1 #pragma once 2 #include "bmcweb_config.h" 3 4 #include "authentication.hpp" 5 #include "http_response.hpp" 6 #include "http_utility.hpp" 7 #include "logging.hpp" 8 #include "utility.hpp" 9 10 #include <boost/algorithm/string/predicate.hpp> 11 #include <boost/asio/io_context.hpp> 12 #include <boost/asio/ip/tcp.hpp> 13 #include <boost/asio/ssl/stream.hpp> 14 #include <boost/asio/steady_timer.hpp> 15 #include <boost/beast/core/flat_static_buffer.hpp> 16 #include <boost/beast/http/parser.hpp> 17 #include <boost/beast/http/read.hpp> 18 #include <boost/beast/http/serializer.hpp> 19 #include <boost/beast/http/write.hpp> 20 #include <boost/beast/ssl/ssl_stream.hpp> 21 #include <boost/beast/websocket.hpp> 22 #include <boost/url/url_view.hpp> 23 #include <json_html_serializer.hpp> 24 #include <security_headers.hpp> 25 #include <ssl_key_handler.hpp> 26 27 #include <atomic> 28 #include <chrono> 29 #include <vector> 30 31 namespace crow 32 { 33 34 inline void prettyPrintJson(crow::Response& res) 35 { 36 json_html_util::dumpHtml(res.body(), res.jsonValue); 37 38 res.addHeader(boost::beast::http::field::content_type, 39 "text/html;charset=UTF-8"); 40 } 41 42 static int connectionCount = 0; 43 44 // request body limit size set by the bmcwebHttpReqBodyLimitMb option 45 constexpr uint64_t httpReqBodyLimit = 46 1024UL * 1024UL * bmcwebHttpReqBodyLimitMb; 47 48 constexpr uint64_t loggedOutPostBodyLimit = 4096; 49 50 constexpr uint32_t httpHeaderLimit = 8192; 51 52 template <typename Adaptor, typename Handler> 53 class Connection : 54 public std::enable_shared_from_this<Connection<Adaptor, Handler>> 55 { 56 public: 57 Connection(Handler* handlerIn, boost::asio::steady_timer&& timerIn, 58 std::function<std::string()>& getCachedDateStrF, 59 Adaptor adaptorIn) : 60 adaptor(std::move(adaptorIn)), 61 handler(handlerIn), timer(std::move(timerIn)), 62 getCachedDateStr(getCachedDateStrF) 63 { 64 parser.emplace(std::piecewise_construct, std::make_tuple()); 65 parser->body_limit(httpReqBodyLimit); 66 parser->header_limit(httpHeaderLimit); 67 68 #ifdef BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION 69 prepareMutualTls(); 70 #endif // BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION 71 72 connectionCount++; 73 74 BMCWEB_LOG_DEBUG << this << " Connection open, total " 75 << connectionCount; 76 } 77 78 ~Connection() 79 { 80 res.setCompleteRequestHandler(nullptr); 81 cancelDeadlineTimer(); 82 83 connectionCount--; 84 BMCWEB_LOG_DEBUG << this << " Connection closed, total " 85 << connectionCount; 86 } 87 88 Connection(const Connection&) = delete; 89 Connection(Connection&&) = delete; 90 Connection& operator=(const Connection&) = delete; 91 Connection& operator=(Connection&&) = delete; 92 93 void prepareMutualTls() 94 { 95 std::error_code error; 96 std::filesystem::path caPath(ensuressl::trustStorePath); 97 auto caAvailable = !std::filesystem::is_empty(caPath, error); 98 caAvailable = caAvailable && !error; 99 if (caAvailable && persistent_data::SessionStore::getInstance() 100 .getAuthMethodsConfig() 101 .tls) 102 { 103 adaptor.set_verify_mode(boost::asio::ssl::verify_peer); 104 std::string id = "bmcweb"; 105 106 const char* cStr = id.c_str(); 107 // NOLINTNEXTLINE(cppcoreguidelines-pro-type-reinterpret-cast) 108 const auto* idC = reinterpret_cast<const unsigned char*>(cStr); 109 int ret = SSL_set_session_id_context( 110 adaptor.native_handle(), idC, 111 static_cast<unsigned int>(id.length())); 