X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=filters.c;h=256b0c9dedda4fed5a1ef8a514a51d233d4c773d;hp=42446193c36f5376746706f157f59104240484ed;hb=52bd067225c1e12ecf7156e5707161ed7df8e8c4;hpb=4d5562a93fbe978ed96fa679ed32f8936682824a diff --git a/filters.c b/filters.c index 42446193..256b0c9d 100644 --- a/filters.c +++ b/filters.c @@ -1,4 +1,4 @@ -const char filters_rcs[] = "$Id: filters.c,v 1.29 2001/09/13 23:32:40 jongfoster Exp $"; +const char filters_rcs[] = "$Id: filters.c,v 1.45 2002/03/08 16:47:50 oes Exp $"; /********************************************************************* * * File : $Source: /cvsroot/ijbswa/current/filters.c,v $ @@ -6,19 +6,19 @@ const char filters_rcs[] = "$Id: filters.c,v 1.29 2001/09/13 23:32:40 jongfoster * Purpose : Declares functions to parse/crunch headers and pages. * Functions declared include: * `acl_addr', `add_stats', `block_acl', `block_imageurl', - * `block_url', `url_actions', `domaincmp', `dsplit', + * `block_url', `url_actions', `domain_split', * `filter_popups', `forward_url', 'redirect_url', * `ij_untrusted_url', `intercept_url', `pcrs_filter_respose', - * `show_proxy_args', 'ijb_send_banner', and `trust_url' + * 'ijb_send_banner', and `trust_url' * * Copyright : Written by and Copyright (C) 2001 the SourceForge * IJBSWA team. http://ijbswa.sourceforge.net * * Based on the Internet Junkbuster originally written - * by and Copyright (C) 1997 Anonymous Coders and + * by and Copyright (C) 1997 Anonymous Coders and * Junkbusters Corporation. http://www.junkbusters.com * - * This program is free software; you can redistribute it + * This program is free software; you can redistribute it * and/or modify it under the terms of the GNU General * Public License as published by the Free Software * Foundation; either version 2 of the License, or (at @@ -38,6 +38,100 @@ const char filters_rcs[] = "$Id: filters.c,v 1.29 2001/09/13 23:32:40 jongfoster * * Revisions : * $Log: filters.c,v $ + * Revision 1.45 2002/03/08 16:47:50 oes + * Added choice beween GIF and PNG built-in images + * + * Revision 1.44 2002/03/07 03:49:31 oes + * - Fixed compiler warnings etc + * - Changed built-in images from GIF to PNG + * (with regard to Unisys patent issue) + * - Added a 4x4 pattern PNG which is less intrusive + * than the logo but also clearly marks the deleted banners + * + * Revision 1.43 2002/01/22 23:51:59 jongfoster + * Replacing strsav() with the safer string_append(). + * + * Adding missing html_encode() to error message generators. Where encoded + * and unencoded versions of a string were provided, removing the unencoded + * one. + * + * Revision 1.42 2002/01/17 21:00:32 jongfoster + * Moving all our URL and URL pattern parsing code to urlmatch.c. + * + * Using a single, simple url_match(pattern,url) function - rather than + * the 3-line match routine which was repeated all over the place. + * + * Renaming free_url to free_url_spec, since it frees a struct url_spec. + * + * Using parse_http_url() to parse URLs without faking a HTTP + * request line for parse_http_request(). + * + * Revision 1.41 2001/11/13 00:14:07 jongfoster + * Fixing stupid bug now I've figured out what || means. + * (It always returns 0 or 1, not one of it's paramaters.) + * + * Revision 1.40 2001/10/26 17:37:55 oes + * - Re-enabled Netscape 200/404 bug workaround in block_url(): + * - Removed OS/2 special case + * - Made block_url() independant from sed() having been run + * - Made trust_url independant from sed() having been run + * - Made is_imageurl independant from sed() having