Gitiles
Code Review Sign In
gerrit.openbmc.org / openbmc / bmcweb / ac29323dda1b643a81bf85719f7d3b7b2ab97903 / . / http / http_connection.h
blob: 7781ca60a7f9efc153b90bb2c3f3a06c2f42dbc0 [file] [log] [blame]
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]1#pragma once
Adriana Kobylak0e1cf262019-12-05 13:57:57 -0600[diff] [blame]2#include "config.h"
3
Manojkiran Eda44250442020-06-16 12:51:38 +0530[diff] [blame]4#include "http_response.h"
5#include "logging.h"
Manojkiran Eda44250442020-06-16 12:51:38 +0530[diff] [blame]6#include "timer_queue.h"
7#include "utility.h"
8
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]9#include "authorization.hpp"
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]10#include "http_utility.hpp"
11
Ed Tanouse0d918b2018-03-27 17:41:04 -0700[diff] [blame]12#include <boost/algorithm/string.hpp>
Ed Tanous257f5792018-03-17 14:40:09 -0700[diff] [blame]13#include <boost/algorithm/string/predicate.hpp>
Ed Tanous8f626352018-12-19 14:51:54 -0800[diff] [blame]14#include <boost/asio/io_context.hpp>
Ed Tanous3112a142018-11-29 15:45:10 -0800[diff] [blame]15#include <boost/asio/ip/tcp.hpp>
Ed Tanous2f1ebcd2019-02-13 19:39:07 -0800[diff] [blame]16#include <boost/asio/ssl.hpp>
Ed Tanous3112a142018-11-29 15:45:10 -0800[diff] [blame]17#include <boost/beast/core/flat_static_buffer.hpp>
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500[diff] [blame]18#include <boost/beast/http.hpp>
Manojkiran Eda44250442020-06-16 12:51:38 +0530[diff] [blame]19#include <boost/beast/ssl/ssl_stream.hpp>
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500[diff] [blame]20#include <boost/beast/websocket.hpp>
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]21#include <security_headers.hpp>
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500[diff] [blame]22#include <ssl_key_handler.hpp>
23
Manojkiran Eda44250442020-06-16 12:51:38 +0530[diff] [blame]24#include <atomic>
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500[diff] [blame]25#include <chrono>
26#include <vector>
27
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]28namespace crow
29{
Ed Tanous257f5792018-03-17 14:40:09 -0700[diff] [blame]30
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]31inline void prettyPrintJson(crow::Response& res)
32{
Jason M. Bills193ad2f2018-09-26 15:08:52 -0700[diff] [blame]33 std::string value = res.jsonValue.dump(4, ' ', true);
Ed Tanousa29c9972018-11-29 15:54:32 -0800[diff] [blame]34 utility::escapeHtml(value);
35 utility::convertToLinks(value);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]36 res.body() = "<html>\n"
37 "<head>\n"
38 "<title>Redfish API</title>\n"
39 "<link rel=\"stylesheet\" type=\"text/css\" "
40 "href=\"/styles/default.css\">\n"
41 "<script src=\"/highlight.pack.js\"></script>"
42 "<script>hljs.initHighlightingOnLoad();</script>"
43 "</head>\n"
44 "<body>\n"
45 "<div style=\"max-width: 576px;margin:0 auto;\">\n"
46 "<img src=\"/DMTF_Redfish_logo_2017.svg\" alt=\"redfish\" "
47 "height=\"406px\" "
48 "width=\"576px\">\n"
49 "<br>\n"
50 "<pre>\n"
51 "<code class=\"json\">" +
52 value +
53 "</code>\n"
54 "</pre>\n"
55 "</div>\n"
56 "</body>\n"
57 "</html>\n";
Ed Tanous93ef5802019-01-03 10:15:41 -0800[diff] [blame]58 res.addHeader("Content-Type", "text/html;charset=UTF-8");
Ed Tanous257f5792018-03-17 14:40:09 -0700[diff] [blame]59}
60
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]61using namespace boost;
62using tcp = asio::ip::tcp;
63
Ed Tanous55c7b7a2018-05-22 15:27:24 -0700[diff] [blame]64#ifdef BMCWEB_ENABLE_DEBUG
Ed Tanouse0d918b2018-03-27 17:41:04 -0700[diff] [blame]65static std::atomic<int> connectionCount;
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]66#endif
Jennifer Leeacb7cfb2018-06-07 16:08:15 -0700[diff] [blame]67
Adriana Kobylak0e1cf262019-12-05 13:57:57 -0600[diff] [blame]68// request body limit size set by the BMCWEB_HTTP_REQ_BODY_LIMIT_MB option
69constexpr unsigned int httpReqBodyLimit =
70 1024 * 1024 * BMCWEB_HTTP_REQ_BODY_LIMIT_MB;