112 if (ret == 0) 113 { 114 BMCWEB_LOG_ERROR << this << " failed to set SSL id"; 115 } 116 } 117 118 adaptor.set_verify_callback( 119 [this](bool preverified, boost::asio::ssl::verify_context& ctx) { 120 // do nothing if TLS is disabled 121 if (!persistent_data::SessionStore::getInstance() 122 .getAuthMethodsConfig() 123 .tls) 124 { 125 BMCWEB_LOG_DEBUG << this << " TLS auth_config is disabled"; 126 return true; 127 } 128 129 // We always return true to allow full auth flow 130 if (!preverified) 131 { 132 BMCWEB_LOG_DEBUG << this << " TLS preverification failed."; 133 return true; 134 } 135 136 X509_STORE_CTX* cts = ctx.native_handle(); 137 if (cts == nullptr) 138 { 139 BMCWEB_LOG_DEBUG << this << " Cannot get native TLS handle."; 140 return true; 141 } 142 143 // Get certificate 144 X509* peerCert = 145 X509_STORE_CTX_get_current_cert(ctx.native_handle()); 146 if (peerCert == nullptr) 147 { 148 BMCWEB_LOG_DEBUG << this 149 << " Cannot get current TLS certificate."; 150 return true; 151 } 152 153 // Check if certificate is OK 154 int ctxError = X509_STORE_CTX_get_error(cts); 155 if (ctxError != X509_V_OK) 156 { 157 BMCWEB_LOG_INFO << this << " Last TLS error is: " << ctxError; 158 return true; 159 } 160 // Check that we have reached final certificate in chain 161 int32_t depth = X509_STORE_CTX_get_error_depth(cts); 162 if (depth != 0) 163 164 { 165 BMCWEB_LOG_DEBUG 166 << this << " Certificate verification in progress (depth " 167 << depth << "), waiting to reach final depth"; 168 return true; 169 } 170 171 BMCWEB_LOG_DEBUG << this 172 << " Certificate verification of final depth"; 173 174 // Verify KeyUsage 175 bool isKeyUsageDigitalSignature = false; 176 bool isKeyUsageKeyAgreement = false; 177 178 ASN1_BIT_STRING* usage = static_cast<ASN1_BIT_STRING*>( 179 X509_get_ext_d2i(peerCert, NID_key_usage, nullptr, nullptr)); 180 181 if (usage == nullptr) 182 { 183 BMCWEB_LOG_DEBUG << this << " TLS usage is null"; 184 return true; 185 } 186 187 for (int i = 0; i < usage->length; i++) 188 { 189 // NOLINTNEXTLINE(cppcoreguidelines-pro-bounds-pointer-arithmetic) 190 unsigned char usageChar = usage->data[i]; 191 if (KU_DIGITAL_SIGNATURE & usageChar) 192 { 193 isKeyUsageDigitalSignature = true; 194 } 195 if (KU_KEY_AGREEMENT & usageChar) 196 { 197 isKeyUsageKeyAgreement = true; 198 } 199 } 200 ASN1_BIT_STRING_free(usage); 201 202 if (!isKeyUsageDigitalSignature || !isKeyUsageKeyAgreement) 203 { 204 BMCWEB_LOG_DEBUG << this 205 << " Certificate ExtendedKeyUsage does " 206 "not allow provided certificate to " 207 "be used for user authentication"; 208 return true; 209 } 210 211 // Determine that ExtendedKeyUsage includes Client Auth 212 213 stack_st_ASN1_OBJECT* extUsage = 214 static_cast<stack_st_ASN1_OBJECT*>(X509_get_ext_d2i( 215 peerCert, NID_ext_key_usage, nullptr, nullptr)); 216 217 if (extUsage == nullptr) 218 { 219 BMCWEB_LOG_DEBUG << this << " TLS extUsage is null"; 220 return true; 221 } 222 223 bool isExKeyUsageClientAuth = false; 224 for (int i = 0; i < sk_ASN1_OBJECT_num(extUsage); i++) 225 { 226 // NOLINTNEXTLINE(cppcoreguidelines-pro-type-cstyle-cast) 227 int nid = OBJ_obj2nid(sk_ASN1_OBJECT_value(extUsage, i)); 228 if (NID_client_auth == nid) 229 { 230 isExKeyUsageClientAuth = true; 231 break; 232 } 233 } 234 sk_ASN1_OBJECT_free(extUsage); 235 236 // Certificate has to have proper key usages set 237 if (!isExKeyUsageClientAuth) 238 { 239 BMCWEB_LOG_DEBUG << this 