#include <XrdHttpProtocol.hh>

Inheritance diagram for XrdHttpProtocol:

Collaboration diagram for XrdHttpProtocol:

Classes
struct	StaticPreloadInfo

Public Member Functions
	XrdHttpProtocol (bool imhttps)

	XrdHttpProtocol (const XrdHttpProtocol &)=default
	Ctor, dtors and copy ctor.

	~XrdHttpProtocol ()

int	doChksum (const XrdOucString &fname)
	Perform a checksum request.

void	DoIt ()
	Override from the base class.

int	doStat (char *fname)
	Perform a Stat request.

bool	isHTTPS ()
	called via https

XrdProtocol *	Match (XrdLink *lp)
	Tells if the oustanding bytes on the socket match this protocol implementation.

XrdHttpProtocol	operator= (const XrdHttpProtocol &rhs)

int	Process (XrdLink *lp)
	Process data incoming from the socket.

void	Recycle (XrdLink lp, int consec, const char reason)
	Recycle this instance.

int	Stats (char *buff, int blen, int do_sync=0)
	Get activity stats.

Public Member Functions inherited from XrdProtocol
	XrdProtocol (const char *jname)

virtual	~XrdProtocol ()

Public Member Functions inherited from XrdJob
	XrdJob (const char *desc="")

virtual	~XrdJob ()

Static Public Member Functions
static int	Configure (char parms, XrdProtocol_Config pi)
	Read and apply the configuration.

static int	parseHeader2CGI (XrdOucStream &Config, XrdSysError &err, std::map< std::string, std::string > &header2cgi)
	Use this function to parse header2cgi configurations.

Public Attributes
XrdObject< XrdHttpProtocol >	ProtLink

XrdSecEntity	SecEntity
	Authentication area.

Public Attributes inherited from XrdJob
const char *	Comment

XrdJob *	NextJob

Static Public Attributes
static XrdHttpChecksumHandler	cksumHandler = XrdHttpChecksumHandler()

static XrdObjectQ< XrdHttpProtocol >	ProtStack

static XrdHttpReadRangeHandler::Configuration	ReadRangeConfig
	configuration for the read range handler

Protected Attributes
char *	Addr_str

XrdXrootd::Bridge *	Bridge
	The Bridge that we use to exercise the xrootd internals.

XrdHttpReq	CurrentReq

XrdLink *	Link
	The link we are bound to.

Static Protected Attributes
static bool	allowMissingCRL = false

static XrdBuffManager *	BPool = 0

static XrdSecService *	CIA = 0

static bool	compatNameGeneration = false

static int	crlRefIntervalSec = XrdTlsContext::DEFAULT_CRL_REF_INT_SEC
	CRL thread refresh interval.

static XrdSysError	eDest = 0

static bool	embeddedstatic = true
	If true, use the embedded css and icons.

static char *	gridmap = 0
	Gridmap file location. The same used by XrdSecGsi.

static int	hailWait = 60000
	Timeout for reading the handshake.

static std::map< std::string, std::string >	hdr2cgimap
	Rules that turn HTTP headers to cgi tokens in the URL, for internal comsumption.

static bool	isdesthttps = false
	True if the redirections must be towards https targets.

static bool	isRequiredGridmap = false

static bool	listdeny = false
	If true, any form of listing is denied.

static char *	listredir = 0
	Url to redirect to in the case a listing is requested.

static BIO_METHOD *	m_bio_method = NULL
	C-style vptr table for our custom BIO objects.

static int	m_bio_type = 0
	Type identifier for our custom BIO objects.

static int	m_maxdelay = -1

static std::unordered_map< std::string, std::vector< std::pair< std::string, std::string > > >	m_staticheader_map
	The static headers to always return; map is from verb to a list of (header, val) pairs.

static std::unordered_map< std::string, std::string >	m_staticheaders

static kXR_int32	myRole = kXR_isManager
	Our role.

static XrdNetPMark *	pmarkHandle = nullptr
	Packet marking handler pointer (assigned from the environment during the Config() call)

static int	Port = 1094
	Our port.

static char *	Port_str = 0
	Our port, as a string.

static int	readWait = 300000
	Timeout for reading data.

static XrdScheduler *	Sched = 0

static char *	secretkey = 0
	The key used to calculate the url hashes.

static bool	selfhttps2http = false
	If client is HTTPS, self-redirect with HTTP+token.

static XrdOucGMap *	servGMap = 0
	The instance of the DN mapper. Created only when a valid path is given.

static char *	sslcadir = 0

static char *	sslcafile = 0

static char *	sslcert = 0
	OpenSSL stuff.

static char *	sslcipherfilter = 0

static char *	sslkey = 0

static int	sslverifydepth = 9
	Depth of verification of a certificate chain.

static XrdOucHash< StaticPreloadInfo > *	staticpreload = 0

static char *	staticredir = 0

static bool	tpcForwardCreds = false
	If set to true, the HTTP TPC transfers will forward the credentials to redirected hosts.

static char *	xrd_cslist = nullptr
	The list of checksums that were configured via the xrd.cksum parameter on the server config file.

static XrdHttpCors *	xrdcors = nullptr

static std::string	xrdcorsLibPath

Friends
class	XrdHttpExtReq

class	XrdHttpReq

Detailed Description

Definition at line 81 of file XrdHttpProtocol.hh.

Class Documentation

◆ XrdHttpProtocol::StaticPreloadInfo

struct XrdHttpProtocol::StaticPreloadInfo

Definition at line 444 of file XrdHttpProtocol.hh.

Collaboration diagram for XrdHttpProtocol::StaticPreloadInfo:

Class Members
char *	data
int	len

Constructor & Destructor Documentation

◆ XrdHttpProtocol() [1/2]

XrdHttpProtocol::XrdHttpProtocol ( const XrdHttpProtocol & )

default

Ctor, dtors and copy ctor.

References XrdHttpProtocol().

Referenced by XrdHttpProtocol(), Match(), and operator=().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ XrdHttpProtocol() [2/2]

XrdHttpProtocol::XrdHttpProtocol ( bool imhttps )

Definition at line 204 of file XrdHttpProtocol.cc.