Jennifer Leeacb7cfb2018-06-07 16:08:15 -0700[diff] [blame]71
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]72constexpr uint64_t loggedOutPostBodyLimit = 4096;
73
74constexpr uint32_t httpHeaderLimit = 8192;
75
76// drop all connections after 1 minute, this time limit was chosen
77// arbitrarily and can be adjusted later if needed
78static constexpr const size_t loggedInAttempts =
79 (60 / timerQueueTimeoutSeconds);
80
81static constexpr const size_t loggedOutAttempts =
82 (15 / timerQueueTimeoutSeconds);
83
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]84template <typename Adaptor, typename Handler>
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500[diff] [blame]85class Connection :
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]86 public std::enable_shared_from_this<Connection<Adaptor, Handler>>
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]87{
88 public:
Ed Tanouscb13a392020-07-25 19:02:03 +0000[diff] [blame]89 Connection(Handler* handlerIn, const std::string& ServerNameIn,
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]90 std::function<std::string()>& get_cached_date_str_f,
Ed Tanous271584a2019-07-09 16:24:22 -0700[diff] [blame]91 detail::TimerQueue& timerQueueIn, Adaptor adaptorIn) :
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]92 adaptor(std::move(adaptorIn)),
Ed Tanous271584a2019-07-09 16:24:22 -0700[diff] [blame]93 handler(handlerIn), serverName(ServerNameIn),
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]94 getCachedDateStr(get_cached_date_str_f), timerQueue(timerQueueIn)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]95 {
96 parser.emplace(std::piecewise_construct, std::make_tuple());
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]97 parser->body_limit(httpReqBodyLimit);
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]98 parser->header_limit(httpHeaderLimit);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]99 req.emplace(parser->get());
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200[diff] [blame]100
101#ifdef BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]102 auto ca_available = !std::filesystem::is_empty(
103 std::filesystem::path(ensuressl::trustStorePath));
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]104 if (ca_available && persistent_data::SessionStore::getInstance()
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]105 .getAuthMethodsConfig()
106 .tls)
107 {
108 adaptor.set_verify_mode(boost::asio::ssl::verify_peer);
109 SSL_set_session_id_context(
110 adaptor.native_handle(),
111 reinterpret_cast<const unsigned char*>(serverName.c_str()),
Zbigniew Kurzynskicac94c52019-11-07 12:55:04 +0100[diff] [blame]112 static_cast<unsigned int>(serverName.length()));
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]113 BMCWEB_LOG_DEBUG << this << " TLS is enabled on this connection.";
114 }
115
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]116 adaptor.set_verify_callback([this](
117 bool preverified,
118 boost::asio::ssl::verify_context& ctx) {
119 // do nothing if TLS is disabled
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]120 if (!persistent_data::SessionStore::getInstance()
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]121 .getAuthMethodsConfig()
122 .tls)
123 {
124 BMCWEB_LOG_DEBUG << this << " TLS auth_config is disabled";
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200[diff] [blame]125 return true;
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]126 }
127
128 // We always return true to allow full auth flow
129 if (!preverified)
130 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]131 BMCWEB_LOG_DEBUG << this << " TLS preverification failed.";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]132 return true;
133 }
134
135 X509_STORE_CTX* cts = ctx.native_handle();
136 if (cts == nullptr)
137 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]138 BMCWEB_LOG_DEBUG << this << " Cannot get native TLS handle.";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]139 return true;
140 }
141
