1 #pragma once 2 #include "bmcweb_config.h" 3 4 #include "authentication.hpp" 5 #include "http_response.hpp" 6 #include "http_utility.hpp" 7 #include "logging.hpp" 8 #include "utility.hpp" 9 10 #include <boost/algorithm/string.hpp> 11 #include <boost/algorithm/string/predicate.hpp> 12 #include <boost/asio/io_context.hpp> 13 #include <boost/asio/ip/tcp.hpp> 14 #include <boost/asio/ssl/stream.hpp> 15 #include <boost/asio/steady_timer.hpp> 16 #include <boost/beast/core/flat_static_buffer.hpp> 17 #include <boost/beast/http/parser.hpp> 18 #include <boost/beast/http/read.hpp> 19 #include <boost/beast/http/serializer.hpp> 20 #include <boost/beast/http/write.hpp> 21 #include <boost/beast/ssl/ssl_stream.hpp> 22 #include <boost/beast/websocket.hpp> 23 #include <boost/url/url_view.hpp> 24 #include <json_html_serializer.hpp> 25 #include <security_headers.hpp> 26 #include <ssl_key_handler.hpp> 27 28 #include <atomic> 29 #include <chrono> 30 #include <vector> 31 32 namespace crow 33 { 34 35 inline void prettyPrintJson(crow::Response& res) 36 { 37 json_html_util::dumpHtml(res.body(), res.jsonValue); 38 39 res.addHeader("Content-Type", "text/html;charset=UTF-8"); 40 } 41 42 static int connectionCount = 0; 43 44 // request body limit size set by the bmcwebHttpReqBodyLimitMb option 45 constexpr uint64_t httpReqBodyLimit = 46 1024UL * 1024UL * bmcwebHttpReqBodyLimitMb; 47 48 constexpr uint64_t loggedOutPostBodyLimit = 4096; 49 50 constexpr uint32_t httpHeaderLimit = 8192; 51 52 template <typename Adaptor, typename Handler> 53 class Connection : 54 public std::enable_shared_from_this<Connection<Adaptor, Handler>> 55 { 56 public: 57 Connection(Handler* handlerIn, boost::asio::steady_timer&& timerIn, 58 std::function<std::string()>& getCachedDateStrF, 59 Adaptor adaptorIn) : 60 adaptor(std::move(adaptorIn)), 61 handler(handlerIn), timer(std::move(timerIn)), 62 getCachedDateStr(getCachedDateStrF) 63 { 64 parser.emplace(std::piecewise_construct, std::make_tuple()); 65 parser->body_limit(httpReqBodyLimit); 66 parser->header_limit(httpHeaderLimit); 67 68 #ifdef BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION 69 prepareMutualTls(); 70 #endif // BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION 71 72 connectionCount++; 73 74 BMCWEB_LOG_DEBUG << this << " Connection open, total " 75 << connectionCount; 76 } 77 78 ~Connection() 79 { 80 res.setCompleteRequestHandler(nullptr); 81 cancelDeadlineTimer(); 82 83 connectionCount--; 84 BMCWEB_LOG_DEBUG << this << " Connection closed, total " 85 << connectionCount; 86 } 87 88 Connection(const Connection&) = delete; 89 Connection(Connection&&) = delete; 90 Connection& operator=(const Connection&) = delete; 91 Connection& operator=(Connection&&) = delete; 92 93 void prepareMutualTls() 94 { 95 std::error_code error; 96 std::filesystem::path caPath(ensuressl::trustStorePath); 97 auto caAvailable = !std::filesystem::is_empty(caPath, error); 98 caAvailable = caAvailable && !error; 99 if (caAvailable && persistent_data::SessionStore::getInstance() 100 .getAuthMethodsConfig() 101 .tls) 102 { 103 adaptor.set_verify_mode(boost::asio::ssl::verify_peer); 104 std::string id = "bmcweb"; 105 106 const char* cStr = id.c_str(); 107 // NOLINTNEXTLINE(cppcoreguidelines-pro-type-reinterpret-cast) 108 const auto* idC = reinterpret_cast<const unsigned char*>(cStr); 109 int ret = SSL_set_session_id_context( 