240 << " Certificate ExtendedKeyUsage does " 241 "not allow provided certificate to " 242 "be used for user authentication"; 243 return true; 244 } 245 std::string sslUser; 246 // Extract username contained in CommonName 247 sslUser.resize(256, '\0'); 248 249 int status = X509_NAME_get_text_by_NID( 250 X509_get_subject_name(peerCert), NID_commonName, sslUser.data(), 251 static_cast<int>(sslUser.size())); 252 253 if (status == -1) 254 { 255 BMCWEB_LOG_DEBUG 256 << this << " TLS cannot get username to create session"; 257 return true; 258 } 259 260 size_t lastChar = sslUser.find('\0'); 261 if (lastChar == std::string::npos || lastChar == 0) 262 { 263 BMCWEB_LOG_DEBUG << this << " Invalid TLS user name"; 264 return true; 265 } 266 sslUser.resize(lastChar); 267 std::string unsupportedClientId; 268 sessionIsFromTransport = true; 269 userSession = persistent_data::SessionStore::getInstance() 270 .generateUserSession( 271 sslUser, req->ipAddress, unsupportedClientId, 272 persistent_data::PersistenceType::TIMEOUT); 273 if (userSession != nullptr) 274 { 275 BMCWEB_LOG_DEBUG 276 << this 277 << " Generating TLS session: " << userSession->uniqueId; 278 } 279 return true; 280 }); 281 } 282 283 Adaptor& socket() 284 { 285 return adaptor; 286 } 287 288 void start() 289 { 290 if (connectionCount >= 100) 291 { 292 BMCWEB_LOG_CRITICAL << this << "Max connection count exceeded."; 293 return; 294 } 295 296 startDeadline(); 297 298 // TODO(ed) Abstract this to a more clever class with the idea of an 299 // asynchronous "start" 300 if constexpr (std::is_same_v<Adaptor, 301 boost::beast::ssl_stream< 302 boost::asio::ip::tcp::socket>>) 303 { 304 adaptor.async_handshake(boost::asio::ssl::stream_base::server, 305 [this, self(shared_from_this())]( 306 const boost::system::error_code& ec) { 307 if (ec) 308 { 309 return; 310 } 311 doReadHeaders(); 312 }); 313 } 314 else 315 { 316 doReadHeaders(); 317 } 318 } 319 320 void handle() 321 { 322 std::error_code reqEc; 323 crow::Request& thisReq = req.emplace(parser->release(), reqEc); 324 if (reqEc) 325 { 326 BMCWEB_LOG_DEBUG << "Request failed to construct" << reqEc; 327 return; 328 } 329 thisReq.session = userSession; 330 331 // Fetch the client IP address 332 readClientIp(); 333 334 // Check for HTTP version 1.1. 335 if (thisReq.version() == 11) 336 { 337 if (thisReq.getHeaderValue(boost::beast::http::field::host).empty()) 338 { 339 res.result(boost::beast::http::status::bad_request); 340 completeRequest(res); 341 return; 342 } 343 } 344 345 BMCWEB_LOG_INFO << "Request: " 346 << " " << this << " HTTP/" << thisReq.version() / 10 347 << "." << thisReq.version() % 10 << ' ' 348 << thisReq.methodString() << " " << thisReq.target() 349 << " " << thisReq.ipAddress.to_string(); 350 351 res.isAliveHelper = [this]() -> bool { return isAlive(); }; 352 353 thisReq.ioService = static_cast<decltype(thisReq.ioService)>( 354 &adaptor.get_executor().context()); 355 356 if (res.completed) 357 { 358 completeRequest(res); 359 return; 360 } 361 #ifndef BMCWEB_INSECURE_DISABLE_AUTHX 362 if (!crow::authentication::isOnAllowlist(req->url, req->method()) && 363 thisReq.session == nullptr) 364 { 365 BMCWEB_LOG_WARNING << "Authentication failed"; 366 forward_unauthorized::sendUnauthorized( 367 req->url, req->getHeaderValue("X-Requested-With"), 368 req->getHeaderValue("Accept"), res); 369 completeRequest(res); 370 return; 371 } 372 #endif // BMCWEB_INSECURE_DISABLE_AUTHX 373 auto