blob: 8c86ac90839fb64386be3451147cd8849f477dde [file] [log] [blame]
Ed Tanous7045c8d2017-04-03 10:04:37 -07001#pragma once
Ed Tanous75312982021-02-11 14:26:02 -08002#include "bmcweb_config.h"
Adriana Kobylak0e1cf262019-12-05 13:57:57 -06003
Nan Zhoud055a342022-05-25 01:15:34 +00004#include "authentication.hpp"
Ed Tanous04e438c2020-10-03 08:06:26 -07005#include "http_response.hpp"
Ed Tanous1abe55e2018-09-05 08:30:59 -07006#include "http_utility.hpp"
Ed Tanous04e438c2020-10-03 08:06:26 -07007#include "logging.hpp"
Ed Tanous04e438c2020-10-03 08:06:26 -07008#include "utility.hpp"
Ed Tanous1abe55e2018-09-05 08:30:59 -07009
Ed Tanouse0d918b2018-03-27 17:41:04 -070010#include <boost/algorithm/string.hpp>
Ed Tanous257f5792018-03-17 14:40:09 -070011#include <boost/algorithm/string/predicate.hpp>
Ed Tanous8f626352018-12-19 14:51:54 -080012#include <boost/asio/io_context.hpp>
Ed Tanous3112a142018-11-29 15:45:10 -080013#include <boost/asio/ip/tcp.hpp>
Ed Tanousd43cd0c2020-09-30 20:46:53 -070014#include <boost/asio/ssl/stream.hpp>
Ed Tanous5dfb5b22021-12-03 11:24:53 -080015#include <boost/asio/steady_timer.hpp>
Ed Tanous3112a142018-11-29 15:45:10 -080016#include <boost/beast/core/flat_static_buffer.hpp>
Ed Tanous918ef252022-05-25 10:40:41 -070017#include <boost/beast/http/parser.hpp>
18#include <boost/beast/http/read.hpp>
19#include <boost/beast/http/serializer.hpp>
20#include <boost/beast/http/write.hpp>
Manojkiran Eda44250442020-06-16 12:51:38 +053021#include <boost/beast/ssl/ssl_stream.hpp>
Gunnar Mills1214b7e2020-06-04 10:11:30 -050022#include <boost/beast/websocket.hpp>
Ed Tanousd32c4fa2021-09-14 13:16:51 -070023#include <boost/url/url_view.hpp>
Ed Tanous57fce802019-05-21 13:00:34 -070024#include <json_html_serializer.hpp>
Ed Tanous52cc1122020-07-18 13:51:21 -070025#include <security_headers.hpp>
Gunnar Mills1214b7e2020-06-04 10:11:30 -050026#include <ssl_key_handler.hpp>
27
Manojkiran Eda44250442020-06-16 12:51:38 +053028#include <atomic>
Gunnar Mills1214b7e2020-06-04 10:11:30 -050029#include <chrono>
30#include <vector>
31
Ed Tanous1abe55e2018-09-05 08:30:59 -070032namespace crow
33{
Ed Tanous257f5792018-03-17 14:40:09 -070034
Ed Tanous1abe55e2018-09-05 08:30:59 -070035inline void prettyPrintJson(crow::Response& res)
36{
Ed Tanous57fce802019-05-21 13:00:34 -070037 json_html_util::dumpHtml(res.body(), res.jsonValue);
38
Ed Tanous93ef5802019-01-03 10:15:41 -080039 res.addHeader("Content-Type", "text/html;charset=UTF-8");
Ed Tanous257f5792018-03-17 14:40:09 -070040}
41
Ed Tanous6fbdbca2021-12-06 14:36:06 -080042static int connectionCount = 0;
Jennifer Leeacb7cfb2018-06-07 16:08:15 -070043
Ed Tanous0260d9d2021-02-07 19:31:07 +000044// request body limit size set by the bmcwebHttpReqBodyLimitMb option
Ed Tanous6de264c2022-01-06 12:47:59 -080045constexpr uint64_t httpReqBodyLimit =
46 1024UL * 1024UL * bmcwebHttpReqBodyLimitMb;
Jennifer Leeacb7cfb2018-06-07 16:08:15 -070047
James Feist3909dc82020-04-03 10:58:55 -070048constexpr uint64_t loggedOutPostBodyLimit = 4096;
49
50constexpr uint32_t httpHeaderLimit = 8192;
51
Ed Tanous52cc1122020-07-18 13:51:21 -070052template <typename Adaptor, typename Handler>
Gunnar Mills1214b7e2020-06-04 10:11:30 -050053class Connection :
Ed Tanous52cc1122020-07-18 13:51:21 -070054 public std::enable_shared_from_this<Connection<Adaptor, Handler>>
Ed Tanous1abe55e2018-09-05 08:30:59 -070055{
56 public:
Ed Tanous5dfb5b22021-12-03 11:24:53 -080057 Connection(Handler* handlerIn, boost::asio::steady_timer&& timerIn,
Ed Tanous81ce6092020-12-17 16:54:55 +000058 std::function<std::string()>& getCachedDateStrF,
Ed Tanous5dfb5b22021-12-03 11:24:53 -080059 Adaptor adaptorIn) :
Ed Tanousceac6f72018-12-02 11:58:47 -080060 adaptor(std::move(adaptorIn)),
Ed Tanous5dfb5b22021-12-03 11:24:53 -080061 handler(handlerIn), timer(std::move(timerIn)),
62 getCachedDateStr(getCachedDateStrF)
Ed Tanous1abe55e2018-09-05 08:30:59 -070063 {
64 parser.emplace(std::piecewise_construct, std::make_tuple());
Ed Tanous1abe55e2018-09-05 08:30:59 -070065 parser->body_limit(httpReqBodyLimit);
James Feist3909dc82020-04-03 10:58:55 -070066 parser->header_limit(httpHeaderLimit);