110 adaptor.native_handle(), idC, 111 static_cast<unsigned int>(id.length())); 112 if (ret == 0) 113 { 114 BMCWEB_LOG_ERROR << this << " failed to set SSL id"; 115 } 116 } 117 118 adaptor.set_verify_callback( 119 [this](bool preverified, boost::asio::ssl::verify_context& ctx) { 120 // do nothing if TLS is disabled 121 if (!persistent_data::SessionStore::getInstance() 122 .getAuthMethodsConfig() 123 .tls) 124 { 125 BMCWEB_LOG_DEBUG << this << " TLS auth_config is disabled"; 126 return true; 127 } 128 129 // We always return true to allow full auth flow 130 if (!preverified) 131 { 132 BMCWEB_LOG_DEBUG << this << " TLS preverification failed."; 133 return true; 134 } 135 136 X509_STORE_CTX* cts = ctx.native_handle(); 137 if (cts == nullptr) 138 { 139 BMCWEB_LOG_DEBUG << this << " Cannot get native TLS handle."; 140 return true; 141 } 142 143 // Get certificate 144 X509* peerCert = 145 X509_STORE_CTX_get_current_cert(ctx.native_handle()); 146 if (peerCert == nullptr) 147 { 148 BMCWEB_LOG_DEBUG << this 149 << " Cannot get current TLS certificate."; 150 return true; 151 } 152 153 // Check if certificate is OK 154 int error = X509_STORE_CTX_get_error(cts); 155 if (error != X509_V_OK) 156 { 157 BMCWEB_LOG_INFO << this << " Last TLS error is: " << error; 158 return true; 159 } 160 // Check that we have reached final certificate in chain 161 int32_t depth = X509_STORE_CTX_get_error_depth(cts); 162 if (depth != 0) 163 164 { 165 BMCWEB_LOG_DEBUG 166 << this << " Certificate verification in progress (depth " 167 << depth << "), waiting to reach final depth"; 168 return true; 169 } 170 171 BMCWEB_LOG_DEBUG << this 172 << " Certificate verification of final depth"; 173 174 // Verify KeyUsage 175 bool isKeyUsageDigitalSignature = false; 176 bool isKeyUsageKeyAgreement = false; 177 178 ASN1_BIT_STRING* usage = static_cast<ASN1_BIT_STRING*>( 179 X509_get_ext_d2i(peerCert, NID_key_usage, nullptr, nullptr)); 180 181 if (usage == nullptr) 182 { 183 BMCWEB_LOG_DEBUG << this << " TLS usage is null"; 184 return true; 185 } 186 187 for (int i = 0; i < usage->length; i++) 188 { 189 // NOLINTNEXTLINE(cppcoreguidelines-pro-bounds-pointer-arithmetic) 190 unsigned char usageChar = usage->data[i]; 191 if (KU_DIGITAL_SIGNATURE & usageChar) 192 { 193 isKeyUsageDigitalSignature = true; 194 } 195 if (KU_KEY_AGREEMENT & usageChar) 196 { 197 isKeyUsageKeyAgreement = true; 198 } 199 } 200 ASN1_BIT_STRING_free(usage); 201 202 if (!isKeyUsageDigitalSignature || !isKeyUsageKeyAgreement) 203 { 204 BMCWEB_LOG_DEBUG << this 205 << " Certificate ExtendedKeyUsage does " 206 "not allow provided certificate to " 207 "be used for user authentication"; 208 return true; 209 } 210 211 // Determine that ExtendedKeyUsage includes Client Auth 212 213 stack_st_ASN1_OBJECT* extUsage = 214 static_cast<stack_st_ASN1_OBJECT*>(X509_get_ext_d2i( 215 peerCert, NID_ext_key_usage, nullptr, nullptr)); 216 217 if (extUsage == nullptr) 218 { 219 BMCWEB_LOG_DEBUG << this << " TLS extUsage is null"; 220 return true; 221 } 222 223 bool isExKeyUsageClientAuth = false; 224 for (int i = 0; i < sk_ASN1_OBJECT_num(extUsage); i++) 225 { 226 // NOLINTNEXTLINE(cppcoreguidelines-pro-type-cstyle-cast) 227 int nid = OBJ_obj2nid(sk_ASN1_OBJECT_value(extUsage, i)); 228 if (NID_client_auth == nid) 229 { 230 isExKeyUsageClientAuth = true; 231 break; 232 } 233 } 234 sk_ASN1_OBJECT_free(extUsage); 