lighttpd 1.4.x https://www.lighttpd.net/
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

1178 lines
42 KiB

#include "first.h"
#include "sys-time.h"
#include "base.h"
#include "array.h"
#include "buffer.h"
#include "chunk.h"
#include "fdevent.h"
#include "log.h"
#include "http_chunk.h"
#include "http_cgi.h"
#include "http_date.h"
#include "http_etag.h"
#include "http_header.h"
#include "response.h"
#include "sock_addr.h"
#include "stat_cache.h"
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include "sys-socket.h"
#include <unistd.h>
/**
* max size of the HTTP response header from backends
* (differs from server.max-request-field-size for max request field size)
*/
#define MAX_HTTP_RESPONSE_FIELD_SIZE 65535
__attribute_cold__
int http_response_buffer_append_authority(request_st * const r, buffer * const o) {
if (!buffer_string_is_empty(&r->uri.authority)) {
buffer_append_string_buffer(o, &r->uri.authority);
} else {
/* get the name of the currently connected socket */
sock_addr our_addr;
socklen_t our_addr_len;
our_addr.plain.sa_family = 0;
our_addr_len = sizeof(our_addr);
if (-1 == getsockname(r->con->fd, (struct sockaddr *)&our_addr, &our_addr_len)
|| our_addr_len > (socklen_t)sizeof(our_addr)) {
r->http_status = 500;
log_perror(r->conf.errh, __FILE__, __LINE__, "can't get sockname");
return -1;
}
if (our_addr.plain.sa_family == AF_INET
&& our_addr.ipv4.sin_addr.s_addr == htonl(INADDR_LOOPBACK)) {
static char lhost[32];
static size_t lhost_len = 0;
if (0 != lhost_len) {
buffer_append_string_len(o, lhost, lhost_len);
}
else {
size_t olen = buffer_string_length(o);
if (0 == sock_addr_nameinfo_append_buffer(o, &our_addr, r->conf.errh)) {
lhost_len = buffer_string_length(o) - olen;
if (lhost_len < sizeof(lhost)) {
memcpy(lhost, o->ptr+olen, lhost_len+1); /*(+1 for '\0')*/
}
else {
lhost_len = 0;
}
}
else {
lhost_len = sizeof("localhost")-1;
memcpy(lhost, "localhost", lhost_len+1); /*(+1 for '\0')*/
buffer_append_string_len(o, lhost, lhost_len);
}
}
} else if (!buffer_string_is_empty(r->server_name)) {
buffer_append_string_buffer(o, r->server_name);
} else
/* Lookup name: secondly try to get hostname for bind address */
if (0 != sock_addr_nameinfo_append_buffer(o, &our_addr, r->conf.errh)) {
r->http_status = 500;
return -1;
}
{
unsigned short listen_port = sock_addr_get_port(&our_addr);
unsigned short default_port = 80;
if (buffer_is_equal_string(&r->uri.scheme, CONST_STR_LEN("https"))) {
default_port = 443;
}
if (0 == listen_port) listen_port = r->con->srv->srvconf.port;
if (default_port != listen_port) {
buffer_append_string_len(o, CONST_STR_LEN(":"));
buffer_append_int(o, listen_port);
}
}
}
return 0;
}
int http_response_redirect_to_directory(request_st * const r, int status) {
buffer *o = r->tmp_buf;
buffer_clear(o);
/* XXX: store flag in global at startup? */
if (r->con->srv->srvconf.absolute_dir_redirect) {
buffer_append_str2(o, CONST_BUF_LEN(&r->uri.scheme),
CONST_STR_LEN("://"));
if (0 != http_response_buffer_append_authority(r, o)) {
return -1;
}
}
buffer *vb;
if (status >= 300) {
r->http_status = status;
r->resp_body_finished = 1;
vb = http_header_response_set_ptr(r, HTTP_HEADER_LOCATION,
CONST_STR_LEN("Location"));
}
else {
vb = http_header_response_set_ptr(r, HTTP_HEADER_CONTENT_LOCATION,
CONST_STR_LEN("Content-Location"));
}
buffer_copy_buffer(vb, o);
buffer_append_string_encoded(vb, CONST_BUF_LEN(&r->uri.path),
ENCODING_REL_URI);
buffer_append_string_len(vb, CONST_STR_LEN("/"));
if (!buffer_string_is_empty(&r->uri.query))
buffer_append_str2(vb, CONST_STR_LEN("?"),
CONST_BUF_LEN(&r->uri.query));
return 0;
}
#define MTIME_CACHE_MAX 16
struct mtime_cache_type {
time_t mtime; /* key */
buffer str; /* buffer for string representation */
};
static struct mtime_cache_type mtime_cache[MTIME_CACHE_MAX];
static char mtime_cache_str[MTIME_CACHE_MAX][HTTP_DATE_SZ];
/* 30-chars for "%a, %d %b %Y %T GMT" */
void strftime_cache_reset(void) {
for (int i = 0; i < MTIME_CACHE_MAX; ++i) {
mtime_cache[i].mtime = (time_t)-1;
mtime_cache[i].str.ptr = mtime_cache_str[i];
mtime_cache[i].str.used = sizeof(mtime_cache_str[0]);
mtime_cache[i].str.size = sizeof(mtime_cache_str[0]);
}
}
static const buffer * strftime_cache_get(const time_t last_mod) {
static int mtime_cache_idx;
for (int j = 0; j < MTIME_CACHE_MAX; ++j) {
if (mtime_cache[j].mtime == last_mod)
return &mtime_cache[j].str; /* found cache-entry */
}
if (++mtime_cache_idx == MTIME_CACHE_MAX) mtime_cache_idx = 0;
const int i = mtime_cache_idx;
http_date_time_to_str(mtime_cache[i].str.ptr, sizeof(mtime_cache_str[0]),
(mtime_cache[i].mtime = last_mod));
return &mtime_cache[i].str;
}
const buffer * http_response_set_last_modified(request_st * const r, const time_t lmtime) {
buffer * const vb =
http_header_response_set_ptr(r, HTTP_HEADER_LAST_MODIFIED,
CONST_STR_LEN("Last-Modified"));
buffer_copy_buffer(vb, strftime_cache_get(lmtime));
return vb;
}
int http_response_handle_cachable(request_st * const r, const buffer * const lmod, const time_t lmtime) {
if (!(r->rqst_htags
& (light_bshift(HTTP_HEADER_IF_NONE_MATCH)
|light_bshift(HTTP_HEADER_IF_MODIFIED_SINCE)))) {
return HANDLER_GO_ON;
}
const buffer *vb;
/*
* 14.26 If-None-Match
* [...]