Kowalski, Kamil55e43f62019-07-10 13:12:57 +020067
68#ifdef BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION
Ed Tanous40aa0582021-07-14 13:24:40 -070069 prepareMutualTls();
70#endif // BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION
71
Ed Tanous40aa0582021-07-14 13:24:40 -070072 connectionCount++;
Ed Tanous6fbdbca2021-12-06 14:36:06 -080073
Ed Tanous40aa0582021-07-14 13:24:40 -070074 BMCWEB_LOG_DEBUG << this << " Connection open, total "
75 << connectionCount;
Ed Tanous40aa0582021-07-14 13:24:40 -070076 }
77
78 ~Connection()
79 {
John Edward Broadbent4147b8a2021-07-19 16:52:24 -070080 res.setCompleteRequestHandler(nullptr);
Ed Tanous40aa0582021-07-14 13:24:40 -070081 cancelDeadlineTimer();
Ed Tanous6fbdbca2021-12-06 14:36:06 -080082
Ed Tanous40aa0582021-07-14 13:24:40 -070083 connectionCount--;
84 BMCWEB_LOG_DEBUG << this << " Connection closed, total "
85 << connectionCount;
Ed Tanous40aa0582021-07-14 13:24:40 -070086 }
87
Ed Tanousecd6a3a2022-01-07 09:18:40 -080088 Connection(const Connection&) = delete;
89 Connection(Connection&&) = delete;
90 Connection& operator=(const Connection&) = delete;
91 Connection& operator=(Connection&&) = delete;
92
Ed Tanous40aa0582021-07-14 13:24:40 -070093 void prepareMutualTls()
94 {
Jonathan Doman83deb7d2020-11-16 17:00:22 -080095 std::error_code error;
96 std::filesystem::path caPath(ensuressl::trustStorePath);
97 auto caAvailable = !std::filesystem::is_empty(caPath, error);
98 caAvailable = caAvailable && !error;
Ed Tanous2c70f802020-09-28 14:29:23 -070099 if (caAvailable && persistent_data::SessionStore::getInstance()
100 .getAuthMethodsConfig()
101 .tls)
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100102 {
103 adaptor.set_verify_mode(boost::asio::ssl::verify_peer);
Ed Tanouse7d1a1c2020-09-28 09:36:35 -0700104 std::string id = "bmcweb";
Ed Tanous46ff87b2022-01-07 09:25:51 -0800105
Ed Tanous9eb808c2022-01-25 10:19:23 -0800106 const char* cStr = id.c_str();
Ed Tanous46ff87b2022-01-07 09:25:51 -0800107 // NOLINTNEXTLINE(cppcoreguidelines-pro-type-reinterpret-cast)
Ed Tanous9eb808c2022-01-25 10:19:23 -0800108 const auto* idC = reinterpret_cast<const unsigned char*>(cStr);
Ed Tanouse7d1a1c2020-09-28 09:36:35 -0700109 int ret = SSL_set_session_id_context(
Ed Tanous46ff87b2022-01-07 09:25:51 -0800110 adaptor.native_handle(), idC,
Ed Tanouse7d1a1c2020-09-28 09:36:35 -0700111 static_cast<unsigned int>(id.length()));
112 if (ret == 0)
113 {
114 BMCWEB_LOG_ERROR << this << " failed to set SSL id";
115 }
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100116 }
117
Ed Tanous002d39b2022-05-31 08:59:27 -0700118 adaptor.set_verify_callback(
119 [this](bool preverified, boost::asio::ssl::verify_context& ctx) {
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100120 // do nothing if TLS is disabled
Ed Tanous52cc1122020-07-18 13:51:21 -0700121 if (!persistent_data::SessionStore::getInstance()
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100122 .getAuthMethodsConfig()
123 .tls)
124 {
125 BMCWEB_LOG_DEBUG << this << " TLS auth_config is disabled";
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200126 return true;
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100127 }
128
129 // We always return true to allow full auth flow
130 if (!preverified)
131 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100132 BMCWEB_LOG_DEBUG << this << " TLS preverification failed.";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100133 return true;
134 }
135
136 X509_STORE_CTX* cts = ctx.native_handle();
137 if (cts == nullptr)
138 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100139 BMCWEB_LOG_DEBUG << this << " Cannot get native TLS handle.";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100140 return true;
141 }
142
143 // Get certificate
144 X509* peerCert =
145 X509_STORE_CTX_get_current_cert(ctx.native_handle());
146 if (peerCert == nullptr)
147 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100148 BMCWEB_LOG_DEBUG << this
149 << " Cannot get current TLS certificate.";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100150 return true;
151 }
152
153 // Check if certificate is OK