: XrdProtocol("HTTP protocol handler"), ProtLink(this),
SecEntity(""), CurrentReq(this, ReadRangeConfig) {
  myBuff = 0;
  Addr_str = 0;
  Reset();
  ishttps = imhttps;
 
}

References XrdProtocol::XrdProtocol(), Addr_str, CurrentReq, ProtLink, ReadRangeConfig, and SecEntity.

Here is the call graph for this function:

◆ ~XrdHttpProtocol()

XrdHttpProtocol::~XrdHttpProtocol ( )

inline

Definition at line 125 of file XrdHttpProtocol.hh.

                     {
    Cleanup();
  }

Member Function Documentation

◆ Configure()

int XrdHttpProtocol::Configure	(	char *	parms,
		XrdProtocol_Config *	pi )

static

Read and apply the configuration.

Definition at line 1758 of file XrdHttpProtocol.cc.

                                                                   {
  /*
    Function: Establish configuration at load time.
 
    Input:    None.
 
    Output:   0 upon success or !0 otherwise.
   */
 
  char *rdf;
 
  // Copy out the special info we want to use at top level
  //
  eDest.logger(pi->eDest->logger());
  XrdHttpTrace.SetLogger(pi->eDest->logger());
  //  SI = new XrdXrootdStats(pi->Stats);
  Sched = pi->Sched;
  BPool = pi->BPool;
  xrd_cslist = getenv("XRD_CSLIST");
 
  Port = pi->Port;
 
  // Copy out the current TLS context
  //
  xrdctx = pi->tlsCtx;
 
  {
    char buf[16];
    sprintf(buf, "%d", Port);
    Port_str = strdup(buf);
  }
 
  // Now process and configuration parameters
  //
  rdf = (parms && *parms ? parms : pi->ConfigFN);
  if (rdf && Config(rdf, pi->theEnv)) return 0;
  if (pi->DebugON) XrdHttpTrace.What = TRACE_ALL;
 
  // Set the redirect flag if we are a pure redirector
  myRole = kXR_isServer;
  if ((rdf = getenv("XRDROLE"))) {
      eDest.Emsg("Config", "XRDROLE: ", rdf);
 
      if (!strcasecmp(rdf, "manager") || !strcasecmp(rdf, "supervisor")) {
        myRole = kXR_isManager;
        eDest.Emsg("Config", "Configured as HTTP(s) redirector.");
      } else {
 
        eDest.Emsg("Config", "Configured as HTTP(s) data server.");
      }
 
  } else {
    eDest.Emsg("Config", "No XRDROLE specified.");
  }
 
  // Schedule protocol object cleanup
  //
  ProtStack.Set(pi->Sched, &XrdHttpTrace,
                (XrdHttpTrace.What & TRACE_MEM ? TRACE_MEM : 0));
  ProtStack.Set((pi->ConnMax / 3 ? pi->ConnMax / 3 : 30), 60 * 60);
 
  // Return success
  //
 
  return 1;
}

References BPool, XrdProtocol_Config::BPool, XrdProtocol_Config::ConfigFN, XrdProtocol_Config::ConnMax, XrdProtocol_Config::DebugON, eDest, XrdProtocol_Config::eDest, kXR_isManager, kXR_isServer, XrdSysError::logger(), myRole, Port, XrdProtocol_Config::Port, Port_str, ProtStack, Sched, XrdProtocol_Config::Sched, XrdProtocol_Config::theEnv, XrdProtocol_Config::tlsCtx, TRACE_ALL, TRACE_MEM, xrd_cslist, XrdHttpProtoInfo::xrdctx, and XrdHttpTrace.

Referenced by XrdgetProtocol().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ doChksum()

int XrdHttpProtocol::doChksum ( const XrdOucString & fname )

Perform a checksum request.

Definition at line 3134 of file XrdHttpProtocol.cc.

                                                       {
  size_t length;
  memset(&CurrentReq.xrdreq, 0, sizeof (ClientRequest));
  CurrentReq.xrdreq.query.requestid = htons(kXR_query);
  CurrentReq.xrdreq.query.infotype = htons(kXR_Qcksum);
  memset(CurrentReq.xrdreq.query.reserved1, '\0', sizeof(CurrentReq.xrdreq.query.reserved1));
  memset(CurrentReq.xrdreq.query.fhandle, '\0', sizeof(CurrentReq.xrdreq.query.fhandle));
  memset(CurrentReq.xrdreq.query.reserved2, '\0', sizeof(CurrentReq.xrdreq.query.reserved2));
  length = fname.length() + 1;
  CurrentReq.xrdreq.query.dlen = htonl(length);
 
  if (!Bridge) return -1;
 
  return Bridge->Run(reinterpret_cast<char *>(&CurrentReq.xrdreq), const_cast<char *>(fname.c_str()), length) ? 0 : -1;
}

References Bridge, XrdOucString::c_str(), CurrentReq, kXR_Qcksum, kXR_query, and XrdOucString::length().

Here is the call graph for this function:

◆ DoIt()

void XrdHttpProtocol::DoIt ( )

inlinevirtual

Override from the base class.

Implements XrdJob.

Definition at line 92 of file XrdHttpProtocol.hh.

              {
    if (Resume) (*this.*Resume)();
  }

◆ doStat()

int XrdHttpProtocol::doStat ( char * fname )

Perform a Stat request.

Definition at line 3106 of file XrdHttpProtocol.cc.

                                       {
  int l;
  bool b;
  CurrentReq.filesize = 0;
  CurrentReq.fileflags = 0;
  CurrentReq.filemodtime = 0;
 
  memset(&CurrentReq.xrdreq, 0, sizeof (ClientRequest));
  CurrentReq.xrdreq.stat.requestid = htons(kXR_stat);
  memset(CurrentReq.xrdreq.stat.reserved, 0,
          sizeof (CurrentReq.xrdreq.stat.reserved));
  l = strlen(fname) + 1;
  CurrentReq.xrdreq.stat.dlen = htonl(l);
 
  if (!Bridge) return -1;
  b = Bridge->Run((char *) &CurrentReq.xrdreq, fname, l);
  if (!b) {
    return -1;
  }
 
 
  return 0;
}

References Bridge, CurrentReq, and kXR_stat.

◆ isHTTPS()

bool XrdHttpProtocol::isHTTPS ( )

inline

called via https

Definition at line 143 of file XrdHttpProtocol.hh.

