Bug Summary

File:lib/lwan-request.c
Warning:line 1731, column 13
1st function call argument is an uninitialized value

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name lwan-request.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -fno-plt -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/home/buildbot/lwan-worker/clang-analyze/build/src/lib -resource-dir /usr/lib/clang/14.0.6 -include /home/buildbot/lwan-worker/clang-analyze/build/lwan-build-config.h -D _FILE_OFFSET_BITS=64 -D _TIME_BITS=64 -I /home/buildbot/lwan-worker/clang-analyze/build/src/lib/missing -I /usr/include/luajit-2.1 -I /usr/include/valgrind -I /home/buildbot/lwan-worker/clang-analyze/build/src/lib -I /home/buildbot/lwan-worker/clang-analyze/build -internal-isystem /usr/lib/clang/14.0.6/include -internal-isystem /usr/local/include -internal-isystem /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/12.2.0/../../../../x86_64-pc-linux-gnu/include -internal-externc-isystem /include -internal-externc-isystem /usr/include -Wno-unused-parameter -Wno-free-nonheap-object -std=gnu11 -fdebug-compilation-dir=/home/buildbot/lwan-worker/clang-analyze/build/src/lib -ferror-limit 19 -stack-protector 2 -fgnuc-version=4.2.1 -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/buildbot/lwan-worker/clang-analyze/CLANG/2023-01-03-015947-1047285-1 -x c /home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c
1/*
2 * lwan - web server
3 * Copyright (c) 2012-2014 L. A. F. Pereira <l@tia.mat.br>
4 *
5 * This program is free software; you can redistribute it and/or
6 * modify it under the terms of the GNU General Public License
7 * as published by the Free Software Foundation; either version 2
8 * of the License, or any later version.
9 *
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
14 *
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, write to the Free Software
17 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
18 */
19
20#define _GNU_SOURCE
21#include <arpa/inet.h>
22#include <assert.h>
23#include <ctype.h>
24#include <errno(*__errno_location ()).h>
25#include <fcntl.h>
26#include <inttypes.h>
27#include <limits.h>
28#include <stddef.h>
29#include <stdio.h>
30#include <stdlib.h>
31#include <string.h>
32#include <strings.h>
33#include <sys/mman.h>
34#include <sys/socket.h>
35#include <sys/stat.h>
36#include <sys/types.h>
37#include <sys/vfs.h>
38#include <unistd.h>
39
40#include "lwan-private.h"
41
42#include "base64.h"
43#include "list.h"
44#include "lwan-config.h"
45#include "lwan-http-authorize.h"
46#include "lwan-io-wrappers.h"
47#include "sha1.h"
48
49#define HEADER_VALUE_SEPARATOR_LEN(sizeof(": ") - 1) (sizeof(": ") - 1)
50#define HEADER_TERMINATOR_LEN(sizeof("\r\n") - 1) (sizeof("\r\n") - 1)
51#define MIN_REQUEST_SIZE(sizeof("GET / HTTP/1.1\r\n\r\n") - 1) (sizeof("GET / HTTP/1.1\r\n\r\n") - 1)
52
53enum lwan_read_finalizer {
54 FINALIZER_DONE,
55 FINALIZER_TRY_AGAIN,
56 FINALIZER_TIMEOUT,
57};
58
59struct proxy_header_v2 {
60 uint8_t sig[12];
61 uint8_t cmd_ver;
62 uint8_t fam;
63 uint16_t len;
64 union {
65 struct {
66 in_addr_t src_addr;
67 in_addr_t dst_addr;
68 uint16_t src_port;
69 uint16_t dst_port;
70 } ip4;
71 struct {
72 struct in6_addr src_addr;
73 struct in6_addr dst_addr;
74 uint16_t src_port;
75 uint16_t dst_port;
76 } ip6;
77 } addr;
78};
79
80static char decode_hex_digit(char ch) __attribute__((pure));
81static char *ignore_leading_whitespace(char *buffer) __attribute__((pure));
82
83
84static bool_Bool
85parse_ascii_port(char *port, unsigned short *out)
86{
87 unsigned long parsed;
88 char *end_ptr;
89
90 errno(*__errno_location ()) = 0;
91 parsed = strtoul(port, &end_ptr, 10);
92
93 if (UNLIKELY(errno != 0)__builtin_expect((((*__errno_location ()) != 0)), (0)))
94 return false0;
95
96 if (UNLIKELY(*end_ptr != '\0')__builtin_expect(((*end_ptr != '\0')), (0)))
97 return false0;
98
99 if (UNLIKELY((unsigned long)(unsigned short)parsed != parsed)__builtin_expect((((unsigned long)(unsigned short)parsed != parsed
)), (0)))
100 return false0;
101
102 *out = htons((unsigned short)parsed);
103 return true1;
104}
105
106static char *
107strsep_char(char *strp, const char *end, char delim)
108{
109 char *ptr;
110
111 if (UNLIKELY(!strp)__builtin_expect(((!strp)), (0)))
112 return NULL((void*)0);
113
114 if (UNLIKELY(strp > end)__builtin_expect(((strp > end)), (0)))
115 return NULL((void*)0);
116
117 ptr = strchr(strp, delim);
118 if (UNLIKELY(!ptr)__builtin_expect(((!ptr)), (0)))
119 return NULL((void*)0);
120
121 *ptr = '\0';
122 return ptr + 1;
123}
124
125static char *
126parse_proxy_protocol_v1(struct lwan_request *request, char *buffer)
127{
128 static const size_t line_size = 108;
129 char *end, *protocol, *src_addr, *dst_addr, *src_port, *dst_port;
130 unsigned int size;
131 struct lwan_proxy *const proxy = request->proxy;
132
133 end = memchr(buffer, '\r', line_size);
134 if (UNLIKELY(!end || end[1] != '\n')__builtin_expect(((!end || end[1] != '\n')), (0)))
135 return NULL((void*)0);
136 *end = '\0';
137 size = (unsigned int) (end + 2 - buffer);
138
139 protocol = buffer + sizeof("PROXY ") - 1;
140 src_addr = strsep_char(protocol, end, ' ');
141 dst_addr = strsep_char(src_addr, end, ' ');
142 src_port = strsep_char(dst_addr, end, ' ');
143 dst_port = strsep_char(src_port, end, ' ');
144
145 if (UNLIKELY(!dst_port)__builtin_expect(((!dst_port)), (0)))
146 return NULL((void*)0);
147
148 STRING_SWITCH(protocol)switch (string_as_uint32(protocol)) {
149 case STR4_INT('T', 'C', 'P', '4')((uint32_t)(('T') | ('C') << 8 | ('P') << 16 | ('4'
) << 24)): {
150 struct sockaddr_in *from = &proxy->from.ipv4;
151 struct sockaddr_in *to = &proxy->to.ipv4;
152
153 from->sin_family = to->sin_family = AF_INET2;
154
155 if (UNLIKELY(inet_pton(AF_INET, src_addr, &from->sin_addr) <= 0)__builtin_expect(((inet_pton(2, src_addr, &from->sin_addr
) <= 0)), (0)))
156 return NULL((void*)0);
157 if (UNLIKELY(inet_pton(AF_INET, dst_addr, &to->sin_addr) <= 0)__builtin_expect(((inet_pton(2, dst_addr, &to->sin_addr
) <= 0)), (0)))
158 return NULL((void*)0);
159 if (UNLIKELY(!parse_ascii_port(src_port, &from->sin_port))__builtin_expect(((!parse_ascii_port(src_port, &from->
sin_port))), (0)))
160 return NULL((void*)0);
161 if (UNLIKELY(!parse_ascii_port(dst_port, &to->sin_port))__builtin_expect(((!parse_ascii_port(dst_port, &to->sin_port
))), (0)))
162 return NULL((void*)0);
163
164 break;
165 }
166 case STR4_INT('T', 'C', 'P', '6')((uint32_t)(('T') | ('C') << 8 | ('P') << 16 | ('6'
) << 24)): {
167 struct sockaddr_in6 *from = &proxy->from.ipv6;
168 struct sockaddr_in6 *to = &proxy->to.ipv6;
169
170 from->sin6_family = to->sin6_family = AF_INET610;
171
172 if (UNLIKELY(inet_pton(AF_INET6, src_addr, &from->sin6_addr) <= 0)__builtin_expect(((inet_pton(10, src_addr, &from->sin6_addr
) <= 0)), (0)))
173 return NULL((void*)0);
174 if (UNLIKELY(inet_pton(AF_INET6, dst_addr, &to->sin6_addr) <= 0)__builtin_expect(((inet_pton(10, dst_addr, &to->sin6_addr
) <= 0)), (0)))
175 return NULL((void*)0);
176 if (UNLIKELY(!parse_ascii_port(src_port, &from->sin6_port))__builtin_expect(((!parse_ascii_port(src_port, &from->
sin6_port))), (0)))
177 return NULL((void*)0);
178 if (UNLIKELY(!parse_ascii_port(dst_port, &to->sin6_port))__builtin_expect(((!parse_ascii_port(dst_port, &to->sin6_port
))), (0)))
179 return NULL((void*)0);
180
181 break;
182 }
183 default:
184 return NULL((void*)0);
185 }
186
187 request->flags |= REQUEST_PROXIED;
188 return buffer + size;
189}
190
191static char *parse_proxy_protocol_v2(struct lwan_request *request, char *buffer)
192{
193 struct proxy_header_v2 *hdr = (struct proxy_header_v2 *)buffer;
194 struct lwan_request_parser_helper *helper = request->helper;
195 const unsigned int proto_signature_length = 16;
196 unsigned int size;
197 struct lwan_proxy *const proxy = request->proxy;
198
199 enum { LOCAL = 0x20, PROXY = 0x21, TCP4 = 0x11, TCP6 = 0x21 };
200
201 size = proto_signature_length + (unsigned int)ntohs(hdr->len);
202 if (UNLIKELY(size > (unsigned int)sizeof(*hdr))__builtin_expect(((size > (unsigned int)sizeof(*hdr))), (0
)))
203 return NULL((void*)0);
204 if (UNLIKELY(size >= helper->buffer->len)__builtin_expect(((size >= helper->buffer->len)), (0
)))
205 return NULL((void*)0);
206
207 if (LIKELY(hdr->cmd_ver == PROXY)__builtin_expect((!!(hdr->cmd_ver == PROXY)), (1))) {
208 if (hdr->fam == TCP4) {
209 struct sockaddr_in *from = &proxy->from.ipv4;
210 struct sockaddr_in *to = &proxy->to.ipv4;
211
212 to->sin_family = from->sin_family = AF_INET2;
213
214 from->sin_addr.s_addr = hdr->addr.ip4.src_addr;
215 from->sin_port = hdr->addr.ip4.src_port;
216
217 to->sin_addr.s_addr = hdr->addr.ip4.dst_addr;
218 to->sin_port = hdr->addr.ip4.dst_port;
219 } else if (hdr->fam == TCP6) {
220 struct sockaddr_in6 *from = &proxy->from.ipv6;
221 struct sockaddr_in6 *to = &proxy->to.ipv6;
222
223 from->sin6_family = to->sin6_family = AF_INET610;
224
225 from->sin6_addr = hdr->addr.ip6.src_addr;
226 from->sin6_port = hdr->addr.ip6.src_port;
227
228 to->sin6_addr = hdr->addr.ip6.dst_addr;
229 to->sin6_port = hdr->addr.ip6.dst_port;
230 } else {
231 return NULL((void*)0);
232 }
233 } else if (hdr->cmd_ver == LOCAL) {
234 struct sockaddr_in *from = &proxy->from.ipv4;
235 struct sockaddr_in *to = &proxy->to.ipv4;
236
237 from->sin_family = to->sin_family = AF_UNSPEC0;
238 } else {
239 return NULL((void*)0);
240 }
241
242 request->flags |= REQUEST_PROXIED;
243 return buffer + size;
244}
245
246#if !defined(LWAN_HAVE_BUILTIN_EXPECT_PROBABILITY)
247#define __builtin_expect_with_probability(value1, value2, probability) \
248 __builtin_expect(value1, value2)
249#endif
250
251static ALWAYS_INLINEinline __attribute__((always_inline)) char *identify_http_method(struct lwan_request *request,
252 char *buffer)
253{
254 const uint32_t first_four = string_as_uint32(buffer);
255
256#define GENERATE_IF(upper, lower, mask, constant, probability) \
257 if (__builtin_expect_with_probability(first_four == (constant), 1, \
258 probability)) { \
259 request->flags |= (mask); \
260 return buffer + sizeof(#upper); \
261 }
262
263 FOR_EACH_REQUEST_METHOD(GENERATE_IF)GENERATE_IF(GET, get, (1 << 0), (((uint32_t)(('G') | ('E'
) << 8 | ('T') << 16 | (' ') << 24))), 0.6)
GENERATE_IF(POST, post, (1 << 3 | 1 << 1 | 1 <<
0), (((uint32_t)(('P') | ('O') << 8 | ('S') << 16
| ('T') << 24))), 0.2) GENERATE_IF(HEAD, head, (1 <<
1), (((uint32_t)(('H') | ('E') << 8 | ('A') << 16
| ('D') << 24))), 0.2) GENERATE_IF(OPTIONS, options, (
1 << 2), (((uint32_t)(('O') | ('P') << 8 | ('T') <<
16 | ('I') << 24))), 0.1) GENERATE_IF(DELETE, delete, (
1 << 1 | 1 << 2), (((uint32_t)(('D') | ('E') <<
8 | ('L') << 16 | ('E') << 24))), 0.1) GENERATE_IF