154 int error = X509_STORE_CTX_get_error(cts);
155 if (error != X509_V_OK)
156 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100157 BMCWEB_LOG_INFO << this << " Last TLS error is: " << error;
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100158 return true;
159 }
160 // Check that we have reached final certificate in chain
161 int32_t depth = X509_STORE_CTX_get_error_depth(cts);
162 if (depth != 0)
163
164 {
165 BMCWEB_LOG_DEBUG
166 << this << " Certificate verification in progress (depth "
167 << depth << "), waiting to reach final depth";
168 return true;
169 }
170
171 BMCWEB_LOG_DEBUG << this
172 << " Certificate verification of final depth";
173
174 // Verify KeyUsage
175 bool isKeyUsageDigitalSignature = false;
176 bool isKeyUsageKeyAgreement = false;
177
178 ASN1_BIT_STRING* usage = static_cast<ASN1_BIT_STRING*>(
Ed Tanous23a21a12020-07-25 04:45:05 +0000179 X509_get_ext_d2i(peerCert, NID_key_usage, nullptr, nullptr));
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100180
181 if (usage == nullptr)
182 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100183 BMCWEB_LOG_DEBUG << this << " TLS usage is null";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100184 return true;
185 }
186
187 for (int i = 0; i < usage->length; i++)
188 {
Ed Tanousca45aa32022-01-07 09:28:45 -0800189 // NOLINTNEXTLINE(cppcoreguidelines-pro-bounds-pointer-arithmetic)
190 unsigned char usageChar = usage->data[i];
191 if (KU_DIGITAL_SIGNATURE & usageChar)
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100192 {
193 isKeyUsageDigitalSignature = true;
194 }
Ed Tanousca45aa32022-01-07 09:28:45 -0800195 if (KU_KEY_AGREEMENT & usageChar)
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100196 {
197 isKeyUsageKeyAgreement = true;
198 }
199 }
Vernon Maueryb9378302021-06-16 14:06:57 -0700200 ASN1_BIT_STRING_free(usage);
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100201
202 if (!isKeyUsageDigitalSignature || !isKeyUsageKeyAgreement)
203 {
204 BMCWEB_LOG_DEBUG << this
205 << " Certificate ExtendedKeyUsage does "
206 "not allow provided certificate to "
207 "be used for user authentication";
208 return true;
209 }
210
211 // Determine that ExtendedKeyUsage includes Client Auth
212
Ed Tanous23a21a12020-07-25 04:45:05 +0000213 stack_st_ASN1_OBJECT* extUsage =
214 static_cast<stack_st_ASN1_OBJECT*>(X509_get_ext_d2i(
215 peerCert, NID_ext_key_usage, nullptr, nullptr));
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100216
217 if (extUsage == nullptr)
218 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100219 BMCWEB_LOG_DEBUG << this << " TLS extUsage is null";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100220 return true;
221 }
222
223 bool isExKeyUsageClientAuth = false;
224 for (int i = 0; i < sk_ASN1_OBJECT_num(extUsage); i++)
225 {
Ed Tanous4bac4a82022-01-07 09:37:55 -0800226 // NOLINTNEXTLINE(cppcoreguidelines-pro-type-cstyle-cast)
227 int nid = OBJ_obj2nid(sk_ASN1_OBJECT_value(extUsage, i));
228 if (NID_client_auth == nid)
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100229 {
230 isExKeyUsageClientAuth = true;
231 break;
232 }
233 }
Zbigniew Kurzynski09d02f82020-03-30 13:41:42 +0200234 sk_ASN1_OBJECT_free(extUsage);
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100235
236 // Certificate has to have proper key usages set
237 if (!isExKeyUsageClientAuth)
238 {
239 BMCWEB_LOG_DEBUG << this
240 << " Certificate ExtendedKeyUsage does "
241 "not allow provided certificate to "
242 "be used for user authentication";
243 return true;
244 }
245 std::string sslUser;
246 // Extract username contained in CommonName
247 sslUser.resize(256, '\0');
248
249 int status = X509_NAME_get_text_by_NID(
250 X509_get_subject_name(peerCert), NID_commonName, sslUser.data(),
251 static_cast<int>(sslUser.size()));
252
253 if (status == -1)
254 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100255 BMCWEB_LOG_DEBUG
256 << this << " TLS cannot get username to create session";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100257 return true;
258 }
259
260 size_t lastChar = sslUser.find('\0');
261 if (lastChar == std::string::npos || lastChar == 0)