143{ return ishttps; }

◆ Match()

XrdProtocol * XrdHttpProtocol::Match ( XrdLink * lp )

virtual

Tells if the oustanding bytes on the socket match this protocol implementation.

Implements XrdProtocol.

Definition at line 230 of file XrdHttpProtocol.cc.

                                               {
  char mybuf[16], mybuf2[1024];
  XrdHttpProtocol *hp;
  int dlen;
  bool myishttps = false;
 
  // Peek at the first 20 bytes of data
  //
  if ((dlen = lp->Peek(mybuf, (int) sizeof (mybuf), hailWait)) < (int) sizeof (mybuf)) {
    if (dlen <= 0) lp->setEtext("handshake not received");
    return (XrdProtocol *) 0;
  }
  mybuf[dlen - 1] = '\0';
 
  // Trace the data
  //
 
  TRACEI(DEBUG, "received dlen: " << dlen);
  //TRACEI(REQ, "received buf: " << mybuf);
  mybuf2[0] = '\0';
  for (int i = 0; i < dlen; i++) {
    char mybuf3[16];
    sprintf(mybuf3, "%.02d ", mybuf[i]);
    strcat(mybuf2, mybuf3);
 
  }
  TRACEI(DEBUG, "received dump: " << mybuf2);
 
  // Decide if it looks http or not. For now we are happy if all the received characters are alphanumeric
  bool ismine = true;
  for (int i = 0; i < dlen - 1; i++)
    if (!isprint(mybuf[i]) && (mybuf[i] != '\r') && (mybuf[i] != '\n')) {
      ismine = false;
      TRACEI(DEBUG, "This does not look like http at pos " << i);
      break;
    }
 
  // If it does not look http then look if it looks like https
  if ((!ismine) && (dlen >= 4)) {
    char check[4] = {00, 00, 00, 00};
    if (memcmp(mybuf, check, 4)) {
 
      if (httpsmode) {
        ismine = true;
        myishttps = true;
        TRACEI(DEBUG, "This may look like https");
      } else {
        TRACEI(ALL, "This may look like https, but https is not configured");
      }
 
    }
  }
 
  if (!ismine) {
    TRACEI(DEBUG, "This does not look like https. Protocol not matched.");
    return (XrdProtocol *) 0;
  }
 
  // It does look http or https...
  // Get a protocol object off the stack (if none, allocate a new one)
  //
 
  TRACEI(REQ, "Protocol matched. https: " << myishttps);
  if (!(hp = ProtStack.Pop())) hp = new XrdHttpProtocol(myishttps);
  else
    hp->ishttps = myishttps;
 
  // We now have to do some work arounds to tell the underlying framework
  // that is is https without invoking TLS on the actual link. Eventually,
  // we should just use the link's TLS native implementation.
  //
  hp->SecEntity.addrInfo = lp->AddrInfo();
  XrdNetAddr *netP = const_cast<XrdNetAddr*>(lp->NetAddr());
  netP->SetDialect("https");
  netP->SetTLS(true);
 
  // Allocate 1MB buffer from pool
  if (!hp->myBuff) {
    hp->myBuff = BPool->Obtain(1024 * 1024);
  }
  hp->myBuffStart = hp->myBuffEnd = hp->myBuff->buff;
 
  // Bind the protocol to the link and return the protocol
  //
  hp->Link = lp;
  return (XrdProtocol *) hp;
}

References XrdHttpProtocol(), XrdProtocol::XrdProtocol(), XrdLink::AddrInfo(), XrdSecEntity::addrInfo, BPool, XrdBuffer::buff, DEBUG, hailWait, XrdHttpProtoInfo::httpsmode, Link, XrdLink::NetAddr(), XrdLink::Peek(), ProtStack, SecEntity, XrdNetAddr::SetDialect(), XrdLink::setEtext(), XrdNetAddr::SetTLS(), and TRACEI.

Here is the call graph for this function:

◆ operator=()

XrdHttpProtocol XrdHttpProtocol::operator= ( const XrdHttpProtocol & rhs )

Definition at line 219 of file XrdHttpProtocol.cc.

                                                                      {
 
  return *this;
}

References XrdHttpProtocol().

Here is the call graph for this function:

◆ parseHeader2CGI()

int XrdHttpProtocol::parseHeader2CGI	(	XrdOucStream &	Config,
		XrdSysError &	err,
		std::map< std::string, std::string > &	header2cgi )

static

Use this function to parse header2cgi configurations.

Definition at line 1828 of file XrdHttpProtocol.cc.

                                                                                                                     {
  char *val, keybuf[1024], parmbuf[1024];
  char *parm;
 
  // Get the header key
  val = Config.GetWord();
  if (!val || !val[0]) {
    err.Emsg("Config", "No headerkey specified.");
    return 1;
  } else {
 
    // Trim the beginning, in place
    while ( *val && !isalnum(*val) ) val++;
    strcpy(keybuf, val);
 
    // Trim the end, in place
    char *pp;
    pp = keybuf + strlen(keybuf) - 1;
    while ( (pp >= keybuf) && (!isalnum(*pp)) ) {
      *pp = '\0';
      pp--;
    }
 
    parm = Config.GetWord();
 
    // Avoids segfault in case a key is given without value
    if(!parm || !parm[0]) {
      err.Emsg("Config", "No header2cgi value specified. key: '", keybuf, "'");
      return 1;
    }
 
    // Trim the beginning, in place
    while ( *parm && !isalnum(*parm) ) parm++;
    strcpy(parmbuf, parm);
 
    // Trim the end, in place
    pp = parmbuf + strlen(parmbuf) - 1;
    while ( (pp >= parmbuf) && (!isalnum(*pp)) ) {
      *pp = '\0';
      pp--;
    }
 
    // Add this mapping to the map that will be used
    try {
      header2cgi[keybuf] = parmbuf;
    } catch ( ... ) {
      err.Emsg("Config", "Can't insert new header2cgi rule. key: '", keybuf, "'");
      return 1;
    }
 
  }
  return 0;
}

References XrdSysError::Emsg().

Here is the call graph for this function:

◆ Process()

int XrdHttpProtocol::Process ( XrdLink * lp )

virtual

Process data incoming from the socket.

Implements XrdProtocol.

