contained in CommonName
247 sslUser.resize(256, '\0');
248
249 int status = X509_NAME_get_text_by_NID(
250 X509_get_subject_name(peerCert), NID_commonName, sslUser.data(),
251 static_cast<int>(sslUser.size()));
252
253 if (status == -1)
254 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100255 BMCWEB_LOG_DEBUG
256 << this << " TLS cannot get username to create session";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100257 return true;
258 }
259
260 size_t lastChar = sslUser.find('\0');
261 if (lastChar == std::string::npos || lastChar == 0)
262 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100263 BMCWEB_LOG_DEBUG << this << " Invalid TLS user name";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100264 return true;
265 }
266 sslUser.resize(lastChar);
Ed Tanouse05aec52022-01-25 10:28:56 -0800267 std::string unsupportedClientId;
Ed Tanous9a69d5a2021-09-13 10:23:51 -0700268 sessionIsFromTransport = true;
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700269 userSession = persistent_data::SessionStore::getInstance()
270 .generateUserSession(
Jiaqing Zhao41d61c82021-12-07 13:21:47 +0800271 sslUser, req->ipAddress, unsupportedClientId,
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700272 persistent_data::PersistenceType::TIMEOUT);
273 if (userSession != nullptr)
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100274 {
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700275 BMCWEB_LOG_DEBUG
276 << this
277 << " Generating TLS session: " << userSession->uniqueId;
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100278 }
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100279 return true;
280 });
Ed Tanous7045c8d2017-04-03 10:04:37 -0700281 }
282
Ed Tanousceac6f72018-12-02 11:58:47 -0800283 Adaptor& socket()
Ed Tanous1abe55e2018-09-05 08:30:59 -0700284 {
Ed Tanousceac6f72018-12-02 11:58:47 -0800285 return adaptor;
Ed Tanous7045c8d2017-04-03 10:04:37 -0700286 }
287
Ed Tanous1abe55e2018-09-05 08:30:59 -0700288 void start()
289 {
Ed Tanous6fbdbca2021-12-06 14:36:06 -0800290 if (connectionCount >= 100)
291 {
292 BMCWEB_LOG_CRITICAL << this << "Max connection count exceeded.";
293 return;
294 }
295
Ed Tanous5dfb5b22021-12-03 11:24:53 -0800296 startDeadline();
Sunitha Harishc0ea7ae2020-10-30 02:37:30 -0500297
Ed Tanousceac6f72018-12-02 11:58:47 -0800298 // TODO(ed) Abstract this to a more clever class with the idea of an
299 // asynchronous "start"
300 if constexpr (std::is_same_v<Adaptor,
301 boost::beast::ssl_stream<
302 boost::asio::ip::tcp::socket>>)
303 {
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000304 adaptor.async_handshake(boost::asio::ssl::stream_base::server,
305 [this, self(shared_from_this())](
306 const boost::system::error_code& ec) {
Ed Tanous002d39b2022-05-31 08:59:27 -0700307 if (ec)
308 {
309 return;
310 }
311 doReadHeaders();
312 });
Ed Tanousceac6f72018-12-02 11:58:47 -0800313 }
314 else
315 {
316 doReadHeaders();
317 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700318 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700319
Ed Tanous1abe55e2018-09-05 08:30:59 -0700320 void handle()
321 {
Ed Tanousf79b7a52021-09-22 19:04:29 -0700322 std::error_code reqEc;
323 crow::Request& thisReq = req.emplace(parser->release(), reqEc);
324 if (reqEc)
325 {
326 BMCWEB_LOG_DEBUG << "Request failed to construct" << reqEc;
327 return;
328 }
Ed Tanous596b2032021-09-13 10:32:22 -0700329 thisReq.session = userSession;
330
Ivan Mikhaylovf65b0be2021-04-19 10:05:30 +0000331 // Fetch the client IP address
332 readClientIp();
333
Ed Tanous1abe55e2018-09-05 08:30:59 -0700334 // Check for HTTP version 1.1.