262 {
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100263 BMCWEB_LOG_DEBUG << this << " Invalid TLS user name";
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100264 return true;
265 }
266 sslUser.resize(lastChar);
Ed Tanouse05aec52022-01-25 10:28:56 -0800267 std::string unsupportedClientId;
Ed Tanous9a69d5a2021-09-13 10:23:51 -0700268 sessionIsFromTransport = true;
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700269 userSession = persistent_data::SessionStore::getInstance()
270 .generateUserSession(
Jiaqing Zhao41d61c82021-12-07 13:21:47 +0800271 sslUser, req->ipAddress, unsupportedClientId,
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700272 persistent_data::PersistenceType::TIMEOUT);
273 if (userSession != nullptr)
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100274 {
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700275 BMCWEB_LOG_DEBUG
276 << this
277 << " Generating TLS session: " << userSession->uniqueId;
Zbigniew Kurzynski009c2a42019-11-14 13:37:15 +0100278 }
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100279 return true;
280 });
Ed Tanous7045c8d2017-04-03 10:04:37 -0700281 }
282
Ed Tanousceac6f72018-12-02 11:58:47 -0800283 Adaptor& socket()
Ed Tanous1abe55e2018-09-05 08:30:59 -0700284 {
Ed Tanousceac6f72018-12-02 11:58:47 -0800285 return adaptor;
Ed Tanous7045c8d2017-04-03 10:04:37 -0700286 }
287
Ed Tanous1abe55e2018-09-05 08:30:59 -0700288 void start()
289 {
Ed Tanous6fbdbca2021-12-06 14:36:06 -0800290 if (connectionCount >= 100)
291 {
292 BMCWEB_LOG_CRITICAL << this << "Max connection count exceeded.";
293 return;
294 }
295
Ed Tanous5dfb5b22021-12-03 11:24:53 -0800296 startDeadline();
Sunitha Harishc0ea7ae2020-10-30 02:37:30 -0500297
Ed Tanousceac6f72018-12-02 11:58:47 -0800298 // TODO(ed) Abstract this to a more clever class with the idea of an
299 // asynchronous "start"
300 if constexpr (std::is_same_v<Adaptor,
301 boost::beast::ssl_stream<
302 boost::asio::ip::tcp::socket>>)
303 {
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000304 adaptor.async_handshake(boost::asio::ssl::stream_base::server,
305 [this, self(shared_from_this())](
306 const boost::system::error_code& ec) {
Ed Tanous002d39b2022-05-31 08:59:27 -0700307 if (ec)
308 {
309 return;
310 }
311 doReadHeaders();
312 });
Ed Tanousceac6f72018-12-02 11:58:47 -0800313 }
314 else
315 {
316 doReadHeaders();
317 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700318 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700319
Ed Tanous1abe55e2018-09-05 08:30:59 -0700320 void handle()
321 {
Ed Tanousf79b7a52021-09-22 19:04:29 -0700322 std::error_code reqEc;
323 crow::Request& thisReq = req.emplace(parser->release(), reqEc);
324 if (reqEc)
325 {
326 BMCWEB_LOG_DEBUG << "Request failed to construct" << reqEc;
327 return;
328 }
Ed Tanous596b2032021-09-13 10:32:22 -0700329 thisReq.session = userSession;
330
Ivan Mikhaylovf65b0be2021-04-19 10:05:30 +0000331 // Fetch the client IP address
332 readClientIp();
333
Ed Tanous1abe55e2018-09-05 08:30:59 -0700334 // Check for HTTP version 1.1.
Ed Tanous596b2032021-09-13 10:32:22 -0700335 if (thisReq.version() == 11)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700336 {
Ed Tanous596b2032021-09-13 10:32:22 -0700337 if (thisReq.getHeaderValue(boost::beast::http::field::host).empty())
Ed Tanous1abe55e2018-09-05 08:30:59 -0700338 {
Ed Tanousde5c9f32019-03-26 09:17:55 -0700339 res.result(boost::beast::http::status::bad_request);
Nan Zhou72374eb2022-01-27 17:06:51 -0800340 completeRequest(res);
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700341 return;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700342 }
343 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700344
Ed Tanouse278c182019-03-13 16:23:37 -0700345 BMCWEB_LOG_INFO << "Request: "
Ed Tanous596b2032021-09-13 10:32:22 -0700346 << " " << this << " HTTP/" << thisReq.version() / 10
347 << "." << thisReq.version() % 10 << ' '
348 << thisReq.methodString() << " " << thisReq.target()
Ed Tanous8cc8ede2022-02-28 10:20:59 -0800349 << " " << thisReq.ipAddress.to_string();
Ed Tanousd32c4fa2021-09-14 13:16:51 -0700350
