#include <XrdHttpProtocol.hh>

Inheritance diagram for XrdHttpProtocol:

Collaboration diagram for XrdHttpProtocol:

Classes
struct	StaticPreloadInfo

Public Member Functions
	XrdHttpProtocol (bool imhttps)

	XrdHttpProtocol (const XrdHttpProtocol &)=default
	Ctor, dtors and copy ctor.

	~XrdHttpProtocol ()

int	doChksum (const XrdOucString &fname)
	Perform a checksum request.

void	DoIt ()
	Override from the base class.

int	doStat (char *fname)
	Perform a Stat request.

bool	isHTTPS ()
	called via https

XrdProtocol *	Match (XrdLink *lp)
	Tells if the oustanding bytes on the socket match this protocol implementation.

XrdHttpProtocol	operator= (const XrdHttpProtocol &rhs)

int	Process (XrdLink *lp)
	Process data incoming from the socket.

void	Recycle (XrdLink lp, int consec, const char reason)
	Recycle this instance.

int	Stats (char *buff, int blen, int do_sync=0)
	Get activity stats.

Public Member Functions inherited from XrdProtocol
	XrdProtocol (const char *jname)

virtual	~XrdProtocol ()

Public Member Functions inherited from XrdJob
	XrdJob (const char *desc="")

virtual	~XrdJob ()

Static Public Member Functions
static int	Configure (char parms, XrdProtocol_Config pi)
	Read and apply the configuration.

static int	parseHeader2CGI (XrdOucStream &Config, XrdSysError &err, std::map< std::string, std::string > &header2cgi)
	Use this function to parse header2cgi configurations.

Public Attributes
XrdObject< XrdHttpProtocol >	ProtLink

XrdSecEntity	SecEntity
	Authentication area.

Public Attributes inherited from XrdJob
const char *	Comment

XrdJob *	NextJob

Static Public Attributes
static XrdHttpChecksumHandler	cksumHandler = XrdHttpChecksumHandler()

static XrdObjectQ< XrdHttpProtocol >	ProtStack

static XrdHttpReadRangeHandler::Configuration	ReadRangeConfig
	configuration for the read range handler

Protected Attributes
char *	Addr_str

XrdXrootd::Bridge *	Bridge
	The Bridge that we use to exercise the xrootd internals.

XrdHttpReq	CurrentReq

XrdLink *	Link
	The link we are bound to.

Static Protected Attributes
static XrdBuffManager *	BPool = 0

static XrdSecService *	CIA = 0

static bool	compatNameGeneration = false

static int	crlRefIntervalSec = XrdTlsContext::DEFAULT_CRL_REF_INT_SEC
	CRL thread refresh interval.

static XrdSysError	eDest = 0

static bool	embeddedstatic = true
	If true, use the embedded css and icons.

static char *	gridmap = 0
	Gridmap file location. The same used by XrdSecGsi.

static int	hailWait = 60000
	Timeout for reading the handshake.

static std::map< std::string, std::string >	hdr2cgimap
	Rules that turn HTTP headers to cgi tokens in the URL, for internal comsumption.

static bool	isdesthttps = false
	True if the redirections must be towards https targets.

static bool	isRequiredGridmap = false

static bool	listdeny = false
	If true, any form of listing is denied.

static char *	listredir = 0
	Url to redirect to in the case a listing is requested.

static BIO_METHOD *	m_bio_method = NULL
	C-style vptr table for our custom BIO objects.

static int	m_bio_type = 0
	Type identifier for our custom BIO objects.

static int	m_maxdelay = -1

static std::unordered_map< std::string, std::vector< std::pair< std::string, std::string > > >	m_staticheader_map
	The static headers to always return; map is from verb to a list of (header, val) pairs.

static std::unordered_map< std::string, std::string >	m_staticheaders

static kXR_int32	myRole = kXR_isManager
	Our role.

static XrdNetPMark *	pmarkHandle = nullptr
	Packet marking handler pointer (assigned from the environment during the Config() call)

static int	Port = 1094
	Our port.

static char *	Port_str = 0
	Our port, as a string.

static int	readWait = 300000
	Timeout for reading data.

static XrdScheduler *	Sched = 0

static char *	secretkey = 0
	The key used to calculate the url hashes.

static bool	selfhttps2http = false
	If client is HTTPS, self-redirect with HTTP+token.

static XrdOucGMap *	servGMap = 0
	The instance of the DN mapper. Created only when a valid path is given.

static char *	sslcadir = 0

static char *	sslcafile = 0

static char *	sslcert = 0
	OpenSSL stuff.

static char *	sslcipherfilter = 0

static char *	sslkey = 0

static int	sslverifydepth = 9
	Depth of verification of a certificate chain.

static XrdOucHash< StaticPreloadInfo > *	staticpreload = 0

static char *	staticredir = 0

static bool	tpcForwardCreds = false
	If set to true, the HTTP TPC transfers will forward the credentials to redirected hosts.

static char *	xrd_cslist = nullptr
	The list of checksums that were configured via the xrd.cksum parameter on the server config file.

Friends
class	XrdHttpExtReq

class	XrdHttpReq

Detailed Description

Definition at line 80 of file XrdHttpProtocol.hh.

Class Documentation

◆ XrdHttpProtocol::StaticPreloadInfo

struct XrdHttpProtocol::StaticPreloadInfo

Definition at line 436 of file XrdHttpProtocol.hh.

Collaboration diagram for XrdHttpProtocol::StaticPreloadInfo:

Class Members
char *	data
int	len

Constructor & Destructor Documentation

◆ XrdHttpProtocol() [1/2]

XrdHttpProtocol::XrdHttpProtocol ( const XrdHttpProtocol & )

default

Ctor, dtors and copy ctor.

References XrdHttpProtocol().

Referenced by XrdHttpProtocol(), Match(), and operator=().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ XrdHttpProtocol() [2/2]

XrdHttpProtocol::XrdHttpProtocol ( bool imhttps )

Definition at line 200 of file XrdHttpProtocol.cc.