Definition at line 492 of file XrdHttpProtocol.cc.

{
  int rc = 0;
 
  TRACEI(DEBUG, " Process. lp:"<<(void *)lp<<" reqstate: "<<CurrentReq.reqstate);
 
  if (!myBuff || !myBuff->buff || !myBuff->bsize) {
    TRACE(ALL, " Process. No buffer available. Internal error.");
    return -1;
  }
 
 
  if (!SecEntity.host) {
    char *nfo = GetClientIPStr();
    if (nfo) {
      TRACEI(REQ, " Setting host: " << nfo);
      SecEntity.host = nfo;
      strcpy(SecEntity.prot, "http");
    }
  }
 
 
 
  // If https then check independently for the ssl handshake
  if (ishttps && !ssldone) {
 
      if (!ssl) {
          sbio = CreateBIO(Link);
          BIO_set_nbio(sbio, 1);
          ssl = (SSL*)xrdctx->Session();
        }
 
      if (!ssl) {
          TRACEI(DEBUG, " SSL_new returned NULL");
          ERR_print_errors(sslbio_err);
          return -1;
        }
 
      // If a secxtractor has been loaded
      // maybe it wants to add its own initialization bits
      if (secxtractor)
        secxtractor->InitSSL(ssl, sslcadir);
 
      SSL_set_bio(ssl, sbio, sbio);
      //SSL_set_connect_state(ssl);
 
      //SSL_set_fd(ssl, Link->FDnum());
      struct timeval tv;
      tv.tv_sec = 10;
      tv.tv_usec = 0;
      setsockopt(Link->FDnum(), SOL_SOCKET, SO_RCVTIMEO, (struct timeval *)&tv, sizeof(struct timeval));
      setsockopt(Link->FDnum(), SOL_SOCKET, SO_SNDTIMEO, (struct timeval *)&tv, sizeof(struct timeval));
 
      TRACEI(DEBUG, " Entering SSL_accept...");
      int res = SSL_accept(ssl);
      TRACEI(DEBUG, " SSL_accept returned :" << res);
      if ((res == -1) && (SSL_get_error(ssl, res) == SSL_ERROR_WANT_READ)) {
          TRACEI(DEBUG, " SSL_accept wants to read more bytes... err:" << SSL_get_error(ssl, res));
          return 1;
        }
 
      if(res <= 0) {
          ERR_print_errors(sslbio_err);
          if (res < 0) {
 
              SSL_free(ssl);
              ssl = 0;
              return -1;
          }
      }
 
      BIO_set_nbio(sbio, 0);
 
      strcpy(SecEntity.prot, "https");
 
      // Get the voms string and auth information
      if (tlsClientAuth && HandleAuthentication(Link)) {
          SSL_free(ssl);
          ssl = 0;
          return -1;
      }
 
      ssldone = true;
      if (TRACING(TRACE_AUTH)) {
        SecEntity.Display(eDest);
      }
    }
 
 
 
  if (!DoingLogin) {
    // Re-invocations triggered by the bridge have lp==0
    // In this case we keep track of a different request state
    if (lp) {
 
      // This is an invocation that was triggered by a socket event
      // Read all the data that is available, throw it into the buffer
      if ((rc = getDataOneShot(BuffAvailable())) < 0) {
        // Error -> exit
        return -1;
      }
 
      // If we need more bytes, let's wait for another invokation
      if (BuffUsed() < ResumeBytes) return 1;
 
 
    } else
      CurrentReq.reqstate++;
  } else if (!DoneSetInfo && !CurrentReq.userAgent().empty()) { // DoingLogin is true, meaning the login finished.
    std::string mon_info = "monitor info " + CurrentReq.userAgent();
    DoneSetInfo = true;
    if (mon_info.size() >= 1024) {
      TRACEI(ALL, "User agent string too long");
    } else if (!Bridge) {
      TRACEI(ALL, "Internal logic error: Bridge is null after login");
    } else {
      TRACEI(DEBUG, "Setting " << mon_info);
      memset(&CurrentReq.xrdreq, 0, sizeof (ClientRequest));
      CurrentReq.xrdreq.set.requestid = htons(kXR_set);
      CurrentReq.xrdreq.set.modifier = '\0';
      memset(CurrentReq.xrdreq.set.reserved, '\0', sizeof(CurrentReq.xrdreq.set.reserved));
      CurrentReq.xrdreq.set.dlen = htonl(mon_info.size());
      if (!Bridge->Run((char *) &CurrentReq.xrdreq, (char *) mon_info.c_str(), mon_info.size())) {
        SendSimpleResp(500, nullptr, nullptr, "Could not set user agent.", 0, false);
        return -1;
      }
      return 0;
    }
  } else {
    DoingLogin = false;
  }
 
  // Read the next request header, that is, read until a double CRLF is found
 
 
  if (!CurrentReq.headerok) {
 
    // Read as many lines as possible into the buffer. An empty line breaks
    while ((rc = BuffgetLine(tmpline)) > 0) {
      std::string traceLine = tmpline.c_str();
      if (TRACING(TRACE_DEBUG)) {
        traceLine = obfuscateAuth(traceLine);
      }
      TRACE(DEBUG, " rc:" << rc << " got hdr line: " << traceLine);
      if ((rc == 2) && (tmpline.length() > 1) && (tmpline[rc - 1] == '\n')) {
        CurrentReq.headerok = true;
        TRACE(DEBUG, " rc:" << rc << " detected header end.");
        break;
      }
 
 
      if (CurrentReq.request == CurrentReq.rtUnset) {
        TRACE(DEBUG, " Parsing first line: " << traceLine.c_str());
        int result = CurrentReq.parseFirstLine((char *)tmpline.c_str(), tmpline.length());
        if (result < 0) {
          TRACE(DEBUG, " Parsing of first line failed with " << result);
          return -1;
        }
      } else {
        int result = CurrentReq.parseLine((char *) tmpline.c_str(), tmpline.length());
        if(result < 0) {
          TRACE(DEBUG, " Parsing of header line failed with " << result)
          SendSimpleResp(400,NULL,NULL,"Malformed header line. Hint: ensure the line finishes with \"\\r\\n\"", 0, false);
          return -1;
        }
      }
 
