/src/botan/src/lib/utils/http_util/http_util.cpp
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Sketchy HTTP client |
3 | | * (C) 2013,2016 Jack Lloyd |
4 | | * 2017 René Korthaus, Rohde & Schwarz Cybersecurity |
5 | | * |
6 | | * Botan is released under the Simplified BSD License (see license.txt) |
7 | | */ |
8 | | |
9 | | #include <botan/http_util.h> |
10 | | #include <botan/parsing.h> |
11 | | #include <botan/hex.h> |
12 | | #include <botan/internal/os_utils.h> |
13 | | #include <botan/internal/socket.h> |
14 | | #include <botan/internal/stl_util.h> |
15 | | #include <sstream> |
16 | | |
17 | | namespace Botan { |
18 | | |
19 | | namespace HTTP { |
20 | | |
21 | | namespace { |
22 | | |
23 | | /* |
24 | | * Connect to a host, write some bytes, then read until the server |
25 | | * closes the socket. |
26 | | */ |
27 | | std::string http_transact(const std::string& hostname, |
28 | | const std::string& message, |
29 | | std::chrono::milliseconds timeout) |
30 | 0 | { |
31 | 0 | std::unique_ptr<OS::Socket> socket; |
32 | 0 |
|
33 | 0 | const std::chrono::system_clock::time_point start_time = std::chrono::system_clock::now(); |
34 | 0 |
|
35 | 0 | try |
36 | 0 | { |
37 | 0 | socket = OS::open_socket(hostname, "http", timeout); |
38 | 0 | if(!socket) |
39 | 0 | throw Not_Implemented("No socket support enabled in build"); |
40 | 0 | } |
41 | 0 | catch(std::exception& e) |
42 | 0 | { |
43 | 0 | throw HTTP_Error("HTTP connection to " + hostname + " failed: " + e.what()); |
44 | 0 | } |
45 | 0 | |
46 | 0 | // Blocks until entire message has been written |
47 | 0 | socket->write(cast_char_ptr_to_uint8(message.data()), |
48 | 0 | message.size()); |
49 | 0 |
|
50 | 0 | if(std::chrono::system_clock::now() - start_time > timeout) |
51 | 0 | throw HTTP_Error("Timeout during writing message body"); |
52 | 0 | |
53 | 0 | std::ostringstream oss; |
54 | 0 | std::vector<uint8_t> buf(BOTAN_DEFAULT_BUFFER_SIZE); |
55 | 0 | while(true) |
56 | 0 | { |
57 | 0 | const size_t got = socket->read(buf.data(), buf.size()); |
58 | 0 | if(got == 0) // EOF |
59 | 0 | break; |
60 | 0 | |
61 | 0 | if(std::chrono::system_clock::now() - start_time > timeout) |
62 | 0 | throw HTTP_Error("Timeout while reading message body"); |
63 | 0 | |
64 | 0 | oss.write(cast_uint8_ptr_to_char(buf.data()), |
65 | 0 | static_cast<std::streamsize>(got)); |
66 | 0 | } |
67 | 0 |
|
68 | 0 | return oss.str(); |
69 | 0 | } |
70 | | |
71 | | } |
72 | | |
73 | | std::string url_encode(const std::string& in) |
74 | 0 | { |
75 | 0 | std::ostringstream out; |
76 | 0 |
|
77 | 0 | for(auto c : in) |
78 | 0 | { |
79 | 0 | if(c >= 'A' && c <= 'Z') |
80 | 0 | out << c; |
81 | 0 | else if(c >= 'a' && c <= 'z') |
82 | 0 | out << c; |
83 | 0 | else if(c >= '0' && c <= '9') |
84 | 0 | out << c; |
85 | 0 | else if(c == '-' || c == '_' || c == '.' || c == '~') |
86 | 0 | out << c; |
87 | 0 | else |
88 | 0 | out << '%' << hex_encode(cast_char_ptr_to_uint8(&c), 1); |
89 | 0 | } |
90 | 0 |
|
91 | 0 | return out.str(); |
92 | 0 | } |
93 | | |