asyncResp = std::make_shared<bmcweb::AsyncResp>(); 374 BMCWEB_LOG_DEBUG << "Setting completion handler"; 375 asyncResp->res.setCompleteRequestHandler( 376 [self(shared_from_this())](crow::Response& thisRes) { 377 self->completeRequest(thisRes); 378 }); 379 380 if (thisReq.isUpgrade() && 381 boost::iequals( 382 thisReq.getHeaderValue(boost::beast::http::field::upgrade), 383 "websocket")) 384 { 385 handler->handleUpgrade(thisReq, res, std::move(adaptor)); 386 // delete lambda with self shared_ptr 387 // to enable connection destruction 388 asyncResp->res.setCompleteRequestHandler(nullptr); 389 return; 390 } 391 handler->handle(thisReq, asyncResp); 392 } 393 394 bool isAlive() 395 { 396 if constexpr (std::is_same_v<Adaptor, 397 boost::beast::ssl_stream< 398 boost::asio::ip::tcp::socket>>) 399 { 400 return adaptor.next_layer().is_open(); 401 } 402 else 403 { 404 return adaptor.is_open(); 405 } 406 } 407 void close() 408 { 409 if constexpr (std::is_same_v<Adaptor, 410 boost::beast::ssl_stream< 411 boost::asio::ip::tcp::socket>>) 412 { 413 adaptor.next_layer().close(); 414 if (sessionIsFromTransport && userSession != nullptr) 415 { 416 BMCWEB_LOG_DEBUG 417 << this 418 << " Removing TLS session: " << userSession->uniqueId; 419 persistent_data::SessionStore::getInstance().removeSession( 420 userSession); 421 } 422 } 423 else 424 { 425 adaptor.close(); 426 } 427 } 428 429 void completeRequest(crow::Response& thisRes) 430 { 431 if (!req) 432 { 433 return; 434 } 435 res = std::move(thisRes); 436 BMCWEB_LOG_INFO << "Response: " << this << ' ' << req->url << ' ' 437 << res.resultInt() << " keepalive=" << req->keepAlive(); 438 439 addSecurityHeaders(*req, res); 440 441 crow::authentication::cleanupTempSession(*req); 442 443 if (!isAlive()) 444 { 445 // BMCWEB_LOG_DEBUG << this << " delete (socket is closed) " << 446 // isReading 447 // << ' ' << isWriting; 448 // delete this; 449 450 // delete lambda with self shared_ptr 451 // to enable connection destruction 452 res.setCompleteRequestHandler(nullptr); 453 return; 454 } 455 if (res.body().empty() && !res.jsonValue.empty()) 456 { 457 using http_helpers::ContentType; 458 std::array<ContentType, 2> allowed{ContentType::JSON, 459 ContentType::HTML}; 460 ContentType prefered = 461 getPreferedContentType(req->getHeaderValue("Accept"), allowed); 462 463 if (prefered == ContentType::HTML) 464 { 465 prettyPrintJson(res); 466 } 467 else 468 { 469 // Technically prefered could also be NoMatch here, but we'd 470 // like to default to something rather than return 400 for 471 // backward compatibility. 472 res.addHeader(boost::beast::http::field::content_type, 473 "application/json"); 474 res.body() = res.jsonValue.dump( 475 2, ' ', true, nlohmann::json::error_handler_t::replace); 476 } 477 } 478 479 if (res.resultInt() >= 400 && res.body().empty()) 480 { 481 res.body() = std::string(res.reason()); 482 } 483 484 if (res.result() == boost::beast::http::status::no_content) 485 { 486 // Boost beast throws if content is provided on a no-content 487 // response. Ideally, this would never happen, but in the case that 488 // it does, we don't want to throw. 