(PUT, put, (1 << 3 | 1 << 2 | 1 << 0), (((uint32_t
)(('P') | ('U') << 8 | ('T') << 16 | (' ') <<
24))), 0.1)
264
265#undef GENERATE_IF
266
267 return NULL((void*)0);
268}
269
270static ALWAYS_INLINEinline __attribute__((always_inline)) char decode_hex_digit(char ch)
271{
272 static const char hex_digit_tbl[256] = {
273 ['0'] = 0, ['1'] = 1, ['2'] = 2, ['3'] = 3, ['4'] = 4, ['5'] = 5,
274 ['6'] = 6, ['7'] = 7, ['8'] = 8, ['9'] = 9, ['a'] = 10, ['b'] = 11,
275 ['c'] = 12, ['d'] = 13, ['e'] = 14, ['f'] = 15, ['A'] = 10, ['B'] = 11,
276 ['C'] = 12, ['D'] = 13, ['E'] = 14, ['F'] = 15,
277 };
278 return hex_digit_tbl[(unsigned char)ch];
279}
280
281__attribute__((nonnull(1))) static ssize_t url_decode(char *str)
282{
283 char *inptr = str;
284 char *outptr = str;
285
286 for (char *ch = strchr(str, '+'); ch; ch = strchr(ch + 1, '+'))
287 *ch = ' ';
288
289 while (true1) {
290 char *pct = strchr(inptr, '%');
291 if (!pct) {
292 if (inptr > outptr)
293 outptr = stpcpy(outptr, inptr);
294 break;
295 }
296
297 ptrdiff_t diff = pct - inptr;
298 if (diff) {
299 memmove(outptr, inptr, (size_t)diff);
300 outptr += diff;
301 }
302
303 char decoded = (char)(decode_hex_digit(pct[1]) << 4);
304 decoded |= (char)decode_hex_digit(pct[2]);
305 if (UNLIKELY(!decoded)__builtin_expect(((!decoded)), (0))) {
306 return -1;
307 }
308
309 *outptr = decoded;
310 outptr++;
311
312 inptr = pct + 3;
313 }
314
315 return (ssize_t)(outptr - str);
316}
317
318static int key_value_compare(const void *a, const void *b)
319{
320 return strcmp(((const struct lwan_key_value *)a)->key,
321 ((const struct lwan_key_value *)b)->key);
322}
323
324static void
325reset_key_value_array(void *data)
326{
327 struct lwan_key_value_array *array = data;
328
329 lwan_key_value_array_reset(array);
330}
331
332static void parse_key_values(struct lwan_request *request,
333 struct lwan_value *helper_value,
334 struct lwan_key_value_array *array,
335 ssize_t (*decode_value)(char *value),
336 const char separator)
337{
338 struct lwan_key_value *kv;
339 char *ptr = helper_value->value;
340 const char *end = helper_value->value + helper_value->len;
341 coro_deferred reset_defer;
342
343 if (!helper_value->len)
344 return;
345
346 lwan_key_value_array_init(array);
347 reset_defer = coro_defer(request->conn->coro, reset_key_value_array, array);
348
349 do {
350 char *key, *value;
351
352 while (*ptr == ' ' || *ptr == separator)
353 ptr++;
354 if (UNLIKELY(*ptr == '\0')__builtin_expect(((*ptr == '\0')), (0)))
355 break;
356
357 key = ptr;
358 ptr = strsep_char(key, end, separator);
359
360 value = strsep_char(key, end, '=');
361 if (UNLIKELY(!value)__builtin_expect(((!value)), (0))) {
362 value = "";
363 } else if (UNLIKELY(decode_value(value) < 0)__builtin_expect(((decode_value(value) < 0)), (0))) {
364 /* Disallow values that failed decoding, but allow empty values */
365 goto error;
366 }
367
368 if (UNLIKELY(decode_value(key) <= 0)__builtin_expect(((decode_value(key) <= 0)), (0))) {
369 /* Disallow keys that failed decoding, or empty keys */
370 goto error;
371 }
372
373 kv = lwan_key_value_array_append(array);
374 if (UNLIKELY(!kv)__builtin_expect(((!kv)), (0)))
375 goto error;
376
377 kv->key = key;
378 kv->value = value;
379 } while (ptr);
380
381 lwan_key_value_array_sort(array, key_value_compare);
382
383 return;
384
385error:
386 coro_defer_fire_and_disarm(request->conn->coro, reset_defer);
387}
388
389static ssize_t
390identity_decode(char *input __attribute__((unused)))
391{
392 return 1;
393}
394
395static void parse_cookies(struct lwan_request *request)
396{
397 const char *cookies = lwan_request_get_header(request, "Cookie");
398
399 if (!cookies)
400 return;
401
402 struct lwan_value header = {.value = (char *)cookies,
403 .len = strlen(cookies)};
404 parse_key_values(request, &header, &request->helper->cookies,
405 identity_decode, ';');
406}
407
408static void parse_query_string(struct lwan_request *request)
409{
410 struct lwan_request_parser_helper *helper = request->helper;
411
412 parse_key_values(request, &helper->query_string, &helper->query_params,
413 url_decode, '&');
414}
415
416static void parse_form_data(struct lwan_request *request)
417{
418 struct lwan_request_parser_helper *helper = request->helper;
419 static const char content_type[] = "application/x-www-form-urlencoded";
420
421 if (helper->content_type.len < sizeof(content_type) - 1)
422 return;
423 if (UNLIKELY(strncmp(helper->content_type.value, content_type,__builtin_expect(((strncmp(helper->content_type.value, content_type
, sizeof(content_type) - 1))), (0))
424 sizeof(content_type) - 1))__builtin_expect(((strncmp(helper->content_type.value, content_type
, sizeof(content_type) - 1))), (0)))
425 return;
426
427 parse_key_values(request, &helper->body_data, &helper->post_params,
428 url_decode, '&');
429}
430
431static void find_query_string(struct lwan_request *request, const char *space)
432{
433 struct lwan_request_parser_helper *helper = request->helper;
434
435 char *query_string = memchr(request->url.value, '?', request->url.len);
436 if (query_string) {
437 *query_string = '\0';
438 helper->query_string.value = query_string + 1;
439 helper->query_string.len = (size_t)(space - query_string - 1);
440 request->url.len -= helper->query_string.len + 1;
441 request->flags |= REQUEST_HAS_QUERY_STRING;
442 }
443}
444
445static char *
446identify_http_path(struct lwan_request *request, char *buffer)
447{
448 struct lwan_request_parser_helper *helper = request->helper;
449 static const size_t minimal_request_line_len = sizeof("/ HTTP/1.0") - 1;
450 char *space, *end_of_line;
451 ptrdiff_t end_len;
452
453 if (UNLIKELY(*buffer != '/')__builtin_expect(((*buffer != '/')), (0)))
454 return NULL((void*)0);
455
456 end_len = buffer - helper->buffer->value;
457 if (UNLIKELY((size_t)end_len >= helper->buffer->len)__builtin_expect((((size_t)end_len >= helper->buffer->
len)), (0)))
458 return NULL((void*)0);
459
460 end_of_line = memchr(buffer, '\r', helper->buffer->len - (size_t)end_len);
461 if (UNLIKELY(!end_of_line)__builtin_expect(((!end_of_line)), (0)))
462 return NULL((void*)0);
463 if (UNLIKELY((size_t)(end_of_line - buffer) < minimal_request_line_len)__builtin_expect((((size_t)(end_of_line - buffer) < minimal_request_line_len
)), (0)))
464 return NULL((void*)0);
465 *end_of_line = '\0';
466
467 space = end_of_line - sizeof("HTTP/X.X");
468
469 request->url.value = buffer;
470 request->url.len = (size_t)(space - buffer);
471 find_query_string(request, space);
472 request->original_url = request->url;
473
474 *space++ = '\0';
475
476 STRING_SWITCH_LARGE(space)switch (string_as_uint64(space)) {
477 case STR8_INT('H','T','T','P','/','1','.','0')((uint64_t)((uint32_t)(('H') | ('T') << 8 | ('T') <<
16 | ('P') << 24)) | (uint64_t)((uint32_t)(('/') | ('1'
) << 8 | ('.') << 16 | ('0') << 24)) <<
32):
478 request->flags |= REQUEST_IS_HTTP_1_0;
479 break;
480 case STR8_INT('H','T','T','P','/','1','.','1')((uint64_t)((uint32_t)(('H') | ('T') << 8 | ('T') <<
16 | ('P') << 24)) | (uint64_t)((uint32_t)(('/') | ('1'
) << 8 | ('.') << 16 | ('1') << 24)) <<
32):
481 break;
482 default:
483 return NULL((void*)0);
484 }
485
486 return end_of_line + 1;
487}
488
489__attribute__((noinline)) static void set_header_value(
490 struct lwan_value *header, char *end, char *p, size_t header_len)
491{
492 p += header_len;
493
494 if (LIKELY(string_as_uint16(p) == STR2_INT(':', ' '))__builtin_expect((!!(string_as_uint16(p) == ((uint16_t)((':')
| (' ') << 8)))), (1))) {
495 *end = '\0';
496 char *value = p + sizeof(": ") - 1;
497
498 header->value = value;
499 header->len = (size_t)(end - value);
500 }
501}
502
503#define HEADER_LENGTH(hdr) \
504 ({ \
505 if (UNLIKELY(end - sizeof(hdr) + 1 < p)__builtin_expect(((end - sizeof(hdr) + 1 < p)), (0))) \
506 continue; \
507 sizeof(hdr) - 1; \
508 })
509
510#define SET_HEADER_VALUE(dest, hdr) \
511 do { \
512 const size_t header_len = HEADER_LENGTH(hdr); \
513 set_header_value(&(helper->dest), end, p, header_len); \
514 } while (0)
515
516static ALWAYS_INLINEinline __attribute__((always_inline)) ssize_t find_headers(char **header_start,
517 struct lwan_value *request_buffer,
518 char **next_request)
519{
520 char *buffer = request_buffer->value;
521 char *buffer_end = buffer + request_buffer->len;
522 ssize_t n_headers = 0;
523 char *next_header;
524
525 for (char *next_chr = buffer + 1;;) {
526 next_header = memchr(next_chr, '\r', (size_t)(buffer_end - next_chr));
527
528 if (UNLIKELY(!next_header)__builtin_expect(((!next_header)), (0)))
529 return -1;
530
531 if (next_chr == next_header) {
532 if (buffer_end - next_chr >= (ptrdiff_t)HEADER_TERMINATOR_LEN(sizeof("\r\n") - 1)) {
533 STRING_SWITCH_SMALL (next_header)switch (string_as_uint16(next_header)) {
534 case STR2_INT('\r', '\n')((uint16_t)(('\r') | ('\n') << 8)):
535 *next_request = next_header + HEADER_TERMINATOR_LEN(sizeof("\r\n") - 1);
536 }
537 }
538 goto out;
539 }
540
541 /* Is there at least a space for a minimal (H)eader and a (V)alue? */
542 if (LIKELY(next_header - next_chr >= (ptrdiff_t)(sizeof("H: V") - 1))__builtin_expect((!!(next_header - next_chr >= (ptrdiff_t)
(sizeof("H: V") - 1))), (1))) {
543 header_start[n_headers++] = next_chr;
544
545 if (UNLIKELY(n_headers >= N_HEADER_START - 1)__builtin_expect(((n_headers >= 64 - 1)), (0)))
546 return -1;
547 } else {
548 /* Better to abort early if there's no space. */
549 return -1;
550 }
551
552 next_chr = next_header + HEADER_TERMINATOR_LEN(sizeof("\r\n") - 1);
553 if (UNLIKELY(next_chr >= buffer_end)__builtin_expect(((next_chr >= buffer_end)), (0)))
554 return -1;
555 }
556
557out:
558 header_start[n_headers] = next_header;
559 return n_headers;
560}
561
562static bool_Bool parse_headers(struct lwan_request_parser_helper *helper,
563 char *buffer)
564{
565 char **header_start = helper->header_start;
566 ssize_t n_headers = 0;
567
568 /* FIXME: is there a better way to do this? */
569 struct lwan_value header_start_buffer = {
570 .value = buffer,
571 .len = helper->buffer->len - (size_t)(buffer - helper->buffer->value)
572 };
573 n_headers = find_headers(header_start, &header_start_buffer,
574 &helper->next_request);
575 if (UNLIKELY(n_headers < 0)__builtin_expect(((n_headers < 0)), (0)))
576 return false0;
577
578 for (ssize_t i = 0; i < n_headers; i++) {
579 char *p = header_start[i];
580 char *end = header_start[i + 1] - HEADER_TERMINATOR_LEN(sizeof("\r\n") - 1);
581
582 STRING_SWITCH_L (p)switch (((string_as_uint32(p)) | (uint32_t)0x20202020)) {
583 case STR4_INT_L('A', 'c', 'c', 'e')((((uint32_t)(('A') | ('c') << 8 | ('c') << 16 | (
'e') << 24))) | (uint32_t)0x20202020):
584 p += HEADER_LENGTH("Accept");
585
586 STRING_SWITCH_L (p)switch (((string_as_uint32(p)) | (uint32_t)0x20202020)) {