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700351 res.isAliveHelper = [this]() -> bool { return isAlive(); };
Ed Tanous7045c8d2017-04-03 10:04:37 -0700352
Ed Tanous596b2032021-09-13 10:32:22 -0700353 thisReq.ioService = static_cast<decltype(thisReq.ioService)>(
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700354 &adaptor.get_executor().context());
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200355
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700356 if (res.completed)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700357 {
Nan Zhou72374eb2022-01-27 17:06:51 -0800358 completeRequest(res);
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700359 return;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700360 }
Nan Zhoua43ea822022-05-27 00:42:44 +0000361#ifndef BMCWEB_INSECURE_DISABLE_AUTHX
Nan Zhoud055a342022-05-25 01:15:34 +0000362 if (!crow::authentication::isOnAllowlist(req->url, req->method()) &&
Ed Tanous1d3c14a2021-09-22 18:54:40 -0700363 thisReq.session == nullptr)
364 {
Nan Zhou72374eb2022-01-27 17:06:51 -0800365 BMCWEB_LOG_WARNING << "Authentication failed";
Ed Tanous1d3c14a2021-09-22 18:54:40 -0700366 forward_unauthorized::sendUnauthorized(
367 req->url, req->getHeaderValue("User-Agent"),
368 req->getHeaderValue("Accept"), res);
Nan Zhou72374eb2022-01-27 17:06:51 -0800369 completeRequest(res);
Ed Tanous1d3c14a2021-09-22 18:54:40 -0700370 return;
371 }
Nan Zhoua43ea822022-05-27 00:42:44 +0000372#endif // BMCWEB_INSECURE_DISABLE_AUTHX
Nan Zhou72374eb2022-01-27 17:06:51 -0800373 auto asyncResp = std::make_shared<bmcweb::AsyncResp>();
374 BMCWEB_LOG_DEBUG << "Setting completion handler";
375 asyncResp->res.setCompleteRequestHandler(
376 [self(shared_from_this())](crow::Response& thisRes) {
Ed Tanous002d39b2022-05-31 08:59:27 -0700377 self->completeRequest(thisRes);
378 });
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700379
Ed Tanous596b2032021-09-13 10:32:22 -0700380 if (thisReq.isUpgrade() &&
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700381 boost::iequals(
Ed Tanous596b2032021-09-13 10:32:22 -0700382 thisReq.getHeaderValue(boost::beast::http::field::upgrade),
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700383 "websocket"))
384 {
Ed Tanous596b2032021-09-13 10:32:22 -0700385 handler->handleUpgrade(thisReq, res, std::move(adaptor));
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700386 // delete lambda with self shared_ptr
387 // to enable connection destruction
Nan Zhou72374eb2022-01-27 17:06:51 -0800388 asyncResp->res.setCompleteRequestHandler(nullptr);
Ed Tanous6c7f01d2021-08-25 13:42:35 -0700389 return;
390 }
Ed Tanous596b2032021-09-13 10:32:22 -0700391 handler->handle(thisReq, asyncResp);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700392 }
Ed Tanouse0d918b2018-03-27 17:41:04 -0700393
Ed Tanouse278c182019-03-13 16:23:37 -0700394 bool isAlive()
395 {
Ed Tanouse278c182019-03-13 16:23:37 -0700396 if constexpr (std::is_same_v<Adaptor,
397 boost::beast::ssl_stream<
398 boost::asio::ip::tcp::socket>>)
399 {
400 return adaptor.next_layer().is_open();
401 }
402 else
403 {
404 return adaptor.is_open();
405 }
406 }
407 void close()
408 {
Ed Tanouse278c182019-03-13 16:23:37 -0700409 if constexpr (std::is_same_v<Adaptor,
410 boost::beast::ssl_stream<
411 boost::asio::ip::tcp::socket>>)
412 {
413 adaptor.next_layer().close();
Nan Zhou72374eb2022-01-27 17:06:51 -0800414 if (sessionIsFromTransport && userSession != nullptr)
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200415 {
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700416 BMCWEB_LOG_DEBUG
417 << this
418 << " Removing TLS session: " << userSession->uniqueId;
419 persistent_data::SessionStore::getInstance().removeSession(
420 userSession);
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200421 }
Ed Tanouse278c182019-03-13 16:23:37 -0700422 }
423 else
424 {
425 adaptor.close();
426 }
427 }
428
Nan Zhou72374eb2022-01-27 17:06:51 -0800429 void completeRequest(crow::Response& thisRes)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700430 {
Ed Tanousf79b7a52021-09-22 19:04:29 -0700431 if (!req)
432 {
433 return;
434 }