Ed Tanous596b2032021-09-13 10:32:22 -0700335 if (thisReq.version() == 11)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700336 {
Ed Tanous596b2032021-09-13 10:32:22 -0700337 if (thisReq.getHeaderValue(boost::beast::http::field::host).empty())
Ed Tanous1abe55e2018-09-05 08:30:59 -0700338 {
Ed Tanousde5c9f32019-03-26 09:17:55 -0700339 res.result(boost::beast::http::status::bad_request);
Nan Zhou72374eb2022-01-27 17:06:51 -0800340 completeRequest(res);
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700341 return;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700342 }
343 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700344
Ed Tanouse278c182019-03-13 16:23:37 -0700345 BMCWEB_LOG_INFO << "Request: "
Ed Tanous596b2032021-09-13 10:32:22 -0700346 << " " << this << " HTTP/" << thisReq.version() / 10
347 << "." << thisReq.version() % 10 << ' '
348 << thisReq.methodString() << " " << thisReq.target()
Ed Tanous8cc8ede2022-02-28 10:20:59 -0800349 << " " << thisReq.ipAddress.to_string();
Ed Tanousd32c4fa2021-09-14 13:16:51 -0700350
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700351 res.isAliveHelper = [this]() -> bool { return isAlive(); };
Ed Tanous7045c8d2017-04-03 10:04:37 -0700352
Ed Tanous596b2032021-09-13 10:32:22 -0700353 thisReq.ioService = static_cast<decltype(thisReq.ioService)>(
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700354 &adaptor.get_executor().context());
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200355
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700356 if (res.completed)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700357 {
Nan Zhou72374eb2022-01-27 17:06:51 -0800358 completeRequest(res);
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700359 return;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700360 }
Nan Zhoua43ea822022-05-27 00:42:44 +0000361#ifndef BMCWEB_INSECURE_DISABLE_AUTHX
Nan Zhoud055a342022-05-25 01:15:34 +0000362 if (!crow::authentication::isOnAllowlist(req->url, req->method()) &&
Ed Tanous1d3c14a2021-09-22 18:54:40 -0700363 thisReq.session == nullptr)
364 {
Nan Zhou72374eb2022-01-27 17:06:51 -0800365 BMCWEB_LOG_WARNING << "Authentication failed";
Ed Tanous1d3c14a2021-09-22 18:54:40 -0700366 forward_unauthorized::sendUnauthorized(
Ed Tanousc127a0f2022-05-11 15:23:59 -0700367 req->url, req->getHeaderValue("X-Requested-With"),
Ed Tanous1d3c14a2021-09-22 18:54:40 -0700368 req->getHeaderValue("Accept"), res);
Nan Zhou72374eb2022-01-27 17:06:51 -0800369 completeRequest(res);
Ed Tanous1d3c14a2021-09-22 18:54:40 -0700370 return;
371 }
Nan Zhoua43ea822022-05-27 00:42:44 +0000372#endif // BMCWEB_INSECURE_DISABLE_AUTHX
Nan Zhou72374eb2022-01-27 17:06:51 -0800373 auto asyncResp = std::make_shared<bmcweb::AsyncResp>();
374 BMCWEB_LOG_DEBUG << "Setting completion handler";
375 asyncResp->res.setCompleteRequestHandler(
376 [self(shared_from_this())](crow::Response& thisRes) {
Ed Tanous002d39b2022-05-31 08:59:27 -0700377 self->completeRequest(thisRes);
378 });
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700379
Ed Tanous596b2032021-09-13 10:32:22 -0700380 if (thisReq.isUpgrade() &&
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700381 boost::iequals(
Ed Tanous596b2032021-09-13 10:32:22 -0700382 thisReq.getHeaderValue(boost::beast::http::field::upgrade),
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700383 "websocket"))
384 {
Ed Tanous596b2032021-09-13 10:32:22 -0700385 handler->handleUpgrade(thisReq, res, std::move(adaptor));
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700386 // delete lambda with self shared_ptr
387 // to enable connection destruction
Nan Zhou72374eb2022-01-27 17:06:51 -0800388 asyncResp->res.setCompleteRequestHandler(nullptr);
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700389 return;
390 }
Ed Tanous596b2032021-09-13 10:32:22 -0700391 handler->handle(thisReq, asyncResp);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700392 }