* If none of the entity tags match, then the server MAY perform the
* requested method as if the If-None-Match header field did not exist,
* but MUST also ignore any If-Modified-Since header field(s) in the
* request. That is, if no entity tags match, then the server MUST NOT
* return a 304 (Not Modified) response.
*/
if ((vb = http_header_request_get(r, HTTP_HEADER_IF_NONE_MATCH,
CONST_STR_LEN("If-None-Match")))) {
/*(weak etag comparison must not be used for ranged requests)*/
int range_request = (0 != light_btst(r->rqst_htags, HTTP_HEADER_RANGE));
if (http_etag_matches(&r->physical.etag, vb->ptr, !range_request)) {
if (http_method_get_or_head(r->http_method)) {
r->http_status = 304;
return HANDLER_FINISHED;
} else {
r->http_status = 412;
r->handler_module = NULL;
return HANDLER_FINISHED;
}
}
} else if (http_method_get_or_head(r->http_method)
&& (vb = http_header_request_get(r, HTTP_HEADER_IF_MODIFIED_SINCE,
CONST_STR_LEN("If-Modified-Since")))) {
/* last-modified handling */
if (buffer_is_equal(lmod, vb)
|| !http_date_if_modified_since(CONST_BUF_LEN(vb), lmtime)) {
r->http_status = 304;
return HANDLER_FINISHED;
}
}
return HANDLER_GO_ON;
}
void http_response_body_clear (request_st * const r, int preserve_length) {
r->resp_send_chunked = 0;
r->resp_body_scratchpad = -1;
if (light_btst(r->resp_htags, HTTP_HEADER_TRANSFER_ENCODING)) {
http_header_response_unset(r, HTTP_HEADER_TRANSFER_ENCODING,
CONST_STR_LEN("Transfer-Encoding"));
}
if (!preserve_length) { /* preserve for HEAD responses and no-content responses (204, 205, 304) */
if (light_btst(r->resp_htags, HTTP_HEADER_CONTENT_LENGTH)) {
http_header_response_unset(r, HTTP_HEADER_CONTENT_LENGTH,
CONST_STR_LEN("Content-Length"));
}
/*(if not preserving Content-Length, do not preserve trailers, if any)*/
r->resp_decode_chunked = 0;
if (r->gw_dechunk) {
free(r->gw_dechunk->b.ptr);
free(r->gw_dechunk);
r->gw_dechunk = NULL;
}
}
chunkqueue_reset(&r->write_queue);
}
static void http_response_header_clear (request_st * const r) {
r->http_status = 0;
r->resp_htags = 0;
r->resp_header_len = 0;
r->resp_header_repeated = 0;
array_reset_data_strings(&r->resp_headers);
/* Note: http_response_body_clear(r, 0) is not called here
* r->write_queue should be preserved for additional data after 1xx response
* However, if http_response_process_headers() was called and response had
* Transfer-Encoding: chunked set, then other items need to be reset */
r->resp_send_chunked = 0;
r->resp_decode_chunked = 0;
r->resp_body_scratchpad = -1;
if (r->gw_dechunk) {
free(r->gw_dechunk->b.ptr);
free(r->gw_dechunk);
r->gw_dechunk = NULL;
}
}
void http_response_reset (request_st * const r) {
r->http_status = 0;
r->con->is_writable = 1;
r->resp_body_finished = 0;
r->resp_body_started = 0;
r->handler_module = NULL;
if (r->physical.path.ptr) { /*(skip for mod_fastcgi authorizer)*/
buffer_clear(&r->physical.doc_root);
buffer_clear(&r->physical.basedir);
buffer_clear(&r->physical.etag);
buffer_reset(&r->physical.path);
buffer_reset(&r->physical.rel_path);
}
r->resp_htags = 0;
r->resp_header_len = 0;
r->resp_header_repeated = 0;
array_reset_data_strings(&r->resp_headers);
http_response_body_clear(r, 0);
}
handler_t http_response_reqbody_read_error (request_st * const r, int http_status) {
r->keep_alive = 0;
/*(do not change status if response headers already set and possibly sent)*/
if (0 != r->resp_header_len) return HANDLER_ERROR;
http_response_body_clear(r, 0);
r->http_status = http_status;
r->handler_module = NULL;
return HANDLER_FINISHED;
}
void http_response_send_file (request_st * const r, buffer * const path) {
stat_cache_entry * const sce = stat_cache_get_entry_open(path, r->conf.follow_symlink);
const buffer *mtime = NULL;
int allow_caching = (0 == r->http_status || 200 == r->http_status);
if (NULL == sce) {
r->http_status = (errno == ENOENT) ? 404 : 403;
log_error(r->conf.errh, __FILE__, __LINE__,
"not a regular file: %s -> %s", r->uri.path.ptr, path->ptr);
return;
}
if (!r->conf.follow_symlink
&& 0 != stat_cache_path_contains_symlink(path, r->conf.errh)) {
r->http_status = 403;
if (r->conf.log_request_handling) {
log_error(r->conf.errh, __FILE__, __LINE__,
"-- access denied due symlink restriction");
log_error(r->conf.errh, __FILE__, __LINE__,
"Path : %s", path->ptr);
}
return;
}
/* we only handle regular files */
if (!S_ISREG(sce->st.st_mode)) {
r->http_status = 403;
if (r->conf.log_file_not_found) {
log_error(r->conf.errh, __FILE__, __LINE__,
"not a regular file: %s -> %s",
r->uri.path.ptr, path->ptr);
}
return;
}
if (sce->fd < 0 && 0 != sce->st.st_size) {
r->http_status = (errno == ENOENT) ? 404 : 403;
if (r->conf.log_request_handling) {
log_perror(r->conf.errh, __FILE__, __LINE__,