587 case STR4_INT_L('-', 'E', 'n', 'c')((((uint32_t)(('-') | ('E') << 8 | ('n') << 16 | (
'c') << 24))) | (uint32_t)0x20202020):
588 SET_HEADER_VALUE(accept_encoding, "-Encoding");
589 break;
590 }
591 break;
592 case STR4_INT_L('C', 'o', 'n', 'n')((((uint32_t)(('C') | ('o') << 8 | ('n') << 16 | (
'n') << 24))) | (uint32_t)0x20202020):
593 SET_HEADER_VALUE(connection, "Connection");
594 break;
595 case STR4_INT_L('C', 'o', 'n', 't')((((uint32_t)(('C') | ('o') << 8 | ('n') << 16 | (
't') << 24))) | (uint32_t)0x20202020):
596 p += HEADER_LENGTH("Content");
597
598 STRING_SWITCH_L (p)switch (((string_as_uint32(p)) | (uint32_t)0x20202020)) {
599 case STR4_INT_L('-', 'T', 'y', 'p')((((uint32_t)(('-') | ('T') << 8 | ('y') << 16 | (
'p') << 24))) | (uint32_t)0x20202020):
600 SET_HEADER_VALUE(content_type, "-Type");
601 break;
602 case STR4_INT_L('-', 'L', 'e', 'n')((((uint32_t)(('-') | ('L') << 8 | ('e') << 16 | (
'n') << 24))) | (uint32_t)0x20202020):
603 SET_HEADER_VALUE(content_length, "-Length");
604 break;
605 }
606 break;
607 case STR4_INT_L('I', 'f', '-', 'M')((((uint32_t)(('I') | ('f') << 8 | ('-') << 16 | (
'M') << 24))) | (uint32_t)0x20202020):
608 SET_HEADER_VALUE(if_modified_since.raw, "If-Modified-Since");
609 break;
610 case STR4_INT_L('H', 'o', 's', 't')((((uint32_t)(('H') | ('o') << 8 | ('s') << 16 | (
't') << 24))) | (uint32_t)0x20202020):
611 SET_HEADER_VALUE(host, "Host");
612 break;
613 case STR4_INT_L('R', 'a', 'n', 'g')((((uint32_t)(('R') | ('a') << 8 | ('n') << 16 | (
'g') << 24))) | (uint32_t)0x20202020):
614 SET_HEADER_VALUE(range.raw, "Range");
615 break;
616 }
617 }
618
619 helper->n_header_start = (size_t)n_headers;
620 return true1;
621}
622#undef HEADER_LENGTH
623#undef SET_HEADER_VALUE
624
625ssize_t lwan_find_headers(char **header_start, struct lwan_value *buffer,
626 char **next_request)
627{
628 return find_headers(header_start, buffer, next_request);
629}
630
631static void parse_if_modified_since(struct lwan_request_parser_helper *helper)
632{
633 static const size_t header_len =
634 sizeof("Wed, 17 Apr 2019 13:59:27 GMT") - 1;
635 time_t parsed;
636
637 if (UNLIKELY(helper->if_modified_since.raw.len != header_len)__builtin_expect(((helper->if_modified_since.raw.len != header_len
)), (0)))
638 return;
639
640 if (UNLIKELY(lwan_parse_rfc_time(helper->if_modified_since.raw.value,__builtin_expect(((lwan_parse_rfc_time(helper->if_modified_since
.raw.value, &parsed) < 0)), (0))
641 &parsed) < 0)__builtin_expect(((lwan_parse_rfc_time(helper->if_modified_since
.raw.value, &parsed) < 0)), (0)))
642 return;
643
644 helper->if_modified_since.parsed = parsed;
645}
646
647static bool_Bool
648parse_off_without_sign(const char *ptr, char **end, off_t *off)
649{
650 unsigned long long val;
651
652 static_assert_Static_assert(sizeof(val) >= sizeof(off_t),
653 "off_t fits in a long long");
654
655 errno(*__errno_location ()) = 0;
656
657 val = strtoull(ptr, end, 10);
658 if (UNLIKELY(val == 0 && *end == ptr)__builtin_expect(((val == 0 && *end == ptr)), (0)))
659 return false0;
660 if (UNLIKELY(errno != 0)__builtin_expect((((*__errno_location ()) != 0)), (0)))
661 return false0;
662 if (UNLIKELY(val > OFF_MAX)__builtin_expect(((val > 9223372036854775807LL)), (0)))
663 return false0;
664
665 *off = (off_t)val;
666 return true1;
667}
668
669static void
670parse_range(struct lwan_request_parser_helper *helper)
671{
672 if (UNLIKELY(helper->range.raw.len <= (sizeof("bytes=") - 1))__builtin_expect(((helper->range.raw.len <= (sizeof("bytes="
) - 1))), (0)))
673 return;
674
675 char *range = helper->range.raw.value;
676 if (UNLIKELY(strncmp(range, "bytes=", sizeof("bytes=") - 1))__builtin_expect(((strncmp(range, "bytes=", sizeof("bytes=") -
1))), (0)))
677 return;
678
679 range += sizeof("bytes=") - 1;
680
681 off_t from, to;
682 char *end;
683
684 if (*range == '-') {
685 from = 0;
686
687 if (!parse_off_without_sign(range + 1, &end, &to))
688 goto invalid_range;
689 if (*end != '\0')
690 goto invalid_range;
691 } else if (lwan_char_isdigit(*range)) {
692 if (!parse_off_without_sign(range, &end, &from))
693 goto invalid_range;
694 if (*end != '-')
695 goto invalid_range;
696
697 range = end + 1;
698 if (*range == '\0') {
699 to = -1;
700 } else {
701 if (!parse_off_without_sign(range, &end, &to))
702 goto invalid_range;
703 if (*end != '\0')
704 goto invalid_range;
705 }
706 } else {
707invalid_range:
708 to = from = -1;
709 }
710
711 helper->range.from = from;
712 helper->range.to = to;
713}
714
715static void
716parse_accept_encoding(struct lwan_request *request)
717{
718 struct lwan_request_parser_helper *helper = request->helper;
719
720 if (!helper->accept_encoding.len)
721 return;
722
723 for (const char *p = helper->accept_encoding.value; *p; p++) {
724 STRING_SWITCH(p)switch (string_as_uint32(p)) {
725 case STR4_INT('d','e','f','l')((uint32_t)(('d') | ('e') << 8 | ('f') << 16 | ('l'
) << 24)):
726 case STR4_INT(' ','d','e','f')((uint32_t)((' ') | ('d') << 8 | ('e') << 16 | ('f'
) << 24)):
727 request->flags |= REQUEST_ACCEPT_DEFLATE;
728 break;
729 case STR4_INT('g','z','i','p')((uint32_t)(('g') | ('z') << 8 | ('i') << 16 | ('p'
) << 24)):
730 case STR4_INT(' ','g','z','i')((uint32_t)((' ') | ('g') << 8 | ('z') << 16 | ('i'
) << 24)):
731 request->flags |= REQUEST_ACCEPT_GZIP;
732 break;
733#if defined(LWAN_HAVE_ZSTD)
734 case STR4_INT('z','s','t','d')((uint32_t)(('z') | ('s') << 8 | ('t') << 16 | ('d'
) << 24)):
735 case STR4_INT(' ','z','s','t')((uint32_t)((' ') | ('z') << 8 | ('s') << 16 | ('t'
) << 24)):
736 request->flags |= REQUEST_ACCEPT_ZSTD;
737 break;
738#endif
739#if defined(LWAN_HAVE_BROTLI)
740 default:
741 while (lwan_char_isspace(*p))
742 p++;
743
744 STRING_SWITCH_SMALL(p)switch (string_as_uint16(p)) {
745 case STR2_INT('b', 'r')((uint16_t)(('b') | ('r') << 8)):
746 request->flags |= REQUEST_ACCEPT_BROTLI;
747 break;
748 }
749#endif
750 }
751
752 if (!(p = strchr(p, ',')))
753 break;
754 }
755}
756
757static ALWAYS_INLINEinline __attribute__((always_inline)) char *
758ignore_leading_whitespace(char *buffer)
759{
760 while (lwan_char_isspace(*buffer))
761 buffer++;
762 return buffer;
763}
764
765static ALWAYS_INLINEinline __attribute__((always_inline)) void parse_connection_header(struct lwan_request *request)
766{
767 struct lwan_request_parser_helper *helper = request->helper;
768 bool_Bool has_keep_alive = false0;
769 bool_Bool has_close = false0;
770
771 if (!helper->connection.len)
772 goto out;
773
774 for (const char *p = helper->connection.value; *p; p++) {
775 STRING_SWITCH_L(p)switch (((string_as_uint32(p)) | (uint32_t)0x20202020)) {
776 case STR4_INT_L('k','e','e','p')((((uint32_t)(('k') | ('e') << 8 | ('e') << 16 | (
'p') << 24))) | (uint32_t)0x20202020):
777 case STR4_INT_L(' ', 'k','e','e')((((uint32_t)((' ') | ('k') << 8 | ('e') << 16 | (
'e') << 24))) | (uint32_t)0x20202020):
778 has_keep_alive = true1;
779 break;
780 case STR4_INT_L('c','l','o','s')((((uint32_t)(('c') | ('l') << 8 | ('o') << 16 | (
's') << 24))) | (uint32_t)0x20202020):
781 case STR4_INT_L(' ', 'c','l','o')((((uint32_t)((' ') | ('c') << 8 | ('l') << 16 | (
'o') << 24))) | (uint32_t)0x20202020):
782 has_close = true1;
783 break;
784 case STR4_INT_L('u','p','g','r')((((uint32_t)(('u') | ('p') << 8 | ('g') << 16 | (
'r') << 24))) | (uint32_t)0x20202020):
785 case STR4_INT_L(' ', 'u','p','g')((((uint32_t)((' ') | ('u') << 8 | ('p') << 16 | (
'g') << 24))) | (uint32_t)0x20202020):
786 request->conn->flags |= CONN_IS_UPGRADE;
787 break;
788 }
789
790 if (!(p = strchr(p, ',')))
791 break;
792 }
793
794out:
795 if (LIKELY(!(request->flags & REQUEST_IS_HTTP_1_0))__builtin_expect((!!(!(request->flags & REQUEST_IS_HTTP_1_0
))), (1)))
796 has_keep_alive = !has_close;
797
798 if (has_keep_alive) {
799 request->conn->flags |= CONN_IS_KEEP_ALIVE;
800 } else {
801 request->conn->flags &=
802 ~(CONN_IS_KEEP_ALIVE | CONN_SENT_CONNECTION_HEADER);
803 }
804}
805
806#if defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)
807static void save_to_corpus_for_fuzzing(struct lwan_value buffer)
808{
809 struct lwan_value buffer_copy;
810 char corpus_name[PATH_MAX4096];
811 const char *crlfcrlf;
812 int fd;
813
814 if (!(crlfcrlf = memmem(buffer.value, buffer.len, "\r\n\r\n", 4)))
815 return;
816 buffer.len = (size_t)(crlfcrlf - buffer.value + 4);
817
818try_another_file_name:
819 buffer_copy = buffer;
820
821 snprintf(corpus_name, sizeof(corpus_name), "corpus-request-%d", rand());
822
823 fd = open(corpus_name, O_WRONLY01 | O_CLOEXEC02000000 | O_CREAT0100 | O_EXCL0200, 0644);
824 if (fd < 0)
825 goto try_another_file_name;
826
827 while (buffer_copy.len) {
828 ssize_t r = write(fd, buffer_copy.value, buffer_copy.len);
829
830 if (r < 0) {
831 if (errno(*__errno_location ()) == EAGAIN11 || errno(*__errno_location ()) == EINTR4)
832 continue;
833
834 close(fd);
835 unlink(corpus_name);
836 goto try_another_file_name;
837 }
838
839 buffer_copy.value += r;
840 buffer_copy.len -= r;
841 }
842
843 close(fd);
844 lwan_status_debug("Request saved to %s", corpus_name)lwan_status_debug_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 844, __FUNCTION__, "Request saved to %s", corpus_name);
845}
846#endif
847
848static enum lwan_http_status
849client_read(struct lwan_request *request,
850 struct lwan_value *buffer,
851 const size_t want_to_read,
852 enum lwan_read_finalizer (*finalizer)(const struct lwan_value *buffer,
853 size_t want_to_read,
854 const struct lwan_request *request,
855 int n_packets))
856{
857 struct lwan_request_parser_helper *helper = request->helper;
858 int n_packets = 0;
859
860 if (helper->next_request) {
861 const size_t next_request_len = (size_t)(helper->next_request - buffer->value);
862 size_t new_len;
863
864 if (__builtin_sub_overflow(buffer->len, next_request_len, &new_len)) {
865 helper->next_request = NULL((void*)0);
866 } else if (new_len) {
867 /* FIXME: This memmove() could be eventually removed if a better
868 * stucture (maybe a ringbuffer, reading with readv(), and each
869 * pointer is coro_strdup() if they wrap around?) were used for
870 * the request buffer. */
871 buffer->len = new_len;
872 memmove(buffer->value, helper->next_request, new_len);
873 goto try_to_finalize;
874 }
875 }
876
877 for (buffer->len = 0;; n_packets++) {
878 size_t to_read = (size_t)(want_to_read - buffer->len);
879
880 if (UNLIKELY(to_read == 0)__builtin_expect(((to_read == 0)), (0)))
881 return HTTP_TOO_LARGE;
882
883 ssize_t n = recv(request->fd, buffer->value + buffer->len, to_read, 0);
884 if (UNLIKELY(n <= 0)__builtin_expect(((n <= 0)), (0))) {
885 if (n < 0) {
886 switch (errno(*__errno_location ())) {
887 case EINTR4:
888 case EAGAIN11:
889yield_and_read_again:
890 coro_yield(request->conn->coro, CONN_CORO_WANT_READ);
891 continue;
892 }
893
894 /* Unexpected error before reading anything */
895 if (UNLIKELY(!buffer->len)__builtin_expect(((!buffer->len)), (0)))
896 return HTTP_BAD_REQUEST;
897 }
898
899 /* Client shut down orderly (n = 0), or unrecoverable error (n < 0);
900 * shut down coro. */
901 break;
902 }
903
904 buffer->len += (size_t)n;
905
906try_to_finalize:
907 switch (finalizer(buffer, want_to_read, request, n_packets)) {
908 case FINALIZER_DONE:
909 buffer->value[buffer->len] = '\0';
910#if defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)
911 save_to_corpus_for_fuzzing(*buffer);
912#endif
913 return HTTP_OK;
914
915 case FINALIZER_TRY_AGAIN:
916 goto yield_and_read_again;
917
918 case FINALIZER_TIMEOUT:
919 return HTTP_TIMEOUT;
920 }
921 }
922
923 coro_yield(request->conn->coro, CONN_CORO_ABORT);
924 __builtin_unreachable();
925 return HTTP_INTERNAL_ERROR;
926}
927
928static enum lwan_read_finalizer
929read_request_finalizer_from_helper(const struct lwan_value *buffer,
930 struct lwan_request_parser_helper *helper,
931 int n_packets,
932 bool_Bool allow_proxy_reqs)
933{
934 static const size_t min_proxied_request_size =
935 MIN_REQUEST_SIZE(sizeof("GET / HTTP/1.1\r\n\r\n") - 1) + sizeof(struct proxy_header_v2);
936
937 if (LIKELY(buffer->len >= MIN_REQUEST_SIZE)__builtin_expect((!!(buffer->len >= (sizeof("GET / HTTP/1.1\r\n\r\n"
) - 1))), (1))) {
938 STRING_SWITCH (buffer->value + buffer->len - 4)switch (string_as_uint32(buffer->value + buffer->len - 4
)) {
939 case STR4_INT('\r', '\n', '\r', '\n')((uint32_t)(('\r') | ('\n') << 8 | ('\r') << 16 |
('\n') << 24)):
940 return FINALIZER_DONE;
941 }
942 }
943
944 char *crlfcrlf = memmem(buffer->value, buffer->len, "\r\n\r\n", 4);
945 if (LIKELY(crlfcrlf)__builtin_expect((!!(crlfcrlf)), (1))) {
946 if (LIKELY(helper->next_request)__builtin_expect((!!(helper->next_request)), (1))) {
947 helper->next_request = NULL((void*)0);
948 return FINALIZER_DONE;
949 }
950
951 const size_t crlfcrlf_to_base = (size_t)(crlfcrlf - buffer->value);
952 if (crlfcrlf_to_base >= MIN_REQUEST_SIZE(sizeof("GET / HTTP/1.1\r\n\r\n") - 1) - 4)
953 return FINALIZER_DONE;
954
955 if (buffer->len > min_proxied_request_size && allow_proxy_reqs) {
956 /* FIXME: Checking for PROXYv2 protocol header here is a layering
957 * violation. */
958 STRING_SWITCH_LARGE (crlfcrlf + 4)switch (string_as_uint64(crlfcrlf + 4)) {
959 case STR8_INT(0x00, 0x0d, 0x0a, 0x51, 0x55, 0x49, 0x54, 0x0a)((uint64_t)((uint32_t)((0x00) | (0x0d) << 8 | (0x0a) <<
16 | (0x51) << 24)) | (uint64_t)((uint32_t)((0x55) | (
0x49) << 8 | (0x54) << 16 | (0x0a) << 24)) <<
32):
960 return FINALIZER_DONE;
961 }
962 }
963 }
964
965 /* Yield a timeout error to avoid clients being intentionally slow and
966 * hogging the server. (Clients can't only connect and do nothing, they
967 * need to send data, otherwise the timeout queue timer will kick in and
968 * close the connection. Limit the number of packets to avoid them sending
969 * just a byte at a time.) See lwan_calculate_n_packets() to see how this is
970 * calculated. */
971 if (UNLIKELY(n_packets > helper->error_when_n_packets)__builtin_expect(((n_packets > helper->error_when_n_packets
)), (0)))
972 return FINALIZER_TIMEOUT;
973
974 return FINALIZER_TRY_AGAIN;
975}
976
977static inline enum lwan_read_finalizer
978read_request_finalizer(const struct lwan_value *buffer,
979 size_t want_to_read __attribute__((unused)),
980 const struct lwan_request *request,
981 int n_packets)
982{
983 return read_request_finalizer_from_helper(
984 buffer, request->helper, n_packets,
985 request->flags & REQUEST_ALLOW_PROXY_REQS);
986}
987
988static ALWAYS_INLINEinline __attribute__((always_inline)) enum lwan_http_status
989read_request(struct lwan_request *request)
990{
991 return client_read(request, request->helper->buffer,
992 DEFAULT_BUFFER_SIZE4096 - 1 /* -1 for NUL byte */,
993 read_request_finalizer);
994}
995
996static enum lwan_read_finalizer
997body_data_finalizer(const struct lwan_value *buffer,
998 size_t want_to_read,
999 const struct lwan_request *request,
1000 int n_packets)
1001{
1002 const struct lwan_request_parser_helper *helper = request->helper;
1003
1004 if (want_to_read == buffer->len)
1005 return FINALIZER_DONE;
1006
1007 /* For POST requests, the body can be larger, and due to small MTUs on
1008 * most ethernet connections, responding with a timeout solely based on
1009 * number of packets doesn't work. Use keepalive timeout instead. */
1010 if (UNLIKELY(time(NULL) > helper->error_when_time)__builtin_expect(((time(((void*)0)) > helper->error_when_time
)), (0)))
1011 return FINALIZER_TIMEOUT;
1012
1013 /* In addition to time, also estimate the number of packets based on an
1014 * usual MTU value and the request body size. */
1015 if (UNLIKELY(n_packets > helper->error_when_n_packets)__builtin_expect(((n_packets > helper->error_when_n_packets
)), (0)))
1016 return FINALIZER_TIMEOUT;
1017
1018 return FINALIZER_TRY_AGAIN;
1019}
1020
1021static const char *is_dir(const char *v)
1022{
1023 struct stat st;
1024
1025 if (!v)
1026 return NULL((void*)0);
1027
1028 if (*v != '/')
1029 return NULL((void*)0);
1030
1031 if (stat(v, &st) < 0)
1032 return NULL((void*)0);
1033
1034 if (!S_ISDIR(st.st_mode)((((st.st_mode)) & 0170000) == (0040000)))
1035 return NULL((void*)0);
1036
1037 if (!(st.st_mode & S_ISVTX01000)) {
1038 lwan_status_warning(lwan_status_warning_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1041, __FUNCTION__, "Using %s as temporary directory, but it doesn't have "
"the sticky bit set.", v)
1039 "Using %s as temporary directory, but it doesn't have "lwan_status_warning_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1041, __FUNCTION__, "Using %s as temporary directory, but it doesn't have "
"the sticky bit set.", v)
1040 "the sticky bit set.",lwan_status_warning_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1041, __FUNCTION__, "Using %s as temporary directory, but it doesn't have "
"the sticky bit set.", v)
1041 v)lwan_status_warning_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1041, __FUNCTION__, "Using %s as temporary directory, but it doesn't have "
"the sticky bit set.", v);
1042 }
1043
1044 return v;
1045}
1046
1047static const char *is_dir_good_for_tmp(const char *v)
1048{
1049 struct statfs sb;
1050
1051 v = is_dir(v);
1052 if (!v)
1053 return NULL((void*)0);
1054
1055 if (!statfs(v, &sb) && sb.f_type == TMPFS_MAGIC0x01021994) {
1056 lwan_status_warning("%s is a tmpfs filesystem, "lwan_status_warning_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1057, __FUNCTION__, "%s is a tmpfs filesystem, " "not considering it"
, v)
1057 "not considering it", v)lwan_status_warning_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1057, __FUNCTION__, "%s is a tmpfs filesystem, " "not considering it"
, v);
1058 return NULL((void*)0);
1059 }
1060
1061 return v;
1062}
1063
1064static const char *temp_dir;
1065static const size_t body_buffer_temp_file_thresh = 1<<20;
1066
1067static const char *
1068get_temp_dir(void)
1069{
1070 const char *tmpdir;
1071
1072 tmpdir = is_dir_good_for_tmp(secure_getenv("TMPDIR"));
1073 if (tmpdir)
1074 return tmpdir;
1075
1076 tmpdir = is_dir_good_for_tmp(secure_getenv("TMP"));
1077 if (tmpdir)
1078 return tmpdir;
1079
1080 tmpdir = is_dir_good_for_tmp(secure_getenv("TEMP"));
1081 if (tmpdir)
1082 return tmpdir;
1083
1084 tmpdir = is_dir_good_for_tmp("/var/tmp");
1085 if (tmpdir)
1086 return tmpdir;
1087
1088 tmpdir = is_dir_good_for_tmp(P_tmpdir"/tmp");
1089 if (tmpdir)
1090 return tmpdir;
1091
1092 lwan_status_warning("Temporary directory could not be determined. POST "lwan_status_warning_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1094, __FUNCTION__, "Temporary directory could not be determined. POST "
"or PUT requests over %zu bytes bytes will fail.", body_buffer_temp_file_thresh
)
1093 "or PUT requests over %zu bytes bytes will fail.",lwan_status_warning_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1094, __FUNCTION__, "Temporary directory could not be determined. POST "
"or PUT requests over %zu bytes bytes will fail.", body_buffer_temp_file_thresh
)
1094 body_buffer_temp_file_thresh)lwan_status_warning_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1094, __FUNCTION__, "Temporary directory could not be determined. POST "
"or PUT requests over %zu bytes bytes will fail.", body_buffer_temp_file_thresh
);
1095 return NULL((void*)0);
1096}
1097
1098__attribute__((constructor)) static void initialize_temp_dir(void)
1099{
1100 temp_dir = get_temp_dir();
1101}
1102
1103static int create_temp_file(void)
1104{
1105 char template[PATH_MAX4096];
1106 mode_t prev_mask;
1107 int ret;
1108
1109 if (UNLIKELY(!temp_dir)__builtin_expect(((!temp_dir)), (0)))
1110 return -ENOENT2;
1111
1112#if defined(O_TMPFILE(020000000 | 0200000))
1113 int fd = open(temp_dir,
1114 O_TMPFILE(020000000 | 0200000) | O_CREAT0100 | O_RDWR02 | O_EXCL0200 | O_CLOEXEC02000000 |
1115 O_NOFOLLOW0400000 | O_NOATIME01000000,
1116 S_IRUSR0400 | S_IWUSR0200);
1117 if (LIKELY(fd >= 0)__builtin_expect((!!(fd >= 0)), (1)))
1118 return fd;
1119#endif
1120
1121 ret = snprintf(template, sizeof(template), "%s/lwanXXXXXX", temp_dir);
1122 if (UNLIKELY(ret < 0 || ret >= (int)sizeof(template))__builtin_expect(((ret < 0 || ret >= (int)sizeof(template
))), (0)))
1123 return -EOVERFLOW75;
1124
1125 prev_mask = umask_for_tmpfile(S_IRUSR | S_IWUSR)({ (void)(0400 | 0200); 0U; });
1126 ret = mkostemp(template, O_CLOEXEC02000000);
1127 umask_for_tmpfile(prev_mask)({ (void)(prev_mask); 0U; });
1128
1129 if (LIKELY(ret >= 0)__builtin_expect((!!(ret >= 0)), (1)))
1130 unlink(template);
1131
1132 return ret;
1133}
1134
1135struct file_backed_buffer {
1136 void *ptr;
1137 size_t size;
1138};
1139
1140static void
1141free_body_buffer(void *data)
1142{
1143 struct file_backed_buffer *buf = data;
1144
1145 munmap(buf->ptr, buf->size);
1146 free(buf);
1147}
1148
1149static void*
1150alloc_body_buffer(struct coro *coro, size_t size, bool_Bool allow_file)
1151{
1152 struct file_backed_buffer *buf;
1153 void *ptr = (void *)MAP_FAILED((void *) -1);
1154 int fd;
1155
1156 if (LIKELY(size < body_buffer_temp_file_thresh)__builtin_expect((!!(size < body_buffer_temp_file_thresh))
, (1))) {
1157 ptr = coro_malloc(coro, size);
1158
1159 if (LIKELY(ptr)__builtin_expect((!!(ptr)), (1)))
1160 return ptr;
1161 }
1162
1163 if (UNLIKELY(!allow_file)__builtin_expect(((!allow_file)), (0)))
1164 return NULL((void*)0);
1165
1166 fd = create_temp_file();
1167 if (UNLIKELY(fd < 0)__builtin_expect(((fd < 0)), (0)))
1168 return NULL((void*)0);
1169
1170 if (UNLIKELY(ftruncate(fd, (off_t)size) < 0)__builtin_expect(((ftruncate(fd, (off_t)size) < 0)), (0))) {