94 | | std::ostream& operator<<(std::ostream& o, const Response& resp) |
95 | 0 | { |
96 | 0 | o << "HTTP " << resp.status_code() << " " << resp.status_message() << "\n"; |
97 | 0 | for(auto h : resp.headers()) |
98 | 0 | o << "Header '" << h.first << "' = '" << h.second << "'\n"; |
99 | 0 | o << "Body " << std::to_string(resp.body().size()) << " bytes:\n"; |
100 | 0 | o.write(cast_uint8_ptr_to_char(resp.body().data()), resp.body().size()); |
101 | 0 | return o; |
102 | 0 | } |
103 | | |
104 | | Response http_sync(http_exch_fn http_transact, |
105 | | const std::string& verb, |
106 | | const std::string& url, |
107 | | const std::string& content_type, |
108 | | const std::vector<uint8_t>& body, |
109 | | size_t allowable_redirects) |
110 | 0 | { |
111 | 0 | if(url.empty()) |
112 | 0 | throw HTTP_Error("URL empty"); |
113 | 0 | |
114 | 0 | const auto protocol_host_sep = url.find("://"); |
115 | 0 | if(protocol_host_sep == std::string::npos) |
116 | 0 | throw HTTP_Error("Invalid URL '" + url + "'"); |
117 | 0 | |
118 | 0 | const auto host_loc_sep = url.find('/', protocol_host_sep + 3); |
119 | 0 |
|
120 | 0 | std::string hostname, loc; |
121 | 0 |
|
122 | 0 | if(host_loc_sep == std::string::npos) |
123 | 0 | { |
124 | 0 | hostname = url.substr(protocol_host_sep + 3, std::string::npos); |
125 | 0 | loc = "/"; |
126 | 0 | } |
127 | 0 | else |
128 | 0 | { |
129 | 0 | hostname = url.substr(protocol_host_sep + 3, host_loc_sep-protocol_host_sep-3); |
130 | 0 | loc = url.substr(host_loc_sep, std::string::npos); |
131 | 0 | } |
132 | 0 |
|
133 | 0 | std::ostringstream outbuf; |
134 | 0 |
|
135 | 0 | outbuf << verb << " " << loc << " HTTP/1.0\r\n"; |
136 | 0 | outbuf << "Host: " << hostname << "\r\n"; |
137 | 0 |
|
138 | 0 | if(verb == "GET") |
139 | 0 | { |
140 | 0 | outbuf << "Accept: */*\r\n"; |
141 | 0 | outbuf << "Cache-Control: no-cache\r\n"; |
142 | 0 | } |
143 | 0 | else if(verb == "POST") |
144 | 0 | outbuf << "Content-Length: " << body.size() << "\r\n"; |
145 | 0 |
|
146 | 0 | if(!content_type.empty()) |
147 | 0 | outbuf << "Content-Type: " << content_type << "\r\n"; |
148 | 0 | outbuf << "Connection: close\r\n\r\n"; |
149 | 0 | outbuf.write(cast_uint8_ptr_to_char(body.data()), body.size()); |
150 | 0 |
|
151 | 0 | std::istringstream io(http_transact(hostname, outbuf.str())); |
152 | 0 |
|
153 | 0 | std::string line1; |
154 | 0 | std::getline(io, line1); |
155 | 0 | if(!io || line1.empty()) |
156 | 0 | throw HTTP_Error("No response"); |
157 | 0 | |
158 | 0 | std::stringstream response_stream(line1); |
159 | 0 | std::string http_version; |
160 | 0 | unsigned int status_code; |
161 | 0 | std::string status_message; |
162 | 0 |
|
163 | 0 | response_stream >> http_version >> status_code; |
164 | 0 |
|
165 | 0 | std::getline(response_stream, status_message); |
166 | 0 |
|
167 | 0 | if(!response_stream || http_version.substr(0,5) != "HTTP/") |
168 | 0 | throw HTTP_Error("Not an HTTP response"); |
169 | 0 | |
170 | 0 | std::map<std::string, std::string> headers; |
171 | 0 | std::string header_line; |