"file open failed: %s", path->ptr);
}
return;
}
/* set response content-type, if not set already */
if (!light_btst(r->resp_htags, HTTP_HEADER_CONTENT_TYPE)) {
const buffer *content_type = stat_cache_content_type_get(sce, r);
if (buffer_string_is_empty(content_type)) {
/* we are setting application/octet-stream, but also announce that
* this header field might change in the seconds few requests
*
* This should fix the aggressive caching of FF and the script download
* seen by the first installations
*/
http_header_response_set(r, HTTP_HEADER_CONTENT_TYPE,
CONST_STR_LEN("Content-Type"),
CONST_STR_LEN("application/octet-stream"));
allow_caching = 0;
} else {
http_header_response_set(r, HTTP_HEADER_CONTENT_TYPE,
CONST_STR_LEN("Content-Type"),
CONST_BUF_LEN(content_type));
}
}
if (allow_caching) {
if (!light_btst(r->resp_htags, HTTP_HEADER_ETAG)
&& 0 != r->conf.etag_flags) {
const buffer *etag =
stat_cache_etag_get(sce, r->conf.etag_flags);
if (!buffer_string_is_empty(etag)) {
buffer_copy_buffer(&r->physical.etag, etag);
http_header_response_set(r, HTTP_HEADER_ETAG,
CONST_STR_LEN("ETag"),
CONST_BUF_LEN(&r->physical.etag));
}
}
/* prepare header */
mtime = http_header_response_get(r, HTTP_HEADER_LAST_MODIFIED,
CONST_STR_LEN("Last-Modified"));
if (NULL == mtime) {
mtime = http_response_set_last_modified(r, sce->st.st_mtime);
}
if (HANDLER_FINISHED == http_response_handle_cachable(r, mtime, sce->st.st_mtime)) {
return;
}
}
if (0 == sce->st.st_size) {
r->http_status = 200;
r->resp_body_finished = 1;
/*(Transfer-Encoding should not have been set at this point)*/
http_header_response_set(r, HTTP_HEADER_CONTENT_LENGTH,
CONST_STR_LEN("Content-Length"),
CONST_STR_LEN("0"));
return;
}
/* if we are still here, prepare body */
/* we add it here for all requests
* the HEAD request will drop it afterwards again
*/
if (0 == http_chunk_append_file_ref(r, sce)) {
r->http_status = 200;
r->resp_body_finished = 1;
/*(Transfer-Encoding should not have been set at this point)*/
buffer_append_int(
http_header_response_set_ptr(r, HTTP_HEADER_CONTENT_LENGTH,
CONST_STR_LEN("Content-Length")),
sce->st.st_size);
}
else {
r->http_status = 500;
}
}
[mod_fastcgi] use http_response_xsendfile() (fixes #799, fixes #851, fixes #2017, fixes #2076) handle X-Sendfile and X-LIGHTTPD-send-file w/ http_response_xsendfile() if host is configured ( "x-sendfile" = "enable" ) Note: X-Sendfile path is url-decoded for consistency, like X-Sendfile2 (response headers should be url-encoded to avoid tripping over chars allowed in filesystem but which might change response header parsing semantics) Note: deprecated: "allow-x-send-file"; use "x-sendfile" Note: deprecated: X-LIGHTTPD-send-file header; use X-Sendfile header Note: deprecated: X-Sendfile2 header; use X-Sendfile header For now, X-Sendfile2 is still handled internally by mod_fastcgi. Since http_response_send_file() supports HTTP Range requests, X-Sendfile2 is effectively obsolete. However, any code, e.g. PHP, currently using X-Sendfile2 is probably manually generating 206 Partial Content status and Range response headers. A future version of lighttpd might *remove* X-Sendfile2. Existing code should be converted to use X-Sendfile, which is easily done by removing all the special logic around using X-Sendfile2, since the 206 Partial Content status and Range response headers are handled in http_response_send_file(). x-ref: "mod_fastcgi + X-Sendfile -> mod_staticfile" https://redmine.lighttpd.net/issues/799 "Feature Request: New option "x-send-file-docroot"" https://redmine.lighttpd.net/issues/851 "X-Sendfile handoff to mod-static-file in 1.4.x" https://redmine.lighttpd.net/issues/2017 "X-sendfile should be able to set content-type" https://redmine.lighttpd.net/issues/2076
6 years ago
static void http_response_xsendfile (request_st * const r, buffer * const path, const array * const xdocroot) {
const int status = r->http_status;
[mod_fastcgi] use http_response_xsendfile() (fixes #799, fixes #851, fixes #2017, fixes #2076) handle X-Sendfile and X-LIGHTTPD-send-file w/ http_response_xsendfile() if host is configured ( "x-sendfile" = "enable" ) Note: X-Sendfile path is url-decoded for consistency, like X-Sendfile2 (response headers should be url-encoded to avoid tripping over chars allowed in filesystem but which might change response header parsing semantics) Note: deprecated: "allow-x-send-file"; use "x-sendfile" Note: deprecated: X-LIGHTTPD-send-file header; use X-Sendfile header Note: deprecated: X-Sendfile2 header; use X-Sendfile header For now, X-Sendfile2 is still handled internally by mod_fastcgi. Since http_response_send_file() supports HTTP Range requests, X-Sendfile2 