 
    }
 
    // Here we have CurrentReq loaded with the header, or its relevant fields
 
    if (!CurrentReq.headerok) {
      TRACEI(REQ, " rc:" << rc << "Header not yet complete.");
      
      // Here a subtle error condition. IF we failed reading a line AND the buffer
      // has a reasonable amount of data available THEN we consider the header
      // as corrupted and shutdown the client
      if ((rc <= 0) && (BuffUsed() >= 16384)) {
        TRACEI(ALL, "Corrupted header detected, or line too long. Disconnecting client.");
        return -1;
      }
        
        
      if (CurrentReq.reqstate > 0)
        CurrentReq.reqstate--;
      // Waiting for more data
      return 1;
    }
 
  }
 
  // If we are in self-redirect mode, then let's do it
  // Do selfredirect only with 'simple' requests, otherwise poor clients may misbehave
  if (ishttps && ssldone && selfhttps2http &&
    ( (CurrentReq.request == XrdHttpReq::rtGET) || (CurrentReq.request == XrdHttpReq::rtPUT) ||
    (CurrentReq.request == XrdHttpReq::rtPROPFIND)) ) {
    char hash[512];
    time_t timenow = time(0);
 
 
    calcHashes(hash, CurrentReq.resource.c_str(), (kXR_int16) CurrentReq.request,
            &SecEntity,
            timenow,
            secretkey);
 
 
 
    if (hash[0]) {
 
      // Workaround... delete the previous opaque information
      if (CurrentReq.opaque) {
        delete CurrentReq.opaque;
        CurrentReq.opaque = 0;
      }
 
      TRACEI(REQ, " rc:" << rc << " self-redirecting to http with security token.");
 
      XrdOucString dest = "Location: http://";
      // Here I should put the IP addr of the server
      
      // We have to recompute it here because we don't know to which
      // interface the client had connected to
      struct sockaddr_storage sa;
      socklen_t sl = sizeof(sa);
      getsockname(this->Link->AddrInfo()->SockFD(), (struct sockaddr*)&sa, &sl); 
      
      // now get it back and print it
      char buf[256];
      bool ok = false;
      
      switch (sa.ss_family) {
        case AF_INET:
          if (inet_ntop(AF_INET, &(((sockaddr_in*)&sa)->sin_addr), buf, INET_ADDRSTRLEN)) {
            if (Addr_str) free(Addr_str);
            Addr_str = strdup(buf);
            ok = true;
          }
          break;
        case AF_INET6:
          if (inet_ntop(AF_INET6, &(((sockaddr_in6*)&sa)->sin6_addr), buf, INET6_ADDRSTRLEN)) {
            if (Addr_str) free(Addr_str);
            Addr_str = (char *)malloc(strlen(buf)+3);
            strcpy(Addr_str, "[");
            strcat(Addr_str, buf);
            strcat(Addr_str, "]");
            ok = true;
          }
          break;
        default:
          TRACEI(REQ, " Can't recognize the address family of the local host.");
      }
      
      if (ok) {
        dest += Addr_str;
        dest += ":";
        dest += Port_str;
        dest += CurrentReq.resource.c_str();
        TRACEI(REQ," rc:"<<rc<<" self-redirecting to http with security token: '"
                   << dest.c_str() << "'");
 
        
        CurrentReq.appendOpaque(dest, &SecEntity, hash, timenow);
        SendSimpleResp(302, NULL, (char *) dest.c_str(), 0, 0, true);
        CurrentReq.reset();
        return -1;
      }
      
      TRACEI(REQ, " rc:" << rc << " Can't perform self-redirection.");
      
    }
    else {
      TRACEI(ALL, " Could not calculate self-redirection hash");
    }
  }
 
  // If this is not https, then extract the signed information from the url
  // and fill the SecEntity structure as if we were using https
  if (!ishttps && !ssldone) {
 
 
    if (CurrentReq.opaque) {
      char * tk = CurrentReq.opaque->Get("xrdhttptk");
      // If there is a hash then we use it as authn info
      if (tk) {
 
        time_t tim = 0;
        char * t = CurrentReq.opaque->Get("xrdhttptime");
        if (t) tim = atoi(t);
        if (!t) {
          TRACEI(REQ, " xrdhttptime not specified. Authentication failed.");
          return -1;
        }
        if (abs(time(0) - tim) > XRHTTP_TK_GRACETIME) {
          TRACEI(REQ, " Token expired. Authentication failed.");
          return -1;
        }
 
        // Fill the Secentity from the fields in the URL:name, vo, host
        char *nfo;
 
        nfo = CurrentReq.opaque->Get("xrdhttpvorg");
        if (nfo) {
          TRACEI(DEBUG, " Setting vorg: " << nfo);
          SecEntity.vorg = strdup(nfo);
          TRACEI(REQ, " Setting vorg: " << SecEntity.vorg);
        }
 
        nfo = CurrentReq.opaque->Get("xrdhttpname");
        if (nfo) {
          TRACEI(DEBUG, " Setting name: " << nfo);
          SecEntity.name = strdup(decode_str(nfo).c_str());
          TRACEI(REQ, " Setting name: " << SecEntity.name);
        }
        
        nfo = CurrentReq.opaque->Get("xrdhttphost");
        if (nfo) {
          TRACEI(DEBUG, " Setting host: " << nfo);
          if (SecEntity.host) free(SecEntity.host);
          SecEntity.host = strdup(decode_str(nfo).c_str());
          TRACEI(REQ, " Setting host: " << SecEntity.host);
        }
        
        nfo = CurrentReq.opaque->Get("xrdhttpdn");
        if (nfo) {
          TRACEI(DEBUG, " Setting dn: " << nfo);
          SecEntity.moninfo = strdup(decode_str(nfo).c_str());
          TRACEI(REQ, " Setting dn: " << SecEntity.moninfo);
        }
 
        nfo = CurrentReq.opaque->Get("xrdhttprole");
        if (nfo) {
          TRACEI(DEBUG, " Setting role: " << nfo);
          SecEntity.role = strdup(decode_str(nfo).c_str());
          TRACEI(REQ, " Setting role: " << SecEntity.role);
        }
 