: XrdProtocol("HTTP protocol handler"), ProtLink(this),
SecEntity(""), CurrentReq(this, ReadRangeConfig) {
  myBuff = 0;
  Addr_str = 0;
  Reset();
  ishttps = imhttps;
 
}

References XrdProtocol::XrdProtocol(), Addr_str, CurrentReq, ProtLink, ReadRangeConfig, and SecEntity.

Here is the call graph for this function:

◆ ~XrdHttpProtocol()

XrdHttpProtocol::~XrdHttpProtocol ( )

inline

Definition at line 124 of file XrdHttpProtocol.hh.

                     {
    Cleanup();
  }

Member Function Documentation

◆ Configure()

int XrdHttpProtocol::Configure	(	char *	parms,
		XrdProtocol_Config *	pi )

static

Read and apply the configuration.

Definition at line 1760 of file XrdHttpProtocol.cc.

                                                                   {
  /*
    Function: Establish configuration at load time.
 
    Input:    None.
 
    Output:   0 upon success or !0 otherwise.
   */
 
  char *rdf;
 
  // Copy out the special info we want to use at top level
  //
  eDest.logger(pi->eDest->logger());
  XrdHttpTrace.SetLogger(pi->eDest->logger());
  //  SI = new XrdXrootdStats(pi->Stats);
  Sched = pi->Sched;
  BPool = pi->BPool;
  xrd_cslist = getenv("XRD_CSLIST");
 
  Port = pi->Port;
 
  // Copy out the current TLS context
  //
  xrdctx = pi->tlsCtx;
 
  {
    char buf[16];
    sprintf(buf, "%d", Port);
    Port_str = strdup(buf);
  }
 
  // Now process and configuration parameters
  //
  rdf = (parms && *parms ? parms : pi->ConfigFN);
  if (rdf && Config(rdf, pi->theEnv)) return 0;
  if (pi->DebugON) XrdHttpTrace.What = TRACE_ALL;
 
  // Set the redirect flag if we are a pure redirector
  myRole = kXR_isServer;
  if ((rdf = getenv("XRDROLE"))) {
      eDest.Emsg("Config", "XRDROLE: ", rdf);
 
      if (!strcasecmp(rdf, "manager") || !strcasecmp(rdf, "supervisor")) {
        myRole = kXR_isManager;
        eDest.Emsg("Config", "Configured as HTTP(s) redirector.");
      } else {
 
        eDest.Emsg("Config", "Configured as HTTP(s) data server.");
      }
 
  } else {
    eDest.Emsg("Config", "No XRDROLE specified.");
  }
 
  // Schedule protocol object cleanup
  //
  ProtStack.Set(pi->Sched, &XrdHttpTrace,
                (XrdHttpTrace.What & TRACE_MEM ? TRACE_MEM : 0));
  ProtStack.Set((pi->ConnMax / 3 ? pi->ConnMax / 3 : 30), 60 * 60);
 
  // Return success
  //
 
  return 1;
}

References BPool, XrdProtocol_Config::BPool, XrdProtocol_Config::ConfigFN, XrdProtocol_Config::ConnMax, XrdProtocol_Config::DebugON, eDest, XrdProtocol_Config::eDest, kXR_isManager, kXR_isServer, XrdSysError::logger(), myRole, Port, XrdProtocol_Config::Port, Port_str, ProtStack, Sched, XrdProtocol_Config::Sched, XrdProtocol_Config::theEnv, XrdProtocol_Config::tlsCtx, TRACE_ALL, TRACE_MEM, xrd_cslist, XrdHttpProtoInfo::xrdctx, and XrdHttpTrace.

Referenced by XrdgetProtocol().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ doChksum()

int XrdHttpProtocol::doChksum ( const XrdOucString & fname )

Perform a checksum request.

Definition at line 3117 of file XrdHttpProtocol.cc.

                                                       {
  size_t length;
  memset(&CurrentReq.xrdreq, 0, sizeof (ClientRequest));
  CurrentReq.xrdreq.query.requestid = htons(kXR_query);
  CurrentReq.xrdreq.query.infotype = htons(kXR_Qcksum);
  memset(CurrentReq.xrdreq.query.reserved1, '\0', sizeof(CurrentReq.xrdreq.query.reserved1));
  memset(CurrentReq.xrdreq.query.fhandle, '\0', sizeof(CurrentReq.xrdreq.query.fhandle));
  memset(CurrentReq.xrdreq.query.reserved2, '\0', sizeof(CurrentReq.xrdreq.query.reserved2));
  length = fname.length() + 1;
  CurrentReq.xrdreq.query.dlen = htonl(length);
 
  if (!Bridge) return -1;
 
  return Bridge->Run(reinterpret_cast<char *>(&CurrentReq.xrdreq), const_cast<char *>(fname.c_str()), length) ? 0 : -1;
}

References Bridge, XrdOucString::c_str(), CurrentReq, kXR_Qcksum, kXR_query, and XrdOucString::length().

Here is the call graph for this function:

◆ DoIt()

void XrdHttpProtocol::DoIt ( )

inlinevirtual

Override from the base class.

Implements XrdJob.

Definition at line 91 of file XrdHttpProtocol.hh.

              {
    if (Resume) (*this.*Resume)();
  }

◆ doStat()

int XrdHttpProtocol::doStat ( char * fname )

Perform a Stat request.

Definition at line 3089 of file XrdHttpProtocol.cc.

                                       {
  int l;
  bool b;
  CurrentReq.filesize = 0;
  CurrentReq.fileflags = 0;
  CurrentReq.filemodtime = 0;
 
  memset(&CurrentReq.xrdreq, 0, sizeof (ClientRequest));
  CurrentReq.xrdreq.stat.requestid = htons(kXR_stat);
  memset(CurrentReq.xrdreq.stat.reserved, 0,
          sizeof (CurrentReq.xrdreq.stat.reserved));
  l = strlen(fname) + 1;
  CurrentReq.xrdreq.stat.dlen = htonl(l);
 
  if (!Bridge) return -1;
  b = Bridge->Run((char *) &CurrentReq.xrdreq, fname, l);
  if (!b) {
    return -1;
  }
 
 
  return 0;
}

References Bridge, CurrentReq, and kXR_stat.

◆ isHTTPS()

bool XrdHttpProtocol::isHTTPS ( )

inline

called via https

Definition at line 142 of file XrdHttpProtocol.hh.