is effectively obsolete. However, any code, e.g. PHP, currently using X-Sendfile2 is probably manually generating 206 Partial Content status and Range response headers. A future version of lighttpd might *remove* X-Sendfile2. Existing code should be converted to use X-Sendfile, which is easily done by removing all the special logic around using X-Sendfile2, since the 206 Partial Content status and Range response headers are handled in http_response_send_file(). x-ref: "mod_fastcgi + X-Sendfile -> mod_staticfile" https://redmine.lighttpd.net/issues/799 "Feature Request: New option "x-send-file-docroot"" https://redmine.lighttpd.net/issues/851 "X-Sendfile handoff to mod-static-file in 1.4.x" https://redmine.lighttpd.net/issues/2017 "X-sendfile should be able to set content-type" https://redmine.lighttpd.net/issues/2076
6 years ago
int valid = 1;
/* reset Content-Length, if set by backend
* Content-Length might later be set to size of X-Sendfile static file,
* determined by open(), fstat() to reduces race conditions if the file
* is modified between stat() (stat_cache_get_entry()) and open(). */
if (light_btst(r->resp_htags, HTTP_HEADER_CONTENT_LENGTH)) {
http_header_response_unset(r, HTTP_HEADER_CONTENT_LENGTH,
CONST_STR_LEN("Content-Length"));
[mod_fastcgi] use http_response_xsendfile() (fixes #799, fixes #851, fixes #2017, fixes #2076) handle X-Sendfile and X-LIGHTTPD-send-file w/ http_response_xsendfile() if host is configured ( "x-sendfile" = "enable" ) Note: X-Sendfile path is url-decoded for consistency, like X-Sendfile2 (response headers should be url-encoded to avoid tripping over chars allowed in filesystem but which might change response header parsing semantics) Note: deprecated: "allow-x-send-file"; use "x-sendfile" Note: deprecated: X-LIGHTTPD-send-file header; use X-Sendfile header Note: deprecated: X-Sendfile2 header; use X-Sendfile header For now, X-Sendfile2 is still handled internally by mod_fastcgi. Since http_response_send_file() supports HTTP Range requests, X-Sendfile2 is effectively obsolete. However, any code, e.g. PHP, currently using X-Sendfile2 is probably manually generating 206 Partial Content status and Range response headers. A future version of lighttpd might *remove* X-Sendfile2. Existing code should be converted to use X-Sendfile, which is easily done by removing all the special logic around using X-Sendfile2, since the 206 Partial Content status and Range response headers are handled in http_response_send_file(). x-ref: "mod_fastcgi + X-Sendfile -> mod_staticfile" https://redmine.lighttpd.net/issues/799 "Feature Request: New option "x-send-file-docroot"" https://redmine.lighttpd.net/issues/851 "X-Sendfile handoff to mod-static-file in 1.4.x" https://redmine.lighttpd.net/issues/2017 "X-sendfile should be able to set content-type" https://redmine.lighttpd.net/issues/2076
6 years ago
}
buffer_urldecode_path(path);
if (!buffer_is_valid_UTF8(path)) {
log_error(r->conf.errh, __FILE__, __LINE__,
"X-Sendfile invalid UTF-8 after url-decode: %s", path->ptr);
if (r->http_status < 400) {
r->http_status = 502;
r->handler_module = NULL;
}
return;
}
[mod_fastcgi] use http_response_xsendfile() (fixes #799, fixes #851, fixes #2017, fixes #2076) handle X-Sendfile and X-LIGHTTPD-send-file w/ http_response_xsendfile() if host is configured ( "x-sendfile" = "enable" ) Note: X-Sendfile path is url-decoded for consistency, like X-Sendfile2 (response headers should be url-encoded to avoid tripping over chars allowed in filesystem but which might change response header parsing semantics) Note: deprecated: "allow-x-send-file"; use "x-sendfile" Note: deprecated: X-LIGHTTPD-send-file header; use X-Sendfile header Note: deprecated: X-Sendfile2 header; use X-Sendfile header For now, X-Sendfile2 is still handled internally by mod_fastcgi. Since http_response_send_file() supports HTTP Range requests, X-Sendfile2 is effectively obsolete. However, any code, e.g. PHP, currently using X-Sendfile2 is probably manually generating 206 Partial Content status and Range response headers. A future version of lighttpd might *remove* X-Sendfile2. Existing code should be converted to use X-Sendfile, which is easily done by removing all the special logic around using X-Sendfile2, since the 206 Partial Content status and Range response headers are handled in http_response_send_file(). x-ref: "mod_fastcgi + X-Sendfile -> mod_staticfile" https://redmine.lighttpd.net/issues/799 "Feature Request: New option "x-send-file-docroot"" https://redmine.lighttpd.net/issues/851 "X-Sendfile handoff to mod-static-file in 1.4.x" https://redmine.lighttpd.net/issues/2017 "X-sendfile should be able to set content-type" https://redmine.lighttpd.net/issues/2076