        nfo = CurrentReq.opaque->Get("xrdhttpgrps");
        if (nfo) {
          TRACEI(DEBUG, " Setting grps: " << nfo);
          SecEntity.grps = strdup(decode_str(nfo).c_str());
          TRACEI(REQ, " Setting grps: " << SecEntity.grps);
        }
        
        nfo = CurrentReq.opaque->Get("xrdhttpendorsements");
        if (nfo) {
          TRACEI(DEBUG, " Setting endorsements: " << nfo);
          SecEntity.endorsements = strdup(decode_str(nfo).c_str());
          TRACEI(REQ, " Setting endorsements: " << SecEntity.endorsements);
        }
        
        nfo = CurrentReq.opaque->Get("xrdhttpcredslen");
        if (nfo) {
          TRACEI(DEBUG, " Setting credslen: " << nfo);
          char *s1 = strdup(decode_str(nfo).c_str());
          if (s1 && s1[0]) {
            SecEntity.credslen = atoi(s1);
            TRACEI(REQ, " Setting credslen: " << SecEntity.credslen);
          }
          if (s1) free(s1);
        }
        
        if (SecEntity.credslen) {
          nfo = CurrentReq.opaque->Get("xrdhttpcreds");
          if (nfo) {
            TRACEI(DEBUG, " Setting creds: " << nfo);
            SecEntity.creds = strdup(decode_str(nfo).c_str());
            TRACEI(REQ, " Setting creds: " << SecEntity.creds);
          }
        }
        
        char hash[512];
 
        calcHashes(hash, CurrentReq.resource.c_str(), (kXR_int16) CurrentReq.request,
                &SecEntity,
                tim,
                secretkey);
 
        if (compareHash(hash, tk)) {
          TRACEI(REQ, "Invalid tk '" << tk << "' != '" << hash << "' (calculated). Authentication failed.");
          SendSimpleResp(400, nullptr, nullptr, "Authentication failed: invalid token", 0, false);
          return -1;
        }
 
      } else {
        // Client is plain http. If we have a secret key then we reject it
        if (secretkey) {
          TRACEI(ALL, " Rejecting plain http with no valid token as we have a secretkey.");
          return -1;
        }
      }
 
    } else {
      // Client is plain http. If we have a secret key then we reject it
      if (secretkey) {
        TRACEI(ALL, " Rejecting plain http with no valid token as we have a secretkey.");
        return -1;
      }
    }
 
    ssldone = true;
  }
 
 
 
  // Now we have everything that is needed to try the login
  // Remember that if there is an exthandler then it has the responsibility
  // for authorization in the paths that it manages
  if (!Bridge && !FindMatchingExtHandler(CurrentReq)) {
    if (SecEntity.name)
      Bridge = XrdXrootd::Bridge::Login(&CurrentReq, Link, &SecEntity, SecEntity.name, ishttps ? "https" : "http");
    else
      Bridge = XrdXrootd::Bridge::Login(&CurrentReq, Link, &SecEntity, "unknown", ishttps ? "https" : "http");
      
    if (!Bridge) {
      TRACEI(REQ, " Authorization failed.");
      return -1;
    }
    if (m_maxdelay > 0) Bridge->SetWait(m_maxdelay, false);
 
    // Let the bridge process the login, and then reinvoke us
    DoingLogin = true;
    return 0;
  }
 
  // Compute and send the response. This may involve further reading from the socket
  rc = CurrentReq.ProcessHTTPReq();
  if (rc < 0)
     CurrentReq.reset();
 
 
 
  TRACEI(REQ, "Process is exiting rc:" << rc);
  return rc;
}

References Addr_str, Bridge, XrdOucString::c_str(), calcHashes(), compareHash(), CurrentReq, DEBUG, decode_str(), eDest, kXR_set, Link, XrdXrootd::Bridge::Login(), m_maxdelay, obfuscateAuth(), Port_str, XrdHttpReq::rtGET, XrdHttpReq::rtPROPFIND, XrdHttpReq::rtPUT, SecEntity, secretkey, selfhttps2http, sslcadir, XrdHttpProtoInfo::tlsClientAuth, TRACE, TRACE_AUTH, TRACE_DEBUG, TRACEI, TRACING, XrdHttpProtoInfo::xrdctx, and XRHTTP_TK_GRACETIME.

Here is the call graph for this function:

◆ Recycle()

void XrdHttpProtocol::Recycle	(	XrdLink *	lp,
		int	consec,
		const char *	reason )

virtual

Recycle this instance.

Implements XrdProtocol.

Definition at line 934 of file XrdHttpProtocol.cc.

                                                                       {
 
  // Release all appendages
  //
 
  Cleanup();
 
 
  // Set fields to starting point (debugging mostly)
  //
  Reset();
 
  // Push ourselves on the stack
  //
  ProtStack.Push(&ProtLink);
}

References ProtLink, and ProtStack.

◆ Stats()

int XrdHttpProtocol::Stats	(	char *	buff,
		int	blen,
		int	do_sync = 0 )

virtual

Get activity stats.

Implements XrdProtocol.

Definition at line 951 of file XrdHttpProtocol.cc.

                                                            {
  // Synchronize statistics if need be
  //
  //  if (do_sync) {
  //
  //    SI->statsMutex.Lock();
  //    SI->readCnt += numReads;
  //    cumReads += numReads;
  //    numReads = 0;
  //    SI->prerCnt += numReadP;
  //    cumReadP += numReadP;
  //    numReadP = 0;
  //    SI->rvecCnt += numReadV;
  //    cumReadV += numReadV;
  //    numReadV = 0;
  //    SI->rsegCnt += numSegsV;
  //    cumSegsV += numSegsV;
  //    numSegsV = 0;
  //    SI->writeCnt += numWrites;
  //    cumWrites += numWrites;
  //    numWrites = 0;
  //    SI->statsMutex.UnLock();
  //  }
  //
  //  // Now return the statistics
  //  //
  //  return SI->Stats(buff, blen, do_sync);
 
  return 0;
}

Friends And Related Symbol Documentation

◆ XrdHttpExtReq

friend class XrdHttpExtReq

friend

Definition at line 84 of file XrdHttpProtocol.hh.

References XrdHttpExtReq.

Referenced by XrdHttpExtReq.

◆ XrdHttpReq

friend class XrdHttpReq

friend

Definition at line 83 of file XrdHttpProtocol.hh.

References XrdHttpReq.

