http.c 154 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462246324642465246624672468246924702471247224732474247524762477247824792480248124822483248424852486248724882489249024912492249324942495249624972498249925002501250225032504250525062507250825092510251125122513251425152516251725182519252025212522252325242525252625272528252925302531253225332534253525362537253825392540254125422543254425452546254725482549255025512552255325542555255625572558255925602561256225632564256525662567256825692570257125722573257425752576257725782579258025812582258325842585258625872588258925902591259225932594259525962597259825992600260126022603260426052606260726082609261026112612261326142615261626172618261926202621262226232624262526262627262826292630263126322633263426352636263726382639264026412642264326442645264626472648264926502651265226532654265526562657265826592660266126622663266426652666266726682669267026712672267326742675267626772678267926802681268226832684268526862687268826892690269126922693269426952696269726982699270027012702270327042705270627072708270927102711271227132714271527162717271827192720272127222723272427252726272727282729273027312732273327342735273627372738273927402741274227432744274527462747274827492750275127522753275427552756275727582759276027612762276327642765276627672768276927702771277227732774277527762777277827792780278127822783278427852786278727882789279027912792279327942795279627972798279928002801280228032804280528062807280828092810281128122813281428152816281728182819282028212822282328242825282628272828282928302831283228332834283528362837283828392840284128422843284428452846284728482849285028512852285328542855285628572858285928602861286228632864286528662867286828692870287128722873287428752876287728782879288028812882288328842885288628872888288928902891289228932894289528962897289828992900290129022903290429052906290729082909291029112912291329142915291629172918291929202921292229232924292529262927292829292930293129322933293429352936293729382939294029412942294329442945294629472948294929502951295229532954295529562957295829592960296129622963296429652966296729682969297029712972297329742975297629772978297929802981298229832984298529862987298829892990299129922993299429952996299729982999300030013002300330043005300630073008300930103011301230133014301530163017301830193020302130223023302430253026302730283029303030313032303330343035303630373038303930403041304230433044304530463047304830493050305130523053305430553056305730583059306030613062306330643065306630673068306930703071307230733074307530763077307830793080308130823083308430853086308730883089309030913092309330943095309630973098309931003101310231033104310531063107310831093110311131123113311431153116311731183119312031213122312331243125312631273128312931303131313231333134313531363137313831393140314131423143314431453146314731483149315031513152315331543155315631573158315931603161316231633164316531663167316831693170317131723173317431753176317731783179318031813182318331843185318631873188318931903191319231933194319531963197319831993200320132023203320432053206320732083209321032113212321332143215321632173218321932203221322232233224322532263227322832293230323132323233323432353236323732383239324032413242324332443245324632473248324932503251325232533254325532563257325832593260326132623263326432653266326732683269327032713272327332743275327632773278327932803281328232833284328532863287328832893290329132923293329432953296329732983299330033013302330333043305330633073308330933103311331233133314331533163317331833193320332133223323332433253326332733283329333033313332333333343335333633373338333933403341334233433344334533463347334833493350335133523353335433553356335733583359336033613362336333643365336633673368336933703371337233733374337533763377337833793380338133823383338433853386338733883389339033913392339333943395339633973398339934003401340234033404340534063407340834093410341134123413341434153416341734183419342034213422342334243425342634273428342934303431343234333434343534363437343834393440344134423443344434453446344734483449345034513452345334543455345634573458345934603461346234633464346534663467346834693470347134723473347434753476347734783479348034813482348334843485348634873488348934903491349234933494349534963497349834993500350135023503350435053506350735083509351035113512351335143515351635173518351935203521352235233524352535263527352835293530353135323533353435353536353735383539354035413542354335443545354635473548354935503551355235533554355535563557355835593560356135623563356435653566356735683569357035713572357335743575357635773578357935803581358235833584358535863587358835893590359135923593359435953596359735983599360036013602360336043605360636073608360936103611361236133614361536163617361836193620362136223623362436253626362736283629363036313632363336343635363636373638363936403641364236433644364536463647364836493650365136523653365436553656365736583659366036613662366336643665366636673668366936703671367236733674367536763677367836793680368136823683368436853686368736883689369036913692369336943695369636973698369937003701370237033704370537063707370837093710371137123713371437153716371737183719372037213722372337243725372637273728372937303731373237333734373537363737373837393740374137423743374437453746374737483749375037513752375337543755375637573758375937603761376237633764376537663767376837693770377137723773377437753776377737783779378037813782378337843785378637873788378937903791379237933794379537963797379837993800380138023803380438053806380738083809381038113812381338143815381638173818381938203821382238233824382538263827382838293830383138323833383438353836383738383839384038413842384338443845384638473848384938503851385238533854385538563857385838593860386138623863386438653866386738683869387038713872387338743875387638773878387938803881388238833884388538863887388838893890389138923893389438953896389738983899390039013902390339043905390639073908390939103911391239133914391539163917391839193920392139223923392439253926392739283929393039313932393339343935393639373938393939403941394239433944394539463947394839493950395139523953395439553956395739583959396039613962396339643965396639673968396939703971397239733974397539763977397839793980398139823983398439853986398739883989399039913992399339943995399639973998399940004001400240034004400540064007400840094010401140124013401440154016401740184019402040214022402340244025402640274028402940304031403240334034403540364037403840394040404140424043404440454046404740484049405040514052405340544055405640574058405940604061406240634064406540664067406840694070407140724073407440754076407740784079408040814082408340844085408640874088408940904091409240934094409540964097409840994100410141024103410441054106410741084109411041114112411341144115411641174118411941204121412241234124412541264127412841294130413141324133413441354136413741384139414041414142414341444145414641474148414941504151415241534154415541564157415841594160416141624163416441654166416741684169417041714172417341744175417641774178417941804181418241834184418541864187418841894190419141924193419441954196419741984199420042014202420342044205420642074208420942104211421242134214421542164217421842194220422142224223422442254226422742284229423042314232423342344235423642374238423942404241424242434244424542464247424842494250425142524253425442554256425742584259426042614262426342644265426642674268426942704271427242734274427542764277427842794280428142824283428442854286428742884289429042914292429342944295429642974298429943004301430243034304430543064307430843094310431143124313431443154316431743184319432043214322432343244325432643274328432943304331433243334334433543364337433843394340434143424343434443454346434743484349435043514352435343544355435643574358435943604361436243634364436543664367436843694370437143724373437443754376437743784379438043814382438343844385438643874388438943904391439243934394439543964397439843994400440144024403440444054406440744084409441044114412441344144415441644174418441944204421442244234424442544264427442844294430443144324433443444354436443744384439444044414442444344444445444644474448444944504451445244534454445544564457445844594460446144624463446444654466446744684469447044714472447344744475447644774478447944804481448244834484448544864487448844894490449144924493449444954496449744984499450045014502450345044505450645074508450945104511451245134514451545164517451845194520452145224523452445254526452745284529453045314532453345344535453645374538453945404541454245434544454545464547454845494550455145524553455445554556455745584559456045614562456345644565456645674568456945704571457245734574457545764577457845794580458145824583458445854586458745884589459045914592459345944595459645974598459946004601460246034604460546064607460846094610461146124613461446154616461746184619462046214622462346244625462646274628462946304631463246334634463546364637463846394640464146424643464446454646464746484649465046514652465346544655465646574658465946604661466246634664466546664667466846694670467146724673467446754676467746784679468046814682468346844685468646874688468946904691469246934694469546964697469846994700470147024703470447054706470747084709471047114712471347144715471647174718471947204721472247234724472547264727472847294730473147324733473447354736473747384739474047414742474347444745474647474748474947504751475247534754475547564757475847594760476147624763476447654766476747684769477047714772477347744775477647774778477947804781478247834784478547864787478847894790479147924793479447954796479747984799480048014802480348044805480648074808480948104811481248134814481548164817481848194820482148224823482448254826482748284829483048314832483348344835483648374838483948404841484248434844484548464847484848494850485148524853485448554856485748584859486048614862486348644865486648674868486948704871487248734874487548764877487848794880488148824883488448854886488748884889489048914892489348944895489648974898489949004901490249034904490549064907490849094910491149124913491449154916491749184919492049214922492349244925492649274928492949304931493249334934493549364937493849394940494149424943494449454946494749484949495049514952495349544955495649574958495949604961496249634964496549664967496849694970497149724973497449754976
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at https://curl.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. * SPDX-License-Identifier: curl
  22. *
  23. ***************************************************************************/
  24. #include "curl_setup.h"
  25. #ifndef CURL_DISABLE_HTTP
  26. #ifdef HAVE_NETINET_IN_H
  27. #include <netinet/in.h>
  28. #endif
  29. #ifdef HAVE_NETDB_H
  30. #include <netdb.h>
  31. #endif
  32. #ifdef HAVE_ARPA_INET_H
  33. #include <arpa/inet.h>
  34. #endif
  35. #ifdef HAVE_NET_IF_H
  36. #include <net/if.h>
  37. #endif
  38. #ifdef HAVE_SYS_IOCTL_H
  39. #include <sys/ioctl.h>
  40. #endif
  41. #ifdef HAVE_SYS_PARAM_H
  42. #include <sys/param.h>
  43. #endif
  44. #ifdef USE_HYPER
  45. #include <hyper.h>
  46. #endif
  47. #include "urldata.h"
  48. #include <curl/curl.h>
  49. #include "transfer.h"
  50. #include "sendf.h"
  51. #include "formdata.h"
  52. #include "mime.h"
  53. #include "progress.h"
  54. #include "curl_base64.h"
  55. #include "cookie.h"
  56. #include "vauth/vauth.h"
  57. #include "vtls/vtls.h"
  58. #include "vquic/vquic.h"
  59. #include "http_digest.h"
  60. #include "http_ntlm.h"
  61. #include "curl_ntlm_wb.h"
  62. #include "http_negotiate.h"
  63. #include "http_aws_sigv4.h"
  64. #include "url.h"
  65. #include "share.h"
  66. #include "hostip.h"
  67. #include "dynhds.h"
  68. #include "http.h"
  69. #include "select.h"
  70. #include "parsedate.h" /* for the week day and month names */
  71. #include "strtoofft.h"
  72. #include "multiif.h"
  73. #include "strcase.h"
  74. #include "content_encoding.h"
  75. #include "http_proxy.h"
  76. #include "warnless.h"
  77. #include "http2.h"
  78. #include "cfilters.h"
  79. #include "connect.h"
  80. #include "strdup.h"
  81. #include "altsvc.h"
  82. #include "hsts.h"
  83. #include "ws.h"
  84. #include "c-hyper.h"
  85. #include "curl_ctype.h"
  86. /* The last 3 #include files should be in this order */
  87. #include "curl_printf.h"
  88. #include "curl_memory.h"
  89. #include "memdebug.h"
  90. /*
  91. * Forward declarations.
  92. */
  93. static int http_getsock_do(struct Curl_easy *data,
  94. struct connectdata *conn,
  95. curl_socket_t *socks);
  96. static bool http_should_fail(struct Curl_easy *data);
  97. static CURLcode http_setup_conn(struct Curl_easy *data,
  98. struct connectdata *conn);
  99. #ifdef USE_WEBSOCKETS
  100. static CURLcode ws_setup_conn(struct Curl_easy *data,
  101. struct connectdata *conn);
  102. #endif
  103. /*
  104. * HTTP handler interface.
  105. */
  106. const struct Curl_handler Curl_handler_http = {
  107. "HTTP", /* scheme */
  108. http_setup_conn, /* setup_connection */
  109. Curl_http, /* do_it */
  110. Curl_http_done, /* done */
  111. ZERO_NULL, /* do_more */
  112. Curl_http_connect, /* connect_it */
  113. ZERO_NULL, /* connecting */
  114. ZERO_NULL, /* doing */
  115. ZERO_NULL, /* proto_getsock */
  116. http_getsock_do, /* doing_getsock */
  117. ZERO_NULL, /* domore_getsock */
  118. ZERO_NULL, /* perform_getsock */
  119. ZERO_NULL, /* disconnect */
  120. ZERO_NULL, /* readwrite */
  121. ZERO_NULL, /* connection_check */
  122. ZERO_NULL, /* attach connection */
  123. PORT_HTTP, /* defport */
  124. CURLPROTO_HTTP, /* protocol */
  125. CURLPROTO_HTTP, /* family */
  126. PROTOPT_CREDSPERREQUEST | /* flags */
  127. PROTOPT_USERPWDCTRL
  128. };
  129. #ifdef USE_WEBSOCKETS
  130. const struct Curl_handler Curl_handler_ws = {
  131. "WS", /* scheme */
  132. ws_setup_conn, /* setup_connection */
  133. Curl_http, /* do_it */
  134. Curl_http_done, /* done */
  135. ZERO_NULL, /* do_more */
  136. Curl_http_connect, /* connect_it */
  137. ZERO_NULL, /* connecting */
  138. ZERO_NULL, /* doing */
  139. ZERO_NULL, /* proto_getsock */
  140. http_getsock_do, /* doing_getsock */
  141. ZERO_NULL, /* domore_getsock */
  142. ZERO_NULL, /* perform_getsock */
  143. Curl_ws_disconnect, /* disconnect */
  144. ZERO_NULL, /* readwrite */
  145. ZERO_NULL, /* connection_check */
  146. ZERO_NULL, /* attach connection */
  147. PORT_HTTP, /* defport */
  148. CURLPROTO_WS, /* protocol */
  149. CURLPROTO_HTTP, /* family */
  150. PROTOPT_CREDSPERREQUEST | /* flags */
  151. PROTOPT_USERPWDCTRL
  152. };
  153. #endif
  154. #ifdef USE_SSL
  155. /*
  156. * HTTPS handler interface.
  157. */
  158. const struct Curl_handler Curl_handler_https = {
  159. "HTTPS", /* scheme */
  160. http_setup_conn, /* setup_connection */
  161. Curl_http, /* do_it */
  162. Curl_http_done, /* done */
  163. ZERO_NULL, /* do_more */
  164. Curl_http_connect, /* connect_it */
  165. NULL, /* connecting */
  166. ZERO_NULL, /* doing */
  167. NULL, /* proto_getsock */
  168. http_getsock_do, /* doing_getsock */
  169. ZERO_NULL, /* domore_getsock */
  170. ZERO_NULL, /* perform_getsock */
  171. ZERO_NULL, /* disconnect */
  172. ZERO_NULL, /* readwrite */
  173. ZERO_NULL, /* connection_check */
  174. ZERO_NULL, /* attach connection */
  175. PORT_HTTPS, /* defport */
  176. CURLPROTO_HTTPS, /* protocol */
  177. CURLPROTO_HTTP, /* family */
  178. PROTOPT_SSL | PROTOPT_CREDSPERREQUEST | PROTOPT_ALPN | /* flags */
  179. PROTOPT_USERPWDCTRL
  180. };
  181. #ifdef USE_WEBSOCKETS
  182. const struct Curl_handler Curl_handler_wss = {
  183. "WSS", /* scheme */
  184. ws_setup_conn, /* setup_connection */
  185. Curl_http, /* do_it */
  186. Curl_http_done, /* done */
  187. ZERO_NULL, /* do_more */
  188. Curl_http_connect, /* connect_it */
  189. NULL, /* connecting */
  190. ZERO_NULL, /* doing */
  191. NULL, /* proto_getsock */
  192. http_getsock_do, /* doing_getsock */
  193. ZERO_NULL, /* domore_getsock */
  194. ZERO_NULL, /* perform_getsock */
  195. Curl_ws_disconnect, /* disconnect */
  196. ZERO_NULL, /* readwrite */
  197. ZERO_NULL, /* connection_check */
  198. ZERO_NULL, /* attach connection */
  199. PORT_HTTPS, /* defport */
  200. CURLPROTO_WSS, /* protocol */
  201. CURLPROTO_HTTP, /* family */
  202. PROTOPT_SSL | PROTOPT_CREDSPERREQUEST | /* flags */
  203. PROTOPT_USERPWDCTRL
  204. };
  205. #endif
  206. #endif
  207. static CURLcode http_setup_conn(struct Curl_easy *data,
  208. struct connectdata *conn)
  209. {
  210. /* allocate the HTTP-specific struct for the Curl_easy, only to survive
  211. during this request */
  212. struct HTTP *http;
  213. DEBUGASSERT(data->req.p.http == NULL);
  214. http = calloc(1, sizeof(struct HTTP));
  215. if(!http)
  216. return CURLE_OUT_OF_MEMORY;
  217. data->req.p.http = http;
  218. connkeep(conn, "HTTP default");
  219. if(data->state.httpwant == CURL_HTTP_VERSION_3ONLY) {
  220. CURLcode result = Curl_conn_may_http3(data, conn);
  221. if(result)
  222. return result;
  223. }
  224. return CURLE_OK;
  225. }
  226. #ifdef USE_WEBSOCKETS
  227. static CURLcode ws_setup_conn(struct Curl_easy *data,
  228. struct connectdata *conn)
  229. {
  230. /* websockets is 1.1 only (for now) */
  231. data->state.httpwant = CURL_HTTP_VERSION_1_1;
  232. return http_setup_conn(data, conn);
  233. }
  234. #endif
  235. #ifndef CURL_DISABLE_PROXY
  236. /*
  237. * checkProxyHeaders() checks the linked list of custom proxy headers
  238. * if proxy headers are not available, then it will lookup into http header
  239. * link list
  240. *
  241. * It takes a connectdata struct as input to see if this is a proxy request or
  242. * not, as it then might check a different header list. Provide the header
  243. * prefix without colon!
  244. */
  245. char *Curl_checkProxyheaders(struct Curl_easy *data,
  246. const struct connectdata *conn,
  247. const char *thisheader,
  248. const size_t thislen)
  249. {
  250. struct curl_slist *head;
  251. for(head = (conn->bits.proxy && data->set.sep_headers) ?
  252. data->set.proxyheaders : data->set.headers;
  253. head; head = head->next) {
  254. if(strncasecompare(head->data, thisheader, thislen) &&
  255. Curl_headersep(head->data[thislen]))
  256. return head->data;
  257. }
  258. return NULL;
  259. }
  260. #else
  261. /* disabled */
  262. #define Curl_checkProxyheaders(x,y,z,a) NULL
  263. #endif
  264. /*
  265. * Strip off leading and trailing whitespace from the value in the
  266. * given HTTP header line and return a strdupped copy. Returns NULL in
  267. * case of allocation failure. Returns an empty string if the header value
  268. * consists entirely of whitespace.
  269. */
  270. char *Curl_copy_header_value(const char *header)
  271. {
  272. const char *start;
  273. const char *end;
  274. char *value;
  275. size_t len;
  276. /* Find the end of the header name */
  277. while(*header && (*header != ':'))
  278. ++header;
  279. if(*header)
  280. /* Skip over colon */
  281. ++header;
  282. /* Find the first non-space letter */
  283. start = header;
  284. while(*start && ISSPACE(*start))
  285. start++;
  286. /* data is in the host encoding so
  287. use '\r' and '\n' instead of 0x0d and 0x0a */
  288. end = strchr(start, '\r');
  289. if(!end)
  290. end = strchr(start, '\n');
  291. if(!end)
  292. end = strchr(start, '\0');
  293. if(!end)
  294. return NULL;
  295. /* skip all trailing space letters */
  296. while((end > start) && ISSPACE(*end))
  297. end--;
  298. /* get length of the type */
  299. len = end - start + 1;
  300. value = malloc(len + 1);
  301. if(!value)
  302. return NULL;
  303. memcpy(value, start, len);
  304. value[len] = 0; /* null-terminate */
  305. return value;
  306. }
  307. #ifndef CURL_DISABLE_HTTP_AUTH
  308. #ifndef CURL_DISABLE_BASIC_AUTH
  309. /*
  310. * http_output_basic() sets up an Authorization: header (or the proxy version)
  311. * for HTTP Basic authentication.
  312. *
  313. * Returns CURLcode.
  314. */
  315. static CURLcode http_output_basic(struct Curl_easy *data, bool proxy)
  316. {
  317. size_t size = 0;
  318. char *authorization = NULL;
  319. char **userp;
  320. const char *user;
  321. const char *pwd;
  322. CURLcode result;
  323. char *out;
  324. /* credentials are unique per transfer for HTTP, do not use the ones for the
  325. connection */
  326. if(proxy) {
  327. #ifndef CURL_DISABLE_PROXY
  328. userp = &data->state.aptr.proxyuserpwd;
  329. user = data->state.aptr.proxyuser;
  330. pwd = data->state.aptr.proxypasswd;
  331. #else
  332. return CURLE_NOT_BUILT_IN;
  333. #endif
  334. }
  335. else {
  336. userp = &data->state.aptr.userpwd;
  337. user = data->state.aptr.user;
  338. pwd = data->state.aptr.passwd;
  339. }
  340. out = aprintf("%s:%s", user ? user : "", pwd ? pwd : "");
  341. if(!out)
  342. return CURLE_OUT_OF_MEMORY;
  343. result = Curl_base64_encode(out, strlen(out), &authorization, &size);
  344. if(result)
  345. goto fail;
  346. if(!authorization) {
  347. result = CURLE_REMOTE_ACCESS_DENIED;
  348. goto fail;
  349. }
  350. free(*userp);
  351. *userp = aprintf("%sAuthorization: Basic %s\r\n",
  352. proxy ? "Proxy-" : "",
  353. authorization);
  354. free(authorization);
  355. if(!*userp) {
  356. result = CURLE_OUT_OF_MEMORY;
  357. goto fail;
  358. }
  359. fail:
  360. free(out);
  361. return result;
  362. }
  363. #endif
  364. #ifndef CURL_DISABLE_BEARER_AUTH
  365. /*
  366. * http_output_bearer() sets up an Authorization: header
  367. * for HTTP Bearer authentication.
  368. *
  369. * Returns CURLcode.
  370. */
  371. static CURLcode http_output_bearer(struct Curl_easy *data)
  372. {
  373. char **userp;
  374. CURLcode result = CURLE_OK;
  375. userp = &data->state.aptr.userpwd;
  376. free(*userp);
  377. *userp = aprintf("Authorization: Bearer %s\r\n",
  378. data->set.str[STRING_BEARER]);
  379. if(!*userp) {
  380. result = CURLE_OUT_OF_MEMORY;
  381. goto fail;
  382. }
  383. fail:
  384. return result;
  385. }
  386. #endif
  387. #endif
  388. /* pickoneauth() selects the most favourable authentication method from the
  389. * ones available and the ones we want.
  390. *
  391. * return TRUE if one was picked
  392. */
  393. static bool pickoneauth(struct auth *pick, unsigned long mask)
  394. {
  395. bool picked;
  396. /* only deal with authentication we want */
  397. unsigned long avail = pick->avail & pick->want & mask;
  398. picked = TRUE;
  399. /* The order of these checks is highly relevant, as this will be the order
  400. of preference in case of the existence of multiple accepted types. */
  401. if(avail & CURLAUTH_NEGOTIATE)
  402. pick->picked = CURLAUTH_NEGOTIATE;
  403. #ifndef CURL_DISABLE_BEARER_AUTH
  404. else if(avail & CURLAUTH_BEARER)
  405. pick->picked = CURLAUTH_BEARER;
  406. #endif
  407. #ifndef CURL_DISABLE_DIGEST_AUTH
  408. else if(avail & CURLAUTH_DIGEST)
  409. pick->picked = CURLAUTH_DIGEST;
  410. #endif
  411. else if(avail & CURLAUTH_NTLM)
  412. pick->picked = CURLAUTH_NTLM;
  413. else if(avail & CURLAUTH_NTLM_WB)
  414. pick->picked = CURLAUTH_NTLM_WB;
  415. #ifndef CURL_DISABLE_BASIC_AUTH
  416. else if(avail & CURLAUTH_BASIC)
  417. pick->picked = CURLAUTH_BASIC;
  418. #endif
  419. #ifndef CURL_DISABLE_AWS
  420. else if(avail & CURLAUTH_AWS_SIGV4)
  421. pick->picked = CURLAUTH_AWS_SIGV4;
  422. #endif
  423. else {
  424. pick->picked = CURLAUTH_PICKNONE; /* we select to use nothing */
  425. picked = FALSE;
  426. }
  427. pick->avail = CURLAUTH_NONE; /* clear it here */
  428. return picked;
  429. }
  430. /*
  431. * http_perhapsrewind()
  432. *
  433. * If we are doing POST or PUT {
  434. * If we have more data to send {
  435. * If we are doing NTLM {
  436. * Keep sending since we must not disconnect
  437. * }
  438. * else {
  439. * If there is more than just a little data left to send, close
  440. * the current connection by force.