Nan Zhou72374eb2022-01-27 17:06:51 -0800435 res = std::move(thisRes);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700436 BMCWEB_LOG_INFO << "Response: " << this << ' ' << req->url << ' '
437 << res.resultInt() << " keepalive=" << req->keepAlive();
Ed Tanous7045c8d2017-04-03 10:04:37 -0700438
Ed Tanous0260d9d2021-02-07 19:31:07 +0000439 addSecurityHeaders(*req, res);
Ed Tanous52cc1122020-07-18 13:51:21 -0700440
Nan Zhoud055a342022-05-25 01:15:34 +0000441 crow::authentication::cleanupTempSession(*req);
Ed Tanous7045c8d2017-04-03 10:04:37 -0700442
Ed Tanouse278c182019-03-13 16:23:37 -0700443 if (!isAlive())
Ed Tanous1abe55e2018-09-05 08:30:59 -0700444 {
445 // BMCWEB_LOG_DEBUG << this << " delete (socket is closed) " <<
446 // isReading
447 // << ' ' << isWriting;
448 // delete this;
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000449
450 // delete lambda with self shared_ptr
451 // to enable connection destruction
John Edward Broadbent4147b8a2021-07-19 16:52:24 -0700452 res.setCompleteRequestHandler(nullptr);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700453 return;
454 }
455 if (res.body().empty() && !res.jsonValue.empty())
456 {
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700457 if (http_helpers::requestPrefersHtml(req->getHeaderValue("Accept")))
Ed Tanous1abe55e2018-09-05 08:30:59 -0700458 {
459 prettyPrintJson(res);
460 }
461 else
462 {
463 res.jsonMode();
Ed Tanous71f52d92021-02-19 08:51:17 -0800464 res.body() = res.jsonValue.dump(
465 2, ' ', true, nlohmann::json::error_handler_t::replace);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700466 }
467 }
Ed Tanous7045c8d2017-04-03 10:04:37 -0700468
Ed Tanous1abe55e2018-09-05 08:30:59 -0700469 if (res.resultInt() >= 400 && res.body().empty())
470 {
471 res.body() = std::string(res.reason());
472 }
Ed Tanous6295bec2019-09-03 10:11:01 -0700473
474 if (res.result() == boost::beast::http::status::no_content)
475 {
476 // Boost beast throws if content is provided on a no-content
477 // response. Ideally, this would never happen, but in the case that
478 // it does, we don't want to throw.
479 BMCWEB_LOG_CRITICAL
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100480 << this << " Response content provided but code was no-content";
Ed Tanous6295bec2019-09-03 10:11:01 -0700481 res.body().clear();
482 }
483
Ed Tanous1abe55e2018-09-05 08:30:59 -0700484 res.addHeader(boost::beast::http::field::date, getCachedDateStr());
485
486 res.keepAlive(req->keepAlive());
487
Nan Zhou72374eb2022-01-27 17:06:51 -0800488 doWrite(res);
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000489
490 // delete lambda with self shared_ptr
491 // to enable connection destruction
John Edward Broadbent4147b8a2021-07-19 16:52:24 -0700492 res.setCompleteRequestHandler(nullptr);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700493 }
494
Sunitha Harishc0ea7ae2020-10-30 02:37:30 -0500495 void readClientIp()
496 {
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700497 boost::asio::ip::address ip;
498 boost::system::error_code ec = getClientIp(ip);
499 if (ec)
500 {
501 return;
502 }
503 req->ipAddress = ip;
504 }
505
506 boost::system::error_code getClientIp(boost::asio::ip::address& ip)
507 {
Sunitha Harishc0ea7ae2020-10-30 02:37:30 -0500508 boost::system::error_code ec;
509 BMCWEB_LOG_DEBUG << "Fetch the client IP address";
510 boost::asio::ip::tcp::endpoint endpoint =
511 boost::beast::get_lowest_layer(adaptor).remote_endpoint(ec);
512
513 if (ec)
514 {
515 // If remote endpoint fails keep going. "ClientOriginIPAddress"
516 // will be empty.
517 BMCWEB_LOG_ERROR << "Failed to get the client's IP Address. ec : "
518 << ec;
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700519 return ec;
Sunitha Harishc0ea7ae2020-10-30 02:37:30 -0500520 }
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700521 ip = endpoint.address();
522 return ec;
Sunitha Harishc0ea7ae2020-10-30 02:37:30 -0500523 }
524
Ed Tanous1abe55e2018-09-05 08:30:59 -0700525 private:
526 void doReadHeaders()
527 {
Ed Tanous1abe55e2018-09-05 08:30:59 -0700528 BMCWEB_LOG_DEBUG << this << " doReadHeaders";
529
530 // Clean up any previous Connection.