142{ return ishttps; }

◆ Match()

XrdProtocol * XrdHttpProtocol::Match ( XrdLink * lp )

virtual

Tells if the oustanding bytes on the socket match this protocol implementation.

Implements XrdProtocol.

Definition at line 226 of file XrdHttpProtocol.cc.

                                               {
  char mybuf[16], mybuf2[1024];
  XrdHttpProtocol *hp;
  int dlen;
  bool myishttps = false;
 
  // Peek at the first 20 bytes of data
  //
  if ((dlen = lp->Peek(mybuf, (int) sizeof (mybuf), hailWait)) < (int) sizeof (mybuf)) {
    if (dlen <= 0) lp->setEtext("handshake not received");
    return (XrdProtocol *) 0;
  }
  mybuf[dlen - 1] = '\0';
 
  // Trace the data
  //
 
  TRACEI(DEBUG, "received dlen: " << dlen);
  //TRACEI(REQ, "received buf: " << mybuf);
  mybuf2[0] = '\0';
  for (int i = 0; i < dlen; i++) {
    char mybuf3[16];
    sprintf(mybuf3, "%.02d ", mybuf[i]);
    strcat(mybuf2, mybuf3);
 
  }
  TRACEI(DEBUG, "received dump: " << mybuf2);
 
  // Decide if it looks http or not. For now we are happy if all the received characters are alphanumeric
  bool ismine = true;
  for (int i = 0; i < dlen - 1; i++)
    if (!isprint(mybuf[i]) && (mybuf[i] != '\r') && (mybuf[i] != '\n')) {
      ismine = false;
      TRACEI(DEBUG, "This does not look like http at pos " << i);
      break;
    }
 
  // If it does not look http then look if it looks like https
  if ((!ismine) && (dlen >= 4)) {
    char check[4] = {00, 00, 00, 00};
    if (memcmp(mybuf, check, 4)) {
 
      if (httpsmode) {
        ismine = true;
        myishttps = true;
        TRACEI(DEBUG, "This may look like https");
      } else {
        TRACEI(ALL, "This may look like https, but https is not configured");
      }
 
    }
  }
 
  if (!ismine) {
    TRACEI(DEBUG, "This does not look like https. Protocol not matched.");
    return (XrdProtocol *) 0;
  }
 
  // It does look http or https...
  // Get a protocol object off the stack (if none, allocate a new one)
  //
 
  TRACEI(REQ, "Protocol matched. https: " << myishttps);
  if (!(hp = ProtStack.Pop())) hp = new XrdHttpProtocol(myishttps);
  else
    hp->ishttps = myishttps;
 
  // We now have to do some work arounds to tell the underlying framework
  // that is is https without invoking TLS on the actual link. Eventually,
  // we should just use the link's TLS native implementation.
  //
  hp->SecEntity.addrInfo = lp->AddrInfo();
  XrdNetAddr *netP = const_cast<XrdNetAddr*>(lp->NetAddr());
  netP->SetDialect("https");
  netP->SetTLS(true);
 
  // Allocate 1MB buffer from pool
  if (!hp->myBuff) {
    hp->myBuff = BPool->Obtain(1024 * 1024);
  }
  hp->myBuffStart = hp->myBuffEnd = hp->myBuff->buff;
 
  // Bind the protocol to the link and return the protocol
  //
  hp->Link = lp;
  return (XrdProtocol *) hp;
}

References XrdHttpProtocol(), XrdProtocol::XrdProtocol(), XrdLink::AddrInfo(), XrdSecEntity::addrInfo, BPool, XrdBuffer::buff, DEBUG, hailWait, XrdHttpProtoInfo::httpsmode, Link, XrdLink::NetAddr(), XrdLink::Peek(), ProtStack, SecEntity, XrdNetAddr::SetDialect(), XrdLink::setEtext(), XrdNetAddr::SetTLS(), and TRACEI.

Here is the call graph for this function:

◆ operator=()

XrdHttpProtocol XrdHttpProtocol::operator= ( const XrdHttpProtocol & rhs )

Definition at line 215 of file XrdHttpProtocol.cc.

                                                                      {
 
  return *this;
}

References XrdHttpProtocol().

Here is the call graph for this function:

◆ parseHeader2CGI()

int XrdHttpProtocol::parseHeader2CGI	(	XrdOucStream &	Config,
		XrdSysError &	err,
		std::map< std::string, std::string > &	header2cgi )

static

Use this function to parse header2cgi configurations.

Definition at line 1830 of file XrdHttpProtocol.cc.

                                                                                                                     {
  char *val, keybuf[1024], parmbuf[1024];
  char *parm;
 
  // Get the header key
  val = Config.GetWord();
  if (!val || !val[0]) {
    err.Emsg("Config", "No headerkey specified.");
    return 1;
  } else {
 
    // Trim the beginning, in place
    while ( *val && !isalnum(*val) ) val++;
    strcpy(keybuf, val);
 
    // Trim the end, in place
    char *pp;
    pp = keybuf + strlen(keybuf) - 1;
    while ( (pp >= keybuf) && (!isalnum(*pp)) ) {
      *pp = '\0';
      pp--;
    }
 
    parm = Config.GetWord();
 
    // Avoids segfault in case a key is given without value
    if(!parm || !parm[0]) {
      err.Emsg("Config", "No header2cgi value specified. key: '", keybuf, "'");
      return 1;
    }
 
    // Trim the beginning, in place
    while ( *parm && !isalnum(*parm) ) parm++;
    strcpy(parmbuf, parm);
 
    // Trim the end, in place
    pp = parmbuf + strlen(parmbuf) - 1;
    while ( (pp >= parmbuf) && (!isalnum(*pp)) ) {
      *pp = '\0';
      pp--;
    }
 
    // Add this mapping to the map that will be used
    try {
      header2cgi[keybuf] = parmbuf;
    } catch ( ... ) {
      err.Emsg("Config", "Can't insert new header2cgi rule. key: '", keybuf, "'");
      return 1;
    }
 
  }
  return 0;
}

References XrdSysError::Emsg().

Here is the call graph for this function:

◆ Process()

int XrdHttpProtocol::Process ( XrdLink * lp )

virtual

Process data incoming from the socket.