142 // Get certificate
143 X509* peerCert =
144 X509_STORE_CTX_get_current_cert(ctx.native_handle());
145 if (peerCert == nullptr)
146 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]147 BMCWEB_LOG_DEBUG << this
148 << " Cannot get current TLS certificate.";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]149 return true;
150 }
151
152 // Check if certificate is OK
153 int error = X509_STORE_CTX_get_error(cts);
154 if (error != X509_V_OK)
155 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]156 BMCWEB_LOG_INFO << this << " Last TLS error is: " << error;
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]157 return true;
158 }
159 // Check that we have reached final certificate in chain
160 int32_t depth = X509_STORE_CTX_get_error_depth(cts);
161 if (depth != 0)
162
163 {
164 BMCWEB_LOG_DEBUG
165 << this << " Certificate verification in progress (depth "
166 << depth << "), waiting to reach final depth";
167 return true;
168 }
169
170 BMCWEB_LOG_DEBUG << this
171 << " Certificate verification of final depth";
172
173 // Verify KeyUsage
174 bool isKeyUsageDigitalSignature = false;
175 bool isKeyUsageKeyAgreement = false;
176
177 ASN1_BIT_STRING* usage = static_cast<ASN1_BIT_STRING*>(
Ed Tanous23a21a12020-07-25 04:45:05 +0000[diff] [blame]178 X509_get_ext_d2i(peerCert, NID_key_usage, nullptr, nullptr));
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]179
180 if (usage == nullptr)
181 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]182 BMCWEB_LOG_DEBUG << this << " TLS usage is null";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]183 return true;
184 }
185
186 for (int i = 0; i < usage->length; i++)
187 {
188 if (KU_DIGITAL_SIGNATURE & usage->data[i])
189 {
190 isKeyUsageDigitalSignature = true;
191 }
192 if (KU_KEY_AGREEMENT & usage->data[i])
193 {
194 isKeyUsageKeyAgreement = true;
195 }
196 }
197
198 if (!isKeyUsageDigitalSignature || !isKeyUsageKeyAgreement)
199 {
200 BMCWEB_LOG_DEBUG << this
201 << " Certificate ExtendedKeyUsage does "
202 "not allow provided certificate to "
203 "be used for user authentication";
204 return true;
205 }
Zbigniew Kurzynski09d02f82020-03-30 13:41:42 +0200[diff] [blame]206 ASN1_BIT_STRING_free(usage);
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]207
208 // Determine that ExtendedKeyUsage includes Client Auth
209
Ed Tanous23a21a12020-07-25 04:45:05 +0000[diff] [blame]210 stack_st_ASN1_OBJECT* extUsage =
211 static_cast<stack_st_ASN1_OBJECT*>(X509_get_ext_d2i(
212 peerCert, NID_ext_key_usage, nullptr, nullptr));
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]213
214 if (extUsage == nullptr)
215 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]216 BMCWEB_LOG_DEBUG << this << " TLS extUsage is null";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]217 return true;
218 }
219
220 bool isExKeyUsageClientAuth = false;
221 for (int i = 0; i < sk_ASN1_OBJECT_num(extUsage); i++)
222 {
223 if (NID_client_auth ==
224 OBJ_obj2nid(sk_ASN1_OBJECT_value(extUsage, i)))
225 {
226 isExKeyUsageClientAuth = true;
227 break;
228 }
229 }
Zbigniew Kurzynski09d02f82020-03-30 13:41:42 +0200[diff] [blame]230 sk_ASN1_OBJECT_free(extUsage);
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]231
232 // Certificate has to have proper key usages set
233 if (!isExKeyUsageClientAuth)
234 {
235 BMCWEB_LOG_DEBUG << this
236 << " Certificate ExtendedKeyUsage does "
237 "not allow provided certificate to "
238 "be used for user authentication";
239 return true;
240 }
241 std::string sslUser;
242 // Extract username contained in CommonName
243 sslUser.resize(256, '\0');
244
245 int status = X509_NAME_get_text_by_NID(
246 X509_get_subject_name(peerCert), NID_commonName, sslUser.data(),
247 static_cast<int>(sslUser.size()));
248
249 if (status == -1)
250 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]251 BMCWEB_LOG_DEBUG
252 << this << " TLS cannot get username to create session";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]253 return true;
254 }
255
256 size_t lastChar = sslUser.find('\0');