Ed Tanouse0d918b2018-03-27 17:41:04 -0700393
Ed Tanouse278c182019-03-13 16:23:37 -0700394 bool isAlive()
395 {
Ed Tanouse278c182019-03-13 16:23:37 -0700396 if constexpr (std::is_same_v<Adaptor,
397 boost::beast::ssl_stream<
398 boost::asio::ip::tcp::socket>>)
399 {
400 return adaptor.next_layer().is_open();
401 }
402 else
403 {
404 return adaptor.is_open();
405 }
406 }
407 void close()
408 {
Ed Tanouse278c182019-03-13 16:23:37 -0700409 if constexpr (std::is_same_v<Adaptor,
410 boost::beast::ssl_stream<
411 boost::asio::ip::tcp::socket>>)
412 {
413 adaptor.next_layer().close();
Nan Zhou72374eb2022-01-27 17:06:51 -0800414 if (sessionIsFromTransport && userSession != nullptr)
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200415 {
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700416 BMCWEB_LOG_DEBUG
417 << this
418 << " Removing TLS session: " << userSession->uniqueId;
419 persistent_data::SessionStore::getInstance().removeSession(
420 userSession);
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200421 }
Ed Tanouse278c182019-03-13 16:23:37 -0700422 }
423 else
424 {
425 adaptor.close();
426 }
427 }
428
Nan Zhou72374eb2022-01-27 17:06:51 -0800429 void completeRequest(crow::Response& thisRes)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700430 {
Ed Tanousf79b7a52021-09-22 19:04:29 -0700431 if (!req)
432 {
433 return;
434 }
Nan Zhou72374eb2022-01-27 17:06:51 -0800435 res = std::move(thisRes);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700436 BMCWEB_LOG_INFO << "Response: " << this << ' ' << req->url << ' '
437 << res.resultInt() << " keepalive=" << req->keepAlive();
Ed Tanous7045c8d2017-04-03 10:04:37 -0700438
Ed Tanous0260d9d2021-02-07 19:31:07 +0000439 addSecurityHeaders(*req, res);
Ed Tanous52cc1122020-07-18 13:51:21 -0700440
Nan Zhoud055a342022-05-25 01:15:34 +0000441 crow::authentication::cleanupTempSession(*req);
Ed Tanous7045c8d2017-04-03 10:04:37 -0700442
Ed Tanouse278c182019-03-13 16:23:37 -0700443 if (!isAlive())
Ed Tanous1abe55e2018-09-05 08:30:59 -0700444 {
445 // BMCWEB_LOG_DEBUG << this << " delete (socket is closed) " <<
446 // isReading
447 // << ' ' << isWriting;
448 // delete this;
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000449
450 // delete lambda with self shared_ptr
451 // to enable connection destruction
John Edward Broadbent4147b8a2021-07-19 16:52:24 -0700452 res.setCompleteRequestHandler(nullptr);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700453 return;
454 }
455 if (res.body().empty() && !res.jsonValue.empty())
456 {
Ed Tanous99351cd2022-08-07 16:42:51 -0700457 using http_helpers::ContentType;
458 std::array<ContentType, 2> allowed{ContentType::HTML,
459 ContentType::JSON};
460 ContentType prefered =
461 getPreferedContentType(req->getHeaderValue("Accept"), allowed);
462
463 if (prefered == ContentType::HTML)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700464 {
465 prettyPrintJson(res);
466 }
467 else
468 {
Ed Tanous99351cd2022-08-07 16:42:51 -0700469 // Technically prefered could also be NoMatch here, but we'd
470 // like to default to something rather than return 400 for
471 // backward compatibility.
Ed Tanousf610caa2022-03-17 08:53:00 -0700472 res.addHeader(boost::beast::http::field::content_type,
473 "application/json");
Ed Tanous71f52d92021-02-19 08:51:17 -0800474 res.body() = res.jsonValue.dump(
475 2, ' ', true, nlohmann::json::error_handler_t::replace);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700476 }
477 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700478
Ed Tanous1abe55e2018-09-05 08:30:59 -0700479 if (res.resultInt() >= 400 && res.body().empty())
480 {
481 res.body() = std::string(res.reason());
482 }
Ed Tanous6295bec2019-09-03 10:11:01 -0700483
484 if (res.result() == boost::beast::http::status::no_content)
485 {
486 // Boost beast throws if content is provided on a no-content
487 // response. Ideally, this would never happen, but in the case that
488 // it does, we don't want to throw.