172 | 0 | while (std::getline(io, header_line) && header_line != "\r") |
173 | 0 | { |
174 | 0 | auto sep = header_line.find(": "); |
175 | 0 | if(sep == std::string::npos || sep > header_line.size() - 2) |
176 | 0 | throw HTTP_Error("Invalid HTTP header " + header_line); |
177 | 0 | const std::string key = header_line.substr(0, sep); |
178 | 0 |
|
179 | 0 | if(sep + 2 < header_line.size() - 1) |
180 | 0 | { |
181 | 0 | const std::string val = header_line.substr(sep + 2, (header_line.size() - 1) - (sep + 2)); |
182 | 0 | headers[key] = val; |
183 | 0 | } |
184 | 0 | } |
185 | 0 |
|
186 | 0 | if(status_code == 301 && headers.count("Location")) |
187 | 0 | { |
188 | 0 | if(allowable_redirects == 0) |
189 | 0 | throw HTTP_Error("HTTP redirection count exceeded"); |
190 | 0 | return GET_sync(headers["Location"], allowable_redirects - 1); |
191 | 0 | } |
192 | 0 | |
193 | 0 | std::vector<uint8_t> resp_body; |
194 | 0 | std::vector<uint8_t> buf(4096); |
195 | 0 | while(io.good()) |
196 | 0 | { |
197 | 0 | io.read(cast_uint8_ptr_to_char(buf.data()), buf.size()); |
198 | 0 | const size_t got = static_cast<size_t>(io.gcount()); |
199 | 0 | resp_body.insert(resp_body.end(), buf.data(), &buf[got]); |
200 | 0 | } |
201 | 0 |
|
202 | 0 | const std::string header_size = search_map(headers, std::string("Content-Length")); |
203 | 0 |
|
204 | 0 | if(!header_size.empty()) |
205 | 0 | { |
206 | 0 | if(resp_body.size() != to_u32bit(header_size)) |
207 | 0 | throw HTTP_Error("Content-Length disagreement, header says " + |
208 | 0 | header_size + " got " + std::to_string(resp_body.size())); |
209 | 0 | } |
210 | 0 | |
211 | 0 | return Response(status_code, status_message, resp_body, headers); |
212 | 0 | } |
213 | | |
214 | | Response http_sync(const std::string& verb, |
215 | | const std::string& url, |
216 | | const std::string& content_type, |
217 | | const std::vector<uint8_t>& body, |
218 | | size_t allowable_redirects, |
219 | | std::chrono::milliseconds timeout) |
220 | 0 | { |
221 | 0 | auto transact_with_timeout = |
222 | 0 | [timeout](const std::string& hostname, const std::string& service) |
223 | 0 | { |
224 | 0 | return http_transact(hostname, service, timeout); |
225 | 0 | }; |
226 | 0 |
|
227 | 0 | return http_sync( |
228 | 0 | transact_with_timeout, |
229 | 0 | verb, |
230 | 0 | url, |
231 | 0 | content_type, |
232 | 0 | body, |
233 | 0 | allowable_redirects); |
234 | 0 | } |
235 | | |
236 | | Response GET_sync(const std::string& url, |
237 | | size_t allowable_redirects, |
238 | | std::chrono::milliseconds timeout) |
239 | 0 | { |
240 | 0 | return http_sync("GET", url, "", std::vector<uint8_t>(), allowable_redirects, timeout); |
241 | 0 | } |
242 | | |
243 | | Response POST_sync(const std::string& url, |
244 | | const std::string& content_type, |
245 | | const std::vector<uint8_t>& body, |
246 | | size_t allowable_redirects, |
247 | | std::chrono::milliseconds timeout) |
248 | 0 | { |
249 | 0 | return http_sync("POST", url, content_type, body, allowable_redirects, timeout); |
250 | 0 | } |
251 | | |
252 | | } |
253 | | |
254 | | } |