using namespace icinga;
@@ -52,7 +53,7 @@ void HttpServerConnection::StaticInitialize()
{
l_HttpServerConnectionTimeoutTimer = new Timer();
l_HttpServerConnectionTimeoutTimer->OnTimerExpired.connect(std::bind(&HttpServerConnection::TimeoutTimerHandler));
- l_HttpServerConnectionTimeoutTimer->SetInterval(15);
+ l_HttpServerConnectionTimeoutTimer->SetInterval(5);
l_HttpServerConnectionTimeoutTimer->Start();
}
@@ -76,6 +77,12 @@ TlsStream::Ptr HttpServerConnection::GetStream() const
void HttpServerConnection::Disconnect()
{
+ boost::mutex::scoped_try_lock lock(m_DataHandlerMutex);
+ if (!lock.owns_lock()) {
+ Log(LogInformation, "HttpServerConnection", "Unable to disconnect Http client, I/O thread busy");
+ return;
+ }
+
Log(LogDebug, "HttpServerConnection", "Http client disconnected");
ApiListener::Ptr listener = ApiListener::GetInstance();
@@ -89,98 +96,137 @@ void HttpServerConnection::Disconnect()
bool HttpServerConnection::ProcessMessage()
{
+
bool res;
+ HttpResponse response(m_Stream, m_CurrentRequest);
- try {
- res = m_CurrentRequest.Parse(m_Context, false);
- } catch (const std::invalid_argument& ex) {
- HttpResponse response(m_Stream, m_CurrentRequest);
- response.SetStatus(400, "Bad request");
- String msg = String("Bad request
") + ex.what() + "
";
- response.WriteBody(msg.CStr(), msg.GetLength());
- response.Finish();
+ if (!m_CurrentRequest.CompleteHeaders) {
+ try {
+ res = m_CurrentRequest.ParseHeaders(m_Context, false);
+ } catch (const std::invalid_argument& ex) {
+ response.SetStatus(400, "Bad Request");
+ String msg = String("Bad Request
") + ex.what() + "
";
+ response.WriteBody(msg.CStr(), msg.GetLength());
+ response.Finish();
- m_Stream->Shutdown();
- return false;
- } catch (const std::exception& ex) {
- HttpResponse response(m_Stream, m_CurrentRequest);
- response.SetStatus(400, "Bad request");
- String msg = "Bad request
" + DiagnosticInformation(ex) + "
";
- response.WriteBody(msg.CStr(), msg.GetLength());
- response.Finish();
+ m_CurrentRequest.~HttpRequest();
+ new (&m_CurrentRequest) HttpRequest(m_Stream);
- m_Stream->Shutdown();
- return false;
+ m_Stream->Shutdown();
+
+ return false;
+ } catch (const std::exception& ex) {
+ response.SetStatus(500, "Internal Server Error");
+ String msg = "Internal Server Error
" + DiagnosticInformation(ex) + "
";
+ response.WriteBody(msg.CStr(), msg.GetLength());
+ response.Finish();
+
+ m_CurrentRequest.~HttpRequest();
+ new (&m_CurrentRequest) HttpRequest(m_Stream);
+
+ m_Stream->Shutdown();
+
+ return false;
+ }
+ return res;
}
- if (m_CurrentRequest.Complete) {
- m_RequestQueue.Enqueue(std::bind(&HttpServerConnection::ProcessMessageAsync,
- HttpServerConnection::Ptr(this), m_CurrentRequest));
+ if (!m_CurrentRequest.CompleteHeaderCheck) {
+ m_CurrentRequest.CompleteHeaderCheck = true;
+ if (!ManageHeaders(response)) {
+ m_CurrentRequest.~HttpRequest();
+ new (&m_CurrentRequest) HttpRequest(m_Stream);
- m_Seen = Utility::GetTime();
- m_PendingRequests++;
+ m_Stream->Shutdown();
- m_CurrentRequest.~HttpRequest();
- new (&m_CurrentRequest) HttpRequest(m_Stream);