235 236 // Certificate has to have proper key usages set 237 if (!isExKeyUsageClientAuth) 238 { 239 BMCWEB_LOG_DEBUG << this 240 << " Certificate ExtendedKeyUsage does " 241 "not allow provided certificate to " 242 "be used for user authentication"; 243 return true; 244 } 245 std::string sslUser; 246 // Extract username contained in CommonName 247 sslUser.resize(256, '\0'); 248 249 int status = X509_NAME_get_text_by_NID( 250 X509_get_subject_name(peerCert), NID_commonName, sslUser.data(), 251 static_cast<int>(sslUser.size())); 252 253 if (status == -1) 254 { 255 BMCWEB_LOG_DEBUG 256 << this << " TLS cannot get username to create session"; 257 return true; 258 } 259 260 size_t lastChar = sslUser.find('\0'); 261 if (lastChar == std::string::npos || lastChar == 0) 262 { 263 BMCWEB_LOG_DEBUG << this << " Invalid TLS user name"; 264 return true; 265 } 266 sslUser.resize(lastChar); 267 std::string unsupportedClientId; 268 sessionIsFromTransport = true; 269 userSession = persistent_data::SessionStore::getInstance() 270 .generateUserSession( 271 sslUser, req->ipAddress, unsupportedClientId, 272 persistent_data::PersistenceType::TIMEOUT); 273 if (userSession != nullptr) 274 { 275 BMCWEB_LOG_DEBUG 276 << this 277 << " Generating TLS session: " << userSession->uniqueId; 278 } 279 return true; 280 }); 281 } 282 283 Adaptor& socket() 284 { 285 return adaptor; 286 } 287 288 void start() 289 { 290 if (connectionCount >= 100) 291 { 292 BMCWEB_LOG_CRITICAL << this << "Max connection count exceeded."; 293 return; 294 } 295 296 startDeadline(); 297 298 // TODO(ed) Abstract this to a more clever class with the idea of an 299 // asynchronous "start" 300 if constexpr (std::is_same_v<Adaptor, 301 boost::beast::ssl_stream< 302 boost::asio::ip::tcp::socket>>) 303 { 304 adaptor.async_handshake(boost::asio::ssl::stream_base::server, 305 [this, self(shared_from_this())]( 306 const boost::system::error_code& ec) { 307 if (ec) 308 { 309 return; 310 } 311 doReadHeaders(); 312 }); 313 } 314 else 315 { 316 doReadHeaders(); 317 } 318 } 319 320 void handle() 321 { 322 std::error_code reqEc; 323 crow::Request& thisReq = req.emplace(parser->release(), reqEc); 324 if (reqEc) 325 { 326 BMCWEB_LOG_DEBUG << "Request failed to construct" << reqEc; 327 return; 328 } 329 thisReq.session = userSession; 330 331 // Fetch the client IP address 332 readClientIp(); 333 334 // Check for HTTP version 1.1. 335 if (thisReq.version() == 11) 336 { 337 if (thisReq.getHeaderValue(boost::beast::http::field::host).empty()) 338 { 339 res.result(boost::beast::http::status::bad_request); 340 completeRequest(res); 341 return; 342 } 343 } 344 345 BMCWEB_LOG_INFO << "Request: " 346 << " " << this << " HTTP/" << thisReq.version() / 10 347 << "." << thisReq.version() % 10 << ' ' 348 << thisReq.methodString() << " " << thisReq.target() 349 << " " << thisReq.ipAddress.to_string(); 350 351 res.isAliveHelper = [this]() -> bool { return isAlive(); }; 352 353 thisReq.ioService = static_cast<decltype(thisReq.ioService)>( 354 &adaptor.get_executor().context()); 355 356 if (res.completed) 357 { 358 completeRequest(res); 359 return; 360 } 361 #ifndef BMCWEB_INSECURE_DISABLE_AUTHX 362 if (!crow::authentication::isOnAllowlist(req->url, req->method()) && 363 thisReq.session == nullptr) 364 { 365 BMCWEB_LOG_WARNING << "Authentication failed"; 366 forward_unauthorized::sendUnauthorized( 