  441. * }
  442. * }
  443. * If we have sent any data {
  444. * If we don't have track of all the data {
  445. * call app to tell it to rewind
  446. * }
  447. * else {
  448. * rewind internally so that the operation can restart fine
  449. * }
  450. * }
  451. * }
  452. */
  453. static CURLcode http_perhapsrewind(struct Curl_easy *data,
  454. struct connectdata *conn)
  455. {
  456. struct HTTP *http = data->req.p.http;
  457. curl_off_t bytessent;
  458. curl_off_t expectsend = -1; /* default is unknown */
  459. if(!http)
  460. /* If this is still NULL, we have not reach very far and we can safely
  461. skip this rewinding stuff */
  462. return CURLE_OK;
  463. switch(data->state.httpreq) {
  464. case HTTPREQ_GET:
  465. case HTTPREQ_HEAD:
  466. return CURLE_OK;
  467. default:
  468. break;
  469. }
  470. bytessent = data->req.writebytecount;
  471. if(conn->bits.authneg) {
  472. /* This is a state where we are known to be negotiating and we don't send
  473. any data then. */
  474. expectsend = 0;
  475. }
  476. else if(!conn->bits.protoconnstart) {
  477. /* HTTP CONNECT in progress: there is no body */
  478. expectsend = 0;
  479. }
  480. else {
  481. /* figure out how much data we are expected to send */
  482. switch(data->state.httpreq) {
  483. case HTTPREQ_POST:
  484. case HTTPREQ_PUT:
  485. if(data->state.infilesize != -1)
  486. expectsend = data->state.infilesize;
  487. break;
  488. case HTTPREQ_POST_FORM:
  489. case HTTPREQ_POST_MIME:
  490. expectsend = http->postsize;
  491. break;
  492. default:
  493. break;
  494. }
  495. }
  496. data->state.rewindbeforesend = FALSE; /* default */
  497. if((expectsend == -1) || (expectsend > bytessent)) {
  498. #if defined(USE_NTLM)
  499. /* There is still data left to send */
  500. if((data->state.authproxy.picked == CURLAUTH_NTLM) ||
  501. (data->state.authhost.picked == CURLAUTH_NTLM) ||
  502. (data->state.authproxy.picked == CURLAUTH_NTLM_WB) ||
  503. (data->state.authhost.picked == CURLAUTH_NTLM_WB)) {
  504. if(((expectsend - bytessent) < 2000) ||
  505. (conn->http_ntlm_state != NTLMSTATE_NONE) ||
  506. (conn->proxy_ntlm_state != NTLMSTATE_NONE)) {
  507. /* The NTLM-negotiation has started *OR* there is just a little (<2K)
  508. data left to send, keep on sending. */
  509. /* rewind data when completely done sending! */
  510. if(!conn->bits.authneg && (conn->writesockfd != CURL_SOCKET_BAD)) {
  511. data->state.rewindbeforesend = TRUE;
  512. infof(data, "Rewind stream before next send");
  513. }
  514. return CURLE_OK;
  515. }
  516. if(conn->bits.close)
  517. /* this is already marked to get closed */
  518. return CURLE_OK;
  519. infof(data, "NTLM send, close instead of sending %"
  520. CURL_FORMAT_CURL_OFF_T " bytes",
  521. (curl_off_t)(expectsend - bytessent));
  522. }
  523. #endif
  524. #if defined(USE_SPNEGO)
  525. /* There is still data left to send */
  526. if((data->state.authproxy.picked == CURLAUTH_NEGOTIATE) ||
  527. (data->state.authhost.picked == CURLAUTH_NEGOTIATE)) {
  528. if(((expectsend - bytessent) < 2000) ||
  529. (conn->http_negotiate_state != GSS_AUTHNONE) ||
  530. (conn->proxy_negotiate_state != GSS_AUTHNONE)) {
  531. /* The NEGOTIATE-negotiation has started *OR*
  532. there is just a little (<2K) data left to send, keep on sending. */
  533. /* rewind data when completely done sending! */
  534. if(!conn->bits.authneg && (conn->writesockfd != CURL_SOCKET_BAD)) {
  535. data->state.rewindbeforesend = TRUE;
  536. infof(data, "Rewind stream before next send");
  537. }
  538. return CURLE_OK;
  539. }
  540. if(conn->bits.close)
  541. /* this is already marked to get closed */
  542. return CURLE_OK;
  543. infof(data, "NEGOTIATE send, close instead of sending %"
  544. CURL_FORMAT_CURL_OFF_T " bytes",
  545. (curl_off_t)(expectsend - bytessent));
  546. }
  547. #endif
  548. /* This is not NEGOTIATE/NTLM or many bytes left to send: close */
  549. streamclose(conn, "Mid-auth HTTP and much data left to send");
  550. data->req.size = 0; /* don't download any more than 0 bytes */
  551. /* There still is data left to send, but this connection is marked for
  552. closure so we can safely do the rewind right now */
  553. }
  554. if(bytessent) {
  555. /* mark for rewind since if we already sent something */
  556. data->state.rewindbeforesend = TRUE;
  557. infof(data, "Please rewind output before next send");
  558. }
  559. return CURLE_OK;
  560. }
  561. /*
  562. * Curl_http_auth_act() gets called when all HTTP headers have been received
  563. * and it checks what authentication methods that are available and decides
  564. * which one (if any) to use. It will set 'newurl' if an auth method was
  565. * picked.
  566. */
  567. CURLcode Curl_http_auth_act(struct Curl_easy *data)
  568. {
  569. struct connectdata *conn = data->conn;
  570. bool pickhost = FALSE;
  571. bool pickproxy = FALSE;
  572. CURLcode result = CURLE_OK;
  573. unsigned long authmask = ~0ul;
  574. if(!data->set.str[STRING_BEARER])
  575. authmask &= (unsigned long)~CURLAUTH_BEARER;
  576. if(100 <= data->req.httpcode && data->req.httpcode <= 199)
  577. /* this is a transient response code, ignore */
  578. return CURLE_OK;
  579. if(data->state.authproblem)
  580. return data->set.http_fail_on_error?CURLE_HTTP_RETURNED_ERROR:CURLE_OK;
  581. if((data->state.aptr.user || data->set.str[STRING_BEARER]) &&
  582. ((data->req.httpcode == 401) ||
  583. (conn->bits.authneg && data->req.httpcode < 300))) {
  584. pickhost = pickoneauth(&data->state.authhost, authmask);
  585. if(!pickhost)
  586. data->state.authproblem = TRUE;
  587. if(data->state.authhost.picked == CURLAUTH_NTLM &&
  588. conn->httpversion > 11) {
  589. infof(data, "Forcing HTTP/1.1 for NTLM");
  590. connclose(conn, "Force HTTP/1.1 connection");
  591. data->state.httpwant = CURL_HTTP_VERSION_1_1;
  592. }
  593. }
  594. #ifndef CURL_DISABLE_PROXY
  595. if(conn->bits.proxy_user_passwd &&
  596. ((data->req.httpcode == 407) ||
  597. (conn->bits.authneg && data->req.httpcode < 300))) {
  598. pickproxy = pickoneauth(&data->state.authproxy,
  599. authmask & ~CURLAUTH_BEARER);
  600. if(!pickproxy)
  601. data->state.authproblem = TRUE;
  602. }
  603. #endif
  604. if(pickhost || pickproxy) {
  605. if((data->state.httpreq != HTTPREQ_GET) &&
  606. (data->state.httpreq != HTTPREQ_HEAD) &&
  607. !data->state.rewindbeforesend) {
  608. result = http_perhapsrewind(data, conn);
  609. if(result)
  610. return result;
  611. }
  612. /* In case this is GSS auth, the newurl field is already allocated so
  613. we must make sure to free it before allocating a new one. As figured
  614. out in bug #2284386 */
  615. Curl_safefree(data->req.newurl);
  616. data->req.newurl = strdup(data->state.url); /* clone URL */
  617. if(!data->req.newurl)
  618. return CURLE_OUT_OF_MEMORY;
  619. }
  620. else if((data->req.httpcode < 300) &&
  621. (!data->state.authhost.done) &&
  622. conn->bits.authneg) {
  623. /* no (known) authentication available,
  624. authentication is not "done" yet and
  625. no authentication seems to be required and
  626. we didn't try HEAD or GET */
  627. if((data->state.httpreq != HTTPREQ_GET) &&
  628. (data->state.httpreq != HTTPREQ_HEAD)) {
  629. data->req.newurl = strdup(data->state.url); /* clone URL */
  630. if(!data->req.newurl)
  631. return CURLE_OUT_OF_MEMORY;
  632. data->state.authhost.done = TRUE;
  633. }
  634. }
  635. if(http_should_fail(data)) {
  636. failf(data, "The requested URL returned error: %d",
  637. data->req.httpcode);
  638. result = CURLE_HTTP_RETURNED_ERROR;
  639. }
  640. return result;
  641. }
  642. #ifndef CURL_DISABLE_HTTP_AUTH
  643. /*
  644. * Output the correct authentication header depending on the auth type
  645. * and whether or not it is to a proxy.
  646. */
  647. static CURLcode
  648. output_auth_headers(struct Curl_easy *data,
  649. struct connectdata *conn,
  650. struct auth *authstatus,
  651. const char *request,
  652. const char *path,
  653. bool proxy)
  654. {
  655. const char *auth = NULL;
  656. CURLcode result = CURLE_OK;
  657. (void)conn;
  658. #ifdef CURL_DISABLE_DIGEST_AUTH
  659. (void)request;
  660. (void)path;
  661. #endif
  662. #ifndef CURL_DISABLE_AWS
  663. if(authstatus->picked == CURLAUTH_AWS_SIGV4) {
  664. auth = "AWS_SIGV4";
  665. result = Curl_output_aws_sigv4(data, proxy);
  666. if(result)
  667. return result;
  668. }
  669. else
  670. #endif
  671. #ifdef USE_SPNEGO
  672. if(authstatus->picked == CURLAUTH_NEGOTIATE) {
  673. auth = "Negotiate";
  674. result = Curl_output_negotiate(data, conn, proxy);
  675. if(result)
  676. return result;
  677. }
  678. else
  679. #endif
  680. #ifdef USE_NTLM
  681. if(authstatus->picked == CURLAUTH_NTLM) {
  682. auth = "NTLM";
  683. result = Curl_output_ntlm(data, proxy);
  684. if(result)
  685. return result;
  686. }
  687. else
  688. #endif
  689. #if defined(USE_NTLM) && defined(NTLM_WB_ENABLED)
  690. if(authstatus->picked == CURLAUTH_NTLM_WB) {
  691. auth = "NTLM_WB";
  692. result = Curl_output_ntlm_wb(data, conn, proxy);
  693. if(result)
  694. return result;
  695. }
  696. else
  697. #endif
  698. #ifndef CURL_DISABLE_DIGEST_AUTH
  699. if(authstatus->picked == CURLAUTH_DIGEST) {
  700. auth = "Digest";
  701. result = Curl_output_digest(data,
  702. proxy,
  703. (const unsigned char *)request,
  704. (const unsigned char *)path);
  705. if(result)
  706. return result;
  707. }
  708. else
  709. #endif
  710. #ifndef CURL_DISABLE_BASIC_AUTH
  711. if(authstatus->picked == CURLAUTH_BASIC) {
  712. /* Basic */
  713. if(
  714. #ifndef CURL_DISABLE_PROXY
  715. (proxy && conn->bits.proxy_user_passwd &&
  716. !Curl_checkProxyheaders(data, conn, STRCONST("Proxy-authorization"))) ||
  717. #endif
  718. (!proxy && data->state.aptr.user &&
  719. !Curl_checkheaders(data, STRCONST("Authorization")))) {
  720. auth = "Basic";
  721. result = http_output_basic(data, proxy);
  722. if(result)
  723. return result;
  724. }
  725. /* NOTE: this function should set 'done' TRUE, as the other auth
  726. functions work that way */
  727. authstatus->done = TRUE;
  728. }
  729. #endif
  730. #ifndef CURL_DISABLE_BEARER_AUTH
  731. if(authstatus->picked == CURLAUTH_BEARER) {
  732. /* Bearer */
  733. if((!proxy && data->set.str[STRING_BEARER] &&
  734. !Curl_checkheaders(data, STRCONST("Authorization")))) {
  735. auth = "Bearer";
  736. result = http_output_bearer(data);
  737. if(result)
  738. return result;
  739. }
  740. /* NOTE: this function should set 'done' TRUE, as the other auth
  741. functions work that way */
  742. authstatus->done = TRUE;
  743. }
  744. #endif
  745. if(auth) {
  746. #ifndef CURL_DISABLE_PROXY
  747. infof(data, "%s auth using %s with user '%s'",
  748. proxy ? "Proxy" : "Server", auth,
  749. proxy ? (data->state.aptr.proxyuser ?
  750. data->state.aptr.proxyuser : "") :
  751. (data->state.aptr.user ?
  752. data->state.aptr.user : ""));
  753. #else
  754. infof(data, "Server auth using %s with user '%s'",
  755. auth, data->state.aptr.user ?
  756. data->state.aptr.user : "");
  757. #endif
  758. authstatus->multipass = (!authstatus->done) ? TRUE : FALSE;
  759. }
  760. else
  761. authstatus->multipass = FALSE;
  762. return CURLE_OK;
  763. }
  764. /**
  765. * Curl_http_output_auth() setups the authentication headers for the
  766. * host/proxy and the correct authentication
  767. * method. data->state.authdone is set to TRUE when authentication is
  768. * done.
  769. *
  770. * @param conn all information about the current connection
  771. * @param request pointer to the request keyword
  772. * @param path pointer to the requested path; should include query part
  773. * @param proxytunnel boolean if this is the request setting up a "proxy
  774. * tunnel"
  775. *
  776. * @returns CURLcode
  777. */
  778. CURLcode
  779. Curl_http_output_auth(struct Curl_easy *data,
  780. struct connectdata *conn,
  781. const char *request,
  782. Curl_HttpReq httpreq,
  783. const char *path,
  784. bool proxytunnel) /* TRUE if this is the request setting
  785. up the proxy tunnel */
  786. {
  787. CURLcode result = CURLE_OK;
  788. struct auth *authhost;
  789. struct auth *authproxy;
  790. DEBUGASSERT(data);
  791. authhost = &data->state.authhost;
  792. authproxy = &data->state.authproxy;
  793. if(
  794. #ifndef CURL_DISABLE_PROXY
  795. (conn->bits.httpproxy && conn->bits.proxy_user_passwd) ||
  796. #endif
  797. data->state.aptr.user ||
  798. #ifdef USE_SPNEGO
  799. authhost->want & CURLAUTH_NEGOTIATE ||
  800. authproxy->want & CURLAUTH_NEGOTIATE ||
  801. #endif
  802. data->set.str[STRING_BEARER])
  803. /* continue please */;
  804. else {
  805. authhost->done = TRUE;
  806. authproxy->done = TRUE;
  807. return CURLE_OK; /* no authentication with no user or password */
  808. }
  809. if(authhost->want && !authhost->picked)
  810. /* The app has selected one or more methods, but none has been picked
  811. so far by a server round-trip. Then we set the picked one to the
  812. want one, and if this is one single bit it'll be used instantly. */
  813. authhost->picked = authhost->want;
  814. if(authproxy->want && !authproxy->picked)
  815. /* The app has selected one or more methods, but none has been picked so
  816. far by a proxy round-trip. Then we set the picked one to the want one,
  817. and if this is one single bit it'll be used instantly. */
  818. authproxy->picked = authproxy->want;
  819. #ifndef CURL_DISABLE_PROXY
  820. /* Send proxy authentication header if needed */
  821. if(conn->bits.httpproxy &&
  822. (conn->bits.tunnel_proxy == (bit)proxytunnel)) {
  823. result = output_auth_headers(data, conn, authproxy, request, path, TRUE);
  824. if(result)
  825. return result;
  826. }
  827. else
  828. #else
  829. (void)proxytunnel;
  830. #endif /* CURL_DISABLE_PROXY */
  831. /* we have no proxy so let's pretend we're done authenticating
  832. with it */
  833. authproxy->done = TRUE;
  834. /* To prevent the user+password to get sent to other than the original host
  835. due to a location-follow */
  836. if(Curl_auth_allowed_to_host(data)
  837. #ifndef CURL_DISABLE_NETRC
  838. || conn->bits.netrc
  839. #endif
  840. )
  841. result = output_auth_headers(data, conn, authhost, request, path, FALSE);
  842. else
  843. authhost->done = TRUE;
  844. if(((authhost->multipass && !authhost->done) ||
  845. (authproxy->multipass && !authproxy->done)) &&
  846. (httpreq != HTTPREQ_GET) &&
  847. (httpreq != HTTPREQ_HEAD)) {
  848. /* Auth is required and we are not authenticated yet. Make a PUT or POST
  849. with content-length zero as a "probe". */
  850. conn->bits.authneg = TRUE;
  851. }
  852. else
  853. conn->bits.authneg = FALSE;
  854. return result;
  855. }
  856. #else
  857. /* when disabled */
  858. CURLcode
  859. Curl_http_output_auth(struct Curl_easy *data,
  860. struct connectdata *conn,
  861. const char *request,
  862. Curl_HttpReq httpreq,
  863. const char *path,
  864. bool proxytunnel)
  865. {
  866. (void)data;
  867. (void)conn;
  868. (void)request;
  869. (void)httpreq;
  870. (void)path;
  871. (void)proxytunnel;
  872. return CURLE_OK;
  873. }
  874. #endif
  875. /*
  876. * Curl_http_input_auth() deals with Proxy-Authenticate: and WWW-Authenticate:
  877. * headers. They are dealt with both in the transfer.c main loop and in the
  878. * proxy CONNECT loop.
  879. */
  880. static int is_valid_auth_separator(char ch)
  881. {
  882. return ch == '\0' || ch == ',' || ISSPACE(ch);
  883. }
  884. CURLcode Curl_http_input_auth(struct Curl_easy *data, bool proxy,
  885. const char *auth) /* the first non-space */
  886. {
  887. /*
  888. * This resource requires authentication
  889. */
  890. struct connectdata *conn = data->conn;
  891. #ifdef USE_SPNEGO
  892. curlnegotiate *negstate = proxy ? &conn->proxy_negotiate_state :
  893. &conn->http_negotiate_state;
  894. #endif
  895. unsigned long *availp;
  896. struct auth *authp;
  897. (void) conn; /* In case conditionals make it unused. */
  898. if(proxy) {
  899. availp = &data->info.proxyauthavail;
  900. authp = &data->state.authproxy;
  901. }
  902. else {
  903. availp = &data->info.httpauthavail;
  904. authp = &data->state.authhost;
  905. }
  906. /*
  907. * Here we check if we want the specific single authentication (using ==) and
  908. * if we do, we initiate usage of it.
  909. *
  910. * If the provided authentication is wanted as one out of several accepted
  911. * types (using &), we OR this authentication type to the authavail
  912. * variable.
  913. *
  914. * Note:
  915. *
  916. * ->picked is first set to the 'want' value (one or more bits) before the
  917. * request is sent, and then it is again set _after_ all response 401/407
  918. * headers have been received but then only to a single preferred method
  919. * (bit).
  920. */
  921. while(*auth) {
  922. #ifdef USE_SPNEGO
  923. if(checkprefix("Negotiate", auth) && is_valid_auth_separator(auth[9])) {
  924. if((authp->avail & CURLAUTH_NEGOTIATE) ||
  925. Curl_auth_is_spnego_supported()) {
  926. *availp |= CURLAUTH_NEGOTIATE;
  927. authp->avail |= CURLAUTH_NEGOTIATE;
  928. if(authp->picked == CURLAUTH_NEGOTIATE) {
  929. CURLcode result = Curl_input_negotiate(data, conn, proxy, auth);
  930. if(!result) {
  931. free(data->req.newurl);
  932. data->req.newurl = strdup(data->state.url);
  933. if(!data->req.newurl)
  934. return CURLE_OUT_OF_MEMORY;
  935. data->state.authproblem = FALSE;
  936. /* we received a GSS auth token and we dealt with it fine */
  937. *negstate = GSS_AUTHRECV;
  938. }
  939. else
  940. data->state.authproblem = TRUE;
  941. }
  942. }
  943. }
  944. else
  945. #endif
  946. #ifdef USE_NTLM
  947. /* NTLM support requires the SSL crypto libs */
  948. if(checkprefix("NTLM", auth) && is_valid_auth_separator(auth[4])) {
  949. if((authp->avail & CURLAUTH_NTLM) ||
  950. (authp->avail & CURLAUTH_NTLM_WB) ||
  951. Curl_auth_is_ntlm_supported()) {
  952. *availp |= CURLAUTH_NTLM;
  953. authp->avail |= CURLAUTH_NTLM;
  954. if(authp->picked == CURLAUTH_NTLM ||
  955. authp->picked == CURLAUTH_NTLM_WB) {
  956. /* NTLM authentication is picked and activated */
  957. CURLcode result = Curl_input_ntlm(data, proxy, auth);
  958. if(!result) {
  959. data->state.authproblem = FALSE;
  960. #ifdef NTLM_WB_ENABLED
  961. if(authp->picked == CURLAUTH_NTLM_WB) {
  962. *availp &= ~CURLAUTH_NTLM;
  963. authp->avail &= ~CURLAUTH_NTLM;
  964. *availp |= CURLAUTH_NTLM_WB;
  965. authp->avail |= CURLAUTH_NTLM_WB;
  966. result = Curl_input_ntlm_wb(data, conn, proxy, auth);
  967. if(result) {
  968. infof(data, "Authentication problem. Ignoring this.");
  969. data->state.authproblem = TRUE;
  970. }
  971. }
  972. #endif
  973. }
  974. else {
  975. infof(data, "Authentication problem. Ignoring this.");
  976. data->state.authproblem = TRUE;
  977. }
  978. }
  979. }
  980. }
  981. else
  982. #endif
  983. #ifndef CURL_DISABLE_DIGEST_AUTH
  984. if(checkprefix("Digest", auth) && is_valid_auth_separator(auth[6])) {
  985. if((authp->avail & CURLAUTH_DIGEST) != 0)
  986. infof(data, "Ignoring duplicate digest auth header.");
  987. else if(Curl_auth_is_digest_supported()) {
  988. CURLcode result;
  989. *availp |= CURLAUTH_DIGEST;
  990. authp->avail |= CURLAUTH_DIGEST;
  991. /* We call this function on input Digest headers even if Digest
  992. * authentication isn't activated yet, as we need to store the
  993. * incoming data from this header in case we are going to use
  994. * Digest */
  995. result = Curl_input_digest(data, proxy, auth);
  996. if(result) {
  997. infof(data, "Authentication problem. Ignoring this.");
  998. data->state.authproblem = TRUE;
  999. }
  1000. }
  1001. }
  1002. else
  1003. #endif
  1004. #ifndef CURL_DISABLE_BASIC_AUTH
  1005. if(checkprefix("Basic", auth) &&
  1006. is_valid_auth_separator(auth[5])) {
  1007. *availp |= CURLAUTH_BASIC;
  1008. authp->avail |= CURLAUTH_BASIC;
  1009. if(authp->picked == CURLAUTH_BASIC) {
  1010. /* We asked for Basic authentication but got a 40X back
  1011. anyway, which basically means our name+password isn't
  1012. valid. */
  1013. authp->avail = CURLAUTH_NONE;
  1014. infof(data, "Authentication problem. Ignoring this.");
  1015. data->state.authproblem = TRUE;
  1016. }
  1017. }
  1018. else
  1019. #endif
  1020. #ifndef CURL_DISABLE_BEARER_AUTH
  1021. if(checkprefix("Bearer", auth) &&
  1022. is_valid_auth_separator(auth[6])) {
  1023. *availp |= CURLAUTH_BEARER;
  1024. authp->avail |= CURLAUTH_BEARER;
  1025. if(authp->picked == CURLAUTH_BEARER) {
  1026. /* We asked for Bearer authentication but got a 40X back
  1027. anyway, which basically means our token isn't valid. */
  1028. authp->avail = CURLAUTH_NONE;
  1029. infof(data, "Authentication problem. Ignoring this.");
  1030. data->state.authproblem = TRUE;
  1031. }
  1032. }
  1033. #else
  1034. ;
  1035. #endif
  1036. /* there may be multiple methods on one line, so keep reading */
  1037. while(*auth && *auth != ',') /* read up to the next comma */
  1038. auth++;
  1039. if(*auth == ',') /* if we're on a comma, skip it */
  1040. auth++;
  1041. while(*auth && ISSPACE(*auth))
  1042. auth++;
  1043. }
  1044. return CURLE_OK;
  1045. }
  1046. /**
  1047. * http_should_fail() determines whether an HTTP response has gotten us
  1048. * into an error state or not.