Referenced by XrdHttpReq.

Member Data Documentation

◆ Addr_str

char* XrdHttpProtocol::Addr_str

protected

Our IP address, as a string. Please remember that this may not be unique for a given machine, hence we need to keep it here and recompute ad every new connection.

Definition at line 369 of file XrdHttpProtocol.hh.

Referenced by XrdHttpProtocol(), and Process().

◆ allowMissingCRL

bool XrdHttpProtocol::allowMissingCRL = false

staticprotected

Definition at line 408 of file XrdHttpProtocol.hh.

◆ BPool

XrdBuffManager * XrdHttpProtocol::BPool = 0

staticprotected

Definition at line 360 of file XrdHttpProtocol.hh.

Referenced by Configure(), and Match().

◆ Bridge

XrdXrootd::Bridge* XrdHttpProtocol::Bridge

protected

The Bridge that we use to exercise the xrootd internals.

Definition at line 375 of file XrdHttpProtocol.hh.

Referenced by doChksum(), doStat(), and Process().

◆ CIA

XrdSecService * XrdHttpProtocol::CIA = 0

staticprotected

Definition at line 362 of file XrdHttpProtocol.hh.

◆ cksumHandler

XrdHttpChecksumHandler XrdHttpProtocol::cksumHandler = XrdHttpChecksumHandler()

static

Definition at line 137 of file XrdHttpProtocol.hh.

◆ compatNameGeneration

bool XrdHttpProtocol::compatNameGeneration = false

staticprotected

Definition at line 413 of file XrdHttpProtocol.hh.

◆ crlRefIntervalSec

int XrdHttpProtocol::crlRefIntervalSec = XrdTlsContext::DEFAULT_CRL_REF_INT_SEC

staticprotected

CRL thread refresh interval.

Definition at line 405 of file XrdHttpProtocol.hh.

◆ CurrentReq

XrdHttpReq XrdHttpProtocol::CurrentReq

protected

Area for coordinating request and responses to/from the bridge This also can process HTTP/DAV stuff

Definition at line 380 of file XrdHttpProtocol.hh.

Referenced by XrdHttpProtocol(), doChksum(), doStat(), and Process().

◆ eDest

XrdSysError XrdHttpProtocol::eDest = 0

staticprotected

Definition at line 361 of file XrdHttpProtocol.hh.

Referenced by Configure(), and Process().

◆ embeddedstatic

bool XrdHttpProtocol::embeddedstatic = true

staticprotected

If true, use the embedded css and icons.

Definition at line 434 of file XrdHttpProtocol.hh.

◆ gridmap

char * XrdHttpProtocol::gridmap = 0

staticprotected

Gridmap file location. The same used by XrdSecGsi.

Definition at line 411 of file XrdHttpProtocol.hh.

◆ hailWait

int XrdHttpProtocol::hailWait = 60000

staticprotected

Timeout for reading the handshake.

Definition at line 390 of file XrdHttpProtocol.hh.

Referenced by Match().

◆ hdr2cgimap

std::map< std::string, std::string > XrdHttpProtocol::hdr2cgimap

staticprotected

Rules that turn HTTP headers to cgi tokens in the URL, for internal comsumption.

Definition at line 454 of file XrdHttpProtocol.hh.

◆ isdesthttps

bool XrdHttpProtocol::isdesthttps = false

staticprotected

True if the redirections must be towards https targets.

Definition at line 422 of file XrdHttpProtocol.hh.

◆ isRequiredGridmap

bool XrdHttpProtocol::isRequiredGridmap = false

staticprotected

Definition at line 412 of file XrdHttpProtocol.hh.

◆ Link

XrdLink* XrdHttpProtocol::Link

protected

The link we are bound to.

Definition at line 365 of file XrdHttpProtocol.hh.

Referenced by Match(), and Process().

◆ listdeny

bool XrdHttpProtocol::listdeny = false

staticprotected

If true, any form of listing is denied.

Definition at line 428 of file XrdHttpProtocol.hh.

◆ listredir

char * XrdHttpProtocol::listredir = 0

staticprotected

Url to redirect to in the case a listing is requested.

Definition at line 425 of file XrdHttpProtocol.hh.

◆ m_bio_method

BIO_METHOD * XrdHttpProtocol::m_bio_method = NULL

staticprotected

C-style vptr table for our custom BIO objects.

Definition at line 460 of file XrdHttpProtocol.hh.

◆ m_bio_type

int XrdHttpProtocol::m_bio_type = 0

staticprotected

Type identifier for our custom BIO objects.

Definition at line 457 of file XrdHttpProtocol.hh.

◆ m_maxdelay

int XrdHttpProtocol::m_maxdelay = -1

staticprotected

Definition at line 441 of file XrdHttpProtocol.hh.

Referenced by Process().

◆ m_staticheader_map

decltype(XrdHttpProtocol::m_staticheader_map) XrdHttpProtocol::m_staticheader_map

staticprotected

The static headers to always return; map is from verb to a list of (header, val) pairs.

Definition at line 472 of file XrdHttpProtocol.hh.

◆ m_staticheaders

decltype(XrdHttpProtocol::m_staticheaders) XrdHttpProtocol::m_staticheaders

staticprotected

The static string version of m_staticheader_map. After config parsing is done, this is computed and we won't need to reference m_staticheader_map in the response path.

Definition at line 476 of file XrdHttpProtocol.hh.

◆ myRole

kXR_int32 XrdHttpProtocol::myRole = kXR_isManager

staticprotected

Our role.

Definition at line 451 of file XrdHttpProtocol.hh.

Referenced by Configure().

◆ pmarkHandle

XrdNetPMark * XrdHttpProtocol::pmarkHandle = nullptr

staticprotected

Packet marking handler pointer (assigned from the environment during the Config() call)

Definition at line 466 of file XrdHttpProtocol.hh.

◆ Port

int XrdHttpProtocol::Port = 1094

staticprotected

Our port.

Definition at line 396 of file XrdHttpProtocol.hh.

Referenced by Configure().

◆ Port_str

char * XrdHttpProtocol::Port_str = 0

staticprotected

Our port, as a string.

Definition at line 399 of file XrdHttpProtocol.hh.

Referenced by Configure(), and Process().