6 years ago
buffer_path_simplify(path, path);
if (r->conf.force_lowercase_filenames) {
[mod_fastcgi] use http_response_xsendfile() (fixes #799, fixes #851, fixes #2017, fixes #2076) handle X-Sendfile and X-LIGHTTPD-send-file w/ http_response_xsendfile() if host is configured ( "x-sendfile" = "enable" ) Note: X-Sendfile path is url-decoded for consistency, like X-Sendfile2 (response headers should be url-encoded to avoid tripping over chars allowed in filesystem but which might change response header parsing semantics) Note: deprecated: "allow-x-send-file"; use "x-sendfile" Note: deprecated: X-LIGHTTPD-send-file header; use X-Sendfile header Note: deprecated: X-Sendfile2 header; use X-Sendfile header For now, X-Sendfile2 is still handled internally by mod_fastcgi. Since http_response_send_file() supports HTTP Range requests, X-Sendfile2 is effectively obsolete. However, any code, e.g. PHP, currently using X-Sendfile2 is probably manually generating 206 Partial Content status and Range response headers. A future version of lighttpd might *remove* X-Sendfile2. Existing code should be converted to use X-Sendfile, which is easily done by removing all the special logic around using X-Sendfile2, since the 206 Partial Content status and Range response headers are handled in http_response_send_file(). x-ref: "mod_fastcgi + X-Sendfile -> mod_staticfile" https://redmine.lighttpd.net/issues/799 "Feature Request: New option "x-send-file-docroot"" https://redmine.lighttpd.net/issues/851 "X-Sendfile handoff to mod-static-file in 1.4.x" https://redmine.lighttpd.net/issues/2017 "X-sendfile should be able to set content-type" https://redmine.lighttpd.net/issues/2076
6 years ago
buffer_to_lower(path);
}
if (buffer_string_is_empty(path)) {
r->http_status = 502;
valid = 0;
}
[mod_fastcgi] use http_response_xsendfile() (fixes #799, fixes #851, fixes #2017, fixes #2076) handle X-Sendfile and X-LIGHTTPD-send-file w/ http_response_xsendfile() if host is configured ( "x-sendfile" = "enable" ) Note: X-Sendfile path is url-decoded for consistency, like X-Sendfile2 (response headers should be url-encoded to avoid tripping over chars allowed in filesystem but which might change response header parsing semantics) Note: deprecated: "allow-x-send-file"; use "x-sendfile" Note: deprecated: X-LIGHTTPD-send-file header; use X-Sendfile header Note: deprecated: X-Sendfile2 header; use X-Sendfile header For now, X-Sendfile2 is still handled internally by mod_fastcgi. Since http_response_send_file() supports HTTP Range requests, X-Sendfile2 is effectively obsolete. However, any code, e.g. PHP, currently using X-Sendfile2 is probably manually generating 206 Partial Content status and Range response headers. A future version of lighttpd might *remove* X-Sendfile2. Existing code should be converted to use X-Sendfile, which is easily done by removing all the special logic around using X-Sendfile2, since the 206 Partial Content status and Range response headers are handled in http_response_send_file(). x-ref: "mod_fastcgi + X-Sendfile -> mod_staticfile" https://redmine.lighttpd.net/issues/799 "Feature Request: New option "x-send-file-docroot"" https://redmine.lighttpd.net/issues/851 "X-Sendfile handoff to mod-static-file in 1.4.x" https://redmine.lighttpd.net/issues/2017 "X-sendfile should be able to set content-type" https://redmine.lighttpd.net/issues/2076
6 years ago
/* check that path is under xdocroot(s)
* - xdocroot should have trailing slash appended at config time
* - r->conf.force_lowercase_filenames is not a server-wide setting,
[mod_fastcgi] use http_response_xsendfile() (fixes #799, fixes #851, fixes #2017, fixes #2076) handle X-Sendfile and X-LIGHTTPD-send-file w/ http_response_xsendfile() if host is configured ( "x-sendfile" = "enable" ) Note: X-Sendfile path is url-decoded for consistency, like X-Sendfile2 (response headers should be url-encoded to avoid tripping over chars allowed in filesystem but which might change response header parsing semantics) Note: deprecated: "allow-x-send-file"; use "x-sendfile" Note: deprecated: X-LIGHTTPD-send-file header; use X-Sendfile header Note: deprecated: X-Sendfile2 header; use X-Sendfile header For now, X-Sendfile2 is still handled internally by mod_fastcgi. Since http_response_send_file() supports HTTP Range requests, X-Sendfile2 is effectively obsolete. However, any code, e.g. PHP, currently using X-Sendfile2 is probably manually generating 206 Partial Content status and Range response headers. A future version of lighttpd might *remove* X-Sendfile2. Existing code should be converted to use X-Sendfile, which is easily done by removing all the special logic around using X-Sendfile2, since the 206 Partial Content status and Range response headers are handled in http_response_send_file(). x-ref: "mod_fastcgi + X-Sendfile -> mod_staticfile" https://redmine.lighttpd.net/issues/799 "Feature Request: New option "x-send-file-docroot"" https://redmine.lighttpd.net/issues/851 "X-Sendfile handoff to mod-static-file in 1.4.x" https://redmine.lighttpd.net/issues/2017 "X-sendfile should be able to set content-type" https://redmine.lighttpd.net/issues/2076