  1049. *
  1050. * @retval FALSE communications should continue
  1051. *
  1052. * @retval TRUE communications should not continue
  1053. */
  1054. static bool http_should_fail(struct Curl_easy *data)
  1055. {
  1056. int httpcode;
  1057. DEBUGASSERT(data);
  1058. DEBUGASSERT(data->conn);
  1059. httpcode = data->req.httpcode;
  1060. /*
  1061. ** If we haven't been asked to fail on error,
  1062. ** don't fail.
  1063. */
  1064. if(!data->set.http_fail_on_error)
  1065. return FALSE;
  1066. /*
  1067. ** Any code < 400 is never terminal.
  1068. */
  1069. if(httpcode < 400)
  1070. return FALSE;
  1071. /*
  1072. ** A 416 response to a resume request is presumably because the file is
  1073. ** already completely downloaded and thus not actually a fail.
  1074. */
  1075. if(data->state.resume_from && data->state.httpreq == HTTPREQ_GET &&
  1076. httpcode == 416)
  1077. return FALSE;
  1078. /*
  1079. ** Any code >= 400 that's not 401 or 407 is always
  1080. ** a terminal error
  1081. */
  1082. if((httpcode != 401) && (httpcode != 407))
  1083. return TRUE;
  1084. /*
  1085. ** All we have left to deal with is 401 and 407
  1086. */
  1087. DEBUGASSERT((httpcode == 401) || (httpcode == 407));
  1088. /*
  1089. ** Examine the current authentication state to see if this
  1090. ** is an error. The idea is for this function to get
  1091. ** called after processing all the headers in a response
  1092. ** message. So, if we've been to asked to authenticate a
  1093. ** particular stage, and we've done it, we're OK. But, if
  1094. ** we're already completely authenticated, it's not OK to
  1095. ** get another 401 or 407.
  1096. **
  1097. ** It is possible for authentication to go stale such that
  1098. ** the client needs to reauthenticate. Once that info is
  1099. ** available, use it here.
  1100. */
  1101. /*
  1102. ** Either we're not authenticating, or we're supposed to
  1103. ** be authenticating something else. This is an error.
  1104. */
  1105. if((httpcode == 401) && !data->state.aptr.user)
  1106. return TRUE;
  1107. #ifndef CURL_DISABLE_PROXY
  1108. if((httpcode == 407) && !data->conn->bits.proxy_user_passwd)
  1109. return TRUE;
  1110. #endif
  1111. return data->state.authproblem;
  1112. }
  1113. /*
  1114. * readmoredata() is a "fread() emulation" to provide POST and/or request
  1115. * data. It is used when a huge POST is to be made and the entire chunk wasn't
  1116. * sent in the first send(). This function will then be called from the
  1117. * transfer.c loop when more data is to be sent to the peer.
  1118. *
  1119. * Returns the amount of bytes it filled the buffer with.
  1120. */
  1121. static size_t readmoredata(char *buffer,
  1122. size_t size,
  1123. size_t nitems,
  1124. void *userp)
  1125. {
  1126. struct HTTP *http = (struct HTTP *)userp;
  1127. struct Curl_easy *data = http->backup.data;
  1128. size_t fullsize = size * nitems;
  1129. if(!http->postsize)
  1130. /* nothing to return */
  1131. return 0;
  1132. /* make sure that an HTTP request is never sent away chunked! */
  1133. data->req.forbidchunk = (http->sending == HTTPSEND_REQUEST)?TRUE:FALSE;
  1134. if(data->set.max_send_speed &&
  1135. (data->set.max_send_speed < (curl_off_t)fullsize) &&
  1136. (data->set.max_send_speed < http->postsize))
  1137. /* speed limit */
  1138. fullsize = (size_t)data->set.max_send_speed;
  1139. else if(http->postsize <= (curl_off_t)fullsize) {
  1140. memcpy(buffer, http->postdata, (size_t)http->postsize);
  1141. fullsize = (size_t)http->postsize;
  1142. if(http->backup.postsize) {
  1143. /* move backup data into focus and continue on that */
  1144. http->postdata = http->backup.postdata;
  1145. http->postsize = http->backup.postsize;
  1146. data->state.fread_func = http->backup.fread_func;
  1147. data->state.in = http->backup.fread_in;
  1148. http->sending++; /* move one step up */
  1149. http->backup.postsize = 0;
  1150. }
  1151. else
  1152. http->postsize = 0;
  1153. return fullsize;
  1154. }
  1155. memcpy(buffer, http->postdata, fullsize);
  1156. http->postdata += fullsize;
  1157. http->postsize -= fullsize;
  1158. return fullsize;
  1159. }
  1160. /*
  1161. * Curl_buffer_send() sends a header buffer and frees all associated
  1162. * memory. Body data may be appended to the header data if desired.
  1163. *
  1164. * Returns CURLcode
  1165. */
  1166. CURLcode Curl_buffer_send(struct dynbuf *in,
  1167. struct Curl_easy *data,
  1168. struct HTTP *http,
  1169. /* add the number of sent bytes to this
  1170. counter */
  1171. curl_off_t *bytes_written,
  1172. /* how much of the buffer contains body data */
  1173. curl_off_t included_body_bytes,
  1174. int sockindex)
  1175. {
  1176. ssize_t amount;
  1177. CURLcode result;
  1178. char *ptr;
  1179. size_t size;
  1180. struct connectdata *conn = data->conn;
  1181. size_t sendsize;
  1182. size_t headersize;
  1183. DEBUGASSERT(sockindex <= SECONDARYSOCKET && sockindex >= 0);
  1184. /* The looping below is required since we use non-blocking sockets, but due
  1185. to the circumstances we will just loop and try again and again etc */
  1186. ptr = Curl_dyn_ptr(in);
  1187. size = Curl_dyn_len(in);
  1188. headersize = size - (size_t)included_body_bytes; /* the initial part that
  1189. isn't body is header */
  1190. DEBUGASSERT(size > (size_t)included_body_bytes);
  1191. if((conn->handler->flags & PROTOPT_SSL
  1192. #ifndef CURL_DISABLE_PROXY
  1193. || IS_HTTPS_PROXY(conn->http_proxy.proxytype)
  1194. #endif
  1195. )
  1196. && conn->httpversion < 20) {
  1197. /* Make sure this doesn't send more body bytes than what the max send
  1198. speed says. The request bytes do not count to the max speed.
  1199. */
  1200. if(data->set.max_send_speed &&
  1201. (included_body_bytes > data->set.max_send_speed)) {
  1202. curl_off_t overflow = included_body_bytes - data->set.max_send_speed;
  1203. DEBUGASSERT((size_t)overflow < size);
  1204. sendsize = size - (size_t)overflow;
  1205. }
  1206. else
  1207. sendsize = size;
  1208. /* OpenSSL is very picky and we must send the SAME buffer pointer to the
  1209. library when we attempt to re-send this buffer. Sending the same data
  1210. is not enough, we must use the exact same address. For this reason, we
  1211. must copy the data to the uploadbuffer first, since that is the buffer
  1212. we will be using if this send is retried later.
  1213. */
  1214. result = Curl_get_upload_buffer(data);
  1215. if(result) {
  1216. /* malloc failed, free memory and return to the caller */
  1217. Curl_dyn_free(in);
  1218. return result;
  1219. }
  1220. /* We never send more than upload_buffer_size bytes in one single chunk
  1221. when we speak HTTPS, as if only a fraction of it is sent now, this data
  1222. needs to fit into the normal read-callback buffer later on and that
  1223. buffer is using this size.
  1224. */
  1225. if(sendsize > (size_t)data->set.upload_buffer_size)
  1226. sendsize = (size_t)data->set.upload_buffer_size;
  1227. memcpy(data->state.ulbuf, ptr, sendsize);
  1228. ptr = data->state.ulbuf;
  1229. }
  1230. else {
  1231. #ifdef CURLDEBUG
  1232. /* Allow debug builds to override this logic to force short initial
  1233. sends
  1234. */
  1235. char *p = getenv("CURL_SMALLREQSEND");
  1236. if(p) {
  1237. size_t altsize = (size_t)strtoul(p, NULL, 10);
  1238. if(altsize)
  1239. sendsize = CURLMIN(size, altsize);
  1240. else
  1241. sendsize = size;
  1242. }
  1243. else
  1244. #endif
  1245. {
  1246. /* Make sure this doesn't send more body bytes than what the max send
  1247. speed says. The request bytes do not count to the max speed.
  1248. */
  1249. if(data->set.max_send_speed &&
  1250. (included_body_bytes > data->set.max_send_speed)) {
  1251. curl_off_t overflow = included_body_bytes - data->set.max_send_speed;
  1252. DEBUGASSERT((size_t)overflow < size);
  1253. sendsize = size - (size_t)overflow;
  1254. }
  1255. else
  1256. sendsize = size;
  1257. }
  1258. /* We currently cannot send more that this for http here:
  1259. * - if sending blocks, it return 0 as amount
  1260. * - we then whisk aside the `in` into the `http` struct
  1261. * and install our own `data->state.fread_func` that
  1262. * on subsequent calls reads `in` empty.
  1263. * - when the whisked away `in` is empty, the `fread_func`
  1264. * is restored ot its original state.
  1265. * The problem is that `fread_func` can only return
  1266. * `upload_buffer_size` lengths. If the send we do here
  1267. * is larger and blocks, we do re-sending with smaller
  1268. * amounts of data and connection filters do not like
  1269. * that.
  1270. */
  1271. if(http && (sendsize > (size_t)data->set.upload_buffer_size))
  1272. sendsize = (size_t)data->set.upload_buffer_size;
  1273. }
  1274. result = Curl_nwrite(data, sockindex, ptr, sendsize, &amount);
  1275. if(!result) {
  1276. /*
  1277. * Note that we may not send the entire chunk at once, and we have a set
  1278. * number of data bytes at the end of the big buffer (out of which we may
  1279. * only send away a part).
  1280. */
  1281. /* how much of the header that was sent */
  1282. size_t headlen = (size_t)amount>headersize ? headersize : (size_t)amount;
  1283. size_t bodylen = amount - headlen;
  1284. /* this data _may_ contain binary stuff */
  1285. Curl_debug(data, CURLINFO_HEADER_OUT, ptr, headlen);
  1286. if(bodylen)
  1287. /* there was body data sent beyond the initial header part, pass that on
  1288. to the debug callback too */
  1289. Curl_debug(data, CURLINFO_DATA_OUT, ptr + headlen, bodylen);
  1290. /* 'amount' can never be a very large value here so typecasting it so a
  1291. signed 31 bit value should not cause problems even if ssize_t is
  1292. 64bit */
  1293. *bytes_written += (long)amount;
  1294. if(http) {
  1295. /* if we sent a piece of the body here, up the byte counter for it
  1296. accordingly */
  1297. data->req.writebytecount += bodylen;
  1298. Curl_pgrsSetUploadCounter(data, data->req.writebytecount);
  1299. if((size_t)amount != size) {
  1300. /* The whole request could not be sent in one system call. We must
  1301. queue it up and send it later when we get the chance. We must not
  1302. loop here and wait until it might work again. */
  1303. size -= amount;
  1304. ptr = Curl_dyn_ptr(in) + amount;
  1305. /* backup the currently set pointers */
  1306. http->backup.fread_func = data->state.fread_func;
  1307. http->backup.fread_in = data->state.in;
  1308. http->backup.postdata = http->postdata;
  1309. http->backup.postsize = http->postsize;
  1310. http->backup.data = data;
  1311. /* set the new pointers for the request-sending */
  1312. data->state.fread_func = (curl_read_callback)readmoredata;
  1313. data->state.in = (void *)http;
  1314. http->postdata = ptr;
  1315. http->postsize = (curl_off_t)size;
  1316. /* this much data is remaining header: */
  1317. data->req.pendingheader = headersize - headlen;
  1318. http->send_buffer = *in; /* copy the whole struct */
  1319. http->sending = HTTPSEND_REQUEST;
  1320. return CURLE_OK;
  1321. }
  1322. http->sending = HTTPSEND_BODY;
  1323. /* the full buffer was sent, clean up and return */
  1324. }
  1325. else {
  1326. if((size_t)amount != size)
  1327. /* We have no continue-send mechanism now, fail. This can only happen
  1328. when this function is used from the CONNECT sending function. We
  1329. currently (stupidly) assume that the whole request is always sent
  1330. away in the first single chunk.
  1331. This needs FIXing.
  1332. */
  1333. return CURLE_SEND_ERROR;
  1334. }
  1335. }
  1336. Curl_dyn_free(in);
  1337. /* no remaining header data */
  1338. data->req.pendingheader = 0;
  1339. return result;
  1340. }
  1341. /* end of the add_buffer functions */
  1342. /* ------------------------------------------------------------------------- */
  1343. /*
  1344. * Curl_compareheader()
  1345. *
  1346. * Returns TRUE if 'headerline' contains the 'header' with given 'content'.
  1347. * Pass headers WITH the colon.
  1348. */
  1349. bool
  1350. Curl_compareheader(const char *headerline, /* line to check */
  1351. const char *header, /* header keyword _with_ colon */
  1352. const size_t hlen, /* len of the keyword in bytes */
  1353. const char *content, /* content string to find */
  1354. const size_t clen) /* len of the content in bytes */
  1355. {
  1356. /* RFC2616, section 4.2 says: "Each header field consists of a name followed
  1357. * by a colon (":") and the field value. Field names are case-insensitive.
  1358. * The field value MAY be preceded by any amount of LWS, though a single SP
  1359. * is preferred." */
  1360. size_t len;
  1361. const char *start;
  1362. const char *end;
  1363. DEBUGASSERT(hlen);
  1364. DEBUGASSERT(clen);
  1365. DEBUGASSERT(header);
  1366. DEBUGASSERT(content);
  1367. if(!strncasecompare(headerline, header, hlen))
  1368. return FALSE; /* doesn't start with header */
  1369. /* pass the header */
  1370. start = &headerline[hlen];
  1371. /* pass all whitespace */
  1372. while(*start && ISSPACE(*start))
  1373. start++;
  1374. /* find the end of the header line */
  1375. end = strchr(start, '\r'); /* lines end with CRLF */
  1376. if(!end) {
  1377. /* in case there's a non-standard compliant line here */
  1378. end = strchr(start, '\n');
  1379. if(!end)
  1380. /* hm, there's no line ending here, use the zero byte! */
  1381. end = strchr(start, '\0');
  1382. }
  1383. len = end-start; /* length of the content part of the input line */
  1384. /* find the content string in the rest of the line */
  1385. for(; len >= clen; len--, start++) {
  1386. if(strncasecompare(start, content, clen))
  1387. return TRUE; /* match! */
  1388. }
  1389. return FALSE; /* no match */
  1390. }
  1391. /*
  1392. * Curl_http_connect() performs HTTP stuff to do at connect-time, called from
  1393. * the generic Curl_connect().
  1394. */
  1395. CURLcode Curl_http_connect(struct Curl_easy *data, bool *done)
  1396. {
  1397. struct connectdata *conn = data->conn;
  1398. /* We default to persistent connections. We set this already in this connect
  1399. function to make the reuse checks properly be able to check this bit. */
  1400. connkeep(conn, "HTTP default");
  1401. return Curl_conn_connect(data, FIRSTSOCKET, FALSE, done);
  1402. }
  1403. /* this returns the socket to wait for in the DO and DOING state for the multi
  1404. interface and then we're always _sending_ a request and thus we wait for
  1405. the single socket to become writable only */
  1406. static int http_getsock_do(struct Curl_easy *data,
  1407. struct connectdata *conn,
  1408. curl_socket_t *socks)
  1409. {
  1410. /* write mode */
  1411. (void)conn;
  1412. socks[0] = Curl_conn_get_socket(data, FIRSTSOCKET);
  1413. return GETSOCK_WRITESOCK(0);
  1414. }
  1415. /*
  1416. * Curl_http_done() gets called after a single HTTP request has been
  1417. * performed.
  1418. */
  1419. CURLcode Curl_http_done(struct Curl_easy *data,
  1420. CURLcode status, bool premature)
  1421. {
  1422. struct connectdata *conn = data->conn;
  1423. struct HTTP *http = data->req.p.http;
  1424. /* Clear multipass flag. If authentication isn't done yet, then it will get
  1425. * a chance to be set back to true when we output the next auth header */
  1426. data->state.authhost.multipass = FALSE;
  1427. data->state.authproxy.multipass = FALSE;
  1428. /* set the proper values (possibly modified on POST) */
  1429. conn->seek_func = data->set.seek_func; /* restore */
  1430. conn->seek_client = data->set.seek_client; /* restore */
  1431. if(!http)
  1432. return CURLE_OK;
  1433. Curl_dyn_free(&http->send_buffer);
  1434. Curl_dyn_reset(&data->state.headerb);
  1435. Curl_hyper_done(data);
  1436. Curl_ws_done(data);
  1437. if(status)
  1438. return status;
  1439. if(!premature && /* this check is pointless when DONE is called before the
  1440. entire operation is complete */
  1441. !conn->bits.retry &&
  1442. !data->set.connect_only &&
  1443. (data->req.bytecount +
  1444. data->req.headerbytecount -
  1445. data->req.deductheadercount) <= 0) {
  1446. /* If this connection isn't simply closed to be retried, AND nothing was
  1447. read from the HTTP server (that counts), this can't be right so we
  1448. return an error here */
  1449. failf(data, "Empty reply from server");
  1450. /* Mark it as closed to avoid the "left intact" message */
  1451. streamclose(conn, "Empty reply from server");
  1452. return CURLE_GOT_NOTHING;
  1453. }
  1454. return CURLE_OK;
  1455. }
  1456. /*
  1457. * Determine if we should use HTTP 1.1 (OR BETTER) for this request. Reasons
  1458. * to avoid it include:
  1459. *
  1460. * - if the user specifically requested HTTP 1.0
  1461. * - if the server we are connected to only supports 1.0
  1462. * - if any server previously contacted to handle this request only supports
  1463. * 1.0.
  1464. */
  1465. bool Curl_use_http_1_1plus(const struct Curl_easy *data,
  1466. const struct connectdata *conn)
  1467. {
  1468. if((data->state.httpversion == 10) || (conn->httpversion == 10))
  1469. return FALSE;
  1470. if((data->state.httpwant == CURL_HTTP_VERSION_1_0) &&
  1471. (conn->httpversion <= 10))
  1472. return FALSE;
  1473. return ((data->state.httpwant == CURL_HTTP_VERSION_NONE) ||
  1474. (data->state.httpwant >= CURL_HTTP_VERSION_1_1));
  1475. }
  1476. #ifndef USE_HYPER
  1477. static const char *get_http_string(const struct Curl_easy *data,
  1478. const struct connectdata *conn)
  1479. {
  1480. if(Curl_conn_is_http3(data, conn, FIRSTSOCKET))
  1481. return "3";
  1482. if(Curl_conn_is_http2(data, conn, FIRSTSOCKET))
  1483. return "2";
  1484. if(Curl_use_http_1_1plus(data, conn))
  1485. return "1.1";
  1486. return "1.0";
  1487. }
  1488. #endif
  1489. /* check and possibly add an Expect: header */
  1490. static CURLcode expect100(struct Curl_easy *data,
  1491. struct connectdata *conn,
  1492. struct dynbuf *req)
  1493. {
  1494. CURLcode result = CURLE_OK;
  1495. data->state.expect100header = FALSE; /* default to false unless it is set
  1496. to TRUE below */
  1497. if(!data->state.disableexpect && Curl_use_http_1_1plus(data, conn) &&
  1498. (conn->httpversion < 20)) {
  1499. /* if not doing HTTP 1.0 or version 2, or disabled explicitly, we add an
  1500. Expect: 100-continue to the headers which actually speeds up post
  1501. operations (as there is one packet coming back from the web server) */
  1502. const char *ptr = Curl_checkheaders(data, STRCONST("Expect"));
  1503. if(ptr) {
  1504. data->state.expect100header =
  1505. Curl_compareheader(ptr, STRCONST("Expect:"), STRCONST("100-continue"));
  1506. }
  1507. else {
  1508. result = Curl_dyn_addn(req, STRCONST("Expect: 100-continue\r\n"));
  1509. if(!result)
  1510. data->state.expect100header = TRUE;
  1511. }
  1512. }
  1513. return result;
  1514. }
  1515. enum proxy_use {
  1516. HEADER_SERVER, /* direct to server */
  1517. HEADER_PROXY, /* regular request to proxy */
  1518. HEADER_CONNECT /* sending CONNECT to a proxy */
  1519. };
  1520. /* used to compile the provided trailers into one buffer
  1521. will return an error code if one of the headers is
  1522. not formatted correctly */
  1523. CURLcode Curl_http_compile_trailers(struct curl_slist *trailers,
  1524. struct dynbuf *b,
  1525. struct Curl_easy *handle)
  1526. {
  1527. char *ptr = NULL;
  1528. CURLcode result = CURLE_OK;
  1529. const char *endofline_native = NULL;
  1530. const char *endofline_network = NULL;
  1531. if(
  1532. #ifdef CURL_DO_LINEEND_CONV
  1533. (handle->state.prefer_ascii) ||
  1534. #endif
  1535. (handle->set.crlf)) {
  1536. /* \n will become \r\n later on */
  1537. endofline_native = "\n";
  1538. endofline_network = "\x0a";
  1539. }
  1540. else {
  1541. endofline_native = "\r\n";
  1542. endofline_network = "\x0d\x0a";
  1543. }
  1544. while(trailers) {
  1545. /* only add correctly formatted trailers */
  1546. ptr = strchr(trailers->data, ':');
  1547. if(ptr && *(ptr + 1) == ' ') {
  1548. result = Curl_dyn_add(b, trailers->data);
  1549. if(result)
  1550. return result;
  1551. result = Curl_dyn_add(b, endofline_native);
  1552. if(result)
  1553. return result;
  1554. }
  1555. else
  1556. infof(handle, "Malformatted trailing header, skipping trailer");
  1557. trailers = trailers->next;
  1558. }
  1559. result = Curl_dyn_add(b, endofline_network);
  1560. return result;
  1561. }
  1562. static bool hd_name_eq(const char *n1, size_t n1len,
  1563. const char *n2, size_t n2len)
  1564. {
  1565. if(n1len == n2len) {
  1566. return strncasecompare(n1, n2, n1len);
  1567. }
  1568. return FALSE;
  1569. }
  1570. CURLcode Curl_dynhds_add_custom(struct Curl_easy *data,
  1571. bool is_connect,
  1572. struct dynhds *hds)
  1573. {
  1574. struct connectdata *conn = data->conn;
  1575. char *ptr;
  1576. struct curl_slist *h[2];
  1577. struct curl_slist *headers;
  1578. int numlists = 1; /* by default */
  1579. int i;
  1580. #ifndef CURL_DISABLE_PROXY
  1581. enum proxy_use proxy;
  1582. if(is_connect)
  1583. proxy = HEADER_CONNECT;
  1584. else
  1585. proxy = conn->bits.httpproxy && !conn->bits.tunnel_proxy?