257 if (lastChar == std::string::npos || lastChar == 0)
258 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]259 BMCWEB_LOG_DEBUG << this << " Invalid TLS user name";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]260 return true;
261 }
262 sslUser.resize(lastChar);
263
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]264 session =
265 persistent_data::SessionStore::getInstance()
266 .generateUserSession(
267 sslUser, persistent_data::PersistenceType::TIMEOUT);
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]268 if (auto sp = session.lock())
269 {
270 BMCWEB_LOG_DEBUG << this
271 << " Generating TLS session: " << sp->uniqueId;
272 }
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]273 return true;
274 });
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200[diff] [blame]275#endif // BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION
276
Ed Tanous55c7b7a2018-05-22 15:27:24 -0700[diff] [blame]277#ifdef BMCWEB_ENABLE_DEBUG
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]278 connectionCount++;
279 BMCWEB_LOG_DEBUG << this << " Connection open, total "
280 << connectionCount;
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]281#endif
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]282 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]283
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]284 ~Connection()
285 {
286 res.completeRequestHandler = nullptr;
287 cancelDeadlineTimer();
Ed Tanous55c7b7a2018-05-22 15:27:24 -0700[diff] [blame]288#ifdef BMCWEB_ENABLE_DEBUG
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]289 connectionCount--;
290 BMCWEB_LOG_DEBUG << this << " Connection closed, total "
291 << connectionCount;
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]292#endif
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]293 }
294
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]295 Adaptor& socket()
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]296 {
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]297 return adaptor;
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]298 }
299
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]300 void start()
301 {
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]302
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]303 startDeadline(0);
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]304 // TODO(ed) Abstract this to a more clever class with the idea of an
305 // asynchronous "start"
306 if constexpr (std::is_same_v<Adaptor,
307 boost::beast::ssl_stream<
308 boost::asio::ip::tcp::socket>>)
309 {
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]310 adaptor.async_handshake(boost::asio::ssl::stream_base::server,
311 [this, self(shared_from_this())](
312 const boost::system::error_code& ec) {
313 if (ec)
314 {
315 return;
316 }
317 doReadHeaders();
318 });
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]319 }
320 else
321 {
322 doReadHeaders();
323 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]324 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]325
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]326 void handle()
327 {
328 cancelDeadlineTimer();
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]329
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]330 bool isInvalidRequest = false;
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]331
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]332 // Check for HTTP version 1.1.
333 if (req->version() == 11)
334 {
335 if (req->getHeaderValue(boost::beast::http::field::host).empty())
336 {
337 isInvalidRequest = true;
Ed Tanousde5c9f32019-03-26 09:17:55 -0700[diff] [blame]338 res.result(boost::beast::http::status::bad_request);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]339 }
340 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]341
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]342 BMCWEB_LOG_INFO << "Request: "
343 << " " << this << " HTTP/" << req->version() / 10 << "."
