root/http/request.cc

/*  This file is part of Alue, the multiprotocol Internet discussion daemon

    Copyright © 2009, 2010 Antti-Juhani Kaijanaho

    Alue is free software: you can redistribute it and/or modify it
    under the terms of the GNU General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.

    Alue is distributed in the hope that it will be useful, but
    WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
    General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with Alue.  If not, see <http://www.gnu.org/licenses/>.

 */

#include "bad_request.hh"
#include "request.hh"
#include "session.hh"
#include "unsupported_version.hh"

#include "../logger/logline.hh"
#include "../util.hh"

#include <boost/algorithm/string/case_conv.hpp>
#include <boost/format.hpp>
#include <boost/lexical_cast.hpp>

#include <iostream>

#include "../assert.hh"

namespace
{
        bool is_token_char(char c)
        {
                return  c != '('  && c != ')' && c != '<' && c != '>' &&
                        c != '@'  && c != ',' && c != ';' && c != ':' &&
                        c != '\\' && c != '"' && c != '/' && c != '[' &&
                        c != '?'  && c != '=' && c != '{' && c != '}' &&
                        c != '\t' && c != ' ' &&
                        31 < c && c < 127;
        }
        bool is_wsp(char c) { return c == ' ' || c == '\t'; }
}

namespace http
{
        request::request(std::string str, server::conn_cb cb,
                         boost::asio::ip::address peer)
                : cb(cb), peer(peer), v11(true), close(false)
                , form_data_ready(false)
        {
                typedef bad_request fv;

                size_t lend = str.find("\r\n");

                parse_header(str.substr(lend+2));
                
                size_t sp1 = str.find(' ');
                size_t sp2 = str.find(' ', sp1+1);

                if (sp1 >= lend || sp2 == lend)
                        throw fv("malformed request line");

                method = str.substr(0, sp1);

                if (! (sp1 + 1 == sp2 - 1 && str[sp1+1] == '*'))
                        uri = str.substr(sp1+1, sp2 - sp1-1);

                std::string ver = str.substr(sp2+1, lend-sp2-1);

                boost::to_upper(method);
                boost::to_upper(ver);

                size_t dot = ver.find('.', 5);
                if (ver.length() < 5 || ver.substr(0,5) != "HTTP/" ||
                    dot == std::string::npos)
                        throw fv("malformed HTTP-version %" + ver);

                if (boost::lexical_cast<unsigned>(ver.substr(5, dot-5)) != 1)
                        throw unsupported_version();

                if (boost::lexical_cast<unsigned>(ver.substr(dot+1)) == 0)
                        v11 = false;

                if (v11 && header.find("host") == header.end())
                        throw fv("missing Host header");

                if (uri.get_host().empty())
                {
                        std::string hostport = header["host"];
                        host = util::split1R(hostport, ":");
                        if (hostport.empty())
                                port = -1;
                        else
                                port = boost::lexical_cast<int>(hostport);
                }

                std::string cs = header["connection"];
                while (!cs.empty())
                {
                        std::string token = util::split(cs, ", \t");
                        boost::to_lower(token);
                        if (!v11) header.erase(token);
                        if (v11 && token == "close") close = true;
                }

        }

        void request::parse_form() const
        {
                if (form_data_ready) return;
                std::string ct = get_header("content-type");
                size_t sc = ct.find(';');
                if (sc != std::string::npos) ct.erase(sc);
                if (method != "POST" || ct == "application/x-www-form-urlencoded")
                {
                        std::string bd = method == "POST"
                                ? body
                                : uri.get_query();
                        while (!bd.empty())
                        {
                                std::string entry = util::split1R(bd, "&");
                                for (size_t i = 0; i < entry.length(); i++)
                                        if (entry[i] == '+') entry[i] = ' ';
                                std::string name = util::split1R(entry, "=");
                                name = uri::percent_decode(name);
                                entry = uri::percent_decode(entry);
                                form_data.insert(std::make_pair(name, entry));
                        }
                }
                form_data_ready = true;
        }