489 BMCWEB_LOG_CRITICAL
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100490 << this << " Response content provided but code was no-content";
Ed Tanous6295bec2019-09-03 10:11:01 -0700491 res.body().clear();
492 }
493
Ed Tanous1abe55e2018-09-05 08:30:59 -0700494 res.addHeader(boost::beast::http::field::date, getCachedDateStr());
495
496 res.keepAlive(req->keepAlive());
497
Nan Zhou72374eb2022-01-27 17:06:51 -0800498 doWrite(res);
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000499
500 // delete lambda with self shared_ptr
501 // to enable connection destruction
John Edward Broadbent4147b8a2021-07-19 16:52:24 -0700502 res.setCompleteRequestHandler(nullptr);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700503 }
504
Sunitha Harishc0ea7ae2020-10-30 02:37:30 -0500505 void readClientIp()
506 {
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700507 boost::asio::ip::address ip;
508 boost::system::error_code ec = getClientIp(ip);
509 if (ec)
510 {
511 return;
512 }
513 req->ipAddress = ip;
514 }
515
516 boost::system::error_code getClientIp(boost::asio::ip::address& ip)
517 {
Sunitha Harishc0ea7ae2020-10-30 02:37:30 -0500518 boost::system::error_code ec;
519 BMCWEB_LOG_DEBUG << "Fetch the client IP address";
520 boost::asio::ip::tcp::endpoint endpoint =
521 boost::beast::get_lowest_layer(adaptor).remote_endpoint(ec);
522
523 if (ec)
524 {
525 // If remote endpoint fails keep going. "ClientOriginIPAddress"
526 // will be empty.
527 BMCWEB_LOG_ERROR << "Failed to get the client's IP Address. ec : "
528 << ec;
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700529 return ec;
Sunitha Harishc0ea7ae2020-10-30 02:37:30 -0500530 }
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700531 ip = endpoint.address();
532 return ec;
Sunitha Harishc0ea7ae2020-10-30 02:37:30 -0500533 }
534
Ed Tanous1abe55e2018-09-05 08:30:59 -0700535 private:
536 void doReadHeaders()
537 {
Ed Tanous1abe55e2018-09-05 08:30:59 -0700538 BMCWEB_LOG_DEBUG << this << " doReadHeaders";
539
540 // Clean up any previous Connection.
541 boost::beast::http::async_read_header(
Ed Tanousceac6f72018-12-02 11:58:47 -0800542 adaptor, buffer, *parser,
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000543 [this,
544 self(shared_from_this())](const boost::system::error_code& ec,
Ed Tanous81ce6092020-12-17 16:54:55 +0000545 std::size_t bytesTransferred) {
Ed Tanous002d39b2022-05-31 08:59:27 -0700546 BMCWEB_LOG_DEBUG << this << " async_read_header "
547 << bytesTransferred << " Bytes";
548 bool errorWhileReading = false;
549 if (ec)
550 {
551 errorWhileReading = true;
552 if (ec == boost::asio::error::eof)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700553 {
Ed Tanous002d39b2022-05-31 08:59:27 -0700554 BMCWEB_LOG_WARNING
555 << this << " Error while reading: " << ec.message();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700556 }
557 else
558 {
Ed Tanous002d39b2022-05-31 08:59:27 -0700559 BMCWEB_LOG_ERROR
560 << this << " Error while reading: " << ec.message();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700561 }
Ed Tanous002d39b2022-05-31 08:59:27 -0700562 }
563 else
564 {
565 // if the adaptor isn't open anymore, and wasn't handed to a
566 // websocket, treat as an error
567 if (!isAlive() &&
568 !boost::beast::websocket::is_upgrade(parser->get()))
Ed Tanous1abe55e2018-09-05 08:30:59 -0700569 {
Ed Tanous002d39b2022-05-31 08:59:27 -0700570 errorWhileReading = true;
571 }
572 }
573
574 cancelDeadlineTimer();
575
576 if (errorWhileReading)
577 {
578 close();
579 BMCWEB_LOG_DEBUG << this << " from read(1)";
580 return;
581 }
582
583 readClientIp();
584
585 boost::asio::ip::address ip;