1171 close(fd);
1172 return NULL((void*)0);
1173 }
1174
1175 if (MAP_HUGETLB0x40000) {
1176 ptr = mmap(NULL((void*)0), size, PROT_READ0x1 | PROT_WRITE0x2,
1177 MAP_SHARED0x01 | MAP_HUGETLB0x40000, fd, 0);
1178 }
1179 if (UNLIKELY(ptr == MAP_FAILED)__builtin_expect(((ptr == ((void *) -1))), (0)))
1180 ptr = mmap(NULL((void*)0), size, PROT_READ0x1 | PROT_WRITE0x2, MAP_SHARED0x01, fd, 0);
1181 close(fd);
1182 if (UNLIKELY(ptr == MAP_FAILED)__builtin_expect(((ptr == ((void *) -1))), (0)))
1183 return NULL((void*)0);
1184
1185 buf = coro_malloc_full(coro, sizeof(*buf), free_body_buffer);
1186 if (UNLIKELY(!buf)__builtin_expect(((!buf)), (0))) {
1187 munmap(ptr, size);
1188 return NULL((void*)0);
1189 }
1190
1191 buf->ptr = ptr;
1192 buf->size = size;
1193 return ptr;
1194}
1195
1196static enum lwan_http_status
1197get_remaining_body_data_length(struct lwan_request *request,
1198 const size_t max_size,
1199 size_t *total,
1200 size_t *have)
1201{
1202 struct lwan_request_parser_helper *helper = request->helper;
1203 long long parsed_size;
1204
1205 if (UNLIKELY(!helper->content_length.value)__builtin_expect(((!helper->content_length.value)), (0)))
1206 return HTTP_BAD_REQUEST;
1207
1208 parsed_size = parse_long_long(helper->content_length.value, -1);
1209 if (UNLIKELY(parsed_size < 0)__builtin_expect(((parsed_size < 0)), (0)))
1210 return HTTP_BAD_REQUEST;
1211 if (UNLIKELY((size_t)parsed_size >= max_size)__builtin_expect((((size_t)parsed_size >= max_size)), (0)))
1212 return HTTP_TOO_LARGE;
1213 if (UNLIKELY(!parsed_size)__builtin_expect(((!parsed_size)), (0)))
1214 return HTTP_OK;
1215
1216 *total = (size_t)parsed_size;
1217
1218 if (!helper->next_request) {
1219 *have = 0;
1220 return HTTP_PARTIAL_CONTENT;
1221 }
1222
1223 char *buffer_end = helper->buffer->value + helper->buffer->len;
1224
1225 *have = (size_t)(buffer_end - helper->next_request);
1226
1227 if (*have < *total)
1228 return HTTP_PARTIAL_CONTENT;
1229
1230 helper->body_data.value = helper->next_request;
1231 helper->body_data.len = *total;
1232 helper->next_request += *total;
1233 return HTTP_OK;
1234}
1235
1236static int read_body_data(struct lwan_request *request)
1237{
1238 /* Holy indirection, Batman! */
1239 const struct lwan_config *config = &request->conn->thread->lwan->config;
1240 struct lwan_request_parser_helper *helper = request->helper;
1241 enum lwan_http_status status;
1242 size_t total, have, max_data_size;
1243 bool_Bool allow_temp_file;
1244 char *new_buffer;
1245
1246 switch (lwan_request_get_method(request)) {
1247 case REQUEST_METHOD_POST:
1248 allow_temp_file = config->allow_post_temp_file;
1249 max_data_size = config->max_post_data_size;
1250 break;
1251 case REQUEST_METHOD_PUT:
1252 allow_temp_file = config->allow_put_temp_file;
1253 max_data_size = config->max_put_data_size;
1254 break;
1255 default:
1256 return -HTTP_NOT_ALLOWED;
1257 }
1258
1259 status =
1260 get_remaining_body_data_length(request, max_data_size, &total, &have);
1261 if (status != HTTP_PARTIAL_CONTENT)
1262 return -(int)status;
1263
1264 new_buffer =
1265 alloc_body_buffer(request->conn->coro, total + 1, allow_temp_file);
1266 if (UNLIKELY(!new_buffer)__builtin_expect(((!new_buffer)), (0)))
1267 return -HTTP_INTERNAL_ERROR;
1268
1269 if (!(request->flags & REQUEST_IS_HTTP_1_0)) {
1270 /* §8.2.3 https://www.w3.org/Protocols/rfc2616/rfc2616-sec8.html */
1271 const char *expect = lwan_request_get_header(request, "Expect");
1272
1273 if (expect && strncmp(expect, "100-", 4) == 0) {
1274 static const char continue_header[] = "HTTP/1.1 100 Continue\r\n\r\n";
1275
1276 lwan_send(request, continue_header, sizeof(continue_header) - 1, 0);
1277 }
1278 }
1279
1280 helper->body_data.value = new_buffer;
1281 helper->body_data.len = total;
1282 if (have) {
1283 new_buffer = mempcpy(new_buffer, helper->next_request, have);
1284 total -= have;
1285 }
1286 helper->next_request = NULL((void*)0);
1287
1288 helper->error_when_time = time(NULL((void*)0)) + config->keep_alive_timeout;
1289 helper->error_when_n_packets = lwan_calculate_n_packets(total);
1290
1291 struct lwan_value buffer = {.value = new_buffer, .len = total};
1292 return (int)client_read(request, &buffer, total, body_data_finalizer);
1293}
1294
1295static char *
1296parse_proxy_protocol(struct lwan_request *request, char *buffer)
1297{
1298 STRING_SWITCH(buffer)switch (string_as_uint32(buffer)) {
1299 case STR4_INT('P','R','O','X')((uint32_t)(('P') | ('R') << 8 | ('O') << 16 | ('X'
) << 24)):
1300 return parse_proxy_protocol_v1(request, buffer);
1301 case STR4_INT('\x0D','\x0A','\x0D','\x0A')((uint32_t)(('\x0D') | ('\x0A') << 8 | ('\x0D') <<
16 | ('\x0A') << 24)):
1302 return parse_proxy_protocol_v2(request, buffer);
1303 }
1304
1305 return buffer;
1306}
1307
1308static enum lwan_http_status parse_http_request(struct lwan_request *request)
1309{
1310 struct lwan_request_parser_helper *helper = request->helper;
1311 char *buffer = helper->buffer->value;
1312
1313 if (request->flags & REQUEST_ALLOW_PROXY_REQS) {
1314 /* REQUEST_ALLOW_PROXY_REQS will be cleared in lwan_process_request() */
1315
1316 buffer = parse_proxy_protocol(request, buffer);
1317 if (UNLIKELY(!buffer)__builtin_expect(((!buffer)), (0)))
1318 return HTTP_BAD_REQUEST;
1319 }
1320
1321 buffer = ignore_leading_whitespace(buffer);
1322
1323 if (UNLIKELY(buffer > helper->buffer->value + helper->buffer->len -__builtin_expect(((buffer > helper->buffer->value + helper
->buffer->len - (sizeof("GET / HTTP/1.1\r\n\r\n") - 1))
), (0))
1324 MIN_REQUEST_SIZE)__builtin_expect(((buffer > helper->buffer->value + helper
->buffer->len - (sizeof("GET / HTTP/1.1\r\n\r\n") - 1))
), (0)))
1325 return HTTP_BAD_REQUEST;
1326
1327 char *path = identify_http_method(request, buffer);
1328 if (UNLIKELY(!path)__builtin_expect(((!path)), (0)))
1329 return HTTP_NOT_ALLOWED;
1330
1331 buffer = identify_http_path(request, path);
1332 if (UNLIKELY(!buffer)__builtin_expect(((!buffer)), (0)))
1333 return HTTP_BAD_REQUEST;
1334
1335 if (UNLIKELY(!parse_headers(helper, buffer))__builtin_expect(((!parse_headers(helper, buffer))), (0)))
1336 return HTTP_BAD_REQUEST;
1337
1338 ssize_t decoded_len = url_decode(request->url.value);
1339 if (UNLIKELY(decoded_len < 0)__builtin_expect(((decoded_len < 0)), (0)))
1340 return HTTP_BAD_REQUEST;
1341 request->original_url.len = request->url.len = (size_t)decoded_len;
1342
1343 parse_connection_header(request);
1344
1345 return HTTP_OK;
1346}
1347
1348static enum lwan_http_status
1349prepare_websocket_handshake(struct lwan_request *request, char **encoded)
1350{
1351 static const unsigned char websocket_uuid[] =
1352 "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
1353 unsigned char digest[20];
1354 sha1_context ctx;
1355
1356 if (UNLIKELY(request->flags & RESPONSE_SENT_HEADERS)__builtin_expect(((request->flags & RESPONSE_SENT_HEADERS
)), (0)))
1357 return HTTP_INTERNAL_ERROR;
1358
1359 if (UNLIKELY(!(request->conn->flags & CONN_IS_UPGRADE))__builtin_expect(((!(request->conn->flags & CONN_IS_UPGRADE
))), (0)))
1360 return HTTP_BAD_REQUEST;
1361
1362 const char *upgrade = lwan_request_get_header(request, "Upgrade");
1363 if (UNLIKELY(!upgrade || !streq(upgrade, "websocket"))__builtin_expect(((!upgrade || !streq(upgrade, "websocket")))
, (0)))
1364 return HTTP_BAD_REQUEST;
1365
1366 const char *sec_websocket_key =
1367 lwan_request_get_header(request, "Sec-WebSocket-Key");
1368 if (UNLIKELY(!sec_websocket_key)__builtin_expect(((!sec_websocket_key)), (0)))
1369 return HTTP_BAD_REQUEST;
1370
1371 const size_t sec_websocket_key_len = strlen(sec_websocket_key);
1372 if (base64_encoded_len(16) != sec_websocket_key_len)
1373 return HTTP_BAD_REQUEST;
1374 if (UNLIKELY(!base64_validate((void *)sec_websocket_key, sec_websocket_key_len))__builtin_expect(((!base64_validate((void *)sec_websocket_key
, sec_websocket_key_len))), (0)))
1375 return HTTP_BAD_REQUEST;
1376
1377 sha1_init(&ctx);
1378 sha1_update(&ctx, (void *)sec_websocket_key, sec_websocket_key_len);
1379 sha1_update(&ctx, websocket_uuid, sizeof(websocket_uuid) - 1);
1380 sha1_finalize(&ctx, digest);
1381
1382 *encoded = (char *)base64_encode(digest, sizeof(digest), NULL((void*)0));
1383 return LIKELY(*encoded)__builtin_expect((!!(*encoded)), (1)) ? HTTP_SWITCHING_PROTOCOLS : HTTP_INTERNAL_ERROR;
1384}
1385
1386enum lwan_http_status
1387lwan_request_websocket_upgrade(struct lwan_request *request)
1388{
1389 char header_buf[DEFAULT_HEADERS_SIZE2048];
1390 size_t header_buf_len;
1391 char *encoded;
1392
1393 enum lwan_http_status r = prepare_websocket_handshake(request, &encoded);
1394 if (r != HTTP_SWITCHING_PROTOCOLS)
1395 return r;
1396
1397 request->flags |= RESPONSE_NO_CONTENT_LENGTH;
1398 header_buf_len = lwan_prepare_response_header_full(
1399 request, HTTP_SWITCHING_PROTOCOLS, header_buf, sizeof(header_buf),
1400 (struct lwan_key_value[]){
1401 /* Connection: Upgrade is implicit if conn->flags & CONN_IS_UPGRADE */
1402 {.key = "Sec-WebSocket-Accept", .value = encoded},
1403 {.key = "Upgrade", .value = "websocket"},
1404 {},
1405 });
1406 free(encoded);
1407 if (UNLIKELY(!header_buf_len)__builtin_expect(((!header_buf_len)), (0)))
1408 return HTTP_INTERNAL_ERROR;
1409
1410 request->conn->flags |= CONN_IS_WEBSOCKET;
1411 lwan_send(request, header_buf, header_buf_len, 0);
1412
1413 return HTTP_SWITCHING_PROTOCOLS;
1414}
1415
1416static inline bool_Bool request_has_body(const struct lwan_request *request)
1417{
1418 /* 3rd bit set in method: request method has body. See lwan.h,
1419 * definition of FOR_EACH_REQUEST_METHOD() for more info. */
1420 return lwan_request_get_method(request) & 1 << 3;
1421}
1422
1423static enum lwan_http_status
1424maybe_read_body_data(const struct lwan_url_map *url_map,
1425 struct lwan_request *request)
1426{
1427 int status = 0;
1428
1429 if (url_map->flags & HANDLER_EXPECTS_BODY_DATA) {
1430 status = read_body_data(request);
1431 if (status > 0)
1432 return (enum lwan_http_status)status;
1433 }
1434
1435 /* Instead of trying to read the body here, which will require
1436 * us to allocate and read potentially a lot of bytes, force
1437 * this connection to be closed as soon as we send a "not allowed"
1438 * response. */
1439 request->conn->flags &= ~CONN_IS_KEEP_ALIVE;
1440
1441 if (status < 0) {
1442 status = -status;
1443 return (enum lwan_http_status)status;
1444 }
1445
1446 return HTTP_NOT_ALLOWED;
1447}
1448
1449static enum lwan_http_status prepare_for_response(const struct lwan_url_map *url_map,
1450 struct lwan_request *request)
1451{
1452 request->url.value += url_map->prefix_len;
1453 request->url.len -= url_map->prefix_len;
1454 while (*request->url.value == '/' && request->url.len > 0) {