531 boost::beast::http::async_read_header(
Ed Tanousceac6f72018-12-02 11:58:47 -0800532 adaptor, buffer, *parser,
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000533 [this,
534 self(shared_from_this())](const boost::system::error_code& ec,
Ed Tanous81ce6092020-12-17 16:54:55 +0000535 std::size_t bytesTransferred) {
Ed Tanous002d39b2022-05-31 08:59:27 -0700536 BMCWEB_LOG_DEBUG << this << " async_read_header "
537 << bytesTransferred << " Bytes";
538 bool errorWhileReading = false;
539 if (ec)
540 {
541 errorWhileReading = true;
542 if (ec == boost::asio::error::eof)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700543 {
Ed Tanous002d39b2022-05-31 08:59:27 -0700544 BMCWEB_LOG_WARNING
545 << this << " Error while reading: " << ec.message();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700546 }
547 else
548 {
Ed Tanous002d39b2022-05-31 08:59:27 -0700549 BMCWEB_LOG_ERROR
550 << this << " Error while reading: " << ec.message();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700551 }
Ed Tanous002d39b2022-05-31 08:59:27 -0700552 }
553 else
554 {
555 // if the adaptor isn't open anymore, and wasn't handed to a
556 // websocket, treat as an error
557 if (!isAlive() &&
558 !boost::beast::websocket::is_upgrade(parser->get()))
Ed Tanous1abe55e2018-09-05 08:30:59 -0700559 {
Ed Tanous002d39b2022-05-31 08:59:27 -0700560 errorWhileReading = true;
561 }
562 }
563
564 cancelDeadlineTimer();
565
566 if (errorWhileReading)
567 {
568 close();
569 BMCWEB_LOG_DEBUG << this << " from read(1)";
570 return;
571 }
572
573 readClientIp();
574
575 boost::asio::ip::address ip;
576 if (getClientIp(ip))
577 {
578 BMCWEB_LOG_DEBUG << "Unable to get client IP";
579 }
580 sessionIsFromTransport = false;
581#ifndef BMCWEB_INSECURE_DISABLE_AUTHX
582 boost::beast::http::verb method = parser->get().method();
583 userSession = crow::authentication::authenticate(
584 ip, res, method, parser->get().base(), userSession);
585
586 bool loggedIn = userSession != nullptr;
587 if (!loggedIn)
588 {
589 const boost::optional<uint64_t> contentLength =
590 parser->content_length();
591 if (contentLength && *contentLength > loggedOutPostBodyLimit)
592 {
593 BMCWEB_LOG_DEBUG << "Content length greater than limit "
594 << *contentLength;
Ed Tanouse278c182019-03-13 16:23:37 -0700595 close();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700596 return;
597 }
598
Ed Tanous002d39b2022-05-31 08:59:27 -0700599 BMCWEB_LOG_DEBUG << "Starting quick deadline";
600 }
Nan Zhoua43ea822022-05-27 00:42:44 +0000601#endif // BMCWEB_INSECURE_DISABLE_AUTHX
Ed Tanous5dfb5b22021-12-03 11:24:53 -0800602
Ed Tanous002d39b2022-05-31 08:59:27 -0700603 doRead();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700604 });
605 }
606
607 void doRead()
608 {
Ed Tanous1abe55e2018-09-05 08:30:59 -0700609 BMCWEB_LOG_DEBUG << this << " doRead";
Ed Tanous5dfb5b22021-12-03 11:24:53 -0800610 startDeadline();
Ed Tanous002d39b2022-05-31 08:59:27 -0700611 boost::beast::http::async_read(adaptor, buffer, *parser,
612 [this, self(shared_from_this())](
613 const boost::system::error_code& ec,
614 std::size_t bytesTransferred) {
615 BMCWEB_LOG_DEBUG << this << " async_read " << bytesTransferred
616 << " Bytes";
617 cancelDeadlineTimer();
618 if (ec)
619 {
620 BMCWEB_LOG_ERROR << this
621 << " Error while reading: " << ec.message();
622 close();
623 BMCWEB_LOG_DEBUG << this << " from read(1)";
624 return;
625 }
626 handle();
627 });
Ed Tanous1abe55e2018-09-05 08:30:59 -0700628 }
629
Nan Zhou72374eb2022-01-27 17:06:51 -0800630 void doWrite(crow::Response& thisRes)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700631 {
Zbigniew Kurzynski2658d982019-11-19 18:01:08 +0100632 BMCWEB_LOG_DEBUG << this << " doWrite";
Nan Zhou72374eb2022-01-27 17:06:51 -0800633 thisRes.preparePayload();
634 serializer.emplace(*thisRes.stringResponse);
Ed Tanous5dfb5b22021-12-03 11:24:53 -0800635 startDeadline();
Ed Tanous002d39b2022-05-31 08:59:27 -0700636 boost::beast::http::async_write(adaptor, *serializer,
637 [this, self(shared_from_this())](
638 const boost::system::error_code& ec,
639 std::size_t bytesTransferred) {
640 BMCWEB_LOG_DEBUG << this << " async_write " << bytesTransferred
641 << " bytes";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700642
Ed Tanous002d39b2022-05-31 08:59:27 -0700643 cancelDeadlineTimer();
James Feist54d8bb12020-07-20 13:28:59 -0700644
Ed Tanous002d39b2022-05-31 08:59:27 -0700645 if (ec)
646 {
647 BMCWEB_LOG_DEBUG << this << " from write(2)";
648 return;
649 }
650 if (!res.keepAlive())
651 {
652 close();
653 BMCWEB_LOG_DEBUG << this << " from write(1)";
654 return;
655 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700656
Ed Tanous002d39b2022-05-31 08:59:27 -0700657 serializer.reset();
658 BMCWEB_LOG_DEBUG << this << " Clearing response";
659 res.clear();
660 parser.emplace(std::piecewise_construct, std::make_tuple());
661 parser->body_limit(httpReqBodyLimit); // reset body limit for
662 // newly created parser
663 buffer.consume(buffer.size());
Ed Tanous1abe55e2018-09-05 08:30:59 -0700664
Ed Tanous002d39b2022-05-31 08:59:27 -0700665 // If the session was built from the transport, we don't need to
666 // clear it. All other sessions are generated per request.