367 req->url, req->getHeaderValue("X-Requested-With"), 368 req->getHeaderValue("Accept"), res); 369 completeRequest(res); 370 return; 371 } 372 #endif // BMCWEB_INSECURE_DISABLE_AUTHX 373 auto asyncResp = std::make_shared<bmcweb::AsyncResp>(); 374 BMCWEB_LOG_DEBUG << "Setting completion handler"; 375 asyncResp->res.setCompleteRequestHandler( 376 [self(shared_from_this())](crow::Response& thisRes) { 377 self->completeRequest(thisRes); 378 }); 379 380 if (thisReq.isUpgrade() && 381 boost::iequals( 382 thisReq.getHeaderValue(boost::beast::http::field::upgrade), 383 "websocket")) 384 { 385 handler->handleUpgrade(thisReq, res, std::move(adaptor)); 386 // delete lambda with self shared_ptr 387 // to enable connection destruction 388 asyncResp->res.setCompleteRequestHandler(nullptr); 389 return; 390 } 391 handler->handle(thisReq, asyncResp); 392 } 393 394 bool isAlive() 395 { 396 if constexpr (std::is_same_v<Adaptor, 397 boost::beast::ssl_stream< 398 boost::asio::ip::tcp::socket>>) 399 { 400 return adaptor.next_layer().is_open(); 401 } 402 else 403 { 404 return adaptor.is_open(); 405 } 406 } 407 void close() 408 { 409 if constexpr (std::is_same_v<Adaptor, 410 boost::beast::ssl_stream< 411 boost::asio::ip::tcp::socket>>) 412 { 413 adaptor.next_layer().close(); 414 if (sessionIsFromTransport && userSession != nullptr) 415 { 416 BMCWEB_LOG_DEBUG 417 << this 418 << " Removing TLS session: " << userSession->uniqueId; 419 persistent_data::SessionStore::getInstance().removeSession( 420 userSession); 421 } 422 } 423 else 424 { 425 adaptor.close(); 426 } 427 } 428 429 void completeRequest(crow::Response& thisRes) 430 { 431 if (!req) 432 { 433 return; 434 } 435 res = std::move(thisRes); 436 BMCWEB_LOG_INFO << "Response: " << this << ' ' << req->url << ' ' 437 << res.resultInt() << " keepalive=" << req->keepAlive(); 438 439 addSecurityHeaders(*req, res); 440 441 crow::authentication::cleanupTempSession(*req); 442 443 if (!isAlive()) 444 { 445 // BMCWEB_LOG_DEBUG << this << " delete (socket is closed) " << 446 // isReading 447 // << ' ' << isWriting; 448 // delete this; 449 450 // delete lambda with self shared_ptr 451 // to enable connection destruction 452 res.setCompleteRequestHandler(nullptr); 453 return; 454 } 455 if (res.body().empty() && !res.jsonValue.empty()) 456 { 457 if (http_helpers::requestPrefersHtml(req->getHeaderValue("Accept"))) 458 { 459 prettyPrintJson(res); 460 } 461 else 462 { 463 res.jsonMode(); 464 res.body() = res.jsonValue.dump( 465 2, ' ', true, nlohmann::json::error_handler_t::replace); 466 } 467 } 468 469 if (res.resultInt() >= 400 && res.body().empty()) 470 { 471 res.body() = std::string(res.reason()); 472 } 473 474 if (res.result() == boost::beast::http::status::no_content) 475 { 476 // Boost beast throws if content is provided on a no-content 477 // response. Ideally, this would never happen, but in the case that 478 // it does, we don't want to throw. 