344 << req->version() % 10 << ' ' << req->methodString()
345 << " " << req->target();
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]346
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]347 needToCallAfterHandlers = false;
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]348
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]349 if (!isInvalidRequest)
350 {
351 res.completeRequestHandler = [] {};
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]352 res.isAliveHelper = [this]() -> bool { return isAlive(); };
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]353
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]354 req->ioService = static_cast<decltype(req->ioService)>(
355 &adaptor.get_executor().context());
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200[diff] [blame]356
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]357 if (!res.completed)
358 {
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]359 needToCallAfterHandlers = true;
360 res.completeRequestHandler = [self(shared_from_this())] {
361 self->completeRequest();
362 };
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]363 if (req->isUpgrade() &&
364 boost::iequals(
365 req->getHeaderValue(boost::beast::http::field::upgrade),
366 "websocket"))
367 {
368 handler->handleUpgrade(*req, res, std::move(adaptor));
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]369 // delete lambda with self shared_ptr
370 // to enable connection destruction
371 res.completeRequestHandler = nullptr;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]372 return;
373 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]374 handler->handle(*req, res);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]375 }
376 else
377 {
378 completeRequest();
379 }
380 }
381 else
382 {
383 completeRequest();
384 }
385 }
Ed Tanouse0d918b2018-03-27 17:41:04 -0700[diff] [blame]386
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]387 bool isAlive()
388 {
389
390 if constexpr (std::is_same_v<Adaptor,
391 boost::beast::ssl_stream<
392 boost::asio::ip::tcp::socket>>)
393 {
394 return adaptor.next_layer().is_open();
395 }
396 else
397 {
398 return adaptor.is_open();
399 }
400 }
401 void close()
402 {
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]403 if constexpr (std::is_same_v<Adaptor,
404 boost::beast::ssl_stream<
405 boost::asio::ip::tcp::socket>>)
406 {
407 adaptor.next_layer().close();
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200[diff] [blame]408#ifdef BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION
409 if (auto sp = session.lock())
410 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100[diff] [blame]411 BMCWEB_LOG_DEBUG << this
412 << " Removing TLS session: " << sp->uniqueId;
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200[diff] [blame]413 persistent_data::SessionStore::getInstance().removeSession(sp);
414 }
415#endif // BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]416 }
417 else
418 {
419 adaptor.close();
420 }
421 }
422
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]423 void completeRequest()
424 {
425 BMCWEB_LOG_INFO << "Response: " << this << ' ' << req->url << ' '
426 << res.resultInt() << " keepalive=" << req->keepAlive();
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]427
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]428 addSecurityHeaders(res);
429
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]430 if (needToCallAfterHandlers)
431 {
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]432 crow::authorization::cleanupTempSession(*req);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]433 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]434
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]435 if (!isAlive())
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]436 {
437 // BMCWEB_LOG_DEBUG << this << " delete (socket is closed) " <<
438 // isReading
439 // << ' ' << isWriting;
440 // delete this;
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]441
442 // delete lambda with self shared_ptr
443 // to enable connection destruction
444 res.completeRequestHandler = nullptr;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]445 return;
446 }
447 if (res.body().empty() && !res.jsonValue.empty())
448 {
449 if (http_helpers::requestPrefersHtml(*req))
450 {
451 prettyPrintJson(res);
452 }
453 else
454 {
455 res.jsonMode();
Jason M. Bills193ad2f2018-09-26 15:08:52 -0700[diff] [blame]456 res.body() = res.jsonValue.dump(2, ' ', true);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]457 }
458 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700[diff] [blame]459
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]460 if (res.resultInt() >= 400 && res.body().empty())
461 {
462 res.body() = std::string(res.reason());
463 }
Ed Tanous6295bec2019-09-03 10:11:01 -0700[diff] [blame]464
465 if (res.result() == boost::beast::http::status::no_content)
466 {
467 // Boost beast throws if content is provided on a no-content
468 // response. Ideally, this would never happen, but in the case that
469 // it does, we don't want to throw.