489 BMCWEB_LOG_CRITICAL 490 << this << " Response content provided but code was no-content"; 491 res.body().clear(); 492 } 493 494 res.addHeader(boost::beast::http::field::date, getCachedDateStr()); 495 496 res.keepAlive(req->keepAlive()); 497 498 doWrite(res); 499 500 // delete lambda with self shared_ptr 501 // to enable connection destruction 502 res.setCompleteRequestHandler(nullptr); 503 } 504 505 void readClientIp() 506 { 507 boost::asio::ip::address ip; 508 boost::system::error_code ec = getClientIp(ip); 509 if (ec) 510 { 511 return; 512 } 513 req->ipAddress = ip; 514 } 515 516 boost::system::error_code getClientIp(boost::asio::ip::address& ip) 517 { 518 boost::system::error_code ec; 519 BMCWEB_LOG_DEBUG << "Fetch the client IP address"; 520 boost::asio::ip::tcp::endpoint endpoint = 521 boost::beast::get_lowest_layer(adaptor).remote_endpoint(ec); 522 523 if (ec) 524 { 525 // If remote endpoint fails keep going. "ClientOriginIPAddress" 526 // will be empty. 527 BMCWEB_LOG_ERROR << "Failed to get the client's IP Address. ec : " 528 << ec; 529 return ec; 530 } 531 ip = endpoint.address(); 532 return ec; 533 } 534 535 private: 536 void doReadHeaders() 537 { 538 BMCWEB_LOG_DEBUG << this << " doReadHeaders"; 539 540 // Clean up any previous Connection. 541 boost::beast::http::async_read_header( 542 adaptor, buffer, *parser, 543 [this, 544 self(shared_from_this())](const boost::system::error_code& ec, 545 std::size_t bytesTransferred) { 546 BMCWEB_LOG_DEBUG << this << " async_read_header " 547 << bytesTransferred << " Bytes"; 548 bool errorWhileReading = false; 549 if (ec) 550 { 551 errorWhileReading = true; 552 if (ec == boost::asio::error::eof) 553 { 554 BMCWEB_LOG_WARNING 555 << this << " Error while reading: " << ec.message(); 556 } 557 else 558 { 559 BMCWEB_LOG_ERROR 560 << this << " Error while reading: " << ec.message(); 561 } 562 } 563 else 564 { 565 // if the adaptor isn't open anymore, and wasn't handed to a 566 // websocket, treat as an error 567 if (!isAlive() && 568 !boost::beast::websocket::is_upgrade(parser->get())) 569 { 570 errorWhileReading = true; 571 } 572 } 573 574 cancelDeadlineTimer(); 575 576 if (errorWhileReading) 577 { 578 close(); 579 BMCWEB_LOG_DEBUG << this << " from read(1)"; 580 return; 581 } 582 583 readClientIp(); 584 585 boost::asio::ip::address ip; 586 if (getClientIp(ip)) 587 { 588 BMCWEB_LOG_DEBUG << "Unable to get client IP"; 589 } 590 sessionIsFromTransport = false; 591 #ifndef BMCWEB_INSECURE_DISABLE_AUTHX 592 boost::beast::http::verb method = parser->get().method(); 593 userSession = crow::authentication::authenticate( 594 ip, res, method, parser->get().base(), userSession); 595 596 bool loggedIn = userSession != nullptr; 597 if (!loggedIn) 598 { 599 const boost::optional<uint64_t> contentLength = 600 parser->content_length(); 601 if (contentLength && *contentLength > loggedOutPostBodyLimit) 602 { 603 BMCWEB_LOG_DEBUG << "Content length greater than limit " 604 << *contentLength; 605 close(); 606 return; 607 } 608 609 BMCWEB_LOG_DEBUG << "Starting quick deadline"; 610 } 611 #endif // BMCWEB_INSECURE_DISABLE_AUTHX 612 613 doRead(); 614 }); 615 } 616 617 void doRead() 618 { 619 BMCWEB_LOG_DEBUG << this << " doRead"; 620 startDeadline(); 621 boost::beast::http::async_read(adaptor, buffer, *parser, 622 [this, self(shared_from_this())]( 623 const boost::system::error_code& ec, 624 std::size_t bytesTransferred) { 625 BMCWEB_LOG_DEBUG << this << " async_read " << bytesTransferred 626 << " Bytes"; 627 cancelDeadlineTimer(); 628 if (ec) 629 { 630 BMCWEB_LOG_ERROR << this 631 << " Error while reading: " << ec.message(); 632 close(); 633 BMCWEB_LOG_DEBUG << this << " from read(1)"; 634 return; 635 } 636 handle(); 637 }); 638 } 639 640 void