1455 request->url.value++;
1456 request->url.len--;
1457 }
1458
1459 if (UNLIKELY(url_map->flags & HANDLER_MUST_AUTHORIZE)__builtin_expect(((url_map->flags & HANDLER_MUST_AUTHORIZE
)), (0))) {
1460 if (!lwan_http_authorize_urlmap(request, url_map))
1461 return HTTP_NOT_AUTHORIZED;
1462 }
1463
1464 if (UNLIKELY(request_has_body(request))__builtin_expect(((request_has_body(request))), (0)))
1465 return maybe_read_body_data(url_map, request);
1466
1467 return HTTP_OK;
1468}
1469
1470static bool_Bool handle_rewrite(struct lwan_request *request)
1471{
1472 struct lwan_request_parser_helper *helper = request->helper;
1473
1474 request->flags &= ~RESPONSE_URL_REWRITTEN;
1475
1476 find_query_string(request, request->url.value + request->url.len);
1477
1478 helper->urls_rewritten++;
1479 if (UNLIKELY(helper->urls_rewritten > 4)__builtin_expect(((helper->urls_rewritten > 4)), (0))) {
1480 lwan_default_response(request, HTTP_INTERNAL_ERROR);
1481 return false0;
1482 }
1483
1484 return true1;
1485}
1486
1487const char *lwan_request_get_method_str(const struct lwan_request *request)
1488{
1489#define GENERATE_CASE_STMT(upper, lower, mask, constant, probability) \
1490 case REQUEST_METHOD_##upper: \
1491 return #upper;
1492
1493 switch (lwan_request_get_method(request)) {
1494 FOR_EACH_REQUEST_METHOD(GENERATE_CASE_STMT)GENERATE_CASE_STMT(GET, get, (1 << 0), (((uint32_t)(('G'
) | ('E') << 8 | ('T') << 16 | (' ') << 24)
)), 0.6) GENERATE_CASE_STMT(POST, post, (1 << 3 | 1 <<
1 | 1 << 0), (((uint32_t)(('P') | ('O') << 8 | (
'S') << 16 | ('T') << 24))), 0.2) GENERATE_CASE_STMT
(HEAD, head, (1 << 1), (((uint32_t)(('H') | ('E') <<
8 | ('A') << 16 | ('D') << 24))), 0.2) GENERATE_CASE_STMT
(OPTIONS, options, (1 << 2), (((uint32_t)(('O') | ('P')
<< 8 | ('T') << 16 | ('I') << 24))), 0.1) GENERATE_CASE_STMT
(DELETE, delete, (1 << 1 | 1 << 2), (((uint32_t)(
('D') | ('E') << 8 | ('L') << 16 | ('E') <<
24))), 0.1) GENERATE_CASE_STMT(PUT, put, (1 << 3 | 1 <<
2 | 1 << 0), (((uint32_t)(('P') | ('U') << 8 | (
'T') << 16 | (' ') << 24))), 0.1)
1495 default:
1496 return "UNKNOWN";
1497 }
1498#undef GENERATE_CASE_STMT
1499}
1500
1501#ifndef NDEBUG
1502static void log_request(struct lwan_request *request,
1503 enum lwan_http_status status,
1504 double time_to_read_request,
1505 double time_to_process_request)
1506{
1507 char ip_buffer[INET6_ADDRSTRLEN46];
1508
1509 lwan_status_debug(lwan_status_debug_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1516, __FUNCTION__, "%s [%s] %016lx \"%s %s HTTP/%s\" %d %s (r:%.3fms p:%.3fms)"
, lwan_request_get_remote_address(request, ip_buffer), request
->conn->thread->date.date, lwan_request_get_id(request
), lwan_request_get_method_str(request), request->original_url
.value, request->flags & REQUEST_IS_HTTP_1_0 ? "1.0" :
"1.1", status, request->response.mime_type, time_to_read_request
, time_to_process_request)
5
←
Calling 'lwan_request_get_remote_address'
→
1510 "%s [%s] %016lx \"%s %s HTTP/%s\" %d %s (r:%.3fms p:%.3fms)",lwan_status_debug_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1516, __FUNCTION__, "%s [%s] %016lx \"%s %s HTTP/%s\" %d %s (r:%.3fms p:%.3fms)"
, lwan_request_get_remote_address(request, ip_buffer), request
->conn->thread->date.date, lwan_request_get_id(request
), lwan_request_get_method_str(request), request->original_url
.value, request->flags & REQUEST_IS_HTTP_1_0 ? "1.0" :
"1.1", status, request->response.mime_type, time_to_read_request
, time_to_process_request)
1511 lwan_request_get_remote_address(request, ip_buffer),lwan_status_debug_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1516, __FUNCTION__, "%s [%s] %016lx \"%s %s HTTP/%s\" %d %s (r:%.3fms p:%.3fms)"
, lwan_request_get_remote_address(request, ip_buffer), request
->conn->thread->date.date, lwan_request_get_id(request
), lwan_request_get_method_str(request), request->original_url
.value, request->flags & REQUEST_IS_HTTP_1_0 ? "1.0" :
"1.1", status, request->response.mime_type, time_to_read_request
, time_to_process_request)
1512 request->conn->thread->date.date, lwan_request_get_id(request),lwan_status_debug_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1516, __FUNCTION__, "%s [%s] %016lx \"%s %s HTTP/%s\" %d %s (r:%.3fms p:%.3fms)"
, lwan_request_get_remote_address(request, ip_buffer), request
->conn->thread->date.date, lwan_request_get_id(request
), lwan_request_get_method_str(request), request->original_url
.value, request->flags & REQUEST_IS_HTTP_1_0 ? "1.0" :
"1.1", status, request->response.mime_type, time_to_read_request
, time_to_process_request)
1513 lwan_request_get_method_str(request), request->original_url.value,lwan_status_debug_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1516, __FUNCTION__, "%s [%s] %016lx \"%s %s HTTP/%s\" %d %s (r:%.3fms p:%.3fms)"
, lwan_request_get_remote_address(request, ip_buffer), request
->conn->thread->date.date, lwan_request_get_id(request
), lwan_request_get_method_str(request), request->original_url
.value, request->flags & REQUEST_IS_HTTP_1_0 ? "1.0" :
"1.1", status, request->response.mime_type, time_to_read_request
, time_to_process_request)
1514 request->flags & REQUEST_IS_HTTP_1_0 ? "1.0" : "1.1", status,lwan_status_debug_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1516, __FUNCTION__, "%s [%s] %016lx \"%s %s HTTP/%s\" %d %s (r:%.3fms p:%.3fms)"
, lwan_request_get_remote_address(request, ip_buffer), request
->conn->thread->date.date, lwan_request_get_id(request
), lwan_request_get_method_str(request), request->original_url
.value, request->flags & REQUEST_IS_HTTP_1_0 ? "1.0" :
"1.1", status, request->response.mime_type, time_to_read_request
, time_to_process_request)
1515 request->response.mime_type, time_to_read_request,lwan_status_debug_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1516, __FUNCTION__, "%s [%s] %016lx \"%s %s HTTP/%s\" %d %s (r:%.3fms p:%.3fms)"
, lwan_request_get_remote_address(request, ip_buffer), request
->conn->thread->date.date, lwan_request_get_id(request
), lwan_request_get_method_str(request), request->original_url
.value, request->flags & REQUEST_IS_HTTP_1_0 ? "1.0" :
"1.1", status, request->response.mime_type, time_to_read_request
, time_to_process_request)
1516 time_to_process_request)lwan_status_debug_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1516, __FUNCTION__, "%s [%s] %016lx \"%s %s HTTP/%s\" %d %s (r:%.3fms p:%.3fms)"
, lwan_request_get_remote_address(request, ip_buffer), request
->conn->thread->date.date, lwan_request_get_id(request
), lwan_request_get_method_str(request), request->original_url
.value, request->flags & REQUEST_IS_HTTP_1_0 ? "1.0" :
"1.1", status, request->response.mime_type, time_to_read_request
, time_to_process_request);
1517}
1518#else
1519#define log_request(...)
1520#endif
1521
1522#ifndef NDEBUG
1523static struct timespec current_precise_monotonic_timespec(void)
1524{
1525 struct timespec now;
1526
1527 if (UNLIKELY(clock_gettime(CLOCK_MONOTONIC, &now) < 0)__builtin_expect(((clock_gettime(1, &now) < 0)), (0))) {
1528 lwan_status_perror("clock_gettime")lwan_status_perror_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1528, __FUNCTION__, "clock_gettime");
1529 return (struct timespec){};
1530 }
1531
1532 return now;
1533}
1534
1535static double elapsed_time_ms(const struct timespec then)
1536{
1537 const struct timespec now = current_precise_monotonic_timespec();
1538 struct timespec diff = {
1539 .tv_sec = now.tv_sec - then.tv_sec,
1540 .tv_nsec = now.tv_nsec - then.tv_nsec,
1541 };
1542
1543 if (diff.tv_nsec < 0) {
1544 diff.tv_sec--;
1545 diff.tv_nsec += 1000000000l;
1546 }
1547
1548 return (double)diff.tv_sec / 1000.0 + (double)diff.tv_nsec / 1000000.0;
1549}
1550#endif
1551
1552void lwan_process_request(struct lwan *l, struct lwan_request *request)
1553{
1554 enum lwan_http_status status;
1555 struct lwan_url_map *url_map;
1556
1557#ifndef NDEBUG
1558 struct timespec request_read_begin_time = current_precise_monotonic_timespec();
1559#endif
1560 status = read_request(request);
1561
1562#ifndef NDEBUG
1563 double time_to_read_request = elapsed_time_ms(request_read_begin_time);
1564
1565 struct timespec request_begin_time = current_precise_monotonic_timespec();
1566#endif
1567 if (UNLIKELY(status != HTTP_OK)__builtin_expect(((status != HTTP_OK)), (0))) {
1
Taking false branch
→
1568 /* If read_request() returns any error at this point, it's probably
1569 * better to just send an error response and abort the coroutine and
1570 * let the client handle the error instead: we don't have
1571 * information to even log the request because it has not been
1572 * parsed yet at this stage. Even if there are other requests waiting
1573 * in the pipeline, this seems like the safer thing to do. */
1574 request->conn->flags &= ~CONN_IS_KEEP_ALIVE;
1575 lwan_default_response(request, status);
1576 /* Let process_request_coro() gracefully close the connection. */
1577 return;
1578 }
1579
1580 status = parse_http_request(request);
1581 if (UNLIKELY(status != HTTP_OK)__builtin_expect(((status != HTTP_OK)), (0)))
2
←
Taking true branch
→
1582 goto log_and_return;
3
←
Control jumps to line 1605
→
1583
1584lookup_again:
1585 url_map = lwan_trie_lookup_prefix(&l->url_map_trie, request->url.value);
1586 if (UNLIKELY(!url_map)__builtin_expect(((!url_map)), (0))) {
1587 status = HTTP_NOT_FOUND;
1588 goto log_and_return;
1589 }
1590
1591 status = prepare_for_response(url_map, request);
1592 if (UNLIKELY(status != HTTP_OK)__builtin_expect(((status != HTTP_OK)), (0)))
1593 goto log_and_return;
1594
1595 status = url_map->handler(request, &request->response, url_map->data);
1596 if (UNLIKELY(url_map->flags & HANDLER_CAN_REWRITE_URL)__builtin_expect(((url_map->flags & HANDLER_CAN_REWRITE_URL
)), (0))) {
1597 if (request->flags & RESPONSE_URL_REWRITTEN) {
1598 if (LIKELY(handle_rewrite(request))__builtin_expect((!!(handle_rewrite(request))), (1)))
1599 goto lookup_again;
1600 return;
1601 }
1602 }
1603
1604log_and_return:
1605 lwan_response(request, status);
1606
1607 log_request(request, status, time_to_read_request, elapsed_time_ms(request_begin_time));
4
←
Calling 'log_request'
→
1608}
1609
1610static inline void *
1611value_lookup(const struct lwan_key_value_array *array, const char *key)
1612{
1613 const struct lwan_array *la = (const struct lwan_array *)array;
1614
1615 if (LIKELY(la->elements)__builtin_expect((!!(la->elements)), (1))) {
1616 struct lwan_key_value k = { .key = (char *)key };
1617 struct lwan_key_value *entry;
1618
1619 entry = bsearch(&k, la->base, la->elements, sizeof(k), key_value_compare);
1620 if (LIKELY(entry)__builtin_expect((!!(entry)), (1)))
1621 return entry->value;
1622 }
1623
1624 return NULL((void*)0);
1625}
1626