470 BMCWEB_LOG_CRITICAL
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]471 << this << " Response content provided but code was no-content";
Ed Tanous6295bec2019-09-03 10:11:01 -0700[diff] [blame]472 res.body().clear();
473 }
474
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]475 res.addHeader(boost::beast::http::field::server, serverName);
476 res.addHeader(boost::beast::http::field::date, getCachedDateStr());
477
478 res.keepAlive(req->keepAlive());
479
480 doWrite();
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]481
482 // delete lambda with self shared_ptr
483 // to enable connection destruction
484 res.completeRequestHandler = nullptr;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]485 }
486
487 private:
488 void doReadHeaders()
489 {
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]490 BMCWEB_LOG_DEBUG << this << " doReadHeaders";
491
492 // Clean up any previous Connection.
493 boost::beast::http::async_read_header(
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]494 adaptor, buffer, *parser,
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]495 [this,
496 self(shared_from_this())](const boost::system::error_code& ec,
497 std::size_t bytes_transferred) {
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]498 BMCWEB_LOG_ERROR << this << " async_read_header "
499 << bytes_transferred << " Bytes";
500 bool errorWhileReading = false;
501 if (ec)
502 {
503 errorWhileReading = true;
504 BMCWEB_LOG_ERROR
505 << this << " Error while reading: " << ec.message();
506 }
507 else
508 {
509 // if the adaptor isn't open anymore, and wasn't handed to a
510 // websocket, treat as an error
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]511 if (!isAlive() && !req->isUpgrade())
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]512 {
513 errorWhileReading = true;
514 }
515 }
516
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]517 cancelDeadlineTimer();
518
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]519 if (errorWhileReading)
520 {
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]521 close();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]522 BMCWEB_LOG_DEBUG << this << " from read(1)";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]523 return;
524 }
525
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]526 if (!req)
527 {
528 close();
529 return;
530 }
531
Ed Tanousdc7a7932020-08-17 15:04:58 -0700[diff] [blame]532 // Note, despite the bmcweb coding policy on use of exceptions
533 // for error handling, this one particular use of exceptions is
534 // deemed acceptible, as it solved a significant error handling
535 // problem that resulted in seg faults, the exact thing that the
536 // exceptions rule is trying to avoid. If at some point,
537 // boost::urls makes the parser object public (or we port it
538 // into bmcweb locally) this will be replaced with
539 // parser::parse, which returns a status code
James Feist5a7e8772020-07-22 09:08:38 -0700[diff] [blame]540
Ed Tanousdc7a7932020-08-17 15:04:58 -0700[diff] [blame]541 try
542 {
543 req->urlView = boost::urls::url_view(req->target());
544 req->url = req->urlView.encoded_path();
545 }
Ed Tanous92ccb882020-08-18 10:36:33 -0700[diff] [blame]546 catch (std::exception& p)
Ed Tanousdc7a7932020-08-17 15:04:58 -0700[diff] [blame]547 {
Ed Tanous3bcc0152020-08-25 07:47:29 -0700[diff] [blame]548 BMCWEB_LOG_ERROR << p.what();
Ed Tanousdc7a7932020-08-17 15:04:58 -0700[diff] [blame]549 }
Ed Tanous92ccb882020-08-18 10:36:33 -0700[diff] [blame]550
James Feist6964c982020-07-28 16:10:23 -0700[diff] [blame]551 crow::authorization::authenticate(*req, res, session);
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]552
553 bool loggedIn = req && req->session;
554 if (loggedIn)
555 {
556 startDeadline(loggedInAttempts);
557 BMCWEB_LOG_DEBUG << "Starting slow deadline";
558
James Feist5a7e8772020-07-22 09:08:38 -0700[diff] [blame]559 req->urlParams = req->urlView.params();
560
561#ifdef BMCWEB_ENABLE_DEBUG
562 std::string paramList = "";
563 for (const auto param : req->urlParams)
564 {
565 paramList += param->key() + " " + param->value() + " ";
566 }
567 BMCWEB_LOG_DEBUG << "QueryParams: " << paramList;
568#endif
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]569 }
570 else
571 {
572 const boost::optional<uint64_t> contentLength =
573 parser->content_length();
574 if (contentLength &&