-
- return true;
- }
-
- return res;
-}
-
-void HttpServerConnection::ProcessMessageAsync(HttpRequest& request)
-{
- String auth_header = request.Headers->Get("authorization");
-
- String::SizeType pos = auth_header.FindFirstOf(" ");
- String username, password;
-
- if (pos != String::NPos && auth_header.SubStr(0, pos) == "Basic") {
- String credentials_base64 = auth_header.SubStr(pos + 1);
- String credentials = Base64::Decode(credentials_base64);
-
- String::SizeType cpos = credentials.FindFirstOf(":");
-
- if (cpos != String::NPos) {
- username = credentials.SubStr(0, cpos);
- password = credentials.SubStr(cpos + 1);
+ return false;
}
}
- ApiUser::Ptr user;
+ if (!m_CurrentRequest.CompleteBody) {
+ try {
+ res = m_CurrentRequest.ParseBody(m_Context, false);
+ } catch (const std::invalid_argument& ex) {
+ response.SetStatus(400, "Bad Request");
+ String msg = String("Bad Request
") + ex.what() + "
";
+ response.WriteBody(msg.CStr(), msg.GetLength());
+ response.Finish();
+
+ m_CurrentRequest.~HttpRequest();
+ new (&m_CurrentRequest) HttpRequest(m_Stream);
+
+ m_Stream->Shutdown();
+
+ return false;
+ } catch (const std::exception& ex) {
+ response.SetStatus(500, "Internal Server Error");
+ String msg = "Internal Server Error
" + DiagnosticInformation(ex) + "
";
+ response.WriteBody(msg.CStr(), msg.GetLength());
+ response.Finish();
+
+ m_CurrentRequest.~HttpRequest();
+ new (&m_CurrentRequest) HttpRequest(m_Stream);
+
+ m_Stream->Shutdown();
+
+ return false;
+ }
+ return res;
+ }
+
+ m_RequestQueue.Enqueue(std::bind(&HttpServerConnection::ProcessMessageAsync,
+ HttpServerConnection::Ptr(this), m_CurrentRequest, response, m_AuthenticatedUser));
+
+ m_Seen = Utility::GetTime();
+ m_PendingRequests++;
+
+ m_CurrentRequest.~HttpRequest();
+ new (&m_CurrentRequest) HttpRequest(m_Stream);
+
+ return false;
+}
+
+bool HttpServerConnection::ManageHeaders(HttpResponse& response)
+{
+ static const size_t defaultContentLengthLimit = 1 * 1028 * 1028;
+ static const Dictionary::Ptr specialContentLengthLimits = new Dictionary({
+ {"*", 512 * 1028 * 1028},
+ {"config/modify", 512 * 1028 * 1028},
+ {"console", 512 * 1028 * 1028},
+ {"objects/create", 512 * 1028 * 1028},
+ {"objects/modify", 512 * 1028 * 1028},
+ {"objects/delete", 512 * 1028 * 1028}
+ });
+
+ if (m_CurrentRequest.Headers->Get("expect") == "100-continue") {
+ String continueResponse = "HTTP/1.1 100 Continue\r\n\r\n";
+ m_Stream->Write(continueResponse.CStr(), continueResponse.GetLength());
+ }
/* client_cn matched. */
if (m_ApiUser)
- user = m_ApiUser;
- else {
- user = ApiUser::GetByName(username);
+ m_AuthenticatedUser = m_ApiUser;
+ else
+ m_AuthenticatedUser = ApiUser::GetByAuthHeader(m_CurrentRequest.Headers->Get("authorization"));
- /* Deny authentication if 1) given password is empty 2) configured password does not match. */
- if (password.IsEmpty())
- user.reset();
- else if (user && user->GetPassword() != password)
- user.reset();
- }
+ String requestUrl = m_CurrentRequest.RequestUrl->Format();
- String requestUrl = request.RequestUrl->Format();