Implements XrdProtocol.

Definition at line 488 of file XrdHttpProtocol.cc.

{
  int rc = 0;
 
  TRACEI(DEBUG, " Process. lp:"<<(void *)lp<<" reqstate: "<<CurrentReq.reqstate);
 
  if (!myBuff || !myBuff->buff || !myBuff->bsize) {
    TRACE(ALL, " Process. No buffer available. Internal error.");
    return -1;
  }
 
 
  if (!SecEntity.host) {
    char *nfo = GetClientIPStr();
    if (nfo) {
      TRACEI(REQ, " Setting host: " << nfo);
      SecEntity.host = nfo;
      strcpy(SecEntity.prot, "http");
    }
  }
 
 
 
  // If https then check independently for the ssl handshake
  if (ishttps && !ssldone) {
 
      if (!ssl) {
          sbio = CreateBIO(Link);
          BIO_set_nbio(sbio, 1);
          if (!xrdctx->SetTlsClientAuth(tlsClientAuth)) {
            TRACE(ALL, "Failed to configure the TLS client authentication; invalid configuration");
            return -1;
          }
          ssl = (SSL*)xrdctx->Session();
        }
 
      if (!ssl) {
          TRACEI(DEBUG, " SSL_new returned NULL");
          ERR_print_errors(sslbio_err);
          return -1;
        }
 
      // If a secxtractor has been loaded
      // maybe it wants to add its own initialization bits
      if (secxtractor)
        secxtractor->InitSSL(ssl, sslcadir);
 
      SSL_set_bio(ssl, sbio, sbio);
      //SSL_set_connect_state(ssl);
 
      //SSL_set_fd(ssl, Link->FDnum());
      struct timeval tv;
      tv.tv_sec = 10;
      tv.tv_usec = 0;
      setsockopt(Link->FDnum(), SOL_SOCKET, SO_RCVTIMEO, (struct timeval *)&tv, sizeof(struct timeval));
      setsockopt(Link->FDnum(), SOL_SOCKET, SO_SNDTIMEO, (struct timeval *)&tv, sizeof(struct timeval));
 
      TRACEI(DEBUG, " Entering SSL_accept...");
      int res = SSL_accept(ssl);
      TRACEI(DEBUG, " SSL_accept returned :" << res);
      if ((res == -1) && (SSL_get_error(ssl, res) == SSL_ERROR_WANT_READ)) {
          TRACEI(DEBUG, " SSL_accept wants to read more bytes... err:" << SSL_get_error(ssl, res));
          return 1;
        }
 
      if(res <= 0) {
          ERR_print_errors(sslbio_err);
          if (res < 0) {
 
              SSL_free(ssl);
              ssl = 0;
              return -1;
          }
      }
 
      BIO_set_nbio(sbio, 0);
 
      strcpy(SecEntity.prot, "https");
 
      // Get the voms string and auth information
      if (tlsClientAuth == XrdTlsContext::ClientAuthSetting::kOn && HandleAuthentication(Link)) {
          SSL_free(ssl);
          ssl = 0;
          return -1;
      }
 
      ssldone = true;
      if (TRACING(TRACE_AUTH)) {
        SecEntity.Display(eDest);
      }
    }
 
 
 
  if (!DoingLogin) {
    // Re-invocations triggered by the bridge have lp==0
    // In this case we keep track of a different request state
    if (lp) {
 
      // This is an invocation that was triggered by a socket event
      // Read all the data that is available, throw it into the buffer
      if ((rc = getDataOneShot(BuffAvailable())) < 0) {
        // Error -> exit
        return -1;
      }
 
      // If we need more bytes, let's wait for another invokation
      if (BuffUsed() < ResumeBytes) return 1;
 
 
    } else
      CurrentReq.reqstate++;
  } else if (!DoneSetInfo && !CurrentReq.userAgent().empty()) { // DoingLogin is true, meaning the login finished.
    std::string mon_info = "monitor info " + CurrentReq.userAgent();
    DoneSetInfo = true;
    if (mon_info.size() >= 1024) {
      TRACEI(ALL, "User agent string too long");
    } else if (!Bridge) {
      TRACEI(ALL, "Internal logic error: Bridge is null after login");
    } else {
      TRACEI(DEBUG, "Setting " << mon_info);
      memset(&CurrentReq.xrdreq, 0, sizeof (ClientRequest));
      CurrentReq.xrdreq.set.requestid = htons(kXR_set);
      CurrentReq.xrdreq.set.modifier = '\0';
      memset(CurrentReq.xrdreq.set.reserved, '\0', sizeof(CurrentReq.xrdreq.set.reserved));
      CurrentReq.xrdreq.set.dlen = htonl(mon_info.size());
      if (!Bridge->Run((char *) &CurrentReq.xrdreq, (char *) mon_info.c_str(), mon_info.size())) {
        SendSimpleResp(500, nullptr, nullptr, "Could not set user agent.", 0, false);
        return -1;
      }
      return 0;
    }
  } else {
    DoingLogin = false;
  }
 
  // Read the next request header, that is, read until a double CRLF is found
 
 
  if (!CurrentReq.headerok) {
 
    // Read as many lines as possible into the buffer. An empty line breaks
    while ((rc = BuffgetLine(tmpline)) > 0) {
      std::string traceLine = tmpline.c_str();
      if (TRACING(TRACE_DEBUG)) {
        traceLine = obfuscateAuth(traceLine);
      }
      TRACE(DEBUG, " rc:" << rc << " got hdr line: " << traceLine);
      if ((rc == 2) && (tmpline.length() > 1) && (tmpline[rc - 1] == '\n')) {
        CurrentReq.headerok = true;
        TRACE(DEBUG, " rc:" << rc << " detected header end.");
        break;
      }
 
 
      if (CurrentReq.request == CurrentReq.rtUnset) {
        TRACE(DEBUG, " Parsing first line: " << traceLine.c_str());
        int result = CurrentReq.parseFirstLine((char *)tmpline.c_str(), rc);
        if (result < 0) {
          TRACE(DEBUG, " Parsing of first line failed with " << result);
          return -1;
        }
      } else {
        int result = CurrentReq.parseLine((char *) tmpline.c_str(), rc);
        if(result < 0) {
          TRACE(DEBUG, " Parsing of header line failed with " << result)
          SendSimpleResp(400,NULL,NULL,"Malformed header line. Hint: ensure the line finishes with \"\\r\\n\"", 0, false);
          return -1;
        }
      }
 