1627const char *lwan_request_get_query_param(struct lwan_request *request,
1628 const char *key)
1629{
1630 return value_lookup(lwan_request_get_query_params(request), key);
1631}
1632
1633const char *lwan_request_get_post_param(struct lwan_request *request,
1634 const char *key)
1635{
1636 return value_lookup(lwan_request_get_post_params(request), key);
1637}
1638
1639const char *lwan_request_get_cookie(struct lwan_request *request,
1640 const char *key)
1641{
1642 return value_lookup(lwan_request_get_cookies(request), key);
1643}
1644
1645const char *
1646lwan_request_get_header_from_helper(struct lwan_request_parser_helper *helper,
1647 const char *header)
1648{
1649 const size_t header_len = strlen(header);
1650 const size_t header_len_with_separator =
1651 header_len + HEADER_VALUE_SEPARATOR_LEN(sizeof(": ") - 1);
1652
1653 assert(strchr(header, ':') == NULL)((void) sizeof ((strchr(header, ':') == ((void*)0)) ? 1 : 0),
__extension__ ({ if (strchr(header, ':') == ((void*)0)) ; else
__assert_fail ("strchr(header, ':') == NULL", "/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1653, __extension__ __PRETTY_FUNCTION__); }));
1654
1655 for (size_t i = 0; i < helper->n_header_start; i++) {
1656 const char *start = helper->header_start[i];
1657 char *end = helper->header_start[i + 1] - HEADER_TERMINATOR_LEN(sizeof("\r\n") - 1);
1658
1659 if (UNLIKELY((size_t)(end - start) < header_len_with_separator)__builtin_expect((((size_t)(end - start) < header_len_with_separator
)), (0)))
1660 continue;
1661
1662 STRING_SWITCH_SMALL (start + header_len)switch (string_as_uint16(start + header_len)) {
1663 case STR2_INT(':', ' ')((uint16_t)((':') | (' ') << 8)):
1664 if (!strncasecmp(start, header, header_len)) {
1665 *end = '\0';
1666 return start + header_len_with_separator;
1667 }
1668 }
1669 }
1670
1671 return NULL((void*)0);
1672}
1673
1674inline const char *lwan_request_get_header(struct lwan_request *request,
1675 const char *header)
1676{
1677 return lwan_request_get_header_from_helper(request->helper, header);
1678}
1679
1680const char *lwan_request_get_host(struct lwan_request *request)
1681{
1682 const struct lwan_request_parser_helper *helper = request->helper;
1683
1684 return helper->host.len ? helper->host.value : NULL((void*)0);
1685}
1686
1687ALWAYS_INLINEinline __attribute__((always_inline)) int
1688lwan_connection_get_fd(const struct lwan *lwan, const struct lwan_connection *conn)
1689{
1690 return (int)(intptr_t)(conn - lwan->conns);
1691}
1692
1693const char *
1694lwan_request_get_remote_address_and_port(struct lwan_request *request,
1695 char buffer[static INET6_ADDRSTRLEN46],
1696 uint16_t *port)
1697{
1698 struct sockaddr_storage non_proxied_addr = {.ss_family = AF_UNSPEC0};
1699 struct sockaddr_storage *sock_addr;
1700
1701 *port = 0;
1702
1703 if (request->flags & REQUEST_PROXIED) {
7
←
Assuming the condition is false
→
8
←
Taking false branch
→
1704 sock_addr = (struct sockaddr_storage *)&request->proxy->from;
1705
1706 if (UNLIKELY(sock_addr->ss_family == AF_UNSPEC)__builtin_expect(((sock_addr->ss_family == 0)), (0))) {
1707 static const char unspecified[] = "*unspecified*";
1708
1709 static_assert_Static_assert(sizeof(unspecified) <= INET6_ADDRSTRLEN46,
1710 "Enough space for unspecified address family");
1711 return memcpy(buffer, unspecified, sizeof(unspecified));
1712 }
1713 } else {
1714 socklen_t sock_len = sizeof(non_proxied_addr);
1715
1716 sock_addr = &non_proxied_addr;
1717
1718 if (UNLIKELY(getpeername(request->fd, (struct sockaddr *)sock_addr,__builtin_expect(((getpeername(request->fd, (struct sockaddr
*)sock_addr, &sock_len) < 0)), (0))
9
←
Assuming the condition is false
→
10
←
Taking false branch
→
1719 &sock_len) < 0)__builtin_expect(((getpeername(request->fd, (struct sockaddr
*)sock_addr, &sock_len) < 0)), (0))) {
1720 return NULL((void*)0);
1721 }
1722 }
1723
1724 if (sock_addr->ss_family
10.1
Field 'ss_family' is not equal to AF_INET
 == AF_INET2) {
11
←
Taking false branch
→
1725 struct sockaddr_in *sin = (struct sockaddr_in *)sock_addr;
1726 *port = ntohs(sin->sin_port);
1727 return inet_ntop(AF_INET2, &sin->sin_addr, buffer, INET6_ADDRSTRLEN46);
1728 }
1729
1730 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sock_addr;
1731 *port = ntohs(sin6->sin6_port);
12
←
1st function call argument is an uninitialized value
1732 return inet_ntop(AF_INET610, &sin6->sin6_addr, buffer, INET6_ADDRSTRLEN46);
1733}
1734
1735const char *
1736lwan_request_get_remote_address(struct lwan_request *request,
1737 char buffer[static INET6_ADDRSTRLEN46])
1738{
1739 uint16_t port;
1740 return lwan_request_get_remote_address_and_port(request, buffer, &port);
6
←
Calling 'lwan_request_get_remote_address_and_port'
→
1741}
1742
1743static void remove_sleep(void *data1, void *data2)
1744{
1745 static const enum lwan_connection_flags suspended_sleep =
1746 CONN_SUSPENDED | CONN_HAS_REMOVE_SLEEP_DEFER;
1747 struct timeouts *wheel = data1;
1748 struct timeout *timeout = data2;
1749 struct lwan_request *request =
1750 container_of(timeout, struct lwan_request, timeout)((struct lwan_request *) ((char *)(timeout) - __builtin_offsetof
(struct lwan_request, timeout)) + ((typeof(*(timeout)) *)0 !=
(typeof(((struct lwan_request *)0)->timeout) *)0));
1751
1752 if ((request->conn->flags & suspended_sleep) == suspended_sleep)
1753 timeouts_del(wheel, timeout);
1754
1755 request->conn->flags &= ~CONN_HAS_REMOVE_SLEEP_DEFER;
1756}
1757
1758void lwan_request_sleep(struct lwan_request *request, uint64_t ms)
1759{
1760 struct lwan_connection *conn = request->conn;
1761 struct timeouts *wheel = conn->thread->wheel;
1762 struct timespec now;
1763 coro_deferred defer = -1;
1764
1765 /* We need to update the timer wheel right now because
1766 * a request might have requested to sleep a long time
1767 * before it was being serviced -- causing the timeout
1768 * to essentially be a no-op. */
1769 if (UNLIKELY(clock_gettime(monotonic_clock_id, &now) < 0)__builtin_expect(((clock_gettime(monotonic_clock_id, &now
) < 0)), (0)))
1770 lwan_status_critical("Could not get monotonic time")lwan_status_critical_debug("/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1770, __FUNCTION__, "Could not get monotonic time");
1771 timeouts_update(wheel, (timeout_t)(now.tv_sec * 1000 + now.tv_nsec / 1000000));
1772
1773 request->timeout = (struct timeout) {};
1774 timeouts_add(wheel, &request->timeout, ms);
1775
1776 if (!(conn->flags & CONN_HAS_REMOVE_SLEEP_DEFER)) {
1777 defer = coro_defer2(conn->coro, remove_sleep, wheel, &request->timeout);
1778 conn->flags |= CONN_HAS_REMOVE_SLEEP_DEFER;
1779 }
1780
1781 coro_yield(conn->coro, CONN_CORO_SUSPEND);
1782
1783 if (defer > 0)
1784 coro_defer_fire_and_disarm(conn->coro, defer);
1785}
1786
1787ALWAYS_INLINEinline __attribute__((always_inline)) int
1788lwan_request_get_range(struct lwan_request *request, off_t *from, off_t *to)
1789{
1790 struct lwan_request_parser_helper *helper = request->helper;
1791
1792 if (!(request->flags & REQUEST_PARSED_RANGE)) {
1793 parse_range(helper);
1794 request->flags |= REQUEST_PARSED_RANGE;
1795 }
1796
1797 if (LIKELY(helper->range.raw.len)__builtin_expect((!!(helper->range.raw.len)), (1))) {
1798 *from = helper->range.from;
1799 *to = helper->range.to;
1800 return 0;
1801 }
1802
1803 return -ENOENT2;
1804}
1805
1806ALWAYS_INLINEinline __attribute__((always_inline)) int
1807lwan_request_get_if_modified_since(struct lwan_request *request, time_t *value)
1808{
1809 struct lwan_request_parser_helper *helper = request->helper;
1810
1811 if (!(request->flags & REQUEST_PARSED_IF_MODIFIED_SINCE)) {
1812 parse_if_modified_since(helper);
1813 request->flags |= REQUEST_PARSED_IF_MODIFIED_SINCE;
1814 }
1815
1816 if (LIKELY(helper->if_modified_since.raw.len)__builtin_expect((!!(helper->if_modified_since.raw.len)), (
1))) {
1817 *value = helper->if_modified_since.parsed;
1818 return 0;
1819 }
1820
1821 return -ENOENT2;
1822}
1823
1824ALWAYS_INLINEinline __attribute__((always_inline)) const struct lwan_value *
1825lwan_request_get_request_body(struct lwan_request *request)
1826{
1827 return &request->helper->body_data;
1828}
1829
1830ALWAYS_INLINEinline __attribute__((always_inline)) const struct lwan_value *
1831lwan_request_get_content_type(struct lwan_request *request)
1832{
1833 return &request->helper->content_type;
1834}
1835
1836ALWAYS_INLINEinline __attribute__((always_inline)) const struct lwan_key_value_array *
1837lwan_request_get_cookies(struct lwan_request *request)
1838{
1839 if (!(request->flags & REQUEST_PARSED_COOKIES)) {
1840 parse_cookies(request);
1841 request->flags |= REQUEST_PARSED_COOKIES;
1842 }
1843
1844 return &request->helper->cookies;
1845}
1846
1847ALWAYS_INLINEinline __attribute__((always_inline)) const struct lwan_key_value_array *
1848lwan_request_get_query_params(struct lwan_request *request)
1849{
1850 if (!(request->flags & REQUEST_PARSED_QUERY_STRING)) {
1851 parse_query_string(request);
1852 request->flags |= REQUEST_PARSED_QUERY_STRING;
1853 }
1854
1855 return &request->helper->query_params;
1856}
1857
1858ALWAYS_INLINEinline __attribute__((always_inline)) const struct lwan_key_value_array *
1859lwan_request_get_post_params(struct lwan_request *request)
1860{
1861 if (!(request->flags & REQUEST_PARSED_FORM_DATA)) {
1862 parse_form_data(request);
1863 request->flags |= REQUEST_PARSED_FORM_DATA;
1864 }
1865
1866 return &request->helper->post_params;
1867}
1868
1869ALWAYS_INLINEinline __attribute__((always_inline)) enum lwan_request_flags
1870lwan_request_get_accept_encoding(struct lwan_request *request)
1871{
1872 if (!(request->flags & REQUEST_PARSED_ACCEPT_ENCODING)) {
1873 parse_accept_encoding(request);
1874 request->flags |= REQUEST_PARSED_ACCEPT_ENCODING;
1875 }
1876
1877 return request->flags & REQUEST_ACCEPT_MASK;
1878}
1879
1880#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
1881static int useless_coro_for_fuzzing(struct coro *c __attribute__((unused)),
1882 void *data __attribute__((unused)))
1883{
1884 return 0;
1885}
1886
1887static bool_Bool request_seems_complete(struct lwan_request_parser_helper *helper)
1888{
1889 return read_request_finalizer_from_helper(helper->buffer, helper, 1,
1890 false0) == FINALIZER_DONE;
1891}
1892
1893__attribute__((used)) int fuzz_parse_http_request(const uint8_t *data,
1894 size_t length)
1895{
1896 static struct coro_switcher switcher;
1897 static struct coro *coro;
1898 static char *header_start[N_HEADER_START64];
1899 static char data_copy[32767] = {0};
1900
1901 if (length > sizeof(data_copy))
1902 length = sizeof(data_copy);
1903 memcpy(data_copy, data, length);
1904
1905 if (!coro) {
1906 coro = coro_new(&switcher, useless_coro_for_fuzzing, NULL((void*)0));
1907