575 *contentLength > loggedOutPostBodyLimit)
576 {
577 BMCWEB_LOG_DEBUG << "Content length greater than limit "
578 << *contentLength;
579 close();
580 return;
581 }
582
583 startDeadline(loggedOutAttempts);
584 BMCWEB_LOG_DEBUG << "Starting quick deadline";
585 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]586 doRead();
587 });
588 }
589
590 void doRead()
591 {
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]592 BMCWEB_LOG_DEBUG << this << " doRead";
593
594 boost::beast::http::async_read(
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]595 adaptor, buffer, *parser,
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]596 [this,
597 self(shared_from_this())](const boost::system::error_code& ec,
598 std::size_t bytes_transferred) {
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]599 BMCWEB_LOG_DEBUG << this << " async_read " << bytes_transferred
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]600 << " Bytes";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]601
602 bool errorWhileReading = false;
603 if (ec)
604 {
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]605 BMCWEB_LOG_ERROR
606 << this << " Error while reading: " << ec.message();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]607 errorWhileReading = true;
608 }
609 else
610 {
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]611 if (isAlive())
612 {
613 cancelDeadlineTimer();
614 bool loggedIn = req && req->session;
615 if (loggedIn)
616 {
617 startDeadline(loggedInAttempts);
618 }
619 else
620 {
621 startDeadline(loggedOutAttempts);
622 }
623 }
624 else
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]625 {
626 errorWhileReading = true;
627 }
628 }
629 if (errorWhileReading)
630 {
631 cancelDeadlineTimer();
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]632 close();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]633 BMCWEB_LOG_DEBUG << this << " from read(1)";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]634 return;
635 }
636 handle();
637 });
638 }
639
640 void doWrite()
641 {
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]642 bool loggedIn = req && req->session;
643 if (loggedIn)
644 {
645 startDeadline(loggedInAttempts);
646 }
647 else
648 {
649 startDeadline(loggedOutAttempts);
650 }
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]651 BMCWEB_LOG_DEBUG << this << " doWrite";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]652 res.preparePayload();
653 serializer.emplace(*res.stringResponse);
654 boost::beast::http::async_write(
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]655 adaptor, *serializer,
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]656 [this,
657 self(shared_from_this())](const boost::system::error_code& ec,
658 std::size_t bytes_transferred) {
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100[diff] [blame]659 BMCWEB_LOG_DEBUG << this << " async_write " << bytes_transferred
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]660 << " bytes";
661
James Feist54d8bb12020-07-20 13:28:59 -0700[diff] [blame]662 cancelDeadlineTimer();
663
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]664 if (ec)
665 {
666 BMCWEB_LOG_DEBUG << this << " from write(2)";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]667 return;
668 }
Ed Tanousceac6f72018-12-02 11:58:47 -0800[diff] [blame]669 if (!res.keepAlive())
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]670 {
Ed Tanouse278c182019-03-13 16:23:37 -0700[diff] [blame]671 close();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]672 BMCWEB_LOG_DEBUG << this << " from write(1)";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]673 return;
674 }
675
676 serializer.reset();
677 BMCWEB_LOG_DEBUG << this << " Clearing response";
678 res.clear();
679 parser.emplace(std::piecewise_construct, std::make_tuple());
Gunnar Millsded2a1e2020-07-24 09:46:33 -0500[diff] [blame]680 parser->body_limit(httpReqBodyLimit); // reset body limit for
681 // newly created parser
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]682 buffer.consume(buffer.size());
683
684 req.emplace(parser->get());
685 doReadHeaders();
686 });
687 }
688
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]689 void cancelDeadlineTimer()
690 {
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]691 if (timerCancelKey)
692 {
693 BMCWEB_LOG_DEBUG << this << " timer cancelled: " << &timerQueue
694 << ' ' << *timerCancelKey;