 
    }
 
    // Here we have CurrentReq loaded with the header, or its relevant fields
 
    if (!CurrentReq.headerok) {
      TRACEI(REQ, " rc:" << rc << "Header not yet complete.");
      
      // Here a subtle error condition. IF we failed reading a line AND the buffer
      // has a reasonable amount of data available THEN we consider the header
      // as corrupted and shutdown the client
      if ((rc <= 0) && (BuffUsed() >= 16384)) {
        TRACEI(ALL, "Corrupted header detected, or line too long. Disconnecting client.");
        return -1;
      }
        
        
      if (CurrentReq.reqstate > 0)
        CurrentReq.reqstate--;
      // Waiting for more data
      return 1;
    }
 
  }
 
  // If we are in self-redirect mode, then let's do it
  // Do selfredirect only with 'simple' requests, otherwise poor clients may misbehave
  if (ishttps && ssldone && selfhttps2http &&
    ( (CurrentReq.request == XrdHttpReq::rtGET) || (CurrentReq.request == XrdHttpReq::rtPUT) ||
    (CurrentReq.request == XrdHttpReq::rtPROPFIND)) ) {
    char hash[512];
    time_t timenow = time(0);
 
 
    calcHashes(hash, CurrentReq.resource.c_str(), (kXR_int16) CurrentReq.request,
            &SecEntity,
            timenow,
            secretkey);
 
 
 
    if (hash[0]) {
 
      // Workaround... delete the previous opaque information
      if (CurrentReq.opaque) {
        delete CurrentReq.opaque;
        CurrentReq.opaque = 0;
      }
 
      TRACEI(REQ, " rc:" << rc << " self-redirecting to http with security token.");
 
      XrdOucString dest = "Location: http://";
      // Here I should put the IP addr of the server
      
      // We have to recompute it here because we don't know to which
      // interface the client had connected to
      struct sockaddr_storage sa;
      socklen_t sl = sizeof(sa);
      getsockname(this->Link->AddrInfo()->SockFD(), (struct sockaddr*)&sa, &sl); 
      
      // now get it back and print it
      char buf[256];
      bool ok = false;
      
      switch (sa.ss_family) {
        case AF_INET:
          if (inet_ntop(AF_INET, &(((sockaddr_in*)&sa)->sin_addr), buf, INET_ADDRSTRLEN)) {
            if (Addr_str) free(Addr_str);
            Addr_str = strdup(buf);
            ok = true;
          }
          break;
        case AF_INET6:
          if (inet_ntop(AF_INET6, &(((sockaddr_in6*)&sa)->sin6_addr), buf, INET6_ADDRSTRLEN)) {
            if (Addr_str) free(Addr_str);
            Addr_str = (char *)malloc(strlen(buf)+3);
            strcpy(Addr_str, "[");
            strcat(Addr_str, buf);
            strcat(Addr_str, "]");
            ok = true;
          }
          break;
        default:
          TRACEI(REQ, " Can't recognize the address family of the local host.");
      }
      
      if (ok) {
        dest += Addr_str;
        dest += ":";
        dest += Port_str;
        dest += CurrentReq.resource.c_str();
        TRACEI(REQ," rc:"<<rc<<" self-redirecting to http with security token: '"
                   << dest.c_str() << "'");
 
        
        CurrentReq.appendOpaque(dest, &SecEntity, hash, timenow);
        SendSimpleResp(302, NULL, (char *) dest.c_str(), 0, 0, true);
        CurrentReq.reset();
        return -1;
      }
      
      TRACEI(REQ, " rc:" << rc << " Can't perform self-redirection.");
      
    }
    else {
      TRACEI(ALL, " Could not calculate self-redirection hash");
    }
  }
 
  // If this is not https, then extract the signed information from the url
  // and fill the SecEntity structure as if we were using https
  if (!ishttps && !ssldone) {
 
 
    if (CurrentReq.opaque) {
      char * tk = CurrentReq.opaque->Get("xrdhttptk");
      // If there is a hash then we use it as authn info
      if (tk) {
 
        time_t tim = 0;
        char * t = CurrentReq.opaque->Get("xrdhttptime");
        if (t) tim = atoi(t);
        if (!t) {
          TRACEI(REQ, " xrdhttptime not specified. Authentication failed.");
          return -1;
        }
        if (abs(time(0) - tim) > XRHTTP_TK_GRACETIME) {
          TRACEI(REQ, " Token expired. Authentication failed.");
          return -1;
        }
 
        // Fill the Secentity from the fields in the URL:name, vo, host
        char *nfo;
 
        nfo = CurrentReq.opaque->Get("xrdhttpvorg");
        if (nfo) {
          TRACEI(DEBUG, " Setting vorg: " << nfo);
          SecEntity.vorg = strdup(nfo);
          TRACEI(REQ, " Setting vorg: " << SecEntity.vorg);
        }
 
        nfo = CurrentReq.opaque->Get("xrdhttpname");
        if (nfo) {
          TRACEI(DEBUG, " Setting name: " << nfo);
          SecEntity.name = strdup(decode_str(nfo).c_str());
          TRACEI(REQ, " Setting name: " << SecEntity.name);
        }
        
        nfo = CurrentReq.opaque->Get("xrdhttphost");
        if (nfo) {
          TRACEI(DEBUG, " Setting host: " << nfo);
          if (SecEntity.host) free(SecEntity.host);
          SecEntity.host = strdup(decode_str(nfo).c_str());
          TRACEI(REQ, " Setting host: " << SecEntity.host);
        }
        
        nfo = CurrentReq.opaque->Get("xrdhttpdn");
        if (nfo) {
          TRACEI(DEBUG, " Setting dn: " << nfo);
          SecEntity.moninfo = strdup(decode_str(nfo).c_str());
          TRACEI(REQ, " Setting dn: " << SecEntity.moninfo);
        }
 