6 years ago
* and so can not be definitively applied to xdocroot at config time*/
if (xdocroot) {
[mod_fastcgi] use http_response_xsendfile() (fixes #799, fixes #851, fixes #2017, fixes #2076) handle X-Sendfile and X-LIGHTTPD-send-file w/ http_response_xsendfile() if host is configured ( "x-sendfile" = "enable" ) Note: X-Sendfile path is url-decoded for consistency, like X-Sendfile2 (response headers should be url-encoded to avoid tripping over chars allowed in filesystem but which might change response header parsing semantics) Note: deprecated: "allow-x-send-file"; use "x-sendfile" Note: deprecated: X-LIGHTTPD-send-file header; use X-Sendfile header Note: deprecated: X-Sendfile2 header; use X-Sendfile header For now, X-Sendfile2 is still handled internally by mod_fastcgi. Since http_response_send_file() supports HTTP Range requests, X-Sendfile2 is effectively obsolete. However, any code, e.g. PHP, currently using X-Sendfile2 is probably manually generating 206 Partial Content status and Range response headers. A future version of lighttpd might *remove* X-Sendfile2. Existing code should be converted to use X-Sendfile, which is easily done by removing all the special logic around using X-Sendfile2, since the 206 Partial Content status and Range response headers are handled in http_response_send_file(). x-ref: "mod_fastcgi + X-Sendfile -> mod_staticfile" https://redmine.lighttpd.net/issues/799 "Feature Request: New option "x-send-file-docroot"" https://redmine.lighttpd.net/issues/851 "X-Sendfile handoff to mod-static-file in 1.4.x" https://redmine.lighttpd.net/issues/2017 "X-sendfile should be able to set content-type" https://redmine.lighttpd.net/issues/2076
6 years ago
size_t i, xlen = buffer_string_length(path);
for (i = 0; i < xdocroot->used; ++i) {
data_string *ds = (data_string *)xdocroot->data[i];
size_t dlen = buffer_string_length(&ds->value);
[mod_fastcgi] use http_response_xsendfile() (fixes #799, fixes #851, fixes #2017, fixes #2076) handle X-Sendfile and X-LIGHTTPD-send-file w/ http_response_xsendfile() if host is configured ( "x-sendfile" = "enable" ) Note: X-Sendfile path is url-decoded for consistency, like X-Sendfile2 (response headers should be url-encoded to avoid tripping over chars allowed in filesystem but which might change response header parsing semantics) Note: deprecated: "allow-x-send-file"; use "x-sendfile" Note: deprecated: X-LIGHTTPD-send-file header; use X-Sendfile header Note: deprecated: X-Sendfile2 header; use X-Sendfile header For now, X-Sendfile2 is still handled internally by mod_fastcgi. Since http_response_send_file() supports HTTP Range requests, X-Sendfile2 is effectively obsolete. However, any code, e.g. PHP, currently using X-Sendfile2 is probably manually generating 206 Partial Content status and Range response headers. A future version of lighttpd might *remove* X-Sendfile2. Existing code should be converted to use X-Sendfile, which is easily done by removing all the special logic around using X-Sendfile2, since the 206 Partial Content status and Range response headers are handled in http_response_send_file(). x-ref: "mod_fastcgi + X-Sendfile -> mod_staticfile" https://redmine.lighttpd.net/issues/799 "Feature Request: New option "x-send-file-docroot"" https://redmine.lighttpd.net/issues/851 "X-Sendfile handoff to mod-static-file in 1.4.x" https://redmine.lighttpd.net/issues/2017 "X-sendfile should be able to set content-type" https://redmine.lighttpd.net/issues/2076
6 years ago
if (dlen <= xlen
&& (!r->conf.force_lowercase_filenames
? 0 == memcmp(path->ptr, ds->value.ptr, dlen)
: buffer_eq_icase_ssn(path->ptr, ds->value.ptr, dlen))) {