586 if (getClientIp(ip))
587 {
588 BMCWEB_LOG_DEBUG << "Unable to get client IP";
589 }
590 sessionIsFromTransport = false;
591#ifndef BMCWEB_INSECURE_DISABLE_AUTHX
592 boost::beast::http::verb method = parser->get().method();
593 userSession = crow::authentication::authenticate(
594 ip, res, method, parser->get().base(), userSession);
595
596 bool loggedIn = userSession != nullptr;
597 if (!loggedIn)
598 {
599 const boost::optional<uint64_t> contentLength =
600 parser->content_length();
601 if (contentLength && *contentLength > loggedOutPostBodyLimit)
602 {
603 BMCWEB_LOG_DEBUG << "Content length greater than limit "
604 << *contentLength;
Ed Tanouse278c182019-03-13 16:23:37 -0700605 close();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700606 return;
607 }
608
Ed Tanous002d39b2022-05-31 08:59:27 -0700609 BMCWEB_LOG_DEBUG << "Starting quick deadline";
610 }
Nan Zhoua43ea822022-05-27 00:42:44 +0000611#endif // BMCWEB_INSECURE_DISABLE_AUTHX
Ed Tanous5dfb5b22021-12-03 11:24:53 -0800612
Ed Tanous002d39b2022-05-31 08:59:27 -0700613 doRead();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700614 });
615 }
616
617 void doRead()
618 {
Ed Tanous1abe55e2018-09-05 08:30:59 -0700619 BMCWEB_LOG_DEBUG << this << " doRead";
Ed Tanous5dfb5b22021-12-03 11:24:53 -0800620 startDeadline();
Ed Tanous002d39b2022-05-31 08:59:27 -0700621 boost::beast::http::async_read(adaptor, buffer, *parser,
622 [this, self(shared_from_this())](
623 const boost::system::error_code& ec,
624 std::size_t bytesTransferred) {
625 BMCWEB_LOG_DEBUG << this << " async_read " << bytesTransferred
626 << " Bytes";
627 cancelDeadlineTimer();
628 if (ec)
629 {
630 BMCWEB_LOG_ERROR << this
631 << " Error while reading: " << ec.message();
632 close();
633 BMCWEB_LOG_DEBUG << this << " from read(1)";
634 return;
635 }
636 handle();
637 });
Ed Tanous1abe55e2018-09-05 08:30:59 -0700638 }
639
Nan Zhou72374eb2022-01-27 17:06:51 -0800640 void doWrite(crow::Response& thisRes)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700641 {
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100642 BMCWEB_LOG_DEBUG << this << " doWrite";
Nan Zhou72374eb2022-01-27 17:06:51 -0800643 thisRes.preparePayload();
644 serializer.emplace(*thisRes.stringResponse);
Ed Tanous5dfb5b22021-12-03 11:24:53 -0800645 startDeadline();
Ed Tanous002d39b2022-05-31 08:59:27 -0700646 boost::beast::http::async_write(adaptor, *serializer,
647 [this, self(shared_from_this())](
648 const boost::system::error_code& ec,
649 std::size_t bytesTransferred) {
650 BMCWEB_LOG_DEBUG << this << " async_write " << bytesTransferred
651 << " bytes";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700652
Ed Tanous002d39b2022-05-31 08:59:27 -0700653 cancelDeadlineTimer();
James Feist54d8bb12020-07-20 13:28:59 -0700654
Ed Tanous002d39b2022-05-31 08:59:27 -0700655 if (ec)
656 {
657 BMCWEB_LOG_DEBUG << this << " from write(2)";
658 return;
659 }
660 if (!res.keepAlive())
661 {
662 close();
663 BMCWEB_LOG_DEBUG << this << " from write(1)";
664 return;
665 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700666
Ed Tanous002d39b2022-05-31 08:59:27 -0700667 serializer.reset();
668 BMCWEB_LOG_DEBUG << this << " Clearing response";
669 res.clear();
670 parser.emplace(std::piecewise_construct, std::make_tuple());
671 parser->body_limit(httpReqBodyLimit); // reset body limit for
672 // newly created parser
673 buffer.consume(buffer.size());
Ed Tanous1abe55e2018-09-05 08:30:59 -0700674
Ed Tanous002d39b2022-05-31 08:59:27 -0700675 // If the session was built from the transport, we don't need to
676 // clear it. All other sessions are generated per request.