        nfo = CurrentReq.opaque->Get("xrdhttprole");
        if (nfo) {
          TRACEI(DEBUG, " Setting role: " << nfo);
          SecEntity.role = strdup(decode_str(nfo).c_str());
          TRACEI(REQ, " Setting role: " << SecEntity.role);
        }
 
        nfo = CurrentReq.opaque->Get("xrdhttpgrps");
        if (nfo) {
          TRACEI(DEBUG, " Setting grps: " << nfo);
          SecEntity.grps = strdup(decode_str(nfo).c_str());
          TRACEI(REQ, " Setting grps: " << SecEntity.grps);
        }
        
        nfo = CurrentReq.opaque->Get("xrdhttpendorsements");
        if (nfo) {
          TRACEI(DEBUG, " Setting endorsements: " << nfo);
          SecEntity.endorsements = strdup(decode_str(nfo).c_str());
          TRACEI(REQ, " Setting endorsements: " << SecEntity.endorsements);
        }
        
        nfo = CurrentReq.opaque->Get("xrdhttpcredslen");
        if (nfo) {
          TRACEI(DEBUG, " Setting credslen: " << nfo);
          char *s1 = strdup(decode_str(nfo).c_str());
          if (s1 && s1[0]) {
            SecEntity.credslen = atoi(s1);
            TRACEI(REQ, " Setting credslen: " << SecEntity.credslen);
          }
          if (s1) free(s1);
        }
        
        if (SecEntity.credslen) {
          nfo = CurrentReq.opaque->Get("xrdhttpcreds");
          if (nfo) {
            TRACEI(DEBUG, " Setting creds: " << nfo);
            SecEntity.creds = strdup(decode_str(nfo).c_str());
            TRACEI(REQ, " Setting creds: " << SecEntity.creds);
          }
        }
        
        char hash[512];
 
        calcHashes(hash, CurrentReq.resource.c_str(), (kXR_int16) CurrentReq.request,
                &SecEntity,
                tim,
                secretkey);
 
        if (compareHash(hash, tk)) {
          TRACEI(REQ, " Invalid tk '" << tk << "' != '" << hash << "'(calculated). Authentication failed.");
          return -1;
        }
 
      } else {
        // Client is plain http. If we have a secret key then we reject it
        if (secretkey) {
          TRACEI(ALL, " Rejecting plain http with no valid token as we have a secretkey.");
          return -1;
        }
      }
 
    } else {
      // Client is plain http. If we have a secret key then we reject it
      if (secretkey) {
        TRACEI(ALL, " Rejecting plain http with no valid token as we have a secretkey.");
        return -1;
      }
    }
 
    ssldone = true;
  }
 
 
 
  // Now we have everything that is needed to try the login
  // Remember that if there is an exthandler then it has the responsibility
  // for authorization in the paths that it manages
  if (!Bridge && !FindMatchingExtHandler(CurrentReq)) {
    if (SecEntity.name)
      Bridge = XrdXrootd::Bridge::Login(&CurrentReq, Link, &SecEntity, SecEntity.name, ishttps ? "https" : "http");
    else
      Bridge = XrdXrootd::Bridge::Login(&CurrentReq, Link, &SecEntity, "unknown", ishttps ? "https" : "http");
      
    if (!Bridge) {
      TRACEI(REQ, " Authorization failed.");
      return -1;
    }
    if (m_maxdelay > 0) Bridge->SetWait(m_maxdelay, false);
 
    // Let the bridge process the login, and then reinvoke us
    DoingLogin = true;
    return 0;
  }
 
  // Compute and send the response. This may involve further reading from the socket
  rc = CurrentReq.ProcessHTTPReq();
  if (rc < 0)
     CurrentReq.reset();
 
 
 
  TRACEI(REQ, "Process is exiting rc:" << rc);
  return rc;
}

References Addr_str, Bridge, XrdOucString::c_str(), calcHashes(), compareHash(), CurrentReq, DEBUG, decode_str(), eDest, XrdTlsContext::kOn, kXR_set, Link, XrdXrootd::Bridge::Login(), m_maxdelay, obfuscateAuth(), Port_str, XrdHttpReq::rtGET, XrdHttpReq::rtPROPFIND, XrdHttpReq::rtPUT, SecEntity, secretkey, selfhttps2http, sslcadir, XrdHttpProtoInfo::tlsClientAuth, TRACE, TRACE_AUTH, TRACE_DEBUG, TRACEI, TRACING, XrdHttpProtoInfo::xrdctx, and XRHTTP_TK_GRACETIME.

Here is the call graph for this function:

◆ Recycle()

void XrdHttpProtocol::Recycle	(	XrdLink *	lp,
		int	consec,
		const char *	reason )

virtual

Recycle this instance.

Implements XrdProtocol.

Definition at line 933 of file XrdHttpProtocol.cc.

                                                                       {
 
  // Release all appendages
  //
 
  Cleanup();
 
 
  // Set fields to starting point (debugging mostly)
  //
  Reset();
 
  // Push ourselves on the stack
  //
  ProtStack.Push(&ProtLink);
}

References ProtLink, and ProtStack.

◆ Stats()

int XrdHttpProtocol::Stats	(	char *	buff,
		int	blen,
		int	do_sync = 0 )

virtual

Get activity stats.

Implements XrdProtocol.

Definition at line 950 of file XrdHttpProtocol.cc.

                                                            {
  // Synchronize statistics if need be
  //
  //  if (do_sync) {
  //
  //    SI->statsMutex.Lock();
  //    SI->readCnt += numReads;
  //    cumReads += numReads;
  //    numReads = 0;
  //    SI->prerCnt += numReadP;
  //    cumReadP += numReadP;
  //    numReadP = 0;
  //    SI->rvecCnt += numReadV;
  //    cumReadV += numReadV;
  //    numReadV = 0;
  //    SI->rsegCnt += numSegsV;
  //    cumSegsV += numSegsV;
  //    numSegsV = 0;
  //    SI->writeCnt += numWrites;
  //    cumWrites += numWrites;
  //    numWrites = 0;
  //    SI->statsMutex.UnLock();
  //  }
  //
  //  // Now return the statistics
  //  //
  //  return SI->Stats(buff, blen, do_sync);
 
  return 0;
}

Friends And Related Symbol Documentation

◆ XrdHttpExtReq

friend class XrdHttpExtReq

friend

Definition at line 83 of file XrdHttpProtocol.hh.