[mod_fastcgi] use http_response_xsendfile() (fixes #799, fixes #851, fixes #2017, fixes #2076) handle X-Sendfile and X-LIGHTTPD-send-file w/ http_response_xsendfile() if host is configured ( "x-sendfile" = "enable" ) Note: X-Sendfile path is url-decoded for consistency, like X-Sendfile2 (response headers should be url-encoded to avoid tripping over chars allowed in filesystem but which might change response header parsing semantics) Note: deprecated: "allow-x-send-file"; use "x-sendfile" Note: deprecated: X-LIGHTTPD-send-file header; use X-Sendfile header Note: deprecated: X-Sendfile2 header; use X-Sendfile header For now, X-Sendfile2 is still handled internally by mod_fastcgi. Since http_response_send_file() supports HTTP Range requests, X-Sendfile2 is effectively obsolete. However, any code, e.g. PHP, currently using X-Sendfile2 is probably manually generating 206 Partial Content status and Range response headers. A future version of lighttpd might *remove* X-Sendfile2. Existing code should be converted to use X-Sendfile, which is easily done by removing all the special logic around using X-Sendfile2, since the 206 Partial Content status and Range response headers are handled in http_response_send_file(). x-ref: "mod_fastcgi + X-Sendfile -> mod_staticfile" https://redmine.lighttpd.net/issues/799 "Feature Request: New option "x-send-file-docroot"" https://redmine.lighttpd.net/issues/851 "X-Sendfile handoff to mod-static-file in 1.4.x" https://redmine.lighttpd.net/issues/2017 "X-sendfile should be able to set content-type" https://redmine.lighttpd.net/issues/2076
6 years ago
break;
}
}
if (i == xdocroot->used && 0 != i) {
log_error(r->conf.errh, __FILE__, __LINE__,
"X-Sendfile (%s) not under configured x-sendfile-docroot(s)", path->ptr);
r->http_status = 403;
[mod_fastcgi] use http_response_xsendfile() (fixes #799, fixes #851, fixes #2017, fixes #2076) handle X-Sendfile and X-LIGHTTPD-send-file w/ http_response_xsendfile() if host is configured ( "x-sendfile" = "enable" ) Note: X-Sendfile path is url-decoded for consistency, like X-Sendfile2 (response headers should be url-encoded to avoid tripping over chars allowed in filesystem but which might change response header parsing semantics) Note: deprecated: "allow-x-send-file"; use "x-sendfile" Note: deprecated: X-LIGHTTPD-send-file header; use X-Sendfile header Note: deprecated: X-Sendfile2 header; use X-Sendfile header For now, X-Sendfile2 is still handled internally by mod_fastcgi. Since http_response_send_file() supports HTTP Range requests, X-Sendfile2 is effectively obsolete. However, any code, e.g. PHP, currently using X-Sendfile2 is probably manually generating 206 Partial Content status and Range response headers. A future version of lighttpd might *remove* X-Sendfile2. Existing code should be converted to use X-Sendfile, which is easily done by removing all the special logic around using X-Sendfile2, since the 206 Partial Content status and Range response headers are handled in http_response_send_file(). x-ref: "mod_fastcgi + X-Sendfile -> mod_staticfile" https://redmine.lighttpd.net/issues/799 "Feature Request: New option "x-send-file-docroot"" https://redmine.lighttpd.net/issues/851 "X-Sendfile handoff to mod-static-file in 1.4.x" https://redmine.lighttpd.net/issues/2017 "X-sendfile should be able to set content-type" https://redmine.lighttpd.net/issues/2076
6 years ago
valid = 0;
}
}
if (valid) http_response_send_file(r, path);
[mod_fastcgi] use http_response_xsendfile() (fixes #799, fixes #851, fixes #2017, fixes #2076) handle X-Sendfile and X-LIGHTTPD-send-file w/ http_response_xsendfile() if host is configured ( "x-sendfile" = "enable" ) Note: X-Sendfile path is url-decoded for consistency, like X-Sendfile2 (response headers should be url-encoded to avoid tripping over chars allowed in filesystem but which might change response header parsing semantics) Note: deprecated: "allow-x-send-file"; use "x-sendfile" Note: deprecated: X-LIGHTTPD-send-file header; use X-Sendfile header Note: deprecated: X-Sendfile2 header; use X-Sendfile header For now, X-Sendfile2 is still handled internally by mod_fastcgi. Since http_response_send_file() supports HTTP Range requests, X-Sendfile2 is effectively obsolete. However, any code, e.g. PHP, currently using X-Sendfile2 is probably manually generating 206 Partial Content status and Range response headers. A future version of lighttpd might *remove* X-Sendfile2. Existing code should be converted to use X-Sendfile, which is easily done by removing all the special logic around using X-Sendfile2, since the 206 Partial Content status and Range response headers are handled in http_response_send_file(). x-ref: "mod_fastcgi + X-Sendfile -> mod_staticfile" https://redmine.lighttpd.net/issues/799 "Feature Request: New option "x-send-file-docroot"" https://redmine.lighttpd.net/issues/851 "X-Sendfile handoff to mod-static-file in 1.4.x" https://redmine.lighttpd.net/issues/2017 "X-sendfile should be able to set content-type" https://redmine.lighttpd.net/issues/2076
6 years ago
if (r->http_status >= 400 && status < 300) {
r->handler_module = NULL;