667 if (!sessionIsFromTransport)
668 {
669 userSession = nullptr;
670 }
Ed Tanous9a69d5a2021-09-13 10:23:51 -0700671
Ed Tanous002d39b2022-05-31 08:59:27 -0700672 // Destroy the Request via the std::optional
673 req.reset();
674 doReadHeaders();
675 });
Ed Tanous1abe55e2018-09-05 08:30:59 -0700676 }
677
Ed Tanous1abe55e2018-09-05 08:30:59 -0700678 void cancelDeadlineTimer()
679 {
Ed Tanous5dfb5b22021-12-03 11:24:53 -0800680 timer.cancel();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700681 }
682
Ed Tanous5dfb5b22021-12-03 11:24:53 -0800683 void startDeadline()
Ed Tanous1abe55e2018-09-05 08:30:59 -0700684 {
685 cancelDeadlineTimer();
686
Ed Tanous5dfb5b22021-12-03 11:24:53 -0800687 std::chrono::seconds timeout(15);
688 // allow slow uploads for logged in users
Lei YU638e2392021-12-28 18:14:13 +0800689 bool loggedIn = userSession != nullptr;
Ed Tanous5dfb5b22021-12-03 11:24:53 -0800690 if (loggedIn)
James Feist3909dc82020-04-03 10:58:55 -0700691 {
Ed Tanous5dfb5b22021-12-03 11:24:53 -0800692 timeout = std::chrono::seconds(60);
James Feistcb6cb492020-04-03 13:36:17 -0700693 return;
694 }
Ed Tanous5dfb5b22021-12-03 11:24:53 -0800695
696 std::weak_ptr<Connection<Adaptor, Handler>> weakSelf = weak_from_this();
697 timer.expires_after(timeout);
698 timer.async_wait([weakSelf](const boost::system::error_code ec) {
699 // Note, we are ignoring other types of errors here; If the timer
700 // failed for any reason, we should still close the connection
701
702 std::shared_ptr<Connection<Adaptor, Handler>> self =
703 weakSelf.lock();
704 if (!self)
705 {
706 BMCWEB_LOG_CRITICAL << self << " Failed to capture connection";
707 return;
708 }
709 if (ec == boost::asio::error::operation_aborted)
710 {
711 // Canceled wait means the path succeeeded.
712 return;
713 }
714 if (ec)
715 {
716 BMCWEB_LOG_CRITICAL << self << " timer failed " << ec;
717 }
718
719 BMCWEB_LOG_WARNING << self << "Connection timed out, closing";
720
721 self->close();
722 });
723
724 BMCWEB_LOG_DEBUG << this << " timer started";
Ed Tanous1abe55e2018-09-05 08:30:59 -0700725 }
726
Ed Tanous1abe55e2018-09-05 08:30:59 -0700727 Adaptor adaptor;
728 Handler* handler;
Ed Tanousa24526d2018-12-10 15:17:59 -0800729 // Making this a std::optional allows it to be efficiently destroyed and
Ed Tanous1abe55e2018-09-05 08:30:59 -0700730 // re-created on Connection reset
Ed Tanousa24526d2018-12-10 15:17:59 -0800731 std::optional<
Ed Tanous1abe55e2018-09-05 08:30:59 -0700732 boost::beast::http::request_parser<boost::beast::http::string_body>>
733 parser;
734
Ed Tanous3112a142018-11-29 15:45:10 -0800735 boost::beast::flat_static_buffer<8192> buffer;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700736
Ed Tanousa24526d2018-12-10 15:17:59 -0800737 std::optional<boost::beast::http::response_serializer<
Ed Tanous1abe55e2018-09-05 08:30:59 -0700738 boost::beast::http::string_body>>
739 serializer;
740
Ed Tanousa24526d2018-12-10 15:17:59 -0800741 std::optional<crow::Request> req;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700742 crow::Response res;
Ed Tanous52cc1122020-07-18 13:51:21 -0700743
Ed Tanous9a69d5a2021-09-13 10:23:51 -0700744 bool sessionIsFromTransport = false;
John Edward Broadbent59b98b22021-07-13 15:36:32 -0700745 std::shared_ptr<persistent_data::UserSession> userSession;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700746
Ed Tanous5dfb5b22021-12-03 11:24:53 -0800747 boost::asio::steady_timer timer;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700748
Ed Tanous1abe55e2018-09-05 08:30:59 -0700749 std::function<std::string()>& getCachedDateStr;
Jan Sowinskiee52ae12020-01-09 16:28:32 +0000750
751 using std::enable_shared_from_this<
Ed Tanous52cc1122020-07-18 13:51:21 -0700752 Connection<Adaptor, Handler>>::shared_from_this;
Ed Tanous5dfb5b22021-12-03 11:24:53 -0800753
754 using std::enable_shared_from_this<
755 Connection<Adaptor, Handler>>::weak_from_this;
Ed Tanous3112a142018-11-29 15:45:10 -0800756};
Ed Tanous1abe55e2018-09-05 08:30:59 -0700757} // namespace crow