        std::string request::get_form_as_query() const
        {
                if (!form_data_ready) parse_form();
                std::string rv;
                for (std::multimap<std::string, std::string>::const_iterator it
                             = form_data.begin();
                     it != form_data.end(); it++)
                {
                        std::string name = uri::percent_encode(it->first);
                        std::string value = uri::percent_encode(it->second);
                        if (!rv.empty()) rv += '&';
                        rv += name;
                        rv += "=";
                        rv += value;
                }
                return rv;
        }

        std::string request::get_header(std::string s) const
        {
                boost::to_lower(s);
                std::map<std::string, std::string>::const_iterator it
                        = header.find(s);
                if (it == header.end()) return "";
                return it->second;
        }

        void request::parse_header(std::string str)
        {
                typedef bad_request fv;

                size_t inx = 0;
                std::string field_name;
                std::string field_body;

        FIELD_NAME:
                if (inx >= str.length())
                        throw fv("request ends in the middle of a header name");
                if (is_token_char(str[inx]))
                {
                        field_name += str[inx];
                        inx++;
                        goto FIELD_NAME;
                }
                if (str[inx] != ':') {
                        throw fv(boost::str(boost::format
                                            ("invalid character (0x%02x) "
                                             "in header field name")
                                            % (unsigned)str[inx]));
                }
                inx++;
                goto FIELD_BODY;

        FIELD_BODY:
                while (inx < str.length() && is_wsp(str[inx])) inx++;
                goto FIELD_BODY_INLINE;

        FIELD_BODY_INLINE:
                if (inx >= str.length())
                        throw fv("header field '" + field_name + "' "
                                 "terminates abruptly");
                if (str[inx] != '\r')
                {
                        field_body += str[inx];
                        inx++;
                        goto FIELD_BODY_INLINE;
                }
                assert(inx  < str.length());
                assert(str[inx] == '\r');
                inx++;
                if (inx >= str.length() || str[inx] != '\n') 
                        throw fv("header field '" + field_name + "' "
                                 "contains a stray CR");
                assert(1 <= inx);
                assert(inx < str.length());
                assert(str[inx-1] == '\r');
                assert(str[inx-0] == '\n');
                inx++;
                if (inx < str.length() && is_wsp(str[inx]))
                {
                        // folded header field
                        goto FIELD_BODY;
                }
                // header field ends
                boost::to_lower(field_name);
                header[field_name] = (header[field_name] != ""
                                      ? header[field_name] + ", "
                                      : "") + field_body;
                if (inx + 1 < str.length() &&
                    str[inx+0] == '\r' && str[inx+1] == '\n')
                {
                        inx += 2;
                        assert(inx == str.length());
                        return;
                }
                field_name.clear();
                field_body.clear();
                goto FIELD_NAME;
        }


        std::string request::get_sessid() const
        {
                std::string cookie = get_header("Cookie");

                std::string sessid;
                while (!cookie.empty())
                {
                        // FIXME too simplistic parsing
                        std::string item = util::split1R(cookie, ";,");
                        std::string name = util::split1L(item, "=");
                        if (name == "ALUE_SESSION") sessid = item;
                }
                if (sessid.empty() || !cb.get_session(sessid)) return "";
                std::string fd_session = get_form_field("alue_sessid");
                if (method != "POST" && !fd_session.empty())
                {
                        logger::logline ll;
                        ll << "expiring session due to exposure";
                        cb.get_session(fd_session).reset();
                }
                if (method == "POST" && fd_session != sessid)
                {
                        logger::logline ll;
                        ll << "POST and sessid not in query data - "
                           << "expiring session";
                        cb.get_session(sessid).reset();
                        return "";
                }
                return sessid;
        }

        boost::shared_ptr<session> &request::get_session() const
        {
                return cb.get_session(get_sessid());
        }

        bool request::is_authenticated() const
        {
                boost::shared_ptr<session> sess = get_session();
                return sess && sess->is_authenticated();
        }

        boost::shared_ptr<db::user> request::get_user() const
        {
                boost::shared_ptr<session> sess = get_session();
                if (!sess || !sess->is_authenticated())
                        return boost::shared_ptr<db::user>();
                return sess->get_user();
        }

}