677 if (!sessionIsFromTransport)
678 {
679 userSession = nullptr;
680 }
Ed Tanous9a69d5a2021-09-13 10:23:51 -0700681
Ed Tanous002d39b2022-05-31 08:59:27 -0700682 // Destroy the Request via the std::optional
683 req.reset();
684 doReadHeaders();
685 });
Ed Tanous1abe55e2018-09-05 08:30:59 -0700686 }
687
Ed Tanous1abe55e2018-09-05 08:30:59 -0700688 void cancelDeadlineTimer()
689 {
Ed Tanous5dfb5b22021-12-03 11:24:53 -0800690 timer.cancel();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700691 }
692
Ed Tanous5dfb5b22021-12-03 11:24:53 -0800693 void startDeadline()
Ed Tanous1abe55e2018-09-05 08:30:59 -0700694 {
695 cancelDeadlineTimer();
696
Ed Tanous5dfb5b22021-12-03 11:24:53 -0800697 std::chrono::seconds timeout(15);
698 // allow slow uploads for logged in users
Lei YU638e2392021-12-28 18:14:13 +0800699 bool loggedIn = userSession != nullptr;
Ed Tanous5dfb5b22021-12-03 11:24:53 -0800700 if (loggedIn)
James Feist3909dc82020-04-03 10:58:55 -0700701 {
Ed Tanous5dfb5b22021-12-03 11:24:53 -0800702 timeout = std::chrono::seconds(60);
James Feistcb6cb492020-04-03 13:36:17 -0700703 return;
704 }
Ed Tanous5dfb5b22021-12-03 11:24:53 -0800705
706 std::weak_ptr<Connection<Adaptor, Handler>> weakSelf = weak_from_this();
707 timer.expires_after(timeout);
708 timer.async_wait([weakSelf](const boost::system::error_code ec) {
709 // Note, we are ignoring other types of errors here; If the timer
710 // failed for any reason, we should still close the connection
711
712 std::shared_ptr<Connection<Adaptor, Handler>> self =
713 weakSelf.lock();
714 if (!self)
715 {
716 BMCWEB_LOG_CRITICAL << self << " Failed to capture connection";
717 return;
718 }
719 if (ec == boost::asio::error::operation_aborted)
720 {
721 // Canceled wait means the path succeeeded.
722 return;
723 }
724 if (ec)
725 {
726 BMCWEB_LOG_CRITICAL << self << " timer failed " << ec;
727 }
728
729 BMCWEB_LOG_WARNING << self << "Connection timed out, closing";
730
731 self->close();
732 });
733
734 BMCWEB_LOG_DEBUG << this << " timer started";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700735 }
736
Ed Tanous1abe55e2018-09-05 08:30:59 -0700737 Adaptor adaptor;
738 Handler* handler;
Ed Tanousa24526d2018-12-10 15:17:59 -0800739 // Making this a std::optional allows it to be efficiently destroyed and
Ed Tanous1abe55e2018-09-05 08:30:59 -0700740 // re-created on Connection reset
Ed Tanousa24526d2018-12-10 15:17:59 -0800741 std::optional<
Ed Tanous1abe55e2018-09-05 08:30:59 -0700742 boost::beast::http::request_parser<boost::beast::http::string_body>>
743 parser;
744
Ed Tanous3112a142018-11-29 15:45:10 -0800745 boost::beast::flat_static_buffer<8192> buffer;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700746
Ed Tanousa24526d2018-12-10 15:17:59 -0800747 std::optional<boost::beast::http::response_serializer<
Ed Tanous1abe55e2018-09-05 08:30:59 -0700748 boost::beast::http::string_body>>
749 serializer;
750
Ed Tanousa24526d2018-12-10 15:17:59 -0800751 std::optional<crow::Request> req;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700752 crow::Response res;
Ed Tanous52cc1122020-07-18 13:51:21 -0700753
Ed Tanous9a69d5a2021-09-13 10:23:51 -0700754 bool sessionIsFromTransport = false;
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700755 std::shared_ptr<persistent_data::UserSession> userSession;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700756
Ed Tanous5dfb5b22021-12-03 11:24:53 -0800757 boost::asio::steady_timer timer;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700758
Ed Tanous1abe55e2018-09-05 08:30:59 -0700759 std::function<std::string()>& getCachedDateStr;
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000760
761 using std::enable_shared_from_this<
Ed Tanous52cc1122020-07-18 13:51:21 -0700762 Connection<Adaptor, Handler>>::shared_from_this;
Ed Tanous5dfb5b22021-12-03 11:24:53 -0800763
764 using std::enable_shared_from_this<
765 Connection<Adaptor, Handler>>::weak_from_this;
Ed Tanous3112a142018-11-29 15:45:10 -0800766};
Ed Tanous1abe55e2018-09-05 08:30:59 -0700767} // namespace crow