1908 lwan_job_thread_init();
1909 lwan_http_authorize_init();
1910 }
1911
1912 struct lwan_request_parser_helper helper = {
1913 .buffer = &(struct lwan_value){.value = data_copy, .len = length},
1914 .header_start = header_start,
1915 .error_when_n_packets = 2,
1916 };
1917 struct lwan_connection conn = {.coro = coro};
1918 struct lwan_proxy proxy = {};
1919 struct lwan_request request = {
1920 .helper = &helper,
1921 .conn = &conn,
1922 .flags = REQUEST_ALLOW_PROXY_REQS,
1923 .proxy = &proxy,
1924 };
1925
1926 /* If the finalizer isn't happy with a request, there's no point in
1927 * going any further with parsing it. */
1928 if (!request_seems_complete(&helper))
1929 return 0;
1930
1931 /* client_read() NUL-terminates the string */
1932 data_copy[length - 1] = '\0';
1933
1934 if (parse_http_request(&request) != HTTP_OK)
1935 return 0;
1936
1937 off_t trash1;
1938 time_t trash2;
1939 char *trash3;
1940 size_t gen = coro_deferred_get_generation(coro);
1941
1942 /* Only pointers were set in helper struct; actually parse them here. */
1943 parse_accept_encoding(&request);
1944
1945 /* Requesting these items will force them to be parsed, and also
1946 * exercise the lookup function. */
1947 LWAN_NO_DISCARD(lwan_request_get_header(&request, "Non-Existing-Header"))do { __typeof__(lwan_request_get_header(&request, "Non-Existing-Header"
)) no_discard_ = lwan_request_get_header(&request, "Non-Existing-Header"
); __asm__ __volatile__("" ::"g"(no_discard_) : "memory"); } while
(0);
1948
1949 /* Usually existing short header */
1950 LWAN_NO_DISCARD(lwan_request_get_header(&request, "Host"))do { __typeof__(lwan_request_get_header(&request, "Host")
) no_discard_ = lwan_request_get_header(&request, "Host")
; __asm__ __volatile__("" ::"g"(no_discard_) : "memory"); } while
(0);
1951
1952 LWAN_NO_DISCARD(lwan_request_get_cookie(&request, "Non-Existing-Cookie"))do { __typeof__(lwan_request_get_cookie(&request, "Non-Existing-Cookie"
)) no_discard_ = lwan_request_get_cookie(&request, "Non-Existing-Cookie"
); __asm__ __volatile__("" ::"g"(no_discard_) : "memory"); } while
(0);
1953 /* Set by some tests */
1954 LWAN_NO_DISCARD(lwan_request_get_cookie(&request, "FOO"))do { __typeof__(lwan_request_get_cookie(&request, "FOO"))
no_discard_ = lwan_request_get_cookie(&request, "FOO"); __asm__
__volatile__("" ::"g"(no_discard_) : "memory"); } while (0);
1955
1956 LWAN_NO_DISCARD(do { __typeof__(lwan_request_get_query_param(&request, "Non-Existing-Query-Param"
)) no_discard_ = lwan_request_get_query_param(&request, "Non-Existing-Query-Param"
); __asm__ __volatile__("" ::"g"(no_discard_) : "memory"); } while
(0)
1957 lwan_request_get_query_param(&request, "Non-Existing-Query-Param"))do { __typeof__(lwan_request_get_query_param(&request, "Non-Existing-Query-Param"
)) no_discard_ = lwan_request_get_query_param(&request, "Non-Existing-Query-Param"
); __asm__ __volatile__("" ::"g"(no_discard_) : "memory"); } while
(0);
1958
1959 LWAN_NO_DISCARD(do { __typeof__(lwan_request_get_post_param(&request, "Non-Existing-Post-Param"
)) no_discard_ = lwan_request_get_post_param(&request, "Non-Existing-Post-Param"
); __asm__ __volatile__("" ::"g"(no_discard_) : "memory"); } while
(0)
1960 lwan_request_get_post_param(&request, "Non-Existing-Post-Param"))do { __typeof__(lwan_request_get_post_param(&request, "Non-Existing-Post-Param"
)) no_discard_ = lwan_request_get_post_param(&request, "Non-Existing-Post-Param"
); __asm__ __volatile__("" ::"g"(no_discard_) : "memory"); } while
(0);
1961
1962 lwan_request_get_range(&request, &trash1, &trash1);
1963 LWAN_NO_DISCARD(trash1)do { __typeof__(trash1) no_discard_ = trash1; __asm__ __volatile__
("" ::"g"(no_discard_) : "memory"); } while (0);
1964
1965 lwan_request_get_if_modified_since(&request, &trash2);
1966 LWAN_NO_DISCARD(trash2)do { __typeof__(trash2) no_discard_ = trash2; __asm__ __volatile__
("" ::"g"(no_discard_) : "memory"); } while (0);
1967
1968 enum lwan_http_status handshake =
1969 prepare_websocket_handshake(&request, &trash3);
1970 LWAN_NO_DISCARD(trash3)do { __typeof__(trash3) no_discard_ = trash3; __asm__ __volatile__
("" ::"g"(no_discard_) : "memory"); } while (0);
1971 if (handshake == HTTP_SWITCHING_PROTOCOLS)
1972 free(trash3);
1973
1974 LWAN_NO_DISCARD(lwan_http_authorize(&request, "Fuzzy Realm", "/dev/null"))do { __typeof__(lwan_http_authorize(&request, "Fuzzy Realm"
, "/dev/null")) no_discard_ = lwan_http_authorize(&request
, "Fuzzy Realm", "/dev/null"); __asm__ __volatile__("" ::"g"(
no_discard_) : "memory"); } while (0);
1975
1976 coro_deferred_run(coro, gen);
1977
1978 return 0;
1979}
1980#endif
1981
1982static inline int64_t
1983make_async_yield_value(int fd, enum lwan_connection_coro_yield event)
1984{
1985 return (int64_t)(((uint64_t)fd << 32 | event));
1986}
1987
1988static inline void async_await_fd(struct coro *coro,
1989 int fd,
1990 enum lwan_connection_coro_yield events)
1991{
1992 assert(events >= CONN_CORO_ASYNC_AWAIT_READ &&((void) sizeof ((events >= CONN_CORO_ASYNC_AWAIT_READ &&
events <= CONN_CORO_ASYNC_AWAIT_READ_WRITE) ? 1 : 0), __extension__
({ if (events >= CONN_CORO_ASYNC_AWAIT_READ && events
<= CONN_CORO_ASYNC_AWAIT_READ_WRITE) ; else __assert_fail
("events >= CONN_CORO_ASYNC_AWAIT_READ && events <= CONN_CORO_ASYNC_AWAIT_READ_WRITE"
, "/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1993, __extension__ __PRETTY_FUNCTION__); }))
1993 events <= CONN_CORO_ASYNC_AWAIT_READ_WRITE)((void) sizeof ((events >= CONN_CORO_ASYNC_AWAIT_READ &&
events <= CONN_CORO_ASYNC_AWAIT_READ_WRITE) ? 1 : 0), __extension__
({ if (events >= CONN_CORO_ASYNC_AWAIT_READ && events
<= CONN_CORO_ASYNC_AWAIT_READ_WRITE) ; else __assert_fail
("events >= CONN_CORO_ASYNC_AWAIT_READ && events <= CONN_CORO_ASYNC_AWAIT_READ_WRITE"
, "/home/buildbot/lwan-worker/clang-analyze/build/src/lib/lwan-request.c"
, 1993, __extension__ __PRETTY_FUNCTION__); }));
1994
1995 return (void)coro_yield(coro, make_async_yield_value(fd, events));
1996}
1997
1998void lwan_request_await_read(struct lwan_request *r, int fd)
1999{
2000 return async_await_fd(r->conn->coro, fd, CONN_CORO_ASYNC_AWAIT_READ);
2001}
2002
2003void lwan_request_await_write(struct lwan_request *r, int fd)
2004{
2005 return async_await_fd(r->conn->coro, fd, CONN_CORO_ASYNC_AWAIT_WRITE);
2006}
2007
2008void lwan_request_await_read_write(struct lwan_request *r, int fd)
2009{
2010 return async_await_fd(r->conn->coro, fd, CONN_CORO_ASYNC_AWAIT_READ_WRITE);
2011}
2012
2013ssize_t lwan_request_async_read_flags(
2014 struct lwan_request *request, int fd, void *buf, size_t len, int flags)
2015{
2016 while (true1) {
2017 ssize_t r = recv(fd, buf, len, MSG_DONTWAITMSG_DONTWAIT | MSG_NOSIGNALMSG_NOSIGNAL | flags);
2018
2019 if (r < 0) {
2020 switch (errno(*__errno_location ())) {
2021 case EWOULDBLOCK11:
2022 lwan_request_await_read(request, fd);
2023 /* Fallthrough */
2024 case EINTR4:
2025 continue;
2026 case EPIPE32:
2027 return -errno(*__errno_location ());
2028 }
2029 }
2030
2031 return r;
2032 }
2033}
2034
2035ssize_t lwan_request_async_read(struct lwan_request *request,
2036 int fd,
2037 void *buf,
2038 size_t len)
2039{
2040 return lwan_request_async_read_flags(request, fd, buf, len, 0);
2041}
2042
2043ssize_t lwan_request_async_write(struct lwan_request *request,
2044 int fd,
2045 const void *buf,
2046 size_t len)
2047{
2048 while (true1) {
2049 ssize_t r = send(fd, buf, len, MSG_DONTWAITMSG_DONTWAIT|MSG_NOSIGNALMSG_NOSIGNAL);
2050
2051 if (r < 0) {
2052 switch (errno(*__errno_location ())) {
2053 case EWOULDBLOCK11:
2054 lwan_request_await_write(request, fd);
2055 /* Fallthrough */
2056 case EINTR4:
2057 continue;
2058 case EPIPE32:
2059 return -errno(*__errno_location ());
2060 }
2061 }
2062
2063 return r;
2064 }
2065}
2066
2067ssize_t lwan_request_async_writev(struct lwan_request *request,
2068 int fd,
2069 struct iovec *iov,
2070 int iov_count)
2071{
2072 ssize_t total_written = 0;
2073 int curr_iov = 0;
2074
2075 for (int tries = 10; tries;) {
2076 const int remaining_len = (int)(iov_count - curr_iov);
2077 ssize_t written;
2078
2079 if (remaining_len == 1) {
2080 const struct iovec *vec = &iov[curr_iov];
2081 return lwan_request_async_write(request, fd, vec->iov_base,
2082 vec->iov_len);
2083 }
2084
2085 written = writev(fd, iov + curr_iov, (size_t)remaining_len);
2086 if (UNLIKELY(written < 0)__builtin_expect(((written < 0)), (0))) {
2087 /* FIXME: Consider short writes as another try as well? */
2088 tries--;
2089
2090 switch (errno(*__errno_location ())) {
2091 case EAGAIN11:
2092 case EINTR4:
2093 goto try_again;
2094 default:
2095 goto out;
2096 }
2097 }
2098
2099 total_written += written;
2100
2101 while (curr_iov < iov_count &&
2102 written >= (ssize_t)iov[curr_iov].iov_len) {
2103 written -= (ssize_t)iov[curr_iov].iov_len;
2104 curr_iov++;
2105 }
2106
2107 if (curr_iov == iov_count)
2108 return total_written;
2109
2110 iov[curr_iov].iov_base = (char *)iov[curr_iov].iov_base + written;
2111 iov[curr_iov].iov_len -= (size_t)written;
2112
2113 try_again:
2114 lwan_request_await_write(request, fd);
2115 }
2116
2117out:
2118 coro_yield(request->conn->coro, CONN_CORO_ABORT);
2119 __builtin_unreachable();
2120}
2121
2122void lwan_request_foreach_header_for_cgi(struct lwan_request *request,
2123 void (*cb)(const char *header_name,
2124 size_t header_len,
2125 const char *value,
2126 size_t value_len,
2127 void *user_data),
2128 void *user_data)
2129{
2130 struct lwan_request_parser_helper *helper = request->helper;
2131 char **header_start = helper->header_start;
2132 size_t n_header_start = helper->n_header_start;
2133
2134 for (size_t i = 0; i < n_header_start; i++) {
2135 const char *header = header_start[i];
2136 const char *next_header = header_start[i + 1];
2137 const char *colon = memchr(header, ':', 127 - sizeof("HTTP_: ") - 1);
2138 char header_name[128];
2139 int r;
2140
2141 if (!colon)
2142 continue;
2143
2144 const size_t header_len = (size_t)(colon - header);
2145 const size_t value_len = (size_t)(next_header - colon - 4);
2146
2147 r = snprintf(header_name, sizeof(header_name), "HTTP_%.*s",
2148 (int)header_len, header);
2149 if (r < 0 || r >= (int)sizeof(header_name))
2150 continue;
2151
2152 /* FIXME: RFC7230/RFC3875 compliance */
2153 for (char *p = header_name; *p; p++) {
2154 if (isalpha(*p)((*__ctype_b_loc ())[(int) ((*p))] & (unsigned short int)
_ISalpha))
2155 *p &= ~0x20;
2156 else if (!isdigit(*p)((*__ctype_b_loc ())[(int) ((*p))] & (unsigned short int)
_ISdigit))
2157 *p = '_';
2158 }
2159
2160 if (streq(header_name, "HTTP_PROXY")) {
2161 /* Mitigation for https://httpoxy.org */
2162 continue;
2163 }
2164
2165 cb(header_name, header_len + sizeof("HTTP_") - 1, colon + 2, value_len,
2166 user_data);
2167 }
2168}