doWrite(crow::Response& thisRes) 641 { 642 BMCWEB_LOG_DEBUG << this << " doWrite"; 643 thisRes.preparePayload(); 644 serializer.emplace(*thisRes.stringResponse); 645 startDeadline(); 646 boost::beast::http::async_write(adaptor, *serializer, 647 [this, self(shared_from_this())]( 648 const boost::system::error_code& ec, 649 std::size_t bytesTransferred) { 650 BMCWEB_LOG_DEBUG << this << " async_write " << bytesTransferred 651 << " bytes"; 652 653 cancelDeadlineTimer(); 654 655 if (ec) 656 { 657 BMCWEB_LOG_DEBUG << this << " from write(2)"; 658 return; 659 } 660 if (!res.keepAlive()) 661 { 662 close(); 663 BMCWEB_LOG_DEBUG << this << " from write(1)"; 664 return; 665 } 666 667 serializer.reset(); 668 BMCWEB_LOG_DEBUG << this << " Clearing response"; 669 res.clear(); 670 parser.emplace(std::piecewise_construct, std::make_tuple()); 671 parser->body_limit(httpReqBodyLimit); // reset body limit for 672 // newly created parser 673 buffer.consume(buffer.size()); 674 675 // If the session was built from the transport, we don't need to 676 // clear it. All other sessions are generated per request. 677 if (!sessionIsFromTransport) 678 { 679 userSession = nullptr; 680 } 681 682 // Destroy the Request via the std::optional 683 req.reset(); 684 doReadHeaders(); 685 }); 686 } 687 688 void cancelDeadlineTimer() 689 { 690 timer.cancel(); 691 } 692 693 void startDeadline() 694 { 695 cancelDeadlineTimer(); 696 697 std::chrono::seconds timeout(15); 698 // allow slow uploads for logged in users 699 bool loggedIn = userSession != nullptr; 700 if (loggedIn) 701 { 702 timeout = std::chrono::seconds(60); 703 return; 704 } 705 706 std::weak_ptr<Connection<Adaptor, Handler>> weakSelf = weak_from_this(); 707 timer.expires_after(timeout); 708 timer.async_wait([weakSelf](const boost::system::error_code ec) { 709 // Note, we are ignoring other types of errors here; If the timer 710 // failed for any reason, we should still close the connection 711 712 std::shared_ptr<Connection<Adaptor, Handler>> self = 713 weakSelf.lock(); 714 if (!self) 715 { 716 BMCWEB_LOG_CRITICAL << self << " Failed to capture connection"; 717 return; 718 } 719 if (ec == boost::asio::error::operation_aborted) 720 { 721 // Canceled wait means the path succeeeded. 722 return; 723 } 724 if (ec) 725 { 726 BMCWEB_LOG_CRITICAL << self << " timer failed " << ec; 727 } 728 729 BMCWEB_LOG_WARNING << self << "Connection timed out, closing"; 730 731 self->close(); 732 }); 733 734 BMCWEB_LOG_DEBUG << this << " timer started"; 735 } 736 737 Adaptor adaptor; 738 Handler* handler; 739 // Making this a std::optional allows it to be efficiently destroyed and 740 // re-created on Connection reset 741 std::optional< 742 boost::beast::http::request_parser<boost::beast::http::string_body>> 743 parser; 744 745 boost::beast::flat_static_buffer<8192> buffer; 746 747 std::optional<boost::beast::http::response_serializer< 748 boost::beast::http::string_body>> 749 serializer; 750 751 std::optional<crow::Request> req; 752 crow::Response res; 753 754 bool sessionIsFromTransport = false; 755 std::shared_ptr<persistent_data::UserSession> userSession; 756 757 boost::asio::steady_timer timer; 758 759 std::function<std::string()>& getCachedDateStr; 760 761 using std::enable_shared_from_this< 762 Connection<Adaptor, Handler>>::shared_from_this; 763 764 using std::enable_shared_from_this< 765 Connection<Adaptor, Handler>>::weak_from_this; 766 }; 767 } // namespace crow 768