◆ ProtLink

XrdObject<XrdHttpProtocol> XrdHttpProtocol::ProtLink

Definition at line 130 of file XrdHttpProtocol.hh.

Referenced by XrdHttpProtocol(), and Recycle().

◆ ProtStack

XrdObjectQ< XrdHttpProtocol > XrdHttpProtocol::ProtStack

static

Definition at line 129 of file XrdHttpProtocol.hh.

Referenced by Configure(), Match(), and Recycle().

◆ ReadRangeConfig

XrdHttpReadRangeHandler::Configuration XrdHttpProtocol::ReadRangeConfig

static

configuration for the read range handler

Definition at line 140 of file XrdHttpProtocol.hh.

Referenced by XrdHttpProtocol().

◆ readWait

int XrdHttpProtocol::readWait = 300000

staticprotected

Timeout for reading data.

Definition at line 393 of file XrdHttpProtocol.hh.

◆ Sched

XrdScheduler * XrdHttpProtocol::Sched = 0

staticprotected

Definition at line 359 of file XrdHttpProtocol.hh.

Referenced by Configure().

◆ SecEntity

XrdSecEntity XrdHttpProtocol::SecEntity

Authentication area.

Definition at line 134 of file XrdHttpProtocol.hh.

Referenced by XrdHttpProtocol(), Match(), and Process().

◆ secretkey

char * XrdHttpProtocol::secretkey = 0

staticprotected

The key used to calculate the url hashes.

Definition at line 416 of file XrdHttpProtocol.hh.

Referenced by Process().

◆ selfhttps2http

bool XrdHttpProtocol::selfhttps2http = false

staticprotected

If client is HTTPS, self-redirect with HTTP+token.

Definition at line 431 of file XrdHttpProtocol.hh.

Referenced by Process().

◆ servGMap

XrdOucGMap * XrdHttpProtocol::servGMap = 0

staticprotected

The instance of the DN mapper. Created only when a valid path is given.

Definition at line 372 of file XrdHttpProtocol.hh.

◆ sslcadir

char * XrdHttpProtocol::sslcadir = 0

staticprotected

Definition at line 402 of file XrdHttpProtocol.hh.

Referenced by Process().

◆ sslcafile

char * XrdHttpProtocol::sslcafile = 0

staticprotected

Definition at line 402 of file XrdHttpProtocol.hh.

◆ sslcert

char * XrdHttpProtocol::sslcert = 0

staticprotected

OpenSSL stuff.

Definition at line 402 of file XrdHttpProtocol.hh.

◆ sslcipherfilter

char * XrdHttpProtocol::sslcipherfilter = 0

staticprotected

Definition at line 402 of file XrdHttpProtocol.hh.

◆ sslkey

char * XrdHttpProtocol::sslkey = 0

staticprotected

Definition at line 402 of file XrdHttpProtocol.hh.

◆ sslverifydepth

int XrdHttpProtocol::sslverifydepth = 9

staticprotected

Depth of verification of a certificate chain.

Definition at line 419 of file XrdHttpProtocol.hh.

◆ staticpreload

XrdOucHash< XrdHttpProtocol::StaticPreloadInfo > * XrdHttpProtocol::staticpreload = 0

staticprotected

Definition at line 448 of file XrdHttpProtocol.hh.

◆ staticredir

char * XrdHttpProtocol::staticredir = 0

staticprotected

Definition at line 437 of file XrdHttpProtocol.hh.

◆ tpcForwardCreds

bool XrdHttpProtocol::tpcForwardCreds = false

staticprotected

If set to true, the HTTP TPC transfers will forward the credentials to redirected hosts.

Definition at line 469 of file XrdHttpProtocol.hh.

◆ xrd_cslist

char * XrdHttpProtocol::xrd_cslist = nullptr

staticprotected

The list of checksums that were configured via the xrd.cksum parameter on the server config file.

Definition at line 463 of file XrdHttpProtocol.hh.

Referenced by Configure().

◆ xrdcors

XrdHttpCors * XrdHttpProtocol::xrdcors = nullptr

staticprotected

Definition at line 384 of file XrdHttpProtocol.hh.

◆ xrdcorsLibPath

std::string XrdHttpProtocol::xrdcorsLibPath

staticprotected

Definition at line 382 of file XrdHttpProtocol.hh.

The documentation for this class was generated from the following files:

Classes

Public Member Functions

Static Public Member Functions

Public Attributes

Static Public Attributes

Protected Attributes

Static Protected Attributes

Friends

Detailed Description

Class Documentation

◆ XrdHttpProtocol::StaticPreloadInfo

Constructor & Destructor Documentation

◆ XrdHttpProtocol() [1/2]

◆ XrdHttpProtocol() [2/2]

◆ ~XrdHttpProtocol()

Member Function Documentation

◆ Configure()

◆ doChksum()

◆ DoIt()

◆ doStat()

◆ isHTTPS()

◆ Match()

◆ operator=()

◆ parseHeader2CGI()

◆ Process()

◆ Recycle()

◆ Stats()

Friends And Related Symbol Documentation

◆ XrdHttpExtReq

◆ XrdHttpReq

Member Data Documentation

◆ Addr_str

◆ allowMissingCRL

◆ BPool

◆ Bridge

◆ CIA

◆ cksumHandler

◆ compatNameGeneration

◆ crlRefIntervalSec

◆ CurrentReq

◆ eDest

◆ embeddedstatic

◆ gridmap

◆ hailWait

◆ hdr2cgimap

◆ isdesthttps

◆ isRequiredGridmap

◆ Link

◆ listdeny

◆ listredir

◆ m_bio_method

◆ m_bio_type

◆ m_maxdelay

◆ m_staticheader_map

◆ m_staticheaders

◆ myRole

◆ pmarkHandle

◆ Port

◆ Port_str

◆ ProtLink

◆ ProtStack

◆ ReadRangeConfig

◆ readWait

◆ Sched

◆ SecEntity

◆ secretkey

◆ selfhttps2http

◆ servGMap

◆ sslcadir

◆ sslcafile

◆ sslcert

◆ sslcipherfilter

◆ sslkey

◆ sslverifydepth

◆ staticpreload

◆ staticredir

◆ tpcForwardCreds

◆ xrd_cslist

◆ xrdcors

◆ xrdcorsLibPath