  1586. HEADER_PROXY:HEADER_SERVER;
  1587. switch(proxy) {
  1588. case HEADER_SERVER:
  1589. h[0] = data->set.headers;
  1590. break;
  1591. case HEADER_PROXY:
  1592. h[0] = data->set.headers;
  1593. if(data->set.sep_headers) {
  1594. h[1] = data->set.proxyheaders;
  1595. numlists++;
  1596. }
  1597. break;
  1598. case HEADER_CONNECT:
  1599. if(data->set.sep_headers)
  1600. h[0] = data->set.proxyheaders;
  1601. else
  1602. h[0] = data->set.headers;
  1603. break;
  1604. }
  1605. #else
  1606. (void)is_connect;
  1607. h[0] = data->set.headers;
  1608. #endif
  1609. /* loop through one or two lists */
  1610. for(i = 0; i < numlists; i++) {
  1611. for(headers = h[i]; headers; headers = headers->next) {
  1612. const char *name, *value;
  1613. size_t namelen, valuelen;
  1614. /* There are 2 quirks in place for custom headers:
  1615. * 1. setting only 'name:' to suppress a header from being sent
  1616. * 2. setting only 'name;' to send an empty (illegal) header
  1617. */
  1618. ptr = strchr(headers->data, ':');
  1619. if(ptr) {
  1620. name = headers->data;
  1621. namelen = ptr - headers->data;
  1622. ptr++; /* pass the colon */
  1623. while(*ptr && ISSPACE(*ptr))
  1624. ptr++;
  1625. if(*ptr) {
  1626. value = ptr;
  1627. valuelen = strlen(value);
  1628. }
  1629. else {
  1630. /* quirk #1, suppress this header */
  1631. continue;
  1632. }
  1633. }
  1634. else {
  1635. ptr = strchr(headers->data, ';');
  1636. if(!ptr) {
  1637. /* neither : nor ; in provided header value. We seem
  1638. * to ignore this silently */
  1639. continue;
  1640. }
  1641. name = headers->data;
  1642. namelen = ptr - headers->data;
  1643. ptr++; /* pass the semicolon */
  1644. while(*ptr && ISSPACE(*ptr))
  1645. ptr++;
  1646. if(!*ptr) {
  1647. /* quirk #2, send an empty header */
  1648. value = "";
  1649. valuelen = 0;
  1650. }
  1651. else {
  1652. /* this may be used for something else in the future,
  1653. * ignore this for now */
  1654. continue;
  1655. }
  1656. }
  1657. DEBUGASSERT(name && value);
  1658. if(data->state.aptr.host &&
  1659. /* a Host: header was sent already, don't pass on any custom Host:
  1660. header as that will produce *two* in the same request! */
  1661. hd_name_eq(name, namelen, STRCONST("Host:")))
  1662. ;
  1663. else if(data->state.httpreq == HTTPREQ_POST_FORM &&
  1664. /* this header (extended by formdata.c) is sent later */
  1665. hd_name_eq(name, namelen, STRCONST("Content-Type:")))
  1666. ;
  1667. else if(data->state.httpreq == HTTPREQ_POST_MIME &&
  1668. /* this header is sent later */
  1669. hd_name_eq(name, namelen, STRCONST("Content-Type:")))
  1670. ;
  1671. else if(conn->bits.authneg &&
  1672. /* while doing auth neg, don't allow the custom length since
  1673. we will force length zero then */
  1674. hd_name_eq(name, namelen, STRCONST("Content-Length:")))
  1675. ;
  1676. else if(data->state.aptr.te &&
  1677. /* when asking for Transfer-Encoding, don't pass on a custom
  1678. Connection: */
  1679. hd_name_eq(name, namelen, STRCONST("Connection:")))
  1680. ;
  1681. else if((conn->httpversion >= 20) &&
  1682. hd_name_eq(name, namelen, STRCONST("Transfer-Encoding:")))
  1683. /* HTTP/2 doesn't support chunked requests */
  1684. ;
  1685. else if((hd_name_eq(name, namelen, STRCONST("Authorization:")) ||
  1686. hd_name_eq(name, namelen, STRCONST("Cookie:"))) &&
  1687. /* be careful of sending this potentially sensitive header to
  1688. other hosts */
  1689. !Curl_auth_allowed_to_host(data))
  1690. ;
  1691. else {
  1692. CURLcode result;
  1693. result = Curl_dynhds_add(hds, name, namelen, value, valuelen);
  1694. if(result)
  1695. return result;
  1696. }
  1697. }
  1698. }
  1699. return CURLE_OK;
  1700. }
  1701. CURLcode Curl_add_custom_headers(struct Curl_easy *data,
  1702. bool is_connect,
  1703. #ifndef USE_HYPER
  1704. struct dynbuf *req
  1705. #else
  1706. void *req
  1707. #endif
  1708. )
  1709. {
  1710. struct connectdata *conn = data->conn;
  1711. char *ptr;
  1712. struct curl_slist *h[2];
  1713. struct curl_slist *headers;
  1714. int numlists = 1; /* by default */
  1715. int i;
  1716. #ifndef CURL_DISABLE_PROXY
  1717. enum proxy_use proxy;
  1718. if(is_connect)
  1719. proxy = HEADER_CONNECT;
  1720. else
  1721. proxy = conn->bits.httpproxy && !conn->bits.tunnel_proxy?
  1722. HEADER_PROXY:HEADER_SERVER;
  1723. switch(proxy) {
  1724. case HEADER_SERVER:
  1725. h[0] = data->set.headers;
  1726. break;
  1727. case HEADER_PROXY:
  1728. h[0] = data->set.headers;
  1729. if(data->set.sep_headers) {
  1730. h[1] = data->set.proxyheaders;
  1731. numlists++;
  1732. }
  1733. break;
  1734. case HEADER_CONNECT:
  1735. if(data->set.sep_headers)
  1736. h[0] = data->set.proxyheaders;
  1737. else
  1738. h[0] = data->set.headers;
  1739. break;
  1740. }
  1741. #else
  1742. (void)is_connect;
  1743. h[0] = data->set.headers;
  1744. #endif
  1745. /* loop through one or two lists */
  1746. for(i = 0; i < numlists; i++) {
  1747. headers = h[i];
  1748. while(headers) {
  1749. char *semicolonp = NULL;
  1750. ptr = strchr(headers->data, ':');
  1751. if(!ptr) {
  1752. char *optr;
  1753. /* no colon, semicolon? */
  1754. ptr = strchr(headers->data, ';');
  1755. if(ptr) {
  1756. optr = ptr;
  1757. ptr++; /* pass the semicolon */
  1758. while(*ptr && ISSPACE(*ptr))
  1759. ptr++;
  1760. if(*ptr) {
  1761. /* this may be used for something else in the future */
  1762. optr = NULL;
  1763. }
  1764. else {
  1765. if(*(--ptr) == ';') {
  1766. /* copy the source */
  1767. semicolonp = strdup(headers->data);
  1768. if(!semicolonp) {
  1769. #ifndef USE_HYPER
  1770. Curl_dyn_free(req);
  1771. #endif
  1772. return CURLE_OUT_OF_MEMORY;
  1773. }
  1774. /* put a colon where the semicolon is */
  1775. semicolonp[ptr - headers->data] = ':';
  1776. /* point at the colon */
  1777. optr = &semicolonp [ptr - headers->data];
  1778. }
  1779. }
  1780. ptr = optr;
  1781. }
  1782. }
  1783. if(ptr && (ptr != headers->data)) {
  1784. /* we require a colon for this to be a true header */
  1785. ptr++; /* pass the colon */
  1786. while(*ptr && ISSPACE(*ptr))
  1787. ptr++;
  1788. if(*ptr || semicolonp) {
  1789. /* only send this if the contents was non-blank or done special */
  1790. CURLcode result = CURLE_OK;
  1791. char *compare = semicolonp ? semicolonp : headers->data;
  1792. if(data->state.aptr.host &&
  1793. /* a Host: header was sent already, don't pass on any custom Host:
  1794. header as that will produce *two* in the same request! */
  1795. checkprefix("Host:", compare))
  1796. ;
  1797. else if(data->state.httpreq == HTTPREQ_POST_FORM &&
  1798. /* this header (extended by formdata.c) is sent later */
  1799. checkprefix("Content-Type:", compare))
  1800. ;
  1801. else if(data->state.httpreq == HTTPREQ_POST_MIME &&
  1802. /* this header is sent later */
  1803. checkprefix("Content-Type:", compare))
  1804. ;
  1805. else if(conn->bits.authneg &&
  1806. /* while doing auth neg, don't allow the custom length since
  1807. we will force length zero then */
  1808. checkprefix("Content-Length:", compare))
  1809. ;
  1810. else if(data->state.aptr.te &&
  1811. /* when asking for Transfer-Encoding, don't pass on a custom
  1812. Connection: */
  1813. checkprefix("Connection:", compare))
  1814. ;
  1815. else if((conn->httpversion >= 20) &&
  1816. checkprefix("Transfer-Encoding:", compare))
  1817. /* HTTP/2 doesn't support chunked requests */
  1818. ;
  1819. else if((checkprefix("Authorization:", compare) ||
  1820. checkprefix("Cookie:", compare)) &&
  1821. /* be careful of sending this potentially sensitive header to
  1822. other hosts */
  1823. !Curl_auth_allowed_to_host(data))
  1824. ;
  1825. else {
  1826. #ifdef USE_HYPER
  1827. result = Curl_hyper_header(data, req, compare);
  1828. #else
  1829. result = Curl_dyn_addf(req, "%s\r\n", compare);
  1830. #endif
  1831. }
  1832. if(semicolonp)
  1833. free(semicolonp);
  1834. if(result)
  1835. return result;
  1836. }
  1837. }
  1838. headers = headers->next;
  1839. }
  1840. }
  1841. return CURLE_OK;
  1842. }
  1843. #ifndef CURL_DISABLE_PARSEDATE
  1844. CURLcode Curl_add_timecondition(struct Curl_easy *data,
  1845. #ifndef USE_HYPER
  1846. struct dynbuf *req
  1847. #else
  1848. void *req
  1849. #endif
  1850. )
  1851. {
  1852. const struct tm *tm;
  1853. struct tm keeptime;
  1854. CURLcode result;
  1855. char datestr[80];
  1856. const char *condp;
  1857. size_t len;
  1858. if(data->set.timecondition == CURL_TIMECOND_NONE)
  1859. /* no condition was asked for */
  1860. return CURLE_OK;
  1861. result = Curl_gmtime(data->set.timevalue, &keeptime);
  1862. if(result) {
  1863. failf(data, "Invalid TIMEVALUE");
  1864. return result;
  1865. }
  1866. tm = &keeptime;
  1867. switch(data->set.timecondition) {
  1868. default:
  1869. return CURLE_BAD_FUNCTION_ARGUMENT;
  1870. case CURL_TIMECOND_IFMODSINCE:
  1871. condp = "If-Modified-Since";
  1872. len = 17;
  1873. break;
  1874. case CURL_TIMECOND_IFUNMODSINCE:
  1875. condp = "If-Unmodified-Since";
  1876. len = 19;
  1877. break;
  1878. case CURL_TIMECOND_LASTMOD:
  1879. condp = "Last-Modified";
  1880. len = 13;
  1881. break;
  1882. }
  1883. if(Curl_checkheaders(data, condp, len)) {
  1884. /* A custom header was specified; it will be sent instead. */
  1885. return CURLE_OK;
  1886. }
  1887. /* The If-Modified-Since header family should have their times set in
  1888. * GMT as RFC2616 defines: "All HTTP date/time stamps MUST be
  1889. * represented in Greenwich Mean Time (GMT), without exception. For the
  1890. * purposes of HTTP, GMT is exactly equal to UTC (Coordinated Universal
  1891. * Time)." (see page 20 of RFC2616).
  1892. */
  1893. /* format: "Tue, 15 Nov 1994 12:45:26 GMT" */
  1894. msnprintf(datestr, sizeof(datestr),
  1895. "%s: %s, %02d %s %4d %02d:%02d:%02d GMT\r\n",
  1896. condp,
  1897. Curl_wkday[tm->tm_wday?tm->tm_wday-1:6],
  1898. tm->tm_mday,
  1899. Curl_month[tm->tm_mon],
  1900. tm->tm_year + 1900,
  1901. tm->tm_hour,
  1902. tm->tm_min,
  1903. tm->tm_sec);
  1904. #ifndef USE_HYPER
  1905. result = Curl_dyn_add(req, datestr);
  1906. #else
  1907. result = Curl_hyper_header(data, req, datestr);
  1908. #endif
  1909. return result;
  1910. }
  1911. #else
  1912. /* disabled */
  1913. CURLcode Curl_add_timecondition(struct Curl_easy *data,
  1914. struct dynbuf *req)
  1915. {
  1916. (void)data;
  1917. (void)req;
  1918. return CURLE_OK;
  1919. }
  1920. #endif
  1921. void Curl_http_method(struct Curl_easy *data, struct connectdata *conn,
  1922. const char **method, Curl_HttpReq *reqp)
  1923. {
  1924. Curl_HttpReq httpreq = (Curl_HttpReq)data->state.httpreq;
  1925. const char *request;
  1926. if((conn->handler->protocol&(PROTO_FAMILY_HTTP|CURLPROTO_FTP)) &&
  1927. data->state.upload)
  1928. httpreq = HTTPREQ_PUT;
  1929. /* Now set the 'request' pointer to the proper request string */
  1930. if(data->set.str[STRING_CUSTOMREQUEST])
  1931. request = data->set.str[STRING_CUSTOMREQUEST];
  1932. else {
  1933. if(data->req.no_body)
  1934. request = "HEAD";
  1935. else {
  1936. DEBUGASSERT((httpreq >= HTTPREQ_GET) && (httpreq <= HTTPREQ_HEAD));
  1937. switch(httpreq) {
  1938. case HTTPREQ_POST:
  1939. case HTTPREQ_POST_FORM:
  1940. case HTTPREQ_POST_MIME:
  1941. request = "POST";
  1942. break;
  1943. case HTTPREQ_PUT:
  1944. request = "PUT";
  1945. break;
  1946. default: /* this should never happen */
  1947. case HTTPREQ_GET:
  1948. request = "GET";
  1949. break;
  1950. case HTTPREQ_HEAD:
  1951. request = "HEAD";
  1952. break;
  1953. }
  1954. }
  1955. }
  1956. *method = request;
  1957. *reqp = httpreq;
  1958. }
  1959. CURLcode Curl_http_useragent(struct Curl_easy *data)
  1960. {
  1961. /* The User-Agent string might have been allocated in url.c already, because
  1962. it might have been used in the proxy connect, but if we have got a header
  1963. with the user-agent string specified, we erase the previously made string
  1964. here. */
  1965. if(Curl_checkheaders(data, STRCONST("User-Agent"))) {
  1966. free(data->state.aptr.uagent);
  1967. data->state.aptr.uagent = NULL;
  1968. }
  1969. return CURLE_OK;
  1970. }
  1971. CURLcode Curl_http_host(struct Curl_easy *data, struct connectdata *conn)
  1972. {
  1973. const char *ptr;
  1974. struct dynamically_allocated_data *aptr = &data->state.aptr;
  1975. if(!data->state.this_is_a_follow) {
  1976. /* Free to avoid leaking memory on multiple requests */
  1977. free(data->state.first_host);
  1978. data->state.first_host = strdup(conn->host.name);
  1979. if(!data->state.first_host)
  1980. return CURLE_OUT_OF_MEMORY;
  1981. data->state.first_remote_port = conn->remote_port;
  1982. data->state.first_remote_protocol = conn->handler->protocol;
  1983. }
  1984. Curl_safefree(aptr->host);
  1985. ptr = Curl_checkheaders(data, STRCONST("Host"));
  1986. if(ptr && (!data->state.this_is_a_follow ||
  1987. strcasecompare(data->state.first_host, conn->host.name))) {
  1988. #if !defined(CURL_DISABLE_COOKIES)
  1989. /* If we have a given custom Host: header, we extract the host name in
  1990. order to possibly use it for cookie reasons later on. We only allow the
  1991. custom Host: header if this is NOT a redirect, as setting Host: in the
  1992. redirected request is being out on thin ice. Except if the host name
  1993. is the same as the first one! */
  1994. char *cookiehost = Curl_copy_header_value(ptr);
  1995. if(!cookiehost)
  1996. return CURLE_OUT_OF_MEMORY;
  1997. if(!*cookiehost)
  1998. /* ignore empty data */
  1999. free(cookiehost);
  2000. else {
  2001. /* If the host begins with '[', we start searching for the port after
  2002. the bracket has been closed */
  2003. if(*cookiehost == '[') {
  2004. char *closingbracket;
  2005. /* since the 'cookiehost' is an allocated memory area that will be
  2006. freed later we cannot simply increment the pointer */
  2007. memmove(cookiehost, cookiehost + 1, strlen(cookiehost) - 1);
  2008. closingbracket = strchr(cookiehost, ']');
  2009. if(closingbracket)
  2010. *closingbracket = 0;
  2011. }
  2012. else {
  2013. int startsearch = 0;
  2014. char *colon = strchr(cookiehost + startsearch, ':');
  2015. if(colon)
  2016. *colon = 0; /* The host must not include an embedded port number */
  2017. }
  2018. Curl_safefree(aptr->cookiehost);
  2019. aptr->cookiehost = cookiehost;
  2020. }
  2021. #endif
  2022. if(strcmp("Host:", ptr)) {
  2023. aptr->host = aprintf("Host:%s\r\n", &ptr[5]);
  2024. if(!aptr->host)
  2025. return CURLE_OUT_OF_MEMORY;
  2026. }
  2027. }
  2028. else {
  2029. /* When building Host: headers, we must put the host name within
  2030. [brackets] if the host name is a plain IPv6-address. RFC2732-style. */
  2031. const char *host = conn->host.name;
  2032. if(((conn->given->protocol&(CURLPROTO_HTTPS|CURLPROTO_WSS)) &&
  2033. (conn->remote_port == PORT_HTTPS)) ||
  2034. ((conn->given->protocol&(CURLPROTO_HTTP|CURLPROTO_WS)) &&
  2035. (conn->remote_port == PORT_HTTP)) )
  2036. /* if(HTTPS on port 443) OR (HTTP on port 80) then don't include
  2037. the port number in the host string */
  2038. aptr->host = aprintf("Host: %s%s%s\r\n", conn->bits.ipv6_ip?"[":"",
  2039. host, conn->bits.ipv6_ip?"]":"");
  2040. else
  2041. aptr->host = aprintf("Host: %s%s%s:%d\r\n", conn->bits.ipv6_ip?"[":"",
  2042. host, conn->bits.ipv6_ip?"]":"",
  2043. conn->remote_port);
  2044. if(!aptr->host)
  2045. /* without Host: we can't make a nice request */
  2046. return CURLE_OUT_OF_MEMORY;
  2047. }
  2048. return CURLE_OK;
  2049. }
  2050. /*
  2051. * Append the request-target to the HTTP request
  2052. */
  2053. CURLcode Curl_http_target(struct Curl_easy *data,
  2054. struct connectdata *conn,
  2055. struct dynbuf *r)
  2056. {
  2057. CURLcode result = CURLE_OK;
  2058. const char *path = data->state.up.path;
  2059. const char *query = data->state.up.query;
  2060. if(data->set.str[STRING_TARGET]) {
  2061. path = data->set.str[STRING_TARGET];
  2062. query = NULL;
  2063. }
  2064. #ifndef CURL_DISABLE_PROXY
  2065. if(conn->bits.httpproxy && !conn->bits.tunnel_proxy) {
  2066. /* Using a proxy but does not tunnel through it */
  2067. /* The path sent to the proxy is in fact the entire URL. But if the remote
  2068. host is a IDN-name, we must make sure that the request we produce only
  2069. uses the encoded host name! */
  2070. /* and no fragment part */
  2071. CURLUcode uc;
  2072. char *url;
  2073. CURLU *h = curl_url_dup(data->state.uh);
  2074. if(!h)
  2075. return CURLE_OUT_OF_MEMORY;
  2076. if(conn->host.dispname != conn->host.name) {
  2077. uc = curl_url_set(h, CURLUPART_HOST, conn->host.name, 0);
  2078. if(uc) {
  2079. curl_url_cleanup(h);
  2080. return CURLE_OUT_OF_MEMORY;
  2081. }
  2082. }
  2083. uc = curl_url_set(h, CURLUPART_FRAGMENT, NULL, 0);
  2084. if(uc) {
  2085. curl_url_cleanup(h);
  2086. return CURLE_OUT_OF_MEMORY;
  2087. }
  2088. if(strcasecompare("http", data->state.up.scheme)) {
  2089. /* when getting HTTP, we don't want the userinfo the URL */
  2090. uc = curl_url_set(h, CURLUPART_USER, NULL, 0);
  2091. if(uc) {
  2092. curl_url_cleanup(h);
  2093. return CURLE_OUT_OF_MEMORY;
  2094. }
  2095. uc = curl_url_set(h, CURLUPART_PASSWORD, NULL, 0);
  2096. if(uc) {
  2097. curl_url_cleanup(h);
  2098. return CURLE_OUT_OF_MEMORY;
  2099. }
  2100. }
  2101. /* Extract the URL to use in the request. Store in STRING_TEMP_URL for
  2102. clean-up reasons if the function returns before the free() further
  2103. down. */
  2104. uc = curl_url_get(h, CURLUPART_URL, &url, CURLU_NO_DEFAULT_PORT);
  2105. if(uc) {
  2106. curl_url_cleanup(h);
  2107. return CURLE_OUT_OF_MEMORY;
  2108. }
  2109. curl_url_cleanup(h);
  2110. /* target or url */
  2111. result = Curl_dyn_add(r, data->set.str[STRING_TARGET]?