been run. + * It now checks User-Agent: and Accept: by itself. + * + * + * Revision 1.39 2001/10/25 03:40:48 david__schmidt + * Change in porting tactics: OS/2's EMX porting layer doesn't allow multiple + * threads to call select() simultaneously. So, it's time to do a real, live, + * native OS/2 port. See defines for __EMX__ (the porting layer) vs. __OS2__ + * (native). Both versions will work, but using __OS2__ offers multi-threading. + * + * Revision 1.38 2001/10/23 21:32:33 jongfoster + * Adding error-checking to selected functions + * + * Revision 1.37 2001/10/22 15:33:56 david__schmidt + * Special-cased OS/2 out of the Netscape-abort-on-404-in-js problem in + * filters.c. Added a FIXME in front of the offending code. I'll gladly + * put in a better/more robust fix for all parties if one is presented... + * It seems that just returning 200 instead of 404 would pretty much fix + * it for everyone, but I don't know all the history of the problem. + * + * Revision 1.36 2001/10/10 16:44:16 oes + * Added match_portlist function + * + * Revision 1.35 2001/10/07 15:41:23 oes + * Replaced 6 boolean members of csp with one bitmap (csp->flags) + * + * New function remove_chunked_transfer_coding that strips chunked + * transfer coding to plain and is called by pcrs_filter_response + * and gif_deanimate_response if neccessary + * + * Improved handling of zero-change re_filter runs + * + * pcrs_filter_response and gif_deanimate_response now remove + * chunked transfer codeing before processing the body. + * + * Revision 1.34 2001/09/20 15:49:36 steudten + * + * Fix BUG: Change int size to size_t size in pcrs_filter_response(). + * See cgi.c fill_template(). + * + * Revision 1.33 2001/09/16 17:05:14 jongfoster + * Removing unused #include showarg.h + * + * Revision 1.32 2001/09/16 13:21:27 jongfoster + * Changes to use new list functions. + * + * Revision 1.31 2001/09/16 11:38:02 jongfoster + * Splitting fill_template() into 2 functions: + * template_load() loads the file + * template_fill() performs the PCRS regexps. + * This is because the CGI edit interface has a "table row" + * template which is used many times in the page - this + * change means it's only loaded from disk once. + * + * Revision 1.30 2001/09/16 11:00:10 jongfoster + * New function alloc_http_response, for symmetry with free_http_response + * * Revision 1.29 2001/09/13 23:32:40 jongfoster * Moving image data to cgi.c rather than cgi.h * Fixing a GPF under Win32 (and any other OS that protects global @@ -269,23 +363,26 @@ const char filters_rcs[] = "$Id: filters.c,v 1.29 2001/09/13 23:32:40 jongfoster #include #include #include +#include #ifndef _WIN32 +#ifndef __OS2__ #include +#endif /* ndef __OS2__ */ #include #else #include -#endif +#endif /* ndef _WIN32 */ + +#ifdef __OS2__ +#include +#endif /* def __OS2__ */ #include "project.h" #include "filters.h" #include "encode.h" -#include "jcc.h" -#include "showargs.h" #include "parsers.h" #include "ssplit.h" -#include "gateway.h" -#include "jbsockets.h" #include "errlog.h" #include "jbsockets.h" #include "miscutil.h" @@ -293,6 +390,7 @@ const char filters_rcs[] = "$Id: filters.c,v 1.29 2001/09/13 23:32:40 jongfoster #include "cgi.h" #include "list.h" #include "deanimate.h" +#include "urlmatch.h" #ifdef _WIN32 #include "win32.h" @@ -375,7 +473,7 @@ int block_acl(struct access_control_addr *dst, struct client_state *csp) * * Function : acl_addr * - * Description : Called from `load_aclfile' to parse an ACL address. + * Description : Called from `load_config' to parse an ACL