[mod_fastcgi] use http_response_xsendfile() (fixes #799, fixes #851, fixes #2017, fixes #2076) handle X-Sendfile and X-LIGHTTPD-send-file w/ http_response_xsendfile() if host is configured ( "x-sendfile" = "enable" ) Note: X-Sendfile path is url-decoded for consistency, like X-Sendfile2 (response headers should be url-encoded to avoid tripping over chars allowed in filesystem but which might change response header parsing semantics) Note: deprecated: "allow-x-send-file"; use "x-sendfile" Note: deprecated: X-LIGHTTPD-send-file header; use X-Sendfile header Note: deprecated: X-Sendfile2 header; use X-Sendfile header For now, X-Sendfile2 is still handled internally by mod_fastcgi. Since http_response_send_file() supports HTTP Range requests, X-Sendfile2 is effectively obsolete. However, any code, e.g. PHP, currently using X-Sendfile2 is probably manually generating 206 Partial Content status and Range response headers. A future version of lighttpd might *remove* X-Sendfile2. Existing code should be converted to use X-Sendfile, which is easily done by removing all the special logic around using X-Sendfile2, since the 206 Partial Content status and Range response headers are handled in http_response_send_file(). x-ref: "mod_fastcgi + X-Sendfile -> mod_staticfile" https://redmine.lighttpd.net/issues/799 "Feature Request: New option "x-send-file-docroot"" https://redmine.lighttpd.net/issues/851 "X-Sendfile handoff to mod-static-file in 1.4.x" https://redmine.lighttpd.net/issues/2017 "X-sendfile should be able to set content-type" https://redmine.lighttpd.net/issues/2076
6 years ago
} else if (0 != status && 200 != status) {
r->http_status = status;
[mod_fastcgi] use http_response_xsendfile() (fixes #799, fixes #851, fixes #2017, fixes #2076) handle X-Sendfile and X-LIGHTTPD-send-file w/ http_response_xsendfile() if host is configured ( "x-sendfile" = "enable" ) Note: X-Sendfile path is url-decoded for consistency, like X-Sendfile2 (response headers should be url-encoded to avoid tripping over chars allowed in filesystem but which might change response header parsing semantics) Note: deprecated: "allow-x-send-file"; use "x-sendfile" Note: deprecated: X-LIGHTTPD-send-file header; use X-Sendfile header Note: deprecated: X-Sendfile2 header; use X-Sendfile header For now, X-Sendfile2 is still handled internally by mod_fastcgi. Since http_response_send_file() supports HTTP Range requests, X-Sendfile2 is effectively obsolete. However, any code, e.g. PHP, currently using X-Sendfile2 is probably manually generating 206 Partial Content status and Range response headers. A future version of lighttpd might *remove* X-Sendfile2. Existing code should be converted to use X-Sendfile, which is easily done by removing all the special logic around using X-Sendfile2, since the 206 Partial Content status and Range response headers are handled in http_response_send_file(). x-ref: "mod_fastcgi + X-Sendfile -> mod_staticfile" https://redmine.lighttpd.net/issues/799 "Feature Request: New option "x-send-file-docroot"" https://redmine.lighttpd.net/issues/851 "X-Sendfile handoff to mod-static-file in 1.4.x" https://redmine.lighttpd.net/issues/2017 "X-sendfile should be able to set content-type" https://redmine.lighttpd.net/issues/2076
6 years ago
}
}
static void http_response_xsendfile2(request_st * const r, const buffer * const value, const array * const xdocroot) {
const char *pos = value->ptr;
buffer * const b = r->tmp_buf;
const int status = r->http_status;
/* reset Content-Length, if set by backend */
if (light_btst(r->resp_htags, HTTP_HEADER_CONTENT_LENGTH)) {
http_header_response_unset(r, HTTP_HEADER_CONTENT_LENGTH,
CONST_STR_LEN("Content-Length"));
}
while (*pos) {
const char *filename, *range;
stat_cache_entry *sce;
off_t begin_range, end_range, range_len;
while (' ' == *pos) pos++;
if (!*pos) break;
filename = pos;
if (NULL == (range = strchr(pos, ' '))) {
/* missing range */
log_error(r->conf.errh, __FILE__, __LINE__,
"Couldn't find range after filename: %s", filename);
r->http_status = 502;
break;
}
buffer_copy_string_len(b, filename, range - filename);
/* find end of range */
for (pos = ++range; *pos && *pos != ' ' && *pos != ','; pos++) ;
buffer_urldecode_path(b);
if (!buffer_is_valid_UTF8(b)) {
log_error(r->conf.errh, __FILE__, __LINE__,
"X-Sendfile2 invalid UTF-8 after url-decode: %s", b->ptr);
r->http_status = 502;
break;
}
buffer_path_simplify(b, b);
if (r->conf.force_lowercase_filenames) {
buffer_to_lower(b);
}
if (buffer_string_is_empty(b)) {
r->http_status = 502;
break;
}
if (xdocroot) {
size_t i, xlen = buffer_string_length(b);
for (i = 0; i < xdocroot->used; ++i) {
data_string *ds = (data_string *)xdocroot->data[i];
size_t dlen = buffer_string_length(&ds->value);