  2112. data->set.str[STRING_TARGET]:url);
  2113. free(url);
  2114. if(result)
  2115. return (result);
  2116. if(strcasecompare("ftp", data->state.up.scheme)) {
  2117. if(data->set.proxy_transfer_mode) {
  2118. /* when doing ftp, append ;type=<a|i> if not present */
  2119. char *type = strstr(path, ";type=");
  2120. if(type && type[6] && type[7] == 0) {
  2121. switch(Curl_raw_toupper(type[6])) {
  2122. case 'A':
  2123. case 'D':
  2124. case 'I':
  2125. break;
  2126. default:
  2127. type = NULL;
  2128. }
  2129. }
  2130. if(!type) {
  2131. result = Curl_dyn_addf(r, ";type=%c",
  2132. data->state.prefer_ascii ? 'a' : 'i');
  2133. if(result)
  2134. return result;
  2135. }
  2136. }
  2137. }
  2138. }
  2139. else
  2140. #else
  2141. (void)conn; /* not used in disabled-proxy builds */
  2142. #endif
  2143. {
  2144. result = Curl_dyn_add(r, path);
  2145. if(result)
  2146. return result;
  2147. if(query)
  2148. result = Curl_dyn_addf(r, "?%s", query);
  2149. }
  2150. return result;
  2151. }
  2152. CURLcode Curl_http_body(struct Curl_easy *data, struct connectdata *conn,
  2153. Curl_HttpReq httpreq, const char **tep)
  2154. {
  2155. CURLcode result = CURLE_OK;
  2156. const char *ptr;
  2157. struct HTTP *http = data->req.p.http;
  2158. http->postsize = 0;
  2159. switch(httpreq) {
  2160. case HTTPREQ_POST_MIME:
  2161. data->state.mimepost = &data->set.mimepost;
  2162. break;
  2163. #ifndef CURL_DISABLE_FORM_API
  2164. case HTTPREQ_POST_FORM:
  2165. /* Convert the form structure into a mime structure, then keep
  2166. the conversion */
  2167. if(!data->state.formp) {
  2168. data->state.formp = calloc(sizeof(curl_mimepart), 1);
  2169. if(!data->state.formp)
  2170. return CURLE_OUT_OF_MEMORY;
  2171. Curl_mime_cleanpart(data->state.formp);
  2172. result = Curl_getformdata(data, data->state.formp, data->set.httppost,
  2173. data->state.fread_func);
  2174. if(result)
  2175. return result;
  2176. data->state.mimepost = data->state.formp;
  2177. }
  2178. break;
  2179. #endif
  2180. default:
  2181. data->state.mimepost = NULL;
  2182. }
  2183. #ifndef CURL_DISABLE_MIME
  2184. if(data->state.mimepost) {
  2185. const char *cthdr = Curl_checkheaders(data, STRCONST("Content-Type"));
  2186. /* Read and seek body only. */
  2187. data->state.mimepost->flags |= MIME_BODY_ONLY;
  2188. /* Prepare the mime structure headers & set content type. */
  2189. if(cthdr)
  2190. for(cthdr += 13; *cthdr == ' '; cthdr++)
  2191. ;
  2192. else if(data->state.mimepost->kind == MIMEKIND_MULTIPART)
  2193. cthdr = "multipart/form-data";
  2194. curl_mime_headers(data->state.mimepost, data->set.headers, 0);
  2195. result = Curl_mime_prepare_headers(data, data->state.mimepost, cthdr,
  2196. NULL, MIMESTRATEGY_FORM);
  2197. curl_mime_headers(data->state.mimepost, NULL, 0);
  2198. if(!result)
  2199. result = Curl_mime_rewind(data->state.mimepost);
  2200. if(result)
  2201. return result;
  2202. http->postsize = Curl_mime_size(data->state.mimepost);
  2203. }
  2204. #endif
  2205. ptr = Curl_checkheaders(data, STRCONST("Transfer-Encoding"));
  2206. if(ptr) {
  2207. /* Some kind of TE is requested, check if 'chunked' is chosen */
  2208. data->req.upload_chunky =
  2209. Curl_compareheader(ptr,
  2210. STRCONST("Transfer-Encoding:"), STRCONST("chunked"));
  2211. }
  2212. else {
  2213. if((conn->handler->protocol & PROTO_FAMILY_HTTP) &&
  2214. (((httpreq == HTTPREQ_POST_MIME || httpreq == HTTPREQ_POST_FORM) &&
  2215. http->postsize < 0) ||
  2216. ((data->state.upload || httpreq == HTTPREQ_POST) &&
  2217. data->state.infilesize == -1))) {
  2218. if(conn->bits.authneg)
  2219. /* don't enable chunked during auth neg */
  2220. ;
  2221. else if(Curl_use_http_1_1plus(data, conn)) {
  2222. if(conn->httpversion < 20)
  2223. /* HTTP, upload, unknown file size and not HTTP 1.0 */
  2224. data->req.upload_chunky = TRUE;
  2225. }
  2226. else {
  2227. failf(data, "Chunky upload is not supported by HTTP 1.0");
  2228. return CURLE_UPLOAD_FAILED;
  2229. }
  2230. }
  2231. else {
  2232. /* else, no chunky upload */
  2233. data->req.upload_chunky = FALSE;
  2234. }
  2235. if(data->req.upload_chunky)
  2236. *tep = "Transfer-Encoding: chunked\r\n";
  2237. }
  2238. return result;
  2239. }
  2240. CURLcode Curl_http_bodysend(struct Curl_easy *data, struct connectdata *conn,
  2241. struct dynbuf *r, Curl_HttpReq httpreq)
  2242. {
  2243. #ifndef USE_HYPER
  2244. /* Hyper always handles the body separately */
  2245. curl_off_t included_body = 0;
  2246. #else
  2247. /* from this point down, this function should not be used */
  2248. #define Curl_buffer_send(a,b,c,d,e,f) CURLE_OK
  2249. #endif
  2250. CURLcode result = CURLE_OK;
  2251. struct HTTP *http = data->req.p.http;
  2252. const char *ptr;
  2253. /* If 'authdone' is FALSE, we must not set the write socket index to the
  2254. Curl_transfer() call below, as we're not ready to actually upload any
  2255. data yet. */
  2256. switch(httpreq) {
  2257. case HTTPREQ_PUT: /* Let's PUT the data to the server! */
  2258. if(conn->bits.authneg)
  2259. http->postsize = 0;
  2260. else
  2261. http->postsize = data->state.infilesize;
  2262. if((http->postsize != -1) && !data->req.upload_chunky &&
  2263. (conn->bits.authneg ||
  2264. !Curl_checkheaders(data, STRCONST("Content-Length")))) {
  2265. /* only add Content-Length if not uploading chunked */
  2266. result = Curl_dyn_addf(r, "Content-Length: %" CURL_FORMAT_CURL_OFF_T
  2267. "\r\n", http->postsize);
  2268. if(result)
  2269. return result;
  2270. }
  2271. /* For really small puts we don't use Expect: headers at all, and for
  2272. the somewhat bigger ones we allow the app to disable it. Just make
  2273. sure that the expect100header is always set to the preferred value
  2274. here. */
  2275. ptr = Curl_checkheaders(data, STRCONST("Expect"));
  2276. if(ptr) {
  2277. data->state.expect100header =
  2278. Curl_compareheader(ptr, STRCONST("Expect:"), STRCONST("100-continue"));
  2279. }
  2280. else if(http->postsize > EXPECT_100_THRESHOLD || http->postsize < 0) {
  2281. result = expect100(data, conn, r);
  2282. if(result)
  2283. return result;
  2284. }
  2285. /* end of headers */
  2286. result = Curl_dyn_addn(r, STRCONST("\r\n"));
  2287. if(result)
  2288. return result;
  2289. /* set the upload size to the progress meter */
  2290. Curl_pgrsSetUploadSize(data, http->postsize);
  2291. /* this sends the buffer and frees all the buffer resources */
  2292. result = Curl_buffer_send(r, data, data->req.p.http,
  2293. &data->info.request_size, 0,
  2294. FIRSTSOCKET);
  2295. if(result)
  2296. failf(data, "Failed sending PUT request");
  2297. else
  2298. /* prepare for transfer */
  2299. Curl_setup_transfer(data, FIRSTSOCKET, -1, TRUE,
  2300. http->postsize?FIRSTSOCKET:-1);
  2301. if(result)
  2302. return result;
  2303. break;
  2304. case HTTPREQ_POST_FORM:
  2305. case HTTPREQ_POST_MIME:
  2306. /* This is form posting using mime data. */
  2307. if(conn->bits.authneg) {
  2308. /* nothing to post! */
  2309. result = Curl_dyn_addn(r, STRCONST("Content-Length: 0\r\n\r\n"));
  2310. if(result)
  2311. return result;
  2312. result = Curl_buffer_send(r, data, data->req.p.http,
  2313. &data->info.request_size, 0,
  2314. FIRSTSOCKET);
  2315. if(result)
  2316. failf(data, "Failed sending POST request");
  2317. else
  2318. /* setup variables for the upcoming transfer */
  2319. Curl_setup_transfer(data, FIRSTSOCKET, -1, TRUE, -1);
  2320. break;
  2321. }
  2322. data->state.infilesize = http->postsize;
  2323. /* We only set Content-Length and allow a custom Content-Length if
  2324. we don't upload data chunked, as RFC2616 forbids us to set both
  2325. kinds of headers (Transfer-Encoding: chunked and Content-Length) */
  2326. if(http->postsize != -1 && !data->req.upload_chunky &&
  2327. (!Curl_checkheaders(data, STRCONST("Content-Length")))) {
  2328. /* we allow replacing this header if not during auth negotiation,
  2329. although it isn't very wise to actually set your own */
  2330. result = Curl_dyn_addf(r,
  2331. "Content-Length: %" CURL_FORMAT_CURL_OFF_T
  2332. "\r\n", http->postsize);
  2333. if(result)
  2334. return result;
  2335. }
  2336. #ifndef CURL_DISABLE_MIME
  2337. /* Output mime-generated headers. */
  2338. {
  2339. struct curl_slist *hdr;
  2340. for(hdr = data->state.mimepost->curlheaders; hdr; hdr = hdr->next) {
  2341. result = Curl_dyn_addf(r, "%s\r\n", hdr->data);
  2342. if(result)
  2343. return result;
  2344. }
  2345. }
  2346. #endif
  2347. /* For really small posts we don't use Expect: headers at all, and for
  2348. the somewhat bigger ones we allow the app to disable it. Just make
  2349. sure that the expect100header is always set to the preferred value
  2350. here. */
  2351. ptr = Curl_checkheaders(data, STRCONST("Expect"));
  2352. if(ptr) {
  2353. data->state.expect100header =
  2354. Curl_compareheader(ptr, STRCONST("Expect:"), STRCONST("100-continue"));
  2355. }
  2356. else if(http->postsize > EXPECT_100_THRESHOLD || http->postsize < 0) {
  2357. result = expect100(data, conn, r);
  2358. if(result)
  2359. return result;
  2360. }
  2361. else
  2362. data->state.expect100header = FALSE;
  2363. /* make the request end in a true CRLF */
  2364. result = Curl_dyn_addn(r, STRCONST("\r\n"));
  2365. if(result)
  2366. return result;
  2367. /* set the upload size to the progress meter */
  2368. Curl_pgrsSetUploadSize(data, http->postsize);
  2369. /* Read from mime structure. */
  2370. data->state.fread_func = (curl_read_callback) Curl_mime_read;
  2371. data->state.in = (void *) data->state.mimepost;
  2372. http->sending = HTTPSEND_BODY;
  2373. /* this sends the buffer and frees all the buffer resources */
  2374. result = Curl_buffer_send(r, data, data->req.p.http,
  2375. &data->info.request_size, 0,
  2376. FIRSTSOCKET);
  2377. if(result)
  2378. failf(data, "Failed sending POST request");
  2379. else
  2380. /* prepare for transfer */
  2381. Curl_setup_transfer(data, FIRSTSOCKET, -1, TRUE,
  2382. http->postsize?FIRSTSOCKET:-1);
  2383. if(result)
  2384. return result;
  2385. break;
  2386. case HTTPREQ_POST:
  2387. /* this is the simple POST, using x-www-form-urlencoded style */
  2388. if(conn->bits.authneg)
  2389. http->postsize = 0;
  2390. else
  2391. /* the size of the post body */
  2392. http->postsize = data->state.infilesize;
  2393. /* We only set Content-Length and allow a custom Content-Length if
  2394. we don't upload data chunked, as RFC2616 forbids us to set both
  2395. kinds of headers (Transfer-Encoding: chunked and Content-Length) */
  2396. if((http->postsize != -1) && !data->req.upload_chunky &&
  2397. (conn->bits.authneg ||
  2398. !Curl_checkheaders(data, STRCONST("Content-Length")))) {
  2399. /* we allow replacing this header if not during auth negotiation,
  2400. although it isn't very wise to actually set your own */
  2401. result = Curl_dyn_addf(r, "Content-Length: %" CURL_FORMAT_CURL_OFF_T
  2402. "\r\n", http->postsize);
  2403. if(result)
  2404. return result;
  2405. }
  2406. if(!Curl_checkheaders(data, STRCONST("Content-Type"))) {
  2407. result = Curl_dyn_addn(r, STRCONST("Content-Type: application/"
  2408. "x-www-form-urlencoded\r\n"));
  2409. if(result)
  2410. return result;
  2411. }
  2412. /* For really small posts we don't use Expect: headers at all, and for
  2413. the somewhat bigger ones we allow the app to disable it. Just make
  2414. sure that the expect100header is always set to the preferred value
  2415. here. */
  2416. ptr = Curl_checkheaders(data, STRCONST("Expect"));
  2417. if(ptr) {
  2418. data->state.expect100header =
  2419. Curl_compareheader(ptr, STRCONST("Expect:"), STRCONST("100-continue"));
  2420. }
  2421. else if(http->postsize > EXPECT_100_THRESHOLD || http->postsize < 0) {
  2422. result = expect100(data, conn, r);
  2423. if(result)
  2424. return result;
  2425. }
  2426. else
  2427. data->state.expect100header = FALSE;
  2428. #ifndef USE_HYPER
  2429. /* With Hyper the body is always passed on separately */
  2430. if(data->set.postfields) {
  2431. if(!data->state.expect100header &&
  2432. (http->postsize < MAX_INITIAL_POST_SIZE)) {
  2433. /* if we don't use expect: 100 AND
  2434. postsize is less than MAX_INITIAL_POST_SIZE
  2435. then append the post data to the HTTP request header. This limit
  2436. is no magic limit but only set to prevent really huge POSTs to
  2437. get the data duplicated with malloc() and family. */
  2438. /* end of headers! */
  2439. result = Curl_dyn_addn(r, STRCONST("\r\n"));
  2440. if(result)
  2441. return result;
  2442. if(!data->req.upload_chunky) {
  2443. /* We're not sending it 'chunked', append it to the request
  2444. already now to reduce the number of send() calls */
  2445. result = Curl_dyn_addn(r, data->set.postfields,
  2446. (size_t)http->postsize);
  2447. included_body = http->postsize;
  2448. }
  2449. else {
  2450. if(http->postsize) {
  2451. char chunk[16];
  2452. /* Append the POST data chunky-style */
  2453. msnprintf(chunk, sizeof(chunk), "%x\r\n", (int)http->postsize);
  2454. result = Curl_dyn_add(r, chunk);
  2455. if(!result) {
  2456. included_body = http->postsize + strlen(chunk);
  2457. result = Curl_dyn_addn(r, data->set.postfields,
  2458. (size_t)http->postsize);
  2459. if(!result)
  2460. result = Curl_dyn_addn(r, STRCONST("\r\n"));
  2461. included_body += 2;
  2462. }
  2463. }
  2464. if(!result) {
  2465. result = Curl_dyn_addn(r, STRCONST("\x30\x0d\x0a\x0d\x0a"));
  2466. /* 0 CR LF CR LF */
  2467. included_body += 5;
  2468. }
  2469. }
  2470. if(result)
  2471. return result;
  2472. /* Make sure the progress information is accurate */
  2473. Curl_pgrsSetUploadSize(data, http->postsize);
  2474. }
  2475. else {
  2476. /* A huge POST coming up, do data separate from the request */
  2477. http->postdata = data->set.postfields;
  2478. http->sending = HTTPSEND_BODY;
  2479. http->backup.data = data;
  2480. data->state.fread_func = (curl_read_callback)readmoredata;
  2481. data->state.in = (void *)http;
  2482. /* set the upload size to the progress meter */
  2483. Curl_pgrsSetUploadSize(data, http->postsize);
  2484. /* end of headers! */
  2485. result = Curl_dyn_addn(r, STRCONST("\r\n"));
  2486. if(result)
  2487. return result;
  2488. }
  2489. }
  2490. else
  2491. #endif
  2492. {
  2493. /* end of headers! */
  2494. result = Curl_dyn_addn(r, STRCONST("\r\n"));
  2495. if(result)
  2496. return result;
  2497. if(data->req.upload_chunky && conn->bits.authneg) {
  2498. /* Chunky upload is selected and we're negotiating auth still, send
  2499. end-of-data only */
  2500. result = Curl_dyn_addn(r, (char *)STRCONST("\x30\x0d\x0a\x0d\x0a"));
  2501. /* 0 CR LF CR LF */
  2502. if(result)
  2503. return result;
  2504. }
  2505. else if(data->state.infilesize) {
  2506. /* set the upload size to the progress meter */
  2507. Curl_pgrsSetUploadSize(data, http->postsize?http->postsize:-1);
  2508. /* set the pointer to mark that we will send the post body using the
  2509. read callback, but only if we're not in authenticate negotiation */
  2510. if(!conn->bits.authneg)
  2511. http->postdata = (char *)&http->postdata;
  2512. }
  2513. }
  2514. /* issue the request */
  2515. result = Curl_buffer_send(r, data, data->req.p.http,
  2516. &data->info.request_size, included_body,
  2517. FIRSTSOCKET);
  2518. if(result)
  2519. failf(data, "Failed sending HTTP POST request");
  2520. else
  2521. Curl_setup_transfer(data, FIRSTSOCKET, -1, TRUE,
  2522. http->postdata?FIRSTSOCKET:-1);
  2523. break;
  2524. default:
  2525. result = Curl_dyn_addn(r, STRCONST("\r\n"));
  2526. if(result)
  2527. return result;
  2528. /* issue the request */
  2529. result = Curl_buffer_send(r, data, data->req.p.http,
  2530. &data->info.request_size, 0,
  2531. FIRSTSOCKET);
  2532. if(result)
  2533. failf(data, "Failed sending HTTP request");
  2534. #ifdef USE_WEBSOCKETS
  2535. else if((conn->handler->protocol & (CURLPROTO_WS|CURLPROTO_WSS)) &&
  2536. !(data->set.connect_only))
  2537. /* Set up the transfer for two-way since without CONNECT_ONLY set, this
  2538. request probably wants to send data too post upgrade */
  2539. Curl_setup_transfer(data, FIRSTSOCKET, -1, TRUE, FIRSTSOCKET);
  2540. #endif
  2541. else
  2542. /* HTTP GET/HEAD download: */
  2543. Curl_setup_transfer(data, FIRSTSOCKET, -1, TRUE, -1);
  2544. }
  2545. return result;
  2546. }
  2547. #if !defined(CURL_DISABLE_COOKIES)
  2548. CURLcode Curl_http_cookies(struct Curl_easy *data,
  2549. struct connectdata *conn,
  2550. struct dynbuf *r)
  2551. {
  2552. CURLcode result = CURLE_OK;
  2553. char *addcookies = NULL;
  2554. bool linecap = FALSE;
  2555. if(data->set.str[STRING_COOKIE] &&
  2556. !Curl_checkheaders(data, STRCONST("Cookie")))
  2557. addcookies = data->set.str[STRING_COOKIE];
  2558. if(data->cookies || addcookies) {
  2559. struct Cookie *co = NULL; /* no cookies from start */
  2560. int count = 0;
  2561. if(data->cookies && data->state.cookie_engine) {
  2562. const char *host = data->state.aptr.cookiehost ?
  2563. data->state.aptr.cookiehost : conn->host.name;
  2564. const bool secure_context =
  2565. conn->handler->protocol&(CURLPROTO_HTTPS|CURLPROTO_WSS) ||
  2566. strcasecompare("localhost", host) ||
  2567. !strcmp(host, "127.0.0.1") ||
  2568. !strcmp(host, "::1") ? TRUE : FALSE;
  2569. Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
  2570. co = Curl_cookie_getlist(data, data->cookies, host, data->state.up.path,
  2571. secure_context);
  2572. Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
  2573. }
  2574. if(co) {
  2575. struct Cookie *store = co;
  2576. size_t clen = 8; /* hold the size of the generated Cookie: header */
  2577. /* now loop through all cookies that matched */
  2578. while(co) {
  2579. if(co->value) {
  2580. size_t add;
  2581. if(!count) {
  2582. result = Curl_dyn_addn(r, STRCONST("Cookie: "));
  2583. if(result)
  2584. break;
  2585. }
  2586. add = strlen(co->name) + strlen(co->value) + 1;
  2587. if(clen + add >= MAX_COOKIE_HEADER_LEN) {
  2588. infof(data, "Restricted outgoing cookies due to header size, "
  2589. "'%s' not sent", co->name);
  2590. linecap = TRUE;
  2591. break;
  2592. }
  2593. result = Curl_dyn_addf(r, "%s%s=%s", count?"; ":"",
  2594. co->name, co->value);
  2595. if(result)
  2596. break;
  2597. clen += add + (count ? 2 : 0);
  2598. count++;
  2599. }
  2600. co = co->next; /* next cookie please */
  2601. }
  2602. Curl_cookie_freelist(store);
  2603. }
  2604. if(addcookies && !result && !linecap) {
  2605. if(!count)
  2606. result = Curl_dyn_addn(r, STRCONST("Cookie: "));
  2607. if(!result) {
  2608. result = Curl_dyn_addf(r, "%s%s", count?"; ":"", addcookies);
  2609. count++;
  2610. }
  2611. }
  2612. if(count && !result)
  2613. result = Curl_dyn_addn(r, STRCONST("\r\n"));
  2614. if(result)
  2615. return result;
  2616. }
  2617. return result;
  2618. }
  2619. #endif
  2620. CURLcode Curl_http_range(struct Curl_easy *data,
  2621. Curl_HttpReq httpreq)
  2622. {
  2623. if(data->state.use_range) {
  2624. /*
  2625. * A range is selected. We use different headers whether we're downloading
  2626. * or uploading and we always let customized headers override our internal
  2627. * ones if any such are specified.
  2628. */
  2629. if(((httpreq == HTTPREQ_GET) || (httpreq == HTTPREQ_HEAD)) &&
  2630. !Curl_checkheaders(data, STRCONST("Range"))) {
  2631. /* if a line like this was already allocated, free the previous one */
  2632. free(data->state.aptr.rangeline);
  2633. data->state.aptr.rangeline = aprintf("Range: bytes=%s\r\n",
  2634. data->state.range);
  2635. }
  2636. else if((httpreq == HTTPREQ_POST || httpreq == HTTPREQ_PUT) &&
  2637. !Curl_checkheaders(data, STRCONST("Content-Range"))) {
  2638. /* if a line like this was already allocated, free the previous one */
  2639. free(data->state.aptr.rangeline);
  2640. if(data->set.set_resume_from < 0) {
  2641. /* Upload resume was asked for, but we don't know the size of the
  2642. remote part so we tell the server (and act accordingly) that we
  2643. upload the whole file (again) */
  2644. data->state.aptr.rangeline =
  2645. aprintf("Content-Range: bytes 0-%" CURL_FORMAT_CURL_OFF_T
  2646. "/%" CURL_FORMAT_CURL_OFF_T "\r\n",
  2647. data->state.infilesize - 1, data->state.infilesize);
  2648. }
  2649. else if(data->state.resume_from) {
  2650. /* This is because "resume" was selected */
  2651. curl_off_t total_expected_size =
  2652. data->state.resume_from + data->state.infilesize;
  2653. data->state.aptr.rangeline =
  2654. aprintf("Content-Range: bytes %s%" CURL_FORMAT_CURL_OFF_T
  2655. "/%" CURL_FORMAT_CURL_OFF_T "\r\n",
  2656. data->state.range, total_expected_size-1,
  2657. total_expected_size);
  2658. }
  2659. else {
  2660. /* Range was selected and then we just pass the incoming range and
  2661. append total size */
  2662. data->state.aptr.rangeline =
  2663. aprintf("Content-Range: bytes %s/%" CURL_FORMAT_CURL_OFF_T "\r\n",
  2664. data->state.range, data->state.infilesize);
  2665. }
  2666. if(!data->state.aptr.rangeline)
  2667. return CURLE_OUT_OF_MEMORY;
  2668. }
  2669. }
  2670. return CURLE_OK;
  2671. }
  2672. CURLcode Curl_http_resume(struct Curl_easy *data,
  2673. struct connectdata *conn,
  2674. Curl_HttpReq httpreq)
  2675. {
  2676. if((HTTPREQ_POST == httpreq || HTTPREQ_PUT == httpreq) &&
  2677. data->state.resume_from) {
  2678. /**********************************************************************
  2679. * Resuming upload in HTTP means that we PUT or POST and that we have
  2680. * got a resume_from value set. The resume value has already created
  2681. * a Range: header that will be passed along. We need to "fast forward"
  2682. * the file the given number of bytes and decrease the assume upload
  2683. * file size before we continue this venture in the dark lands of HTTP.
  2684. * Resuming mime/form posting at an offset > 0 has no sense and is ignored.
  2685. *********************************************************************/
  2686. if(data->state.resume_from < 0) {
  2687. /*
  2688. * This is meant to get the size of the present remote-file by itself.
  2689. * We don't support this now. Bail out!
  2690. */
  2691. data->state.resume_from = 0;
  2692. }
  2693. if(data->state.resume_from && !data->state.followlocation) {
  2694. /* only act on the first request */
  2695. /* Now, let's read off the proper amount of bytes from the
  2696. input. */
  2697. int seekerr = CURL_SEEKFUNC_CANTSEEK;
  2698. if(conn->seek_func) {
  2699. Curl_set_in_callback(data, true);
  2700. seekerr = conn->seek_func(conn->seek_client, data->state.resume_from,
  2701. SEEK_SET);
  2702. Curl_set_in_callback(data, false);
  2703. }
  2704. if(seekerr != CURL_SEEKFUNC_OK) {
  2705. curl_off_t passed = 0;
  2706. if(seekerr != CURL_SEEKFUNC_CANTSEEK) {
  2707. failf(data, "Could not seek stream");
  2708. return CURLE_READ_ERROR;
  2709. }
  2710. /* when seekerr == CURL_SEEKFUNC_CANTSEEK (can't seek to offset) */
  2711. do {
  2712. size_t readthisamountnow =
  2713. (data->state.resume_from - passed > data->set.buffer_size) ?