References XrdHttpExtReq.

Referenced by XrdHttpExtReq.

◆ XrdHttpReq

friend class XrdHttpReq

friend

Definition at line 82 of file XrdHttpProtocol.hh.

References XrdHttpReq.

Referenced by XrdHttpReq.

Member Data Documentation

◆ Addr_str

char* XrdHttpProtocol::Addr_str

protected

Our IP address, as a string. Please remember that this may not be unique for a given machine, hence we need to keep it here and recompute ad every new connection.

Definition at line 366 of file XrdHttpProtocol.hh.

Referenced by XrdHttpProtocol(), and Process().

◆ BPool

XrdBuffManager * XrdHttpProtocol::BPool = 0

staticprotected

Definition at line 357 of file XrdHttpProtocol.hh.

Referenced by Configure(), and Match().

◆ Bridge

XrdXrootd::Bridge* XrdHttpProtocol::Bridge

protected

The Bridge that we use to exercise the xrootd internals.

Definition at line 372 of file XrdHttpProtocol.hh.

Referenced by doChksum(), doStat(), and Process().

◆ CIA

XrdSecService * XrdHttpProtocol::CIA = 0

staticprotected

Definition at line 359 of file XrdHttpProtocol.hh.

◆ cksumHandler

XrdHttpChecksumHandler XrdHttpProtocol::cksumHandler = XrdHttpChecksumHandler()

static

Definition at line 136 of file XrdHttpProtocol.hh.

◆ compatNameGeneration

bool XrdHttpProtocol::compatNameGeneration = false

staticprotected

Definition at line 405 of file XrdHttpProtocol.hh.

◆ crlRefIntervalSec

int XrdHttpProtocol::crlRefIntervalSec = XrdTlsContext::DEFAULT_CRL_REF_INT_SEC

staticprotected

CRL thread refresh interval.

Definition at line 400 of file XrdHttpProtocol.hh.

◆ CurrentReq

XrdHttpReq XrdHttpProtocol::CurrentReq

protected

Area for coordinating request and responses to/from the bridge This also can process HTTP/DAV stuff

Definition at line 377 of file XrdHttpProtocol.hh.

Referenced by XrdHttpProtocol(), doChksum(), doStat(), and Process().

◆ eDest

XrdSysError XrdHttpProtocol::eDest = 0

staticprotected

Definition at line 358 of file XrdHttpProtocol.hh.

Referenced by Configure(), and Process().

◆ embeddedstatic

bool XrdHttpProtocol::embeddedstatic = true

staticprotected

If true, use the embedded css and icons.

Definition at line 426 of file XrdHttpProtocol.hh.

◆ gridmap

char * XrdHttpProtocol::gridmap = 0

staticprotected

Gridmap file location. The same used by XrdSecGsi.

Definition at line 403 of file XrdHttpProtocol.hh.

◆ hailWait

int XrdHttpProtocol::hailWait = 60000

staticprotected

Timeout for reading the handshake.

Definition at line 385 of file XrdHttpProtocol.hh.

Referenced by Match().

◆ hdr2cgimap

std::map< std::string, std::string > XrdHttpProtocol::hdr2cgimap

staticprotected

Rules that turn HTTP headers to cgi tokens in the URL, for internal comsumption.

Definition at line 446 of file XrdHttpProtocol.hh.

◆ isdesthttps

bool XrdHttpProtocol::isdesthttps = false

staticprotected

True if the redirections must be towards https targets.

Definition at line 414 of file XrdHttpProtocol.hh.

◆ isRequiredGridmap

bool XrdHttpProtocol::isRequiredGridmap = false

staticprotected

Definition at line 404 of file XrdHttpProtocol.hh.

◆ Link

XrdLink* XrdHttpProtocol::Link

protected

The link we are bound to.

Definition at line 362 of file XrdHttpProtocol.hh.

Referenced by Match(), and Process().

◆ listdeny

bool XrdHttpProtocol::listdeny = false

staticprotected

If true, any form of listing is denied.

Definition at line 420 of file XrdHttpProtocol.hh.

◆ listredir

char * XrdHttpProtocol::listredir = 0

staticprotected

Url to redirect to in the case a listing is requested.

Definition at line 417 of file XrdHttpProtocol.hh.

◆ m_bio_method

BIO_METHOD * XrdHttpProtocol::m_bio_method = NULL

staticprotected

C-style vptr table for our custom BIO objects.

Definition at line 452 of file XrdHttpProtocol.hh.

◆ m_bio_type

int XrdHttpProtocol::m_bio_type = 0

staticprotected

Type identifier for our custom BIO objects.

Definition at line 449 of file XrdHttpProtocol.hh.

◆ m_maxdelay

int XrdHttpProtocol::m_maxdelay = -1

staticprotected

Definition at line 433 of file XrdHttpProtocol.hh.

Referenced by Process().

◆ m_staticheader_map

decltype(XrdHttpProtocol::m_staticheader_map) XrdHttpProtocol::m_staticheader_map

staticprotected

The static headers to always return; map is from verb to a list of (header, val) pairs.

Definition at line 464 of file XrdHttpProtocol.hh.

◆ m_staticheaders

decltype(XrdHttpProtocol::m_staticheaders) XrdHttpProtocol::m_staticheaders

staticprotected

The static string version of m_staticheader_map. After config parsing is done, this is computed and we won't need to reference m_staticheader_map in the response path.

Definition at line 468 of file XrdHttpProtocol.hh.

◆ myRole

kXR_int32 XrdHttpProtocol::myRole = kXR_isManager

staticprotected

Our role.

Definition at line 443 of file XrdHttpProtocol.hh.

Referenced by Configure().

◆ pmarkHandle

XrdNetPMark * XrdHttpProtocol::pmarkHandle = nullptr

staticprotected

Packet marking handler pointer (assigned from the environment during the Config() call)

Definition at line 458 of file XrdHttpProtocol.hh.

◆ Port

int XrdHttpProtocol::Port = 1094

staticprotected

Our port.