479 BMCWEB_LOG_CRITICAL 480 << this << " Response content provided but code was no-content"; 481 res.body().clear(); 482 } 483 484 res.addHeader(boost::beast::http::field::date, getCachedDateStr()); 485 486 res.keepAlive(req->keepAlive()); 487 488 doWrite(res); 489 490 // delete lambda with self shared_ptr 491 // to enable connection destruction 492 res.setCompleteRequestHandler(nullptr); 493 } 494 495 void readClientIp() 496 { 497 boost::asio::ip::address ip; 498 boost::system::error_code ec = getClientIp(ip); 499 if (ec) 500 { 501 return; 502 } 503 req->ipAddress = ip; 504 } 505 506 boost::system::error_code getClientIp(boost::asio::ip::address& ip) 507 { 508 boost::system::error_code ec; 509 BMCWEB_LOG_DEBUG << "Fetch the client IP address"; 510 boost::asio::ip::tcp::endpoint endpoint = 511 boost::beast::get_lowest_layer(adaptor).remote_endpoint(ec); 512 513 if (ec) 514 { 515 // If remote endpoint fails keep going. "ClientOriginIPAddress" 516 // will be empty. 517 BMCWEB_LOG_ERROR << "Failed to get the client's IP Address. ec : " 518 << ec; 519 return ec; 520 } 521 ip = endpoint.address(); 522 return ec; 523 } 524 525 private: 526 void doReadHeaders() 527 { 528 BMCWEB_LOG_DEBUG << this << " doReadHeaders"; 529 530 // Clean up any previous Connection. 531 boost::beast::http::async_read_header( 532 adaptor, buffer, *parser, 533 [this, 534 self(shared_from_this())](const boost::system::error_code& ec, 535 std::size_t bytesTransferred) { 536 BMCWEB_LOG_DEBUG << this << " async_read_header " 537 << bytesTransferred << " Bytes"; 538 bool errorWhileReading = false; 539 if (ec) 540 { 541 errorWhileReading = true; 542 if (ec == boost::asio::error::eof) 543 { 544 BMCWEB_LOG_WARNING 545 << this << " Error while reading: " << ec.message(); 546 } 547 else 548 { 549 BMCWEB_LOG_ERROR 550 << this << " Error while reading: " << ec.message(); 551 } 552 } 553 else 554 { 555 // if the adaptor isn't open anymore, and wasn't handed to a 556 // websocket, treat as an error 557 if (!isAlive() && 558 !boost::beast::websocket::is_upgrade(parser->get())) 559 { 560 errorWhileReading = true; 561 } 562 } 563 564 cancelDeadlineTimer(); 565 566 if (errorWhileReading) 567 { 568 close(); 569 BMCWEB_LOG_DEBUG << this << " from read(1)"; 570 return; 571 } 572 573 readClientIp(); 574 575 boost::asio::ip::address ip; 576 if (getClientIp(ip)) 577 { 578 BMCWEB_LOG_DEBUG << "Unable to get client IP"; 579 } 580 sessionIsFromTransport = false; 581 #ifndef BMCWEB_INSECURE_DISABLE_AUTHX 582 boost::beast::http::verb method = parser->get().method(); 583 userSession = crow::authentication::authenticate( 584 ip, res, method, parser->get().base(), userSession); 585 586 bool loggedIn = userSession != nullptr; 587 if (!loggedIn) 588 { 589 const boost::optional<uint64_t> contentLength = 590 parser->content_length(); 591 if (contentLength && *contentLength > loggedOutPostBodyLimit) 592 { 593 BMCWEB_LOG_DEBUG << "Content length greater than limit " 594 << *contentLength; 595 close(); 596 return; 597 } 598 599 BMCWEB_LOG_DEBUG << "Starting quick deadline"; 600 } 601 #endif // BMCWEB_INSECURE_DISABLE_AUTHX 602 603 doRead(); 604 }); 605 } 606 607 void doRead() 608 { 609 BMCWEB_LOG_DEBUG << this << " doRead"; 610 startDeadline(); 611 boost::beast::http::async_read(adaptor, buffer, *parser, 612 [this, self(shared_from_this())]( 613 const boost::system::error_code& ec, 614 std::size_t bytesTransferred) { 615 BMCWEB_LOG_DEBUG << this << " async_read " << bytesTransferred 616 << " Bytes"; 617 cancelDeadlineTimer(); 618 if (ec) 619 { 620 BMCWEB_LOG_ERROR << this 621 << " Error while reading: " << ec.message(); 622 close(); 623 BMCWEB_LOG_DEBUG << this << " from read(1)"; 624 return; 625 } 626 handle(); 627 }); 628 } 629 630 void doWrite(crow::Response& thisRes) 631 { 632 BMCWEB_LOG_DEBUG << this << " doWrite"; 633 thisRes.preparePayload(); 634 serializer.emplace(*thisRes.stringResponse); 635 startDeadline(); 636 boost::beast::http::async_write(adaptor, *serializer, 637 [this, self(shared_from_this())]( 638 const boost::system::error_code& ec, 639 std::size_t bytesTransferred) { 640 BMCWEB_LOG_DEBUG << this << " async_write " << bytesTransferred 641 << " bytes"; 642 643 cancelDeadlineTimer(); 644 645 if (ec) 646 { 647 BMCWEB_LOG_DEBUG << this << " from write(2)"; 648 return; 649 } 650 if (!res.keepAlive()) 651 { 652 close(); 653 BMCWEB_LOG_DEBUG << this << " from write(1)"; 654 return; 655 } 656 657 serializer.reset(); 658 BMCWEB_LOG_DEBUG << this << " Clearing response"; 659 res.clear(); 660 parser.emplace(std::piecewise_construct, std::make_tuple()); 661 parser->body_limit(httpReqBodyLimit); // reset body limit for 662 // newly created parser 663 buffer.consume(buffer.size()); 664 665 // If the session was built from the transport, we don't need to 666 // clear it. All other sessions are generated per request. 667 if (!sessionIsFromTransport) 668 { 669 userSession = nullptr; 670 } 671 672 // Destroy the Request via the std::optional 673 req.reset(); 674 doReadHeaders(); 675 }); 676 } 677 678 void cancelDeadlineTimer() 679 { 680 timer.cancel(); 681 } 682 683 void startDeadline() 684 { 685 cancelDeadlineTimer(); 686 687 std::chrono::seconds timeout(15); 688 // allow slow uploads for logged in users 689 bool loggedIn = userSession != nullptr; 690 if (loggedIn) 691 { 692 timeout = std::chrono::seconds(60); 693 return; 694 } 695 696 std::weak_ptr<Connection<Adaptor, Handler>> weakSelf = weak_from_this(); 697 timer.expires_after(timeout); 698 timer.async_wait([weakSelf](const boost::system::error_code ec) { 699 // Note, we are ignoring other types of errors here; If the timer 700 // failed for any reason, we should still close the connection 701 702 std::shared_ptr<Connection<Adaptor, Handler>> self = 703 weakSelf.lock(); 704 if (!self) 705 { 706 BMCWEB_LOG_CRITICAL << self << " Failed to capture connection"; 707 return; 708 } 709 if (ec == boost::asio::error::operation_aborted) 710 { 711 // Canceled wait means the path succeeeded. 712 return; 713 } 714 if (ec) 715 { 716 BMCWEB_LOG_CRITICAL << self << " timer failed " << ec; 717 } 718 719 BMCWEB_LOG_WARNING << self << "Connection timed out, closing"; 720 721 self->close(); 722 }); 723 724 BMCWEB_LOG_DEBUG << this << " timer started"; 725 } 726 727 Adaptor adaptor; 728 Handler* handler; 729 // Making this a std::optional allows it to be efficiently destroyed and 730 // re-created on Connection reset 731 std::optional< 732 boost::beast::http::request_parser<boost::beast::http::string_body>> 733 parser; 734 735 boost::beast::flat_static_buffer<8192> buffer; 736 737 std::optional<boost::beast::http::response_serializer< 738 boost::beast::http::string_body>> 739 serializer; 740 741 std::optional<crow::Request> req; 742 crow::Response res; 743 744 bool sessionIsFromTransport = false; 745 std::shared_ptr<persistent_data::UserSession> userSession; 746 747 boost::asio::steady_timer timer; 748 749 std::function<std::string()>& getCachedDateStr; 750 751 using std::enable_shared_from_this< 752 Connection<Adaptor, Handler>>::shared_from_this; 753 754 using std::enable_shared_from_this< 755 Connection<Adaptor, Handler>>::weak_from_this; 756 }; 757 } // namespace crow 758