  2714. (size_t)data->set.buffer_size :
  2715. curlx_sotouz(data->state.resume_from - passed);
  2716. size_t actuallyread =
  2717. data->state.fread_func(data->state.buffer, 1, readthisamountnow,
  2718. data->state.in);
  2719. passed += actuallyread;
  2720. if((actuallyread == 0) || (actuallyread > readthisamountnow)) {
  2721. /* this checks for greater-than only to make sure that the
  2722. CURL_READFUNC_ABORT return code still aborts */
  2723. failf(data, "Could only read %" CURL_FORMAT_CURL_OFF_T
  2724. " bytes from the input", passed);
  2725. return CURLE_READ_ERROR;
  2726. }
  2727. } while(passed < data->state.resume_from);
  2728. }
  2729. /* now, decrease the size of the read */
  2730. if(data->state.infilesize>0) {
  2731. data->state.infilesize -= data->state.resume_from;
  2732. if(data->state.infilesize <= 0) {
  2733. failf(data, "File already completely uploaded");
  2734. return CURLE_PARTIAL_FILE;
  2735. }
  2736. }
  2737. /* we've passed, proceed as normal */
  2738. }
  2739. }
  2740. return CURLE_OK;
  2741. }
  2742. CURLcode Curl_http_firstwrite(struct Curl_easy *data,
  2743. struct connectdata *conn,
  2744. bool *done)
  2745. {
  2746. struct SingleRequest *k = &data->req;
  2747. if(data->req.newurl) {
  2748. if(conn->bits.close) {
  2749. /* Abort after the headers if "follow Location" is set
  2750. and we're set to close anyway. */
  2751. k->keepon &= ~KEEP_RECV;
  2752. *done = TRUE;
  2753. return CURLE_OK;
  2754. }
  2755. /* We have a new url to load, but since we want to be able to reuse this
  2756. connection properly, we read the full response in "ignore more" */
  2757. k->ignorebody = TRUE;
  2758. infof(data, "Ignoring the response-body");
  2759. }
  2760. if(data->state.resume_from && !k->content_range &&
  2761. (data->state.httpreq == HTTPREQ_GET) &&
  2762. !k->ignorebody) {
  2763. if(k->size == data->state.resume_from) {
  2764. /* The resume point is at the end of file, consider this fine even if it
  2765. doesn't allow resume from here. */
  2766. infof(data, "The entire document is already downloaded");
  2767. streamclose(conn, "already downloaded");
  2768. /* Abort download */
  2769. k->keepon &= ~KEEP_RECV;
  2770. *done = TRUE;
  2771. return CURLE_OK;
  2772. }
  2773. /* we wanted to resume a download, although the server doesn't seem to
  2774. * support this and we did this with a GET (if it wasn't a GET we did a
  2775. * POST or PUT resume) */
  2776. failf(data, "HTTP server doesn't seem to support "
  2777. "byte ranges. Cannot resume.");
  2778. return CURLE_RANGE_ERROR;
  2779. }
  2780. if(data->set.timecondition && !data->state.range) {
  2781. /* A time condition has been set AND no ranges have been requested. This
  2782. seems to be what chapter 13.3.4 of RFC 2616 defines to be the correct
  2783. action for an HTTP/1.1 client */
  2784. if(!Curl_meets_timecondition(data, k->timeofdoc)) {
  2785. *done = TRUE;
  2786. /* We're simulating an HTTP 304 from server so we return
  2787. what should have been returned from the server */
  2788. data->info.httpcode = 304;
  2789. infof(data, "Simulate an HTTP 304 response");
  2790. /* we abort the transfer before it is completed == we ruin the
  2791. reuse ability. Close the connection */
  2792. streamclose(conn, "Simulated 304 handling");
  2793. return CURLE_OK;
  2794. }
  2795. } /* we have a time condition */
  2796. return CURLE_OK;
  2797. }
  2798. #ifdef HAVE_LIBZ
  2799. CURLcode Curl_transferencode(struct Curl_easy *data)
  2800. {
  2801. if(!Curl_checkheaders(data, STRCONST("TE")) &&
  2802. data->set.http_transfer_encoding) {
  2803. /* When we are to insert a TE: header in the request, we must also insert
  2804. TE in a Connection: header, so we need to merge the custom provided
  2805. Connection: header and prevent the original to get sent. Note that if
  2806. the user has inserted his/her own TE: header we don't do this magic
  2807. but then assume that the user will handle it all! */
  2808. char *cptr = Curl_checkheaders(data, STRCONST("Connection"));
  2809. #define TE_HEADER "TE: gzip\r\n"
  2810. Curl_safefree(data->state.aptr.te);
  2811. if(cptr) {
  2812. cptr = Curl_copy_header_value(cptr);
  2813. if(!cptr)
  2814. return CURLE_OUT_OF_MEMORY;
  2815. }
  2816. /* Create the (updated) Connection: header */
  2817. data->state.aptr.te = aprintf("Connection: %s%sTE\r\n" TE_HEADER,
  2818. cptr ? cptr : "", (cptr && *cptr) ? ", ":"");
  2819. free(cptr);
  2820. if(!data->state.aptr.te)
  2821. return CURLE_OUT_OF_MEMORY;
  2822. }
  2823. return CURLE_OK;
  2824. }
  2825. #endif
  2826. #ifndef USE_HYPER
  2827. /*
  2828. * Curl_http() gets called from the generic multi_do() function when an HTTP
  2829. * request is to be performed. This creates and sends a properly constructed
  2830. * HTTP request.
  2831. */
  2832. CURLcode Curl_http(struct Curl_easy *data, bool *done)
  2833. {
  2834. struct connectdata *conn = data->conn;
  2835. CURLcode result = CURLE_OK;
  2836. struct HTTP *http;
  2837. Curl_HttpReq httpreq;
  2838. const char *te = ""; /* transfer-encoding */
  2839. const char *request;
  2840. const char *httpstring;
  2841. struct dynbuf req;
  2842. char *altused = NULL;
  2843. const char *p_accept; /* Accept: string */
  2844. /* Always consider the DO phase done after this function call, even if there
  2845. may be parts of the request that are not yet sent, since we can deal with
  2846. the rest of the request in the PERFORM phase. */
  2847. *done = TRUE;
  2848. switch(conn->alpn) {
  2849. case CURL_HTTP_VERSION_3:
  2850. DEBUGASSERT(Curl_conn_is_http3(data, conn, FIRSTSOCKET));
  2851. break;
  2852. case CURL_HTTP_VERSION_2:
  2853. #ifndef CURL_DISABLE_PROXY
  2854. if(!Curl_conn_is_http2(data, conn, FIRSTSOCKET) &&
  2855. conn->bits.proxy && !conn->bits.tunnel_proxy
  2856. ) {
  2857. result = Curl_http2_switch(data, conn, FIRSTSOCKET);
  2858. if(result)
  2859. return result;
  2860. }
  2861. else
  2862. #endif
  2863. DEBUGASSERT(Curl_conn_is_http2(data, conn, FIRSTSOCKET));
  2864. break;
  2865. case CURL_HTTP_VERSION_1_1:
  2866. /* continue with HTTP/1.1 when explicitly requested */
  2867. break;
  2868. default:
  2869. /* Check if user wants to use HTTP/2 with clear TCP */
  2870. if(Curl_http2_may_switch(data, conn, FIRSTSOCKET)) {
  2871. DEBUGF(infof(data, "HTTP/2 over clean TCP"));
  2872. result = Curl_http2_switch(data, conn, FIRSTSOCKET);
  2873. if(result)
  2874. return result;
  2875. }
  2876. break;
  2877. }
  2878. http = data->req.p.http;
  2879. DEBUGASSERT(http);
  2880. result = Curl_http_host(data, conn);
  2881. if(result)
  2882. return result;
  2883. result = Curl_http_useragent(data);
  2884. if(result)
  2885. return result;
  2886. Curl_http_method(data, conn, &request, &httpreq);
  2887. /* setup the authentication headers */
  2888. {
  2889. char *pq = NULL;
  2890. if(data->state.up.query) {
  2891. pq = aprintf("%s?%s", data->state.up.path, data->state.up.query);
  2892. if(!pq)
  2893. return CURLE_OUT_OF_MEMORY;
  2894. }
  2895. result = Curl_http_output_auth(data, conn, request, httpreq,
  2896. (pq ? pq : data->state.up.path), FALSE);
  2897. free(pq);
  2898. if(result)
  2899. return result;
  2900. }
  2901. Curl_safefree(data->state.aptr.ref);
  2902. if(data->state.referer && !Curl_checkheaders(data, STRCONST("Referer"))) {
  2903. data->state.aptr.ref = aprintf("Referer: %s\r\n", data->state.referer);
  2904. if(!data->state.aptr.ref)
  2905. return CURLE_OUT_OF_MEMORY;
  2906. }
  2907. if(!Curl_checkheaders(data, STRCONST("Accept-Encoding")) &&
  2908. data->set.str[STRING_ENCODING]) {
  2909. Curl_safefree(data->state.aptr.accept_encoding);
  2910. data->state.aptr.accept_encoding =
  2911. aprintf("Accept-Encoding: %s\r\n", data->set.str[STRING_ENCODING]);
  2912. if(!data->state.aptr.accept_encoding)
  2913. return CURLE_OUT_OF_MEMORY;
  2914. }
  2915. else
  2916. Curl_safefree(data->state.aptr.accept_encoding);
  2917. #ifdef HAVE_LIBZ
  2918. /* we only consider transfer-encoding magic if libz support is built-in */
  2919. result = Curl_transferencode(data);
  2920. if(result)
  2921. return result;
  2922. #endif
  2923. result = Curl_http_body(data, conn, httpreq, &te);
  2924. if(result)
  2925. return result;
  2926. p_accept = Curl_checkheaders(data,
  2927. STRCONST("Accept"))?NULL:"Accept: */*\r\n";
  2928. result = Curl_http_resume(data, conn, httpreq);
  2929. if(result)
  2930. return result;
  2931. result = Curl_http_range(data, httpreq);
  2932. if(result)
  2933. return result;
  2934. httpstring = get_http_string(data, conn);
  2935. /* initialize a dynamic send-buffer */
  2936. Curl_dyn_init(&req, DYN_HTTP_REQUEST);
  2937. /* make sure the header buffer is reset - if there are leftovers from a
  2938. previous transfer */
  2939. Curl_dyn_reset(&data->state.headerb);
  2940. /* add the main request stuff */
  2941. /* GET/HEAD/POST/PUT */
  2942. result = Curl_dyn_addf(&req, "%s ", request);
  2943. if(!result)
  2944. result = Curl_http_target(data, conn, &req);
  2945. if(result) {
  2946. Curl_dyn_free(&req);
  2947. return result;
  2948. }
  2949. #ifndef CURL_DISABLE_ALTSVC
  2950. if(conn->bits.altused && !Curl_checkheaders(data, STRCONST("Alt-Used"))) {
  2951. altused = aprintf("Alt-Used: %s:%d\r\n",
  2952. conn->conn_to_host.name, conn->conn_to_port);
  2953. if(!altused) {
  2954. Curl_dyn_free(&req);
  2955. return CURLE_OUT_OF_MEMORY;
  2956. }
  2957. }
  2958. #endif
  2959. result =
  2960. Curl_dyn_addf(&req,
  2961. " HTTP/%s\r\n" /* HTTP version */
  2962. "%s" /* host */
  2963. "%s" /* proxyuserpwd */
  2964. "%s" /* userpwd */
  2965. "%s" /* range */
  2966. "%s" /* user agent */
  2967. "%s" /* accept */
  2968. "%s" /* TE: */
  2969. "%s" /* accept-encoding */
  2970. "%s" /* referer */
  2971. "%s" /* Proxy-Connection */
  2972. "%s" /* transfer-encoding */
  2973. "%s",/* Alt-Used */
  2974. httpstring,
  2975. (data->state.aptr.host?data->state.aptr.host:""),
  2976. data->state.aptr.proxyuserpwd?
  2977. data->state.aptr.proxyuserpwd:"",
  2978. data->state.aptr.userpwd?data->state.aptr.userpwd:"",
  2979. (data->state.use_range && data->state.aptr.rangeline)?
  2980. data->state.aptr.rangeline:"",
  2981. (data->set.str[STRING_USERAGENT] &&
  2982. *data->set.str[STRING_USERAGENT] &&
  2983. data->state.aptr.uagent)?
  2984. data->state.aptr.uagent:"",
  2985. p_accept?p_accept:"",
  2986. data->state.aptr.te?data->state.aptr.te:"",
  2987. (data->set.str[STRING_ENCODING] &&
  2988. *data->set.str[STRING_ENCODING] &&
  2989. data->state.aptr.accept_encoding)?
  2990. data->state.aptr.accept_encoding:"",
  2991. (data->state.referer && data->state.aptr.ref)?
  2992. data->state.aptr.ref:"" /* Referer: <data> */,
  2993. #ifndef CURL_DISABLE_PROXY
  2994. (conn->bits.httpproxy &&
  2995. !conn->bits.tunnel_proxy &&
  2996. !Curl_checkheaders(data, STRCONST("Proxy-Connection")) &&
  2997. !Curl_checkProxyheaders(data,
  2998. conn,
  2999. STRCONST("Proxy-Connection")))?
  3000. "Proxy-Connection: Keep-Alive\r\n":"",
  3001. #else
  3002. "",
  3003. #endif
  3004. te,
  3005. altused ? altused : ""
  3006. );
  3007. /* clear userpwd and proxyuserpwd to avoid reusing old credentials
  3008. * from reused connections */
  3009. Curl_safefree(data->state.aptr.userpwd);
  3010. Curl_safefree(data->state.aptr.proxyuserpwd);
  3011. free(altused);
  3012. if(result) {
  3013. Curl_dyn_free(&req);
  3014. return result;
  3015. }
  3016. if(!(conn->handler->flags&PROTOPT_SSL) &&
  3017. conn->httpversion < 20 &&
  3018. (data->state.httpwant == CURL_HTTP_VERSION_2)) {
  3019. /* append HTTP2 upgrade magic stuff to the HTTP request if it isn't done
  3020. over SSL */
  3021. result = Curl_http2_request_upgrade(&req, data);
  3022. if(result) {
  3023. Curl_dyn_free(&req);
  3024. return result;
  3025. }
  3026. }
  3027. result = Curl_http_cookies(data, conn, &req);
  3028. #ifdef USE_WEBSOCKETS
  3029. if(!result && conn->handler->protocol&(CURLPROTO_WS|CURLPROTO_WSS))
  3030. result = Curl_ws_request(data, &req);
  3031. #endif
  3032. if(!result)
  3033. result = Curl_add_timecondition(data, &req);
  3034. if(!result)
  3035. result = Curl_add_custom_headers(data, FALSE, &req);
  3036. if(!result) {
  3037. http->postdata = NULL; /* nothing to post at this point */
  3038. if((httpreq == HTTPREQ_GET) ||
  3039. (httpreq == HTTPREQ_HEAD))
  3040. Curl_pgrsSetUploadSize(data, 0); /* nothing */
  3041. /* bodysend takes ownership of the 'req' memory on success */
  3042. result = Curl_http_bodysend(data, conn, &req, httpreq);
  3043. }
  3044. if(result) {
  3045. Curl_dyn_free(&req);
  3046. return result;
  3047. }
  3048. if((http->postsize > -1) &&
  3049. (http->postsize <= data->req.writebytecount) &&
  3050. (http->sending != HTTPSEND_REQUEST))
  3051. data->req.upload_done = TRUE;
  3052. if(data->req.writebytecount) {
  3053. /* if a request-body has been sent off, we make sure this progress is noted
  3054. properly */
  3055. Curl_pgrsSetUploadCounter(data, data->req.writebytecount);
  3056. if(Curl_pgrsUpdate(data))
  3057. result = CURLE_ABORTED_BY_CALLBACK;
  3058. if(!http->postsize) {
  3059. /* already sent the entire request body, mark the "upload" as
  3060. complete */
  3061. infof(data, "upload completely sent off: %" CURL_FORMAT_CURL_OFF_T
  3062. " out of %" CURL_FORMAT_CURL_OFF_T " bytes",
  3063. data->req.writebytecount, http->postsize);
  3064. data->req.upload_done = TRUE;
  3065. data->req.keepon &= ~KEEP_SEND; /* we're done writing */
  3066. data->req.exp100 = EXP100_SEND_DATA; /* already sent */
  3067. Curl_expire_done(data, EXPIRE_100_TIMEOUT);
  3068. }
  3069. }
  3070. if(data->req.upload_done)
  3071. Curl_conn_ev_data_done_send(data);
  3072. if((conn->httpversion >= 20) && data->req.upload_chunky)
  3073. /* upload_chunky was set above to set up the request in a chunky fashion,
  3074. but is disabled here again to avoid that the chunked encoded version is
  3075. actually used when sending the request body over h2 */
  3076. data->req.upload_chunky = FALSE;
  3077. return result;
  3078. }
  3079. #endif /* USE_HYPER */
  3080. typedef enum {
  3081. STATUS_UNKNOWN, /* not enough data to tell yet */
  3082. STATUS_DONE, /* a status line was read */
  3083. STATUS_BAD /* not a status line */
  3084. } statusline;
  3085. /* Check a string for a prefix. Check no more than 'len' bytes */
  3086. static bool checkprefixmax(const char *prefix, const char *buffer, size_t len)
  3087. {
  3088. size_t ch = CURLMIN(strlen(prefix), len);
  3089. return curl_strnequal(prefix, buffer, ch);
  3090. }
  3091. /*
  3092. * checkhttpprefix()
  3093. *
  3094. * Returns TRUE if member of the list matches prefix of string
  3095. */
  3096. static statusline
  3097. checkhttpprefix(struct Curl_easy *data,
  3098. const char *s, size_t len)
  3099. {
  3100. struct curl_slist *head = data->set.http200aliases;
  3101. statusline rc = STATUS_BAD;
  3102. statusline onmatch = len >= 5? STATUS_DONE : STATUS_UNKNOWN;
  3103. while(head) {
  3104. if(checkprefixmax(head->data, s, len)) {
  3105. rc = onmatch;
  3106. break;
  3107. }
  3108. head = head->next;
  3109. }
  3110. if((rc != STATUS_DONE) && (checkprefixmax("HTTP/", s, len)))
  3111. rc = onmatch;
  3112. return rc;
  3113. }
  3114. #ifndef CURL_DISABLE_RTSP
  3115. static statusline
  3116. checkrtspprefix(struct Curl_easy *data,
  3117. const char *s, size_t len)
  3118. {
  3119. statusline result = STATUS_BAD;
  3120. statusline onmatch = len >= 5? STATUS_DONE : STATUS_UNKNOWN;
  3121. (void)data; /* unused */
  3122. if(checkprefixmax("RTSP/", s, len))
  3123. result = onmatch;
  3124. return result;
  3125. }
  3126. #endif /* CURL_DISABLE_RTSP */
  3127. static statusline
  3128. checkprotoprefix(struct Curl_easy *data, struct connectdata *conn,
  3129. const char *s, size_t len)
  3130. {
  3131. #ifndef CURL_DISABLE_RTSP
  3132. if(conn->handler->protocol & CURLPROTO_RTSP)
  3133. return checkrtspprefix(data, s, len);
  3134. #else
  3135. (void)conn;
  3136. #endif /* CURL_DISABLE_RTSP */
  3137. return checkhttpprefix(data, s, len);
  3138. }
  3139. /*
  3140. * Curl_http_header() parses a single response header.
  3141. */
  3142. CURLcode Curl_http_header(struct Curl_easy *data, struct connectdata *conn,
  3143. char *headp)
  3144. {
  3145. CURLcode result;
  3146. struct SingleRequest *k = &data->req;
  3147. /* Check for Content-Length: header lines to get size */
  3148. if(!k->http_bodyless &&
  3149. !data->set.ignorecl && checkprefix("Content-Length:", headp)) {
  3150. curl_off_t contentlength;
  3151. CURLofft offt = curlx_strtoofft(headp + strlen("Content-Length:"),
  3152. NULL, 10, &contentlength);
  3153. if(offt == CURL_OFFT_OK) {
  3154. k->size = contentlength;
  3155. k->maxdownload = k->size;
  3156. }
  3157. else if(offt == CURL_OFFT_FLOW) {
  3158. /* out of range */
  3159. if(data->set.max_filesize) {
  3160. failf(data, "Maximum file size exceeded");
  3161. return CURLE_FILESIZE_EXCEEDED;
  3162. }
  3163. streamclose(conn, "overflow content-length");
  3164. infof(data, "Overflow Content-Length: value");
  3165. }
  3166. else {
  3167. /* negative or just rubbish - bad HTTP */
  3168. failf(data, "Invalid Content-Length: value");
  3169. return CURLE_WEIRD_SERVER_REPLY;
  3170. }
  3171. }
  3172. /* check for Content-Type: header lines to get the MIME-type */
  3173. else if(checkprefix("Content-Type:", headp)) {
  3174. char *contenttype = Curl_copy_header_value(headp);
  3175. if(!contenttype)
  3176. return CURLE_OUT_OF_MEMORY;
  3177. if(!*contenttype)
  3178. /* ignore empty data */
  3179. free(contenttype);
  3180. else {
  3181. Curl_safefree(data->info.contenttype);
  3182. data->info.contenttype = contenttype;
  3183. }
  3184. }
  3185. #ifndef CURL_DISABLE_PROXY
  3186. else if((conn->httpversion == 10) &&
  3187. conn->bits.httpproxy &&
  3188. Curl_compareheader(headp,
  3189. STRCONST("Proxy-Connection:"),
  3190. STRCONST("keep-alive"))) {
  3191. /*
  3192. * When an HTTP/1.0 reply comes when using a proxy, the
  3193. * 'Proxy-Connection: keep-alive' line tells us the
  3194. * connection will be kept alive for our pleasure.
  3195. * Default action for 1.0 is to close.
  3196. */
  3197. connkeep(conn, "Proxy-Connection keep-alive"); /* don't close */
  3198. infof(data, "HTTP/1.0 proxy connection set to keep alive");
  3199. }
  3200. else if((conn->httpversion == 11) &&
  3201. conn->bits.httpproxy &&
  3202. Curl_compareheader(headp,
  3203. STRCONST("Proxy-Connection:"),
  3204. STRCONST("close"))) {
  3205. /*
  3206. * We get an HTTP/1.1 response from a proxy and it says it'll
  3207. * close down after this transfer.
  3208. */
  3209. connclose(conn, "Proxy-Connection: asked to close after done");
  3210. infof(data, "HTTP/1.1 proxy connection set close");
  3211. }
  3212. #endif
  3213. else if((conn->httpversion == 10) &&
  3214. Curl_compareheader(headp,
  3215. STRCONST("Connection:"),
  3216. STRCONST("keep-alive"))) {
  3217. /*
  3218. * An HTTP/1.0 reply with the 'Connection: keep-alive' line
  3219. * tells us the connection will be kept alive for our
  3220. * pleasure. Default action for 1.0 is to close.
  3221. *
  3222. * [RFC2068, section 19.7.1] */
  3223. connkeep(conn, "Connection keep-alive");
  3224. infof(data, "HTTP/1.0 connection set to keep alive");
  3225. }
  3226. else if(Curl_compareheader(headp,
  3227. STRCONST("Connection:"), STRCONST("close"))) {
  3228. /*
  3229. * [RFC 2616, section 8.1.2.1]
  3230. * "Connection: close" is HTTP/1.1 language and means that
  3231. * the connection will close when this request has been
  3232. * served.
  3233. */
  3234. streamclose(conn, "Connection: close used");
  3235. }
  3236. else if(!k->http_bodyless && checkprefix("Transfer-Encoding:", headp)) {
  3237. /* One or more encodings. We check for chunked and/or a compression
  3238. algorithm. */
  3239. /*
  3240. * [RFC 2616, section 3.6.1] A 'chunked' transfer encoding
  3241. * means that the server will send a series of "chunks". Each
  3242. * chunk starts with line with info (including size of the
  3243. * coming block) (terminated with CRLF), then a block of data
  3244. * with the previously mentioned size. There can be any amount
  3245. * of chunks, and a chunk-data set to zero signals the
  3246. * end-of-chunks. */
  3247. result = Curl_build_unencoding_stack(data,
  3248. headp + strlen("Transfer-Encoding:"),
  3249. TRUE);
  3250. if(result)
  3251. return result;
  3252. if(!k->chunk && data->set.http_transfer_encoding) {
  3253. /* if this isn't chunked, only close can signal the end of this transfer
  3254. as Content-Length is said not to be trusted for transfer-encoding! */
  3255. connclose(conn, "HTTP/1.1 transfer-encoding without chunks");
  3256. k->ignore_cl = TRUE;
  3257. }
  3258. }
  3259. else if(!k->http_bodyless && checkprefix("Content-Encoding:", headp) &&
  3260. data->set.str[STRING_ENCODING]) {
  3261. /*
  3262. * Process Content-Encoding. Look for the values: identity,
  3263. * gzip, deflate, compress, x-gzip and x-compress. x-gzip and
  3264. * x-compress are the same as gzip and compress. (Sec 3.5 RFC
  3265. * 2616). zlib cannot handle compress. However, errors are
  3266. * handled further down when the response body is processed
  3267. */
  3268. result = Curl_build_unencoding_stack(data,
  3269. headp + strlen("Content-Encoding:"),
  3270. FALSE);
  3271. if(result)
  3272. return result;
  3273. }
  3274. else if(checkprefix("Retry-After:", headp)) {
  3275. /* Retry-After = HTTP-date / delay-seconds */
  3276. curl_off_t retry_after = 0; /* zero for unknown or "now" */
  3277. /* Try it as a decimal number, if it works it is not a date */
  3278. (void)curlx_strtoofft(headp + strlen("Retry-After:"),
  3279. NULL, 10, &retry_after);
  3280. if(!retry_after) {
  3281. time_t date = Curl_getdate_capped(headp + strlen("Retry-After:"));
  3282. if(-1 != date)
  3283. /* convert date to number of seconds into the future */
  3284. retry_after = date - time(NULL);
  3285. }
  3286. data->info.retry_after = retry_after; /* store it */
  3287. }
  3288. else if(!k->http_bodyless && checkprefix("Content-Range:", headp)) {
  3289. /* Content-Range: bytes [num]-
  3290. Content-Range: bytes: [num]-
  3291. Content-Range: [num]-
  3292. Content-Range: [asterisk]/[total]
  3293. The second format was added since Sun's webserver
  3294. JavaWebServer/1.1.1 obviously sends the header this way!
  3295. The third added since some servers use that!
  3296. The fourth means the requested range was unsatisfied.
  3297. */
  3298. char *ptr = headp + strlen("Content-Range:");
  3299. /* Move forward until first digit or asterisk */
  3300. while(*ptr && !ISDIGIT(*ptr) && *ptr != '*')
  3301. ptr++;
  3302. /* if it truly stopped on a digit */
  3303. if(ISDIGIT(*ptr)) {
  3304. if(!curlx_strtoofft(ptr, NULL, 10, &k->offset)) {
  3305. if(data->state.resume_from == k->offset)
  3306. /* we asked for a resume and we got it */
  3307. k->content_range = TRUE;
  3308. }
  3309. }
  3310. else
  3311. data->state.resume_from = 0; /* get everything */
  3312. }
  3313. #if !defined(CURL_DISABLE_COOKIES)
  3314. else if(data->cookies && data->state.cookie_engine &&
  3315. checkprefix("Set-Cookie:", headp)) {
  3316. /* If there is a custom-set Host: name, use it here, or else use real peer
  3317. host name. */
  3318. const char *host = data->state.aptr.cookiehost?