Definition at line 391 of file XrdHttpProtocol.hh.

Referenced by Configure().

◆ Port_str

char * XrdHttpProtocol::Port_str = 0

staticprotected

Our port, as a string.

Definition at line 394 of file XrdHttpProtocol.hh.

Referenced by Configure(), and Process().

◆ ProtLink

XrdObject<XrdHttpProtocol> XrdHttpProtocol::ProtLink

Definition at line 129 of file XrdHttpProtocol.hh.

Referenced by XrdHttpProtocol(), and Recycle().

◆ ProtStack

XrdObjectQ< XrdHttpProtocol > XrdHttpProtocol::ProtStack

static

Definition at line 128 of file XrdHttpProtocol.hh.

Referenced by Configure(), Match(), and Recycle().

◆ ReadRangeConfig

XrdHttpReadRangeHandler::Configuration XrdHttpProtocol::ReadRangeConfig

static

configuration for the read range handler

Definition at line 139 of file XrdHttpProtocol.hh.

Referenced by XrdHttpProtocol().

◆ readWait

int XrdHttpProtocol::readWait = 300000

staticprotected

Timeout for reading data.

Definition at line 388 of file XrdHttpProtocol.hh.

◆ Sched

XrdScheduler * XrdHttpProtocol::Sched = 0

staticprotected

Definition at line 356 of file XrdHttpProtocol.hh.

Referenced by Configure().

◆ SecEntity

XrdSecEntity XrdHttpProtocol::SecEntity

Authentication area.

Definition at line 133 of file XrdHttpProtocol.hh.

Referenced by XrdHttpProtocol(), Match(), and Process().

◆ secretkey

char * XrdHttpProtocol::secretkey = 0

staticprotected

The key used to calculate the url hashes.

Definition at line 408 of file XrdHttpProtocol.hh.

Referenced by Process().

◆ selfhttps2http

bool XrdHttpProtocol::selfhttps2http = false

staticprotected

If client is HTTPS, self-redirect with HTTP+token.

Definition at line 423 of file XrdHttpProtocol.hh.

Referenced by Process().

◆ servGMap

XrdOucGMap * XrdHttpProtocol::servGMap = 0

staticprotected

The instance of the DN mapper. Created only when a valid path is given.

Definition at line 369 of file XrdHttpProtocol.hh.

◆ sslcadir

char * XrdHttpProtocol::sslcadir = 0

staticprotected

Definition at line 397 of file XrdHttpProtocol.hh.

Referenced by Process().

◆ sslcafile

char * XrdHttpProtocol::sslcafile = 0

staticprotected

Definition at line 397 of file XrdHttpProtocol.hh.

◆ sslcert

char * XrdHttpProtocol::sslcert = 0

staticprotected

OpenSSL stuff.

Definition at line 397 of file XrdHttpProtocol.hh.

◆ sslcipherfilter

char * XrdHttpProtocol::sslcipherfilter = 0

staticprotected

Definition at line 397 of file XrdHttpProtocol.hh.

◆ sslkey

char * XrdHttpProtocol::sslkey = 0

staticprotected

Definition at line 397 of file XrdHttpProtocol.hh.

◆ sslverifydepth

int XrdHttpProtocol::sslverifydepth = 9

staticprotected

Depth of verification of a certificate chain.

Definition at line 411 of file XrdHttpProtocol.hh.

◆ staticpreload

XrdOucHash< XrdHttpProtocol::StaticPreloadInfo > * XrdHttpProtocol::staticpreload = 0

staticprotected

Definition at line 440 of file XrdHttpProtocol.hh.

◆ staticredir

char * XrdHttpProtocol::staticredir = 0

staticprotected

Definition at line 429 of file XrdHttpProtocol.hh.

◆ tpcForwardCreds

bool XrdHttpProtocol::tpcForwardCreds = false

staticprotected

If set to true, the HTTP TPC transfers will forward the credentials to redirected hosts.

Definition at line 461 of file XrdHttpProtocol.hh.

◆ xrd_cslist

char * XrdHttpProtocol::xrd_cslist = nullptr

staticprotected

The list of checksums that were configured via the xrd.cksum parameter on the server config file.

Definition at line 455 of file XrdHttpProtocol.hh.

Referenced by Configure().

The documentation for this class was generated from the following files:

Classes

Public Member Functions

Static Public Member Functions

Public Attributes

Static Public Attributes

Protected Attributes

Static Protected Attributes

Friends

Detailed Description

Class Documentation

◆ XrdHttpProtocol::StaticPreloadInfo

Constructor & Destructor Documentation

◆ XrdHttpProtocol() [1/2]

◆ XrdHttpProtocol() [2/2]

◆ ~XrdHttpProtocol()

Member Function Documentation

◆ Configure()

◆ doChksum()

◆ DoIt()

◆ doStat()

◆ isHTTPS()

◆ Match()

◆ operator=()

◆ parseHeader2CGI()

◆ Process()

◆ Recycle()

◆ Stats()

Friends And Related Symbol Documentation

◆ XrdHttpExtReq

◆ XrdHttpReq

Member Data Documentation

◆ Addr_str

◆ BPool

◆ Bridge

◆ CIA

◆ cksumHandler

◆ compatNameGeneration

◆ crlRefIntervalSec

◆ CurrentReq

◆ eDest

◆ embeddedstatic

◆ gridmap

◆ hailWait

◆ hdr2cgimap

◆ isdesthttps

◆ isRequiredGridmap

◆ Link

◆ listdeny

◆ listredir

◆ m_bio_method

◆ m_bio_type

◆ m_maxdelay

◆ m_staticheader_map

◆ m_staticheaders

◆ myRole

◆ pmarkHandle

◆ Port

◆ Port_str

◆ ProtLink

◆ ProtStack

◆ ReadRangeConfig

◆ readWait

◆ Sched

◆ SecEntity

◆ secretkey

◆ selfhttps2http

◆ servGMap

◆ sslcadir

◆ sslcafile

◆ sslcert

◆ sslcipherfilter

◆ sslkey

◆ sslverifydepth

◆ staticpreload

◆ staticredir

◆ tpcForwardCreds

◆ xrd_cslist