+ Socket::Ptr socket = m_Stream->GetSocket();
Log(LogInformation, "HttpServerConnection")
- << "Request: " << request.RequestMethod << " " << requestUrl
- << " (from " << m_Stream->GetSocket()->GetPeerAddress() << ", user: " << (user ? user->GetName() : "") << ")";
-
- HttpResponse response(m_Stream, request);
+ << "Request: " << m_CurrentRequest.RequestMethod << " " << requestUrl
+ << " (from " << (socket ? socket->GetPeerAddress() : "")
+ << ", user: " << (m_AuthenticatedUser ? m_AuthenticatedUser->GetName() : "") << ")";
ApiListener::Ptr listener = ApiListener::GetInstance();
if (!listener)
- return;
+ return false;
Array::Ptr headerAllowOrigin = listener->GetAccessControlAllowOrigin();
if (headerAllowOrigin->GetLength() != 0) {
- String origin = request.Headers->Get("origin");
-
+ String origin = m_CurrentRequest.Headers->Get("origin");
{
ObjectLock olock(headerAllowOrigin);
@@ -193,9 +239,9 @@ void HttpServerConnection::ProcessMessageAsync(HttpRequest& request)
if (listener->GetAccessControlAllowCredentials())
response.AddHeader("Access-Control-Allow-Credentials", "true");
- String accessControlRequestMethodHeader = request.Headers->Get("access-control-request-method");
+ String accessControlRequestMethodHeader = m_CurrentRequest.Headers->Get("access-control-request-method");
- if (!accessControlRequestMethodHeader.IsEmpty()) {
+ if (m_CurrentRequest.RequestMethod == "OPTIONS" && !accessControlRequestMethodHeader.IsEmpty()) {
response.SetStatus(200, "OK");
response.AddHeader("Access-Control-Allow-Methods", listener->GetAccessControlAllowMethods());
@@ -205,27 +251,27 @@ void HttpServerConnection::ProcessMessageAsync(HttpRequest& request)
response.WriteBody(msg.CStr(), msg.GetLength());
response.Finish();
- m_PendingRequests--;
-
- return;
+ return false;
}
}
- String accept_header = request.Headers->Get("accept");
-
- if (request.RequestMethod != "GET" && accept_header != "application/json") {
+ if (m_CurrentRequest.RequestMethod != "GET" && m_CurrentRequest.Headers->Get("accept") != "application/json") {
response.SetStatus(400, "Wrong Accept header");
response.AddHeader("Content-Type", "text/html");
String msg = "Accept header is missing or not set to 'application/json'.
";
response.WriteBody(msg.CStr(), msg.GetLength());
- } else if (!user) {
+ response.Finish();
+ return false;
+ }
+
+ if (!m_AuthenticatedUser) {
Log(LogWarning, "HttpServerConnection")
- << "Unauthorized request: " << request.RequestMethod << " " << requestUrl;
+ << "Unauthorized request: " << m_CurrentRequest.RequestMethod << " " << requestUrl;
response.SetStatus(401, "Unauthorized");
response.AddHeader("WWW-Authenticate", "Basic realm=\"Icinga 2\"");
- if (request.Headers->Get("accept") == "application/json") {
+ if (m_CurrentRequest.Headers->Get("accept") == "application/json") {
Dictionary::Ptr result = new Dictionary({
{ "error", 401 },
{ "status", "Unauthorized. Please check your user credentials." }
@@ -237,32 +283,48 @@ void HttpServerConnection::ProcessMessageAsync(HttpRequest& request)
String msg = "Unauthorized. Please check your user credentials.