  3319. data->state.aptr.cookiehost:conn->host.name;
  3320. const bool secure_context =
  3321. conn->handler->protocol&(CURLPROTO_HTTPS|CURLPROTO_WSS) ||
  3322. strcasecompare("localhost", host) ||
  3323. !strcmp(host, "127.0.0.1") ||
  3324. !strcmp(host, "::1") ? TRUE : FALSE;
  3325. Curl_share_lock(data, CURL_LOCK_DATA_COOKIE,
  3326. CURL_LOCK_ACCESS_SINGLE);
  3327. Curl_cookie_add(data, data->cookies, TRUE, FALSE,
  3328. headp + strlen("Set-Cookie:"), host,
  3329. data->state.up.path, secure_context);
  3330. Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
  3331. }
  3332. #endif
  3333. else if(!k->http_bodyless && checkprefix("Last-Modified:", headp) &&
  3334. (data->set.timecondition || data->set.get_filetime) ) {
  3335. k->timeofdoc = Curl_getdate_capped(headp + strlen("Last-Modified:"));
  3336. if(data->set.get_filetime)
  3337. data->info.filetime = k->timeofdoc;
  3338. }
  3339. else if((checkprefix("WWW-Authenticate:", headp) &&
  3340. (401 == k->httpcode)) ||
  3341. (checkprefix("Proxy-authenticate:", headp) &&
  3342. (407 == k->httpcode))) {
  3343. bool proxy = (k->httpcode == 407) ? TRUE : FALSE;
  3344. char *auth = Curl_copy_header_value(headp);
  3345. if(!auth)
  3346. return CURLE_OUT_OF_MEMORY;
  3347. result = Curl_http_input_auth(data, proxy, auth);
  3348. free(auth);
  3349. if(result)
  3350. return result;
  3351. }
  3352. #ifdef USE_SPNEGO
  3353. else if(checkprefix("Persistent-Auth:", headp)) {
  3354. struct negotiatedata *negdata = &conn->negotiate;
  3355. struct auth *authp = &data->state.authhost;
  3356. if(authp->picked == CURLAUTH_NEGOTIATE) {
  3357. char *persistentauth = Curl_copy_header_value(headp);
  3358. if(!persistentauth)
  3359. return CURLE_OUT_OF_MEMORY;
  3360. negdata->noauthpersist = checkprefix("false", persistentauth)?
  3361. TRUE:FALSE;
  3362. negdata->havenoauthpersist = TRUE;
  3363. infof(data, "Negotiate: noauthpersist -> %d, header part: %s",
  3364. negdata->noauthpersist, persistentauth);
  3365. free(persistentauth);
  3366. }
  3367. }
  3368. #endif
  3369. else if((k->httpcode >= 300 && k->httpcode < 400) &&
  3370. checkprefix("Location:", headp) &&
  3371. !data->req.location) {
  3372. /* this is the URL that the server advises us to use instead */
  3373. char *location = Curl_copy_header_value(headp);
  3374. if(!location)
  3375. return CURLE_OUT_OF_MEMORY;
  3376. if(!*location)
  3377. /* ignore empty data */
  3378. free(location);
  3379. else {
  3380. data->req.location = location;
  3381. if(data->set.http_follow_location) {
  3382. DEBUGASSERT(!data->req.newurl);
  3383. data->req.newurl = strdup(data->req.location); /* clone */
  3384. if(!data->req.newurl)
  3385. return CURLE_OUT_OF_MEMORY;
  3386. /* some cases of POST and PUT etc needs to rewind the data
  3387. stream at this point */
  3388. result = http_perhapsrewind(data, conn);
  3389. if(result)
  3390. return result;
  3391. /* mark the next request as a followed location: */
  3392. data->state.this_is_a_follow = TRUE;
  3393. }
  3394. }
  3395. }
  3396. #ifndef CURL_DISABLE_HSTS
  3397. /* If enabled, the header is incoming and this is over HTTPS */
  3398. else if(data->hsts && checkprefix("Strict-Transport-Security:", headp) &&
  3399. ((conn->handler->flags & PROTOPT_SSL) ||
  3400. #ifdef CURLDEBUG
  3401. /* allow debug builds to circumvent the HTTPS restriction */
  3402. getenv("CURL_HSTS_HTTP")
  3403. #else
  3404. 0
  3405. #endif
  3406. )) {
  3407. CURLcode check =
  3408. Curl_hsts_parse(data->hsts, conn->host.name,
  3409. headp + strlen("Strict-Transport-Security:"));
  3410. if(check)
  3411. infof(data, "Illegal STS header skipped");
  3412. #ifdef DEBUGBUILD
  3413. else
  3414. infof(data, "Parsed STS header fine (%zu entries)",
  3415. data->hsts->list.size);
  3416. #endif
  3417. }
  3418. #endif
  3419. #ifndef CURL_DISABLE_ALTSVC
  3420. /* If enabled, the header is incoming and this is over HTTPS */
  3421. else if(data->asi && checkprefix("Alt-Svc:", headp) &&
  3422. ((conn->handler->flags & PROTOPT_SSL) ||
  3423. #ifdef CURLDEBUG
  3424. /* allow debug builds to circumvent the HTTPS restriction */
  3425. getenv("CURL_ALTSVC_HTTP")
  3426. #else
  3427. 0
  3428. #endif
  3429. )) {
  3430. /* the ALPN of the current request */
  3431. enum alpnid id = (conn->httpversion == 30)? ALPN_h3 :
  3432. (conn->httpversion == 20) ? ALPN_h2 : ALPN_h1;
  3433. result = Curl_altsvc_parse(data, data->asi,
  3434. headp + strlen("Alt-Svc:"),
  3435. id, conn->host.name,
  3436. curlx_uitous((unsigned int)conn->remote_port));
  3437. if(result)
  3438. return result;
  3439. }
  3440. #endif
  3441. else if(conn->handler->protocol & CURLPROTO_RTSP) {
  3442. result = Curl_rtsp_parseheader(data, headp);
  3443. if(result)
  3444. return result;
  3445. }
  3446. return CURLE_OK;
  3447. }
  3448. /*
  3449. * Called after the first HTTP response line (the status line) has been
  3450. * received and parsed.
  3451. */
  3452. CURLcode Curl_http_statusline(struct Curl_easy *data,
  3453. struct connectdata *conn)
  3454. {
  3455. struct SingleRequest *k = &data->req;
  3456. data->info.httpcode = k->httpcode;
  3457. data->info.httpversion = conn->httpversion;
  3458. if(!data->state.httpversion ||
  3459. data->state.httpversion > conn->httpversion)
  3460. /* store the lowest server version we encounter */
  3461. data->state.httpversion = conn->httpversion;
  3462. /*
  3463. * This code executes as part of processing the header. As a
  3464. * result, it's not totally clear how to interpret the
  3465. * response code yet as that depends on what other headers may
  3466. * be present. 401 and 407 may be errors, but may be OK
  3467. * depending on how authentication is working. Other codes
  3468. * are definitely errors, so give up here.
  3469. */
  3470. if(data->state.resume_from && data->state.httpreq == HTTPREQ_GET &&
  3471. k->httpcode == 416) {
  3472. /* "Requested Range Not Satisfiable", just proceed and
  3473. pretend this is no error */
  3474. k->ignorebody = TRUE; /* Avoid appending error msg to good data. */
  3475. }
  3476. if(conn->httpversion == 10) {
  3477. /* Default action for HTTP/1.0 must be to close, unless
  3478. we get one of those fancy headers that tell us the
  3479. server keeps it open for us! */
  3480. infof(data, "HTTP 1.0, assume close after body");
  3481. connclose(conn, "HTTP/1.0 close after body");
  3482. }
  3483. else if(conn->httpversion == 20 ||
  3484. (k->upgr101 == UPGR101_H2 && k->httpcode == 101)) {
  3485. DEBUGF(infof(data, "HTTP/2 found, allow multiplexing"));
  3486. /* HTTP/2 cannot avoid multiplexing since it is a core functionality
  3487. of the protocol */
  3488. conn->bundle->multiuse = BUNDLE_MULTIPLEX;
  3489. }
  3490. else if(conn->httpversion >= 11 &&
  3491. !conn->bits.close) {
  3492. /* If HTTP version is >= 1.1 and connection is persistent */
  3493. DEBUGF(infof(data,
  3494. "HTTP 1.1 or later with persistent connection"));
  3495. }
  3496. k->http_bodyless = k->httpcode >= 100 && k->httpcode < 200;
  3497. switch(k->httpcode) {
  3498. case 304:
  3499. /* (quote from RFC2616, section 10.3.5): The 304 response
  3500. * MUST NOT contain a message-body, and thus is always
  3501. * terminated by the first empty line after the header
  3502. * fields. */
  3503. if(data->set.timecondition)
  3504. data->info.timecond = TRUE;
  3505. /* FALLTHROUGH */
  3506. case 204:
  3507. /* (quote from RFC2616, section 10.2.5): The server has
  3508. * fulfilled the request but does not need to return an
  3509. * entity-body ... The 204 response MUST NOT include a
  3510. * message-body, and thus is always terminated by the first
  3511. * empty line after the header fields. */
  3512. k->size = 0;
  3513. k->maxdownload = 0;
  3514. k->http_bodyless = TRUE;
  3515. break;
  3516. default:
  3517. break;
  3518. }
  3519. return CURLE_OK;
  3520. }
  3521. /* Content-Length must be ignored if any Transfer-Encoding is present in the
  3522. response. Refer to RFC 7230 section 3.3.3 and RFC2616 section 4.4. This is
  3523. figured out here after all headers have been received but before the final
  3524. call to the user's header callback, so that a valid content length can be
  3525. retrieved by the user in the final call. */
  3526. CURLcode Curl_http_size(struct Curl_easy *data)
  3527. {
  3528. struct SingleRequest *k = &data->req;
  3529. if(data->req.ignore_cl || k->chunk) {
  3530. k->size = k->maxdownload = -1;
  3531. }
  3532. else if(k->size != -1) {
  3533. if(data->set.max_filesize &&
  3534. k->size > data->set.max_filesize) {
  3535. failf(data, "Maximum file size exceeded");
  3536. return CURLE_FILESIZE_EXCEEDED;
  3537. }
  3538. Curl_pgrsSetDownloadSize(data, k->size);
  3539. k->maxdownload = k->size;
  3540. }
  3541. return CURLE_OK;
  3542. }
  3543. static CURLcode verify_header(struct Curl_easy *data)
  3544. {
  3545. struct SingleRequest *k = &data->req;
  3546. const char *header = Curl_dyn_ptr(&data->state.headerb);
  3547. size_t hlen = Curl_dyn_len(&data->state.headerb);
  3548. char *ptr = memchr(header, 0x00, hlen);
  3549. if(ptr) {
  3550. /* this is bad, bail out */
  3551. failf(data, "Nul byte in header");
  3552. return CURLE_WEIRD_SERVER_REPLY;
  3553. }
  3554. if(k->headerline < 2)
  3555. /* the first "header" is the status-line and it has no colon */
  3556. return CURLE_OK;
  3557. if(((header[0] == ' ') || (header[0] == '\t')) && k->headerline > 2)
  3558. /* line folding, can't happen on line 2 */
  3559. ;
  3560. else {
  3561. ptr = memchr(header, ':', hlen);
  3562. if(!ptr) {
  3563. /* this is bad, bail out */
  3564. failf(data, "Header without colon");
  3565. return CURLE_WEIRD_SERVER_REPLY;
  3566. }
  3567. }
  3568. return CURLE_OK;
  3569. }
  3570. CURLcode Curl_bump_headersize(struct Curl_easy *data,
  3571. size_t delta,
  3572. bool connect_only)
  3573. {
  3574. size_t bad = 0;
  3575. unsigned int max = MAX_HTTP_RESP_HEADER_SIZE;
  3576. if(delta < MAX_HTTP_RESP_HEADER_SIZE) {
  3577. data->info.header_size += (unsigned int)delta;
  3578. data->req.allheadercount += (unsigned int)delta;
  3579. if(!connect_only)
  3580. data->req.headerbytecount += (unsigned int)delta;
  3581. if(data->req.allheadercount > max)
  3582. bad = data->req.allheadercount;
  3583. else if(data->info.header_size > (max * 20)) {
  3584. bad = data->info.header_size;
  3585. max *= 20;
  3586. }
  3587. }
  3588. else
  3589. bad = data->req.allheadercount + delta;
  3590. if(bad) {
  3591. failf(data, "Too large response headers: %zu > %u", bad, max);
  3592. return CURLE_RECV_ERROR;
  3593. }
  3594. return CURLE_OK;
  3595. }
  3596. /*
  3597. * Read any HTTP header lines from the server and pass them to the client app.
  3598. */
  3599. CURLcode Curl_http_readwrite_headers(struct Curl_easy *data,
  3600. struct connectdata *conn,
  3601. ssize_t *nread,
  3602. bool *stop_reading)
  3603. {
  3604. CURLcode result;
  3605. struct SingleRequest *k = &data->req;
  3606. ssize_t onread = *nread;
  3607. char *ostr = k->str;
  3608. char *headp;
  3609. char *str_start;
  3610. char *end_ptr;
  3611. /* header line within buffer loop */
  3612. do {
  3613. size_t rest_length;
  3614. size_t full_length;
  3615. int writetype;
  3616. /* str_start is start of line within buf */
  3617. str_start = k->str;
  3618. /* data is in network encoding so use 0x0a instead of '\n' */
  3619. end_ptr = memchr(str_start, 0x0a, *nread);
  3620. if(!end_ptr) {
  3621. /* Not a complete header line within buffer, append the data to
  3622. the end of the headerbuff. */
  3623. result = Curl_dyn_addn(&data->state.headerb, str_start, *nread);
  3624. if(result)
  3625. return result;
  3626. if(!k->headerline) {
  3627. /* check if this looks like a protocol header */
  3628. statusline st =
  3629. checkprotoprefix(data, conn,
  3630. Curl_dyn_ptr(&data->state.headerb),
  3631. Curl_dyn_len(&data->state.headerb));
  3632. if(st == STATUS_BAD) {
  3633. /* this is not the beginning of a protocol first header line */
  3634. k->header = FALSE;
  3635. k->badheader = HEADER_ALLBAD;
  3636. streamclose(conn, "bad HTTP: No end-of-message indicator");
  3637. if(!data->set.http09_allowed) {
  3638. failf(data, "Received HTTP/0.9 when not allowed");
  3639. return CURLE_UNSUPPORTED_PROTOCOL;
  3640. }
  3641. break;
  3642. }
  3643. }
  3644. break; /* read more and try again */
  3645. }
  3646. /* decrease the size of the remaining (supposed) header line */
  3647. rest_length = (end_ptr - k->str) + 1;
  3648. *nread -= (ssize_t)rest_length;
  3649. k->str = end_ptr + 1; /* move past new line */
  3650. full_length = k->str - str_start;
  3651. result = Curl_dyn_addn(&data->state.headerb, str_start, full_length);
  3652. if(result)
  3653. return result;
  3654. /****
  3655. * We now have a FULL header line in 'headerb'.
  3656. *****/
  3657. if(!k->headerline) {
  3658. /* the first read header */
  3659. statusline st = checkprotoprefix(data, conn,
  3660. Curl_dyn_ptr(&data->state.headerb),
  3661. Curl_dyn_len(&data->state.headerb));
  3662. if(st == STATUS_BAD) {
  3663. streamclose(conn, "bad HTTP: No end-of-message indicator");
  3664. /* this is not the beginning of a protocol first header line */
  3665. if(!data->set.http09_allowed) {
  3666. failf(data, "Received HTTP/0.9 when not allowed");
  3667. return CURLE_UNSUPPORTED_PROTOCOL;
  3668. }
  3669. k->header = FALSE;
  3670. if(*nread)
  3671. /* since there's more, this is a partial bad header */
  3672. k->badheader = HEADER_PARTHEADER;
  3673. else {
  3674. /* this was all we read so it's all a bad header */
  3675. k->badheader = HEADER_ALLBAD;
  3676. *nread = onread;
  3677. k->str = ostr;
  3678. return CURLE_OK;
  3679. }
  3680. break;
  3681. }
  3682. }
  3683. /* headers are in network encoding so use 0x0a and 0x0d instead of '\n'
  3684. and '\r' */
  3685. headp = Curl_dyn_ptr(&data->state.headerb);
  3686. if((0x0a == *headp) || (0x0d == *headp)) {
  3687. size_t headerlen;
  3688. /* Zero-length header line means end of headers! */
  3689. if('\r' == *headp)
  3690. headp++; /* pass the \r byte */
  3691. if('\n' == *headp)
  3692. headp++; /* pass the \n byte */
  3693. if(100 <= k->httpcode && 199 >= k->httpcode) {
  3694. /* "A user agent MAY ignore unexpected 1xx status responses." */
  3695. switch(k->httpcode) {
  3696. case 100:
  3697. /*
  3698. * We have made an HTTP PUT or POST and this is 1.1-lingo
  3699. * that tells us that the server is OK with this and ready
  3700. * to receive the data.
  3701. * However, we'll get more headers now so we must get
  3702. * back into the header-parsing state!
  3703. */
  3704. k->header = TRUE;
  3705. k->headerline = 0; /* restart the header line counter */
  3706. /* if we did wait for this do enable write now! */
  3707. if(k->exp100 > EXP100_SEND_DATA) {
  3708. k->exp100 = EXP100_SEND_DATA;
  3709. k->keepon |= KEEP_SEND;
  3710. Curl_expire_done(data, EXPIRE_100_TIMEOUT);
  3711. }
  3712. break;
  3713. case 101:
  3714. /* Switching Protocols */
  3715. if(k->upgr101 == UPGR101_H2) {
  3716. /* Switching to HTTP/2 */
  3717. DEBUGASSERT(conn->httpversion < 20);
  3718. infof(data, "Received 101, Switching to HTTP/2");
  3719. k->upgr101 = UPGR101_RECEIVED;
  3720. /* we'll get more headers (HTTP/2 response) */
  3721. k->header = TRUE;
  3722. k->headerline = 0; /* restart the header line counter */
  3723. /* switch to http2 now. The bytes after response headers
  3724. are also processed here, otherwise they are lost. */
  3725. result = Curl_http2_upgrade(data, conn, FIRSTSOCKET,
  3726. k->str, *nread);
  3727. if(result)
  3728. return result;
  3729. *nread = 0;
  3730. }
  3731. #ifdef USE_WEBSOCKETS
  3732. else if(k->upgr101 == UPGR101_WS) {
  3733. /* verify the response */
  3734. result = Curl_ws_accept(data, k->str, *nread);
  3735. if(result)
  3736. return result;
  3737. k->header = FALSE; /* no more header to parse! */
  3738. if(data->set.connect_only) {
  3739. k->keepon &= ~KEEP_RECV; /* read no more content */
  3740. *nread = 0;
  3741. }
  3742. }
  3743. #endif
  3744. else {
  3745. /* Not switching to another protocol */
  3746. k->header = FALSE; /* no more header to parse! */
  3747. }
  3748. break;
  3749. default:
  3750. /* the status code 1xx indicates a provisional response, so
  3751. we'll get another set of headers */
  3752. k->header = TRUE;
  3753. k->headerline = 0; /* restart the header line counter */
  3754. break;
  3755. }
  3756. }
  3757. else {
  3758. if(k->upgr101 == UPGR101_H2) {
  3759. /* A requested upgrade was denied, poke the multi handle to possibly
  3760. allow a pending pipewait to continue */
  3761. Curl_multi_connchanged(data->multi);
  3762. }
  3763. k->header = FALSE; /* no more header to parse! */
  3764. if((k->size == -1) && !k->chunk && !conn->bits.close &&
  3765. (conn->httpversion == 11) &&
  3766. !(conn->handler->protocol & CURLPROTO_RTSP) &&
  3767. data->state.httpreq != HTTPREQ_HEAD) {
  3768. /* On HTTP 1.1, when connection is not to get closed, but no
  3769. Content-Length nor Transfer-Encoding chunked have been
  3770. received, according to RFC2616 section 4.4 point 5, we
  3771. assume that the server will close the connection to
  3772. signal the end of the document. */
  3773. infof(data, "no chunk, no close, no size. Assume close to "
  3774. "signal end");
  3775. streamclose(conn, "HTTP: No end-of-message indicator");
  3776. }
  3777. }
  3778. if(!k->header) {
  3779. result = Curl_http_size(data);
  3780. if(result)
  3781. return result;
  3782. }
  3783. /* At this point we have some idea about the fate of the connection.
  3784. If we are closing the connection it may result auth failure. */
  3785. #if defined(USE_NTLM)
  3786. if(conn->bits.close &&
  3787. (((data->req.httpcode == 401) &&
  3788. (conn->http_ntlm_state == NTLMSTATE_TYPE2)) ||
  3789. ((data->req.httpcode == 407) &&
  3790. (conn->proxy_ntlm_state == NTLMSTATE_TYPE2)))) {
  3791. infof(data, "Connection closure while negotiating auth (HTTP 1.0?)");
  3792. data->state.authproblem = TRUE;
  3793. }
  3794. #endif
  3795. #if defined(USE_SPNEGO)
  3796. if(conn->bits.close &&
  3797. (((data->req.httpcode == 401) &&
  3798. (conn->http_negotiate_state == GSS_AUTHRECV)) ||
  3799. ((data->req.httpcode == 407) &&
  3800. (conn->proxy_negotiate_state == GSS_AUTHRECV)))) {
  3801. infof(data, "Connection closure while negotiating auth (HTTP 1.0?)");
  3802. data->state.authproblem = TRUE;
  3803. }
  3804. if((conn->http_negotiate_state == GSS_AUTHDONE) &&
  3805. (data->req.httpcode != 401)) {
  3806. conn->http_negotiate_state = GSS_AUTHSUCC;
  3807. }
  3808. if((conn->proxy_negotiate_state == GSS_AUTHDONE) &&
  3809. (data->req.httpcode != 407)) {
  3810. conn->proxy_negotiate_state = GSS_AUTHSUCC;
  3811. }
  3812. #endif
  3813. /* now, only output this if the header AND body are requested:
  3814. */
  3815. writetype = CLIENTWRITE_HEADER |
  3816. ((k->httpcode/100 == 1) ? CLIENTWRITE_1XX : 0);
  3817. headerlen = Curl_dyn_len(&data->state.headerb);
  3818. result = Curl_client_write(data, writetype,
  3819. Curl_dyn_ptr(&data->state.headerb),
  3820. headerlen);
  3821. if(result)
  3822. return result;
  3823. result = Curl_bump_headersize(data, headerlen, FALSE);
  3824. if(result)
  3825. return result;
  3826. /*
  3827. * When all the headers have been parsed, see if we should give
  3828. * up and return an error.
  3829. */
  3830. if(http_should_fail(data)) {
  3831. failf(data, "The requested URL returned error: %d",
  3832. k->httpcode);
  3833. return CURLE_HTTP_RETURNED_ERROR;
  3834. }
  3835. #ifdef USE_WEBSOCKETS
  3836. /* All non-101 HTTP status codes are bad when wanting to upgrade to
  3837. websockets */
  3838. if(data->req.upgr101 == UPGR101_WS) {
  3839. failf(data, "Refused WebSockets upgrade: %d", k->httpcode);
  3840. return CURLE_HTTP_RETURNED_ERROR;
  3841. }
  3842. #endif
  3843. data->req.deductheadercount =
  3844. (100 <= k->httpcode && 199 >= k->httpcode)?data->req.headerbytecount:0;
  3845. /* Curl_http_auth_act() checks what authentication methods
  3846. * that are available and decides which one (if any) to
  3847. * use. It will set 'newurl' if an auth method was picked. */
  3848. result = Curl_http_auth_act(data);
  3849. if(result)
  3850. return result;
  3851. if(k->httpcode >= 300) {
  3852. if((!conn->bits.authneg) && !conn->bits.close &&
  3853. !data->state.rewindbeforesend) {
  3854. /*
  3855. * General treatment of errors when about to send data. Including :
  3856. * "417 Expectation Failed", while waiting for 100-continue.
  3857. *
  3858. * The check for close above is done simply because of something
  3859. * else has already deemed the connection to get closed then
  3860. * something else should've considered the big picture and we
  3861. * avoid this check.