695 timerQueue.cancel(*timerCancelKey);
696 timerCancelKey.reset();
697 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]698 }
699
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]700 void startDeadline(size_t timerIterations)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]701 {
702 cancelDeadlineTimer();
703
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]704 if (timerIterations)
705 {
706 timerIterations--;
707 }
Jan Sowinski2b5e08e2020-01-09 17:16:02 +0100[diff] [blame]708
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]709 timerCancelKey =
James Feistbe5dfca2020-07-22 08:54:59 -0700[diff] [blame]710 timerQueue.add([self(shared_from_this()), timerIterations,
711 readCount{parser->get().body().size()}] {
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]712 // Mark timer as not active to avoid canceling it during
713 // Connection destructor which leads to double free issue
714 self->timerCancelKey.reset();
715 if (!self->isAlive())
716 {
717 return;
718 }
Jan Sowinski2b5e08e2020-01-09 17:16:02 +0100[diff] [blame]719
James Feistbe5dfca2020-07-22 08:54:59 -0700[diff] [blame]720 bool loggedIn = self->req && self->req->session;
721 // allow slow uploads for logged in users
722 if (loggedIn && self->parser->get().body().size() > readCount)
723 {
724 BMCWEB_LOG_DEBUG << self.get()
725 << " restart timer - read in progress";
726 self->startDeadline(timerIterations);
727 return;
728 }
729
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]730 // Threshold can be used to drop slow connections
731 // to protect against slow-rate DoS attack
732 if (timerIterations)
733 {
James Feistbe5dfca2020-07-22 08:54:59 -0700[diff] [blame]734 BMCWEB_LOG_DEBUG << self.get() << " restart timer";
James Feist3909dc82020-04-03 10:58:55 -0700[diff] [blame]735 self->startDeadline(timerIterations);
736 return;
737 }
738
739 self->close();
740 });
James Feistcb6cb492020-04-03 13:36:17 -0700[diff] [blame]741
742 if (!timerCancelKey)
743 {
744 close();
745 return;
746 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]747 BMCWEB_LOG_DEBUG << this << " timer added: " << &timerQueue << ' '
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]748 << *timerCancelKey;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]749 }
750
751 private:
752 Adaptor adaptor;
753 Handler* handler;
754
Ed Tanousa24526d2018-12-10 15:17:59 -0800[diff] [blame]755 // Making this a std::optional allows it to be efficiently destroyed and
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]756 // re-created on Connection reset
Ed Tanousa24526d2018-12-10 15:17:59 -0800[diff] [blame]757 std::optional<
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]758 boost::beast::http::request_parser<boost::beast::http::string_body>>
759 parser;
760
Ed Tanous3112a142018-11-29 15:45:10 -0800[diff] [blame]761 boost::beast::flat_static_buffer<8192> buffer;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]762
Ed Tanousa24526d2018-12-10 15:17:59 -0800[diff] [blame]763 std::optional<boost::beast::http::response_serializer<
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]764 boost::beast::http::string_body>>
765 serializer;
766
Ed Tanousa24526d2018-12-10 15:17:59 -0800[diff] [blame]767 std::optional<crow::Request> req;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]768 crow::Response res;
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]769
770 std::weak_ptr<persistent_data::UserSession> session;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]771
772 const std::string& serverName;
773
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]774 std::optional<size_t> timerCancelKey;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]775
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]776 bool needToCallAfterHandlers{};
777 bool needToStartReadAfterComplete{};
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]778
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]779 std::function<std::string()>& getCachedDateStr;
780 detail::TimerQueue& timerQueue;
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000[diff] [blame]781
782 using std::enable_shared_from_this<
Ed Tanous52cc1122020-07-18 13:51:21 -0700[diff] [blame]783 Connection<Adaptor, Handler>>::shared_from_this;
Ed Tanous3112a142018-11-29 15:45:10 -0800[diff] [blame]784};
Ed Tanous1abe55e2018-09-05 08:30:59 -0700[diff] [blame]785} // namespace crow