";
response.WriteBody(msg.CStr(), msg.GetLength());
}
- } else {
- try {
- HttpHandler::ProcessRequest(user, request, response);
- } catch (const std::exception& ex) {
- Log(LogCritical, "HttpServerConnection")
- << "Unhandled exception while processing Http request: " << DiagnosticInformation(ex);
- response.SetStatus(503, "Unhandled exception");
- String errorInfo = DiagnosticInformation(ex);
+ response.Finish();
+ return false;
+ }
- if (request.Headers->Get("accept") == "application/json") {
- Dictionary::Ptr result = new Dictionary({
- { "error", 503 },
- { "status", errorInfo }
- });
+ size_t maxSize = defaultContentLengthLimit;
- HttpUtility::SendJsonBody(response, nullptr, result);
- } else {
- response.AddHeader("Content-Type", "text/plain");
- response.WriteBody(errorInfo.CStr(), errorInfo.GetLength());
- }
- }
+ Array::Ptr permissions = m_AuthenticatedUser->GetPermissions();
+ ObjectLock olock(permissions);
+
+ for (const Value& permission : permissions) {
+ std::vector permissionParts = String(permission).Split("/");
+ String permissionPath = permissionParts[0] + (permissionParts.size() > 1 ? "/" + permissionParts[1] : "");
+ int size = specialContentLengthLimits->Get(permissionPath);
+ maxSize = size > maxSize ? size : maxSize;
+ }
+
+ size_t contentLength = m_CurrentRequest.Headers->Get("content-length");
+
+ if (contentLength > maxSize) {
+ response.SetStatus(400, "Bad Request");
+ String msg = String("Content length exceeded maximum
");
+ response.WriteBody(msg.CStr(), msg.GetLength());
+ response.Finish();
+
+ return false;
+ }
+
+ return true;
+}
+
+void HttpServerConnection::ProcessMessageAsync(HttpRequest& request, HttpResponse& response, const ApiUser::Ptr& user)
+{
+ try {
+ HttpHandler::ProcessRequest(user, request, response);
+ } catch (const std::exception& ex) {
+ Log(LogCritical, "HttpServerConnection")
+ << "Unhandled exception while processing Http request: " << DiagnosticInformation(ex);
+ HttpUtility::SendJsonError(response, nullptr, 503, "Unhandled exception" , DiagnosticInformation(ex));
}
response.Finish();
-
m_PendingRequests--;
}
diff --git a/lib/remote/httpserverconnection.hpp b/lib/remote/httpserverconnection.hpp
index f52110013..5f959b8a0 100644
--- a/lib/remote/httpserverconnection.hpp
+++ b/lib/remote/httpserverconnection.hpp
@@ -21,9 +21,9 @@
#define HTTPSERVERCONNECTION_H
#include "remote/httprequest.hpp"
+#include "remote/httpresponse.hpp"
#include "remote/apiuser.hpp"
#include "base/tlsstream.hpp"
-#include "base/timer.hpp"
#include "base/workqueue.hpp"
namespace icinga
@@ -51,6 +51,7 @@ public:
private:
ApiUser::Ptr m_ApiUser;
+ ApiUser::Ptr m_AuthenticatedUser;
TlsStream::Ptr m_Stream;
double m_Seen;
HttpRequest m_CurrentRequest;
@@ -67,7 +68,9 @@ private:
static void TimeoutTimerHandler();
void CheckLiveness();
- void ProcessMessageAsync(HttpRequest& request);
+ bool ManageHeaders(HttpResponse& response);
+
+ void ProcessMessageAsync(HttpRequest& request, HttpResponse& response, const ApiUser::Ptr&);
};
}
diff --git a/lib/remote/pkiutility.cpp b/lib/remote/pkiutility.cpp
index 6b896dab1..20d9ca6c2 100644
--- a/lib/remote/pkiutility.cpp
+++ b/lib/remote/pkiutility.cpp
@@ -121,8 +121,10 @@ std::shared_ptr PkiUtility::FetchCert(const String& host, const String& po
try {
stream->Handshake();
- } catch (...) {
-
+ } catch (const std::exception& ex) {
+ Log(LogCritical, "pki")
+ << "Client TLS handshake failed. (" << ex.what() << ")";
+ return std::shared_ptr();
}
return stream->GetPeerCertificate();