  3862. *
  3863. * rewindbeforesend indicates that something has told libcurl to
  3864. * continue sending even if it gets discarded
  3865. */
  3866. switch(data->state.httpreq) {
  3867. case HTTPREQ_PUT:
  3868. case HTTPREQ_POST:
  3869. case HTTPREQ_POST_FORM:
  3870. case HTTPREQ_POST_MIME:
  3871. /* We got an error response. If this happened before the whole
  3872. * request body has been sent we stop sending and mark the
  3873. * connection for closure after we've read the entire response.
  3874. */
  3875. Curl_expire_done(data, EXPIRE_100_TIMEOUT);
  3876. if(!k->upload_done) {
  3877. if((k->httpcode == 417) && data->state.expect100header) {
  3878. /* 417 Expectation Failed - try again without the Expect
  3879. header */
  3880. if(!k->writebytecount &&
  3881. k->exp100 == EXP100_AWAITING_CONTINUE) {
  3882. infof(data, "Got HTTP failure 417 while waiting for a 100");
  3883. }
  3884. else {
  3885. infof(data, "Got HTTP failure 417 while sending data");
  3886. streamclose(conn,
  3887. "Stop sending data before everything sent");
  3888. result = http_perhapsrewind(data, conn);
  3889. if(result)
  3890. return result;
  3891. }
  3892. data->state.disableexpect = TRUE;
  3893. DEBUGASSERT(!data->req.newurl);
  3894. data->req.newurl = strdup(data->state.url);
  3895. Curl_done_sending(data, k);
  3896. }
  3897. else if(data->set.http_keep_sending_on_error) {
  3898. infof(data, "HTTP error before end of send, keep sending");
  3899. if(k->exp100 > EXP100_SEND_DATA) {
  3900. k->exp100 = EXP100_SEND_DATA;
  3901. k->keepon |= KEEP_SEND;
  3902. }
  3903. }
  3904. else {
  3905. infof(data, "HTTP error before end of send, stop sending");
  3906. streamclose(conn, "Stop sending data before everything sent");
  3907. result = Curl_done_sending(data, k);
  3908. if(result)
  3909. return result;
  3910. k->upload_done = TRUE;
  3911. if(data->state.expect100header)
  3912. k->exp100 = EXP100_FAILED;
  3913. }
  3914. }
  3915. break;
  3916. default: /* default label present to avoid compiler warnings */
  3917. break;
  3918. }
  3919. }
  3920. if(data->state.rewindbeforesend &&
  3921. (conn->writesockfd != CURL_SOCKET_BAD)) {
  3922. /* We rewind before next send, continue sending now */
  3923. infof(data, "Keep sending data to get tossed away");
  3924. k->keepon |= KEEP_SEND;
  3925. }
  3926. }
  3927. if(!k->header) {
  3928. /*
  3929. * really end-of-headers.
  3930. *
  3931. * If we requested a "no body", this is a good time to get
  3932. * out and return home.
  3933. */
  3934. if(data->req.no_body)
  3935. *stop_reading = TRUE;
  3936. #ifndef CURL_DISABLE_RTSP
  3937. else if((conn->handler->protocol & CURLPROTO_RTSP) &&
  3938. (data->set.rtspreq == RTSPREQ_DESCRIBE) &&
  3939. (k->size <= -1))
  3940. /* Respect section 4.4 of rfc2326: If the Content-Length header is
  3941. absent, a length 0 must be assumed. It will prevent libcurl from
  3942. hanging on DESCRIBE request that got refused for whatever
  3943. reason */
  3944. *stop_reading = TRUE;
  3945. #endif
  3946. /* If max download size is *zero* (nothing) we already have
  3947. nothing and can safely return ok now! But for HTTP/2, we'd
  3948. like to call http2_handle_stream_close to properly close a
  3949. stream. In order to do this, we keep reading until we
  3950. close the stream. */
  3951. if(0 == k->maxdownload
  3952. && !Curl_conn_is_http2(data, conn, FIRSTSOCKET)
  3953. && !Curl_conn_is_http3(data, conn, FIRSTSOCKET))
  3954. *stop_reading = TRUE;
  3955. if(*stop_reading) {
  3956. /* we make sure that this socket isn't read more now */
  3957. k->keepon &= ~KEEP_RECV;
  3958. }
  3959. Curl_debug(data, CURLINFO_HEADER_IN, str_start, headerlen);
  3960. break; /* exit header line loop */
  3961. }
  3962. /* We continue reading headers, reset the line-based header */
  3963. Curl_dyn_reset(&data->state.headerb);
  3964. continue;
  3965. }
  3966. /*
  3967. * Checks for special headers coming up.
  3968. */
  3969. writetype = CLIENTWRITE_HEADER;
  3970. if(!k->headerline++) {
  3971. /* This is the first header, it MUST be the error code line
  3972. or else we consider this to be the body right away! */
  3973. bool fine_statusline = FALSE;
  3974. if(conn->handler->protocol & PROTO_FAMILY_HTTP) {
  3975. /*
  3976. * https://datatracker.ietf.org/doc/html/rfc7230#section-3.1.2
  3977. *
  3978. * The response code is always a three-digit number in HTTP as the spec
  3979. * says. We allow any three-digit number here, but we cannot make
  3980. * guarantees on future behaviors since it isn't within the protocol.
  3981. */
  3982. int httpversion = 0;
  3983. char *p = headp;
  3984. while(*p && ISBLANK(*p))
  3985. p++;
  3986. if(!strncmp(p, "HTTP/", 5)) {
  3987. p += 5;
  3988. switch(*p) {
  3989. case '1':
  3990. p++;
  3991. if((p[0] == '.') && (p[1] == '0' || p[1] == '1')) {
  3992. if(ISBLANK(p[2])) {
  3993. httpversion = 10 + (p[1] - '0');
  3994. p += 3;
  3995. if(ISDIGIT(p[0]) && ISDIGIT(p[1]) && ISDIGIT(p[2])) {
  3996. k->httpcode = (p[0] - '0') * 100 + (p[1] - '0') * 10 +
  3997. (p[2] - '0');
  3998. p += 3;
  3999. if(ISSPACE(*p))
  4000. fine_statusline = TRUE;
  4001. }
  4002. }
  4003. }
  4004. if(!fine_statusline) {
  4005. failf(data, "Unsupported HTTP/1 subversion in response");
  4006. return CURLE_UNSUPPORTED_PROTOCOL;
  4007. }
  4008. break;
  4009. case '2':
  4010. case '3':
  4011. if(!ISBLANK(p[1]))
  4012. break;
  4013. httpversion = (*p - '0') * 10;
  4014. p += 2;
  4015. if(ISDIGIT(p[0]) && ISDIGIT(p[1]) && ISDIGIT(p[2])) {
  4016. k->httpcode = (p[0] - '0') * 100 + (p[1] - '0') * 10 +
  4017. (p[2] - '0');
  4018. p += 3;
  4019. if(!ISSPACE(*p))
  4020. break;
  4021. fine_statusline = TRUE;
  4022. }
  4023. break;
  4024. default: /* unsupported */
  4025. failf(data, "Unsupported HTTP version in response");
  4026. return CURLE_UNSUPPORTED_PROTOCOL;
  4027. }
  4028. }
  4029. if(fine_statusline) {
  4030. if(k->httpcode < 100) {
  4031. failf(data, "Unsupported response code in HTTP response");
  4032. return CURLE_UNSUPPORTED_PROTOCOL;
  4033. }
  4034. switch(httpversion) {
  4035. case 10:
  4036. case 11:
  4037. #ifdef USE_HTTP2
  4038. case 20:
  4039. #endif
  4040. #ifdef ENABLE_QUIC
  4041. case 30:
  4042. #endif
  4043. conn->httpversion = (unsigned char)httpversion;
  4044. break;
  4045. default:
  4046. failf(data, "Unsupported HTTP version (%u.%d) in response",
  4047. httpversion/10, httpversion%10);
  4048. return CURLE_UNSUPPORTED_PROTOCOL;
  4049. }
  4050. if(k->upgr101 == UPGR101_RECEIVED) {
  4051. /* supposedly upgraded to http2 now */
  4052. if(conn->httpversion != 20)
  4053. infof(data, "Lying server, not serving HTTP/2");
  4054. }
  4055. if(conn->httpversion < 20) {
  4056. conn->bundle->multiuse = BUNDLE_NO_MULTIUSE;
  4057. }
  4058. }
  4059. else {
  4060. /* If user has set option HTTP200ALIASES,
  4061. compare header line against list of aliases
  4062. */
  4063. statusline check =
  4064. checkhttpprefix(data,
  4065. Curl_dyn_ptr(&data->state.headerb),
  4066. Curl_dyn_len(&data->state.headerb));
  4067. if(check == STATUS_DONE) {
  4068. fine_statusline = TRUE;
  4069. k->httpcode = 200;
  4070. conn->httpversion = 10;
  4071. }
  4072. }
  4073. }
  4074. else if(conn->handler->protocol & CURLPROTO_RTSP) {
  4075. char *p = headp;
  4076. while(*p && ISBLANK(*p))
  4077. p++;
  4078. if(!strncmp(p, "RTSP/", 5)) {
  4079. p += 5;
  4080. if(ISDIGIT(*p)) {
  4081. p++;
  4082. if((p[0] == '.') && ISDIGIT(p[1])) {
  4083. if(ISBLANK(p[2])) {
  4084. p += 3;
  4085. if(ISDIGIT(p[0]) && ISDIGIT(p[1]) && ISDIGIT(p[2])) {
  4086. k->httpcode = (p[0] - '0') * 100 + (p[1] - '0') * 10 +
  4087. (p[2] - '0');
  4088. p += 3;
  4089. if(ISSPACE(*p)) {
  4090. fine_statusline = TRUE;
  4091. conn->httpversion = 11; /* RTSP acts like HTTP 1.1 */
  4092. }
  4093. }
  4094. }
  4095. }
  4096. }
  4097. if(!fine_statusline)
  4098. return CURLE_WEIRD_SERVER_REPLY;
  4099. }
  4100. }
  4101. if(fine_statusline) {
  4102. result = Curl_http_statusline(data, conn);
  4103. if(result)
  4104. return result;
  4105. writetype |= CLIENTWRITE_STATUS;
  4106. }
  4107. else {
  4108. k->header = FALSE; /* this is not a header line */
  4109. break;
  4110. }
  4111. }
  4112. result = verify_header(data);
  4113. if(result)
  4114. return result;
  4115. result = Curl_http_header(data, conn, headp);
  4116. if(result)
  4117. return result;
  4118. /*
  4119. * End of header-checks. Write them to the client.
  4120. */
  4121. if(k->httpcode/100 == 1)
  4122. writetype |= CLIENTWRITE_1XX;
  4123. Curl_debug(data, CURLINFO_HEADER_IN, headp,
  4124. Curl_dyn_len(&data->state.headerb));
  4125. result = Curl_client_write(data, writetype, headp,
  4126. Curl_dyn_len(&data->state.headerb));
  4127. if(result)
  4128. return result;
  4129. result = Curl_bump_headersize(data, Curl_dyn_len(&data->state.headerb),
  4130. FALSE);
  4131. if(result)
  4132. return result;
  4133. Curl_dyn_reset(&data->state.headerb);
  4134. }
  4135. while(*k->str); /* header line within buffer */
  4136. /* We might have reached the end of the header part here, but
  4137. there might be a non-header part left in the end of the read
  4138. buffer. */
  4139. return CURLE_OK;
  4140. }
  4141. /* Decode HTTP status code string. */
  4142. CURLcode Curl_http_decode_status(int *pstatus, const char *s, size_t len)
  4143. {
  4144. CURLcode result = CURLE_BAD_FUNCTION_ARGUMENT;
  4145. int status = 0;
  4146. int i;
  4147. if(len != 3)
  4148. goto out;
  4149. for(i = 0; i < 3; ++i) {
  4150. char c = s[i];
  4151. if(c < '0' || c > '9')
  4152. goto out;
  4153. status *= 10;
  4154. status += c - '0';
  4155. }
  4156. result = CURLE_OK;
  4157. out:
  4158. *pstatus = result? -1 : status;
  4159. return result;
  4160. }
  4161. /* simple implementation of strndup(), which isn't portable */
  4162. static char *my_strndup(const char *ptr, size_t len)
  4163. {
  4164. char *copy = malloc(len + 1);
  4165. if(!copy)
  4166. return NULL;
  4167. memcpy(copy, ptr, len);
  4168. copy[len] = '\0';
  4169. return copy;
  4170. }
  4171. CURLcode Curl_http_req_make(struct httpreq **preq,
  4172. const char *method, size_t m_len,
  4173. const char *scheme, size_t s_len,
  4174. const char *authority, size_t a_len,
  4175. const char *path, size_t p_len)
  4176. {
  4177. struct httpreq *req;
  4178. CURLcode result = CURLE_OUT_OF_MEMORY;
  4179. DEBUGASSERT(method);
  4180. if(m_len + 1 >= sizeof(req->method))
  4181. return CURLE_BAD_FUNCTION_ARGUMENT;
  4182. req = calloc(1, sizeof(*req));
  4183. if(!req)
  4184. goto out;
  4185. memcpy(req->method, method, m_len);
  4186. if(scheme) {
  4187. req->scheme = my_strndup(scheme, s_len);
  4188. if(!req->scheme)
  4189. goto out;
  4190. }
  4191. if(authority) {
  4192. req->authority = my_strndup(authority, a_len);
  4193. if(!req->authority)
  4194. goto out;
  4195. }
  4196. if(path) {
  4197. req->path = my_strndup(path, p_len);
  4198. if(!req->path)
  4199. goto out;
  4200. }
  4201. Curl_dynhds_init(&req->headers, 0, DYN_HTTP_REQUEST);
  4202. Curl_dynhds_init(&req->trailers, 0, DYN_HTTP_REQUEST);
  4203. result = CURLE_OK;
  4204. out:
  4205. if(result && req)
  4206. Curl_http_req_free(req);
  4207. *preq = result? NULL : req;
  4208. return result;
  4209. }
  4210. static CURLcode req_assign_url_authority(struct httpreq *req, CURLU *url)
  4211. {
  4212. char *user, *pass, *host, *port;
  4213. struct dynbuf buf;
  4214. CURLUcode uc;
  4215. CURLcode result = CURLE_URL_MALFORMAT;
  4216. user = pass = host = port = NULL;
  4217. Curl_dyn_init(&buf, DYN_HTTP_REQUEST);
  4218. uc = curl_url_get(url, CURLUPART_HOST, &host, 0);
  4219. if(uc && uc != CURLUE_NO_HOST)
  4220. goto out;
  4221. if(!host) {
  4222. req->authority = NULL;
  4223. result = CURLE_OK;
  4224. goto out;
  4225. }
  4226. uc = curl_url_get(url, CURLUPART_PORT, &port, CURLU_NO_DEFAULT_PORT);
  4227. if(uc && uc != CURLUE_NO_PORT)
  4228. goto out;
  4229. uc = curl_url_get(url, CURLUPART_USER, &user, 0);
  4230. if(uc && uc != CURLUE_NO_USER)
  4231. goto out;
  4232. if(user) {
  4233. uc = curl_url_get(url, CURLUPART_PASSWORD, &pass, 0);
  4234. if(uc && uc != CURLUE_NO_PASSWORD)
  4235. goto out;
  4236. }
  4237. if(user) {
  4238. result = Curl_dyn_add(&buf, user);
  4239. if(result)
  4240. goto out;
  4241. if(pass) {
  4242. result = Curl_dyn_addf(&buf, ":%s", pass);
  4243. if(result)
  4244. goto out;
  4245. }
  4246. result = Curl_dyn_add(&buf, "@");
  4247. if(result)
  4248. goto out;
  4249. }
  4250. result = Curl_dyn_add(&buf, host);
  4251. if(result)
  4252. goto out;
  4253. if(port) {
  4254. result = Curl_dyn_addf(&buf, ":%s", port);
  4255. if(result)
  4256. goto out;
  4257. }
  4258. req->authority = strdup(Curl_dyn_ptr(&buf));
  4259. if(!req->authority)
  4260. goto out;
  4261. result = CURLE_OK;
  4262. out:
  4263. free(user);
  4264. free(pass);
  4265. free(host);
  4266. free(port);
  4267. Curl_dyn_free(&buf);
  4268. return result;
  4269. }
  4270. static CURLcode req_assign_url_path(struct httpreq *req, CURLU *url)
  4271. {
  4272. char *path, *query;
  4273. struct dynbuf buf;
  4274. CURLUcode uc;
  4275. CURLcode result = CURLE_URL_MALFORMAT;
  4276. path = query = NULL;
  4277. Curl_dyn_init(&buf, DYN_HTTP_REQUEST);
  4278. uc = curl_url_get(url, CURLUPART_PATH, &path, CURLU_PATH_AS_IS);
  4279. if(uc)
  4280. goto out;
  4281. uc = curl_url_get(url, CURLUPART_QUERY, &query, 0);
  4282. if(uc && uc != CURLUE_NO_QUERY)
  4283. goto out;
  4284. if(!path && !query) {
  4285. req->path = NULL;
  4286. }
  4287. else if(path && !query) {
  4288. req->path = path;
  4289. path = NULL;
  4290. }
  4291. else {
  4292. if(path) {
  4293. result = Curl_dyn_add(&buf, path);
  4294. if(result)
  4295. goto out;
  4296. }
  4297. if(query) {
  4298. result = Curl_dyn_addf(&buf, "?%s", query);
  4299. if(result)
  4300. goto out;
  4301. }
  4302. req->path = strdup(Curl_dyn_ptr(&buf));
  4303. if(!req->path)
  4304. goto out;
  4305. }
  4306. result = CURLE_OK;
  4307. out:
  4308. free(path);
  4309. free(query);
  4310. Curl_dyn_free(&buf);
  4311. return result;
  4312. }
  4313. CURLcode Curl_http_req_make2(struct httpreq **preq,
  4314. const char *method, size_t m_len,
  4315. CURLU *url, const char *scheme_default)
  4316. {
  4317. struct httpreq *req;
  4318. CURLcode result = CURLE_OUT_OF_MEMORY;
  4319. CURLUcode uc;
  4320. DEBUGASSERT(method);
  4321. if(m_len + 1 >= sizeof(req->method))
  4322. return CURLE_BAD_FUNCTION_ARGUMENT;
  4323. req = calloc(1, sizeof(*req));
  4324. if(!req)
  4325. goto out;
  4326. memcpy(req->method, method, m_len);
  4327. uc = curl_url_get(url, CURLUPART_SCHEME, &req->scheme, 0);
  4328. if(uc && uc != CURLUE_NO_SCHEME)
  4329. goto out;
  4330. if(!req->scheme && scheme_default) {
  4331. req->scheme = strdup(scheme_default);
  4332. if(!req->scheme)
  4333. goto out;
  4334. }
  4335. result = req_assign_url_authority(req, url);
  4336. if(result)
  4337. goto out;
  4338. result = req_assign_url_path(req, url);
  4339. if(result)
  4340. goto out;
  4341. Curl_dynhds_init(&req->headers, 0, DYN_HTTP_REQUEST);
  4342. Curl_dynhds_init(&req->trailers, 0, DYN_HTTP_REQUEST);
  4343. result = CURLE_OK;
  4344. out:
  4345. if(result && req)
  4346. Curl_http_req_free(req);
  4347. *preq = result? NULL : req;
  4348. return result;
  4349. }
  4350. void Curl_http_req_free(struct httpreq *req)
  4351. {
  4352. if(req) {
  4353. free(req->scheme);
  4354. free(req->authority);
  4355. free(req->path);
  4356. Curl_dynhds_free(&req->headers);
  4357. Curl_dynhds_free(&req->trailers);
  4358. free(req);
  4359. }
  4360. }
  4361. struct name_const {
  4362. const char *name;
  4363. size_t namelen;
  4364. };
  4365. static struct name_const H2_NON_FIELD[] = {
  4366. { STRCONST("Host") },
  4367. { STRCONST("Upgrade") },
  4368. { STRCONST("Connection") },
  4369. { STRCONST("Keep-Alive") },
  4370. { STRCONST("Proxy-Connection") },
  4371. { STRCONST("Transfer-Encoding") },
  4372. };
  4373. static bool h2_non_field(const char *name, size_t namelen)
  4374. {
  4375. size_t i;
  4376. for(i = 0; i < sizeof(H2_NON_FIELD)/sizeof(H2_NON_FIELD[0]); ++i) {
  4377. if(namelen < H2_NON_FIELD[i].namelen)
  4378. return FALSE;
  4379. if(namelen == H2_NON_FIELD[i].namelen &&
  4380. strcasecompare(H2_NON_FIELD[i].name, name))
  4381. return TRUE;
  4382. }
  4383. return FALSE;
  4384. }
  4385. CURLcode Curl_http_req_to_h2(struct dynhds *h2_headers,
  4386. struct httpreq *req, struct Curl_easy *data)
  4387. {
  4388. const char *scheme = NULL, *authority = NULL;
  4389. struct dynhds_entry *e;
  4390. size_t i;
  4391. CURLcode result;
  4392. DEBUGASSERT(req);
  4393. DEBUGASSERT(h2_headers);
  4394. if(req->scheme) {
  4395. scheme = req->scheme;
  4396. }
  4397. else if(strcmp("CONNECT", req->method)) {
  4398. scheme = Curl_checkheaders(data, STRCONST(HTTP_PSEUDO_SCHEME));
  4399. if(scheme) {
  4400. scheme += sizeof(HTTP_PSEUDO_SCHEME);
  4401. while(*scheme && ISBLANK(*scheme))
  4402. scheme++;
  4403. infof(data, "set pseudo header %s to %s", HTTP_PSEUDO_SCHEME, scheme);
  4404. }
  4405. else {
  4406. scheme = (data->conn && data->conn->handler->flags & PROTOPT_SSL)?
  4407. "https" : "http";
  4408. }
  4409. }
  4410. if(req->authority) {
  4411. authority = req->authority;
  4412. }
  4413. else {
  4414. e = Curl_dynhds_get(&req->headers, STRCONST("Host"));
  4415. if(e)
  4416. authority = e->value;
  4417. }
  4418. Curl_dynhds_reset(h2_headers);
  4419. Curl_dynhds_set_opts(h2_headers, DYNHDS_OPT_LOWERCASE);
  4420. result = Curl_dynhds_add(h2_headers, STRCONST(HTTP_PSEUDO_METHOD),
  4421. req->method, strlen(req->method));
  4422. if(!result && scheme) {
  4423. result = Curl_dynhds_add(h2_headers, STRCONST(HTTP_PSEUDO_SCHEME),
  4424. scheme, strlen(scheme));
  4425. }
  4426. if(!result && authority) {
  4427. result = Curl_dynhds_add(h2_headers, STRCONST(HTTP_PSEUDO_AUTHORITY),
  4428. authority, strlen(authority));
  4429. }
  4430. if(!result && req->path) {
  4431. result = Curl_dynhds_add(h2_headers, STRCONST(HTTP_PSEUDO_PATH),
  4432. req->path, strlen(req->path));
  4433. }
  4434. for(i = 0; !result && i < Curl_dynhds_count(&req->headers); ++i) {
  4435. e = Curl_dynhds_getn(&req->headers, i);
  4436. if(!h2_non_field(e->name, e->namelen)) {
  4437. result = Curl_dynhds_add(h2_headers, e->name, e->namelen,
  4438. e->value, e->valuelen);
  4439. }
  4440. }
  4441. return result;
  4442. }
  4443. CURLcode Curl_http_resp_make(struct http_resp **presp,
  4444. int status,
  4445. const char *description)
  4446. {
  4447. struct http_resp *resp;
  4448. CURLcode result = CURLE_OUT_OF_MEMORY;
  4449. resp = calloc(1, sizeof(*resp));
  4450. if(!resp)
  4451. goto out;
  4452. resp->status = status;
  4453. if(description) {
  4454. resp->description = strdup(description);
  4455. if(!resp->description)
  4456. goto out;
  4457. }
  4458. Curl_dynhds_init(&resp->headers, 0, DYN_HTTP_REQUEST);
  4459. Curl_dynhds_init(&resp->trailers, 0, DYN_HTTP_REQUEST);
  4460. result = CURLE_OK;
  4461. out:
  4462. if(result && resp)
  4463. Curl_http_resp_free(resp);
  4464. *presp = result? NULL : resp;
  4465. return result;
  4466. }
  4467. void Curl_http_resp_free(struct http_resp *resp)
  4468. {
  4469. if(resp) {
  4470. free(resp->description);
  4471. Curl_dynhds_free(&resp->headers);
  4472. Curl_dynhds_free(&resp->trailers);
  4473. if(resp->prev)
  4474. Curl_http_resp_free(resp->prev);
  4475. free(resp);
  4476. }
  4477. }
  4478. #endif /* CURL_DISABLE_HTTP */