address. * * Parameters : * 1 : aspec = String specifying ACL address. @@ -423,9 +521,8 @@ int acl_addr(char *aspec, struct access_control_addr *aca) aca->addr = ntohl(resolve_hostname_to_ip(aspec)); - if (aca->addr == -1) + if (aca->addr == INADDR_NONE) { - log_error(LOG_LEVEL_ERROR, "can't resolve address for %s", aspec); return(-1); } @@ -447,6 +544,86 @@ int acl_addr(char *aspec, struct access_control_addr *aca) #endif /* def FEATURE_ACL */ +/********************************************************************* + * + * Function : match_portlist + * + * Description : Check if a given number is covered by a comma + * separated list of numbers and ranges (a,b-c,d,..) + * + * Parameters : + * 1 : portlist = String with list + * 2 : port = port to check + * + * Returns : 0 => no match + * 1 => match + * + *********************************************************************/ +int match_portlist(const char *portlist, int port) +{ + char *min, *max, *next, *portlist_copy; + + min = next = portlist_copy = strdup(portlist); + + /* + * Zero-terminate first item and remember offset for next + */ + if (NULL != (next = strchr(portlist_copy, (int) ','))) + { + *next++ = '\0'; + } + + /* + * Loop through all items, checking for match + */ + while(min) + { + if (NULL == (max = strchr(min, (int) '-'))) + { + /* + * No dash, check for equality + */ + if (port == atoi(min)) + { + free(portlist_copy); + return(1); + } + } + else + { + /* + * This is a range, so check if between min and max, + * or, if max was omitted, between min and 65K + */ + *max++ = '\0'; + if(port >= atoi(min) && port <= (atoi(max) ? atoi(max) : 65535)) + { + free(portlist_copy); + return(1); + } + + } + + /* + * Jump to next item + */ + min = next; + + /* + * Zero-terminate next item and remember offset for n+1 + */ + if ((NULL != next) && (NULL != (next = strchr(next, (int) ',')))) + { + *next++ = '\0'; + } + } + + free(portlist_copy); + return 0; + +} + + /********************************************************************* * * Function : block_url @@ -466,20 +643,20 @@ struct http_response *block_url(struct client_state *csp) #endif /* def FEATURE_IMAGE_BLOCKING */ struct http_response *rsp; - /* + /* * If it's not blocked, don't block it ;-) */ if ((csp->action->flags & ACTION_BLOCK) == 0) { - return(NULL); + return NULL; } - /* + /* * Else, prepare a response */ if (NULL == (rsp = alloc_http_response())) { - return NULL; + return cgi_error_memory(); } /* @@ -496,67 +673,138 @@ struct http_response *block_url(struct client_state *csp) /* and handle accordingly: */ if ((p == NULL) || (0 == strcmpic(p, "logo"))) { - rsp->body = bindup(image_junkbuster_gif_data, image_junkbuster_gif_length); - rsp->content_length = image_junkbuster_gif_length; - enlist_unique_header(rsp->headers, "Content-Type", "image/gif"); + rsp->body = bindup(image_logo_data, image_logo_length); + if (rsp->body == NULL) + { + free_http_response(rsp); + return cgi_error_memory(); + } + rsp->content_length = image_logo_length; + + if (enlist_unique_header(rsp->headers, "Content-Type", BUILTIN_IMAGE_MIMETYPE)) + { + free_http_response(rsp); + return cgi_error_memory(); + } } else if (0 == strcmpic(p, "blank")) { - rsp->body = bindup(image_blank_gif_data, image_blank_gif_length); - rsp->content_length = image_blank_gif_length; - enlist_unique_header(rsp->headers, "Content-Type", "image/gif"); + rsp->body = bindup(image_blank_data, image_blank_length); + if (rsp->body == NULL) + { + free_http_response(rsp); + return cgi_error_memory(); + } + rsp->content_length = image_blank_length; + + if (enlist_unique_header(rsp->headers, "Content-Type", BUILTIN_IMAGE_MIMETYPE)) + { + free_http_response(rsp); + return cgi_error_memory(); + } + } + + else if (0 == strcmpic(p, "pattern")) + { + rsp->body = bindup(image_pattern_data, image_pattern_length); + if (rsp->body == NULL) + { + free_http_response(rsp); + return cgi_error_memory(); + } + rsp->content_length = image_pattern_length; + + if (enlist_unique_header(rsp->headers, "Content-Type", BUILTIN_IMAGE_MIMETYPE)) + { + free_http_response(rsp); + return cgi_error_memory(); + } } else { rsp->status = strdup("302 Local Redirect from Junkbuster"); - enlist_unique_header(rsp->headers, "Location", p); + if (rsp->status == NULL) + { + free_http_response(rsp); + return cgi_error_memory(); + } + + if (enlist_unique_header(rsp->headers, "Location", p)) + { + free_http_response(rsp); + return cgi_error_memory(); + } } - } + } else #endif /* def FEATURE_IMAGE_BLOCKING */ - /* + /* * Else, generate an HTML "blocked" message: */ { - struct map * exports = default_exports(csp, NULL); -#ifdef FEATURE_FORCE_LOAD - map(exports, "force-prefix", 1, FORCE_PREFIX, 1); -#else /* ifndef FEATURE_FORCE_LOAD */ - map_block_killer(exports, "force-support"); -#endif /* ndef FEATURE_FORCE_LOAD */ - - map(exports, "hostport", 1, csp->http->hostport, 1); - map(exports, "hostport-html", 1, html_encode(csp->http->hostport), 0); - map(exports, "path", 1, csp->http->path, 1); - map(exports, "path-html", 1, html_encode(csp->http->path), 0); + jb_err err; + struct map * exports; - rsp->body = fill_template(csp, "blocked", exports); - free_map(exports); - /* * Workaround for stupid Netscape bug which prevents * pages from being displayed if loading a referenced * JavaScript or style sheet fails. So make it appear * as if it succeeded. */ - if (csp->http->user_agent - && !strncmpic(csp->http->user_agent, "mozilla", 7) - && !strstr(csp->http->user_agent, "compatible") - && !strstr(csp->http->user_agent, "Opera")) + if ( NULL != (p = get_header_value(csp->headers, "User-Agent:")) + && !strncmpic(p, "mozilla", 7) /* Catch Netscape but */ + && !strstr(p, "Gecko") /* save Mozilla, */ + && !strstr(p, "compatible") /* MSIE */ + && !strstr(p, "Opera")) /* and Opera. */ { - rsp->status = strdup("200 Request for blocked URL"); + rsp->status = strdup("200 Request for blocked URL"); } else { - rsp->status = strdup("404 Request for blocked URL"); + rsp->status = strdup("404 Request for blocked URL"); + } + + if (rsp->status == NULL) + { + free_http_response(rsp); + return cgi_error_memory(); + } + + exports = default_exports(csp, NULL); + if (exports == NULL) + { + free_http_response(rsp); + return cgi_error_memory(); } +#ifdef FEATURE_FORCE_LOAD + err = map(exports, "force-prefix", 1, FORCE_PREFIX, 1); +#else /* ifndef FEATURE_FORCE_LOAD */ + err = map_block_killer(exports, "force-support"); +#endif /* ndef FEATURE_FORCE_LOAD */ + + if (!err) err = map(exports, "hostport", 1, html_encode(csp->http->hostport), 0); + if (!err) err = map(exports, "path", 1, html_encode(csp->http->path), 0); + + if (err) + { + free_map(exports); + free_http_response(rsp); + return cgi_error_memory(); + } + + err = template_fill_for_cgi(csp, "blocked", exports, rsp); + if (err) + { + free_http_response(rsp); + return cgi_error_memory(); + } } - return(finish_http_response(rsp)); + return finish_http_response(rsp); } @@ -579,8 +827,11 @@ struct http_response *trust_url(struct client_state *csp) { struct http_response *rsp; struct map * exports; - char buf[BUFFER_SIZE], *p = NULL; - struct url_spec **tl, *t; + char buf[BUFFER_SIZE]; + char *p; + struct url_spec **tl; + struct url_spec *t; + jb_err err; /* * Don't bother to work on trusted URLs @@ -590,82 +841,115 @@ struct http_response *trust_url(struct client_state *csp) return NULL; } - /* + /* * Else, prepare a response: */ if (NULL == (rsp = alloc_http_response())) { - return NULL; + return cgi_error_memory(); } exports = default_exports(csp, NULL); + if (exports == NULL) + { + free_http_response(rsp); + return cgi_error_memory(); + } - /* + /* * Export the host, port, and referrer information */ - map(exports, "hostport", 1, csp->http->hostport, 1); - map(exports, "path", 1, csp->http->path, 1); - map(exports, "hostport-html", 1, html_encode(csp->http->hostport), 0); - map(exports, "path-html", 1, html_encode(csp->http->path), 0); + err = map(exports, "hostport", 1, csp->http->hostport, 1); + if (!err) err = map(exports, "path", 1, csp->http->path, 1); - if (csp->referrer && strlen(csp->referrer) > 9) + if (NULL != (p = get_header_value(csp->headers, "Referer:"))) { - map(exports, "referrer", 1, csp->referrer + 9, 1); - map(exports, "referrer-html", 1, html_encode(csp->referrer + 9), 0); + if (!err) err = map(exports, "referrer", 1, html_encode(p), 0); } else { - map(exports, "referrer", 1, "unknown", 1); - map(exports, "referrer-html", 1, "unknown", 1); + if (!err) err = map(exports, "referrer", 1, "unknown", 1); + } + + if (err) + { + free_map(exports); + free_http_response(rsp); + return cgi_error_memory(); } /* * Export the trust list */ + p = strdup(""); for (tl = csp->config->trust_list; (t = *tl) ; tl++) { sprintf(buf, "
  • %s
    • \n", t->spec); - p = strsav(p, buf); + string_append(&p, buf); + } + err = map(exports, "trusted-referrers", 1, p, 0); + + if (err) + { + free_map(exports); + free_http_response(rsp); + return cgi_error_memory(); } - map(exports, "trusted-referrers", 1, p, 0); - p = NULL; /* * Export the trust info, if available */ - if (csp->config->trust_info->next) + if (csp->config->trust_info->first) { - struct list *l; + struct list_entry *l; - for (l = csp->config->trust_info->next; l ; l = l->next) + p = strdup(""); + for (l = csp->config->trust_info->first; l ; l = l->next) { sprintf(buf, "
  • %s
    \n",l->str, l->str); - p = strsav(p, buf); + string_append(&p, buf); } - map(exports, "trust-info", 1, p, 0); + err = map(exports, "trust-info", 1, p, 0); } else { - map_block_killer(exports, "have-trust-info"); + err = map_block_killer(exports, "have-trust-info"); + } + + if (err) + { + free_map(exports); + free_http_response(rsp); + return cgi_error_memory(); } - + /* * Export the force prefix or the force conditional block killer */ #ifdef FEATURE_FORCE_LOAD - map(exports, "force-prefix", 1, FORCE_PREFIX, 1); + err = map(exports, "force-prefix", 1, FORCE_PREFIX, 1); #else /* ifndef FEATURE_FORCE_LOAD */ - map_block_killer(exports, "force-support"); + err = map_block_killer(exports, "force-support"); #endif /* ndef FEATURE_FORCE_LOAD */ + if (err) + { + free_map(exports); + free_http_response(rsp); + return cgi_error_memory(); + } + /* * Build the response */ - rsp->body = fill_template(csp, "untrusted", exports); - free_map(exports); - - return(finish_http_response(rsp)); + err = template_fill_for_cgi(csp, "untrusted", exports, rsp); + if (err) + { + free_http_response(rsp); + return cgi_error_memory(); + } + return finish_http_response(rsp); } #endif /* def FEATURE_TRUST */ @@ -692,7 +976,7 @@ struct http_response *redirect_url(struct client_state *csp) p = q = csp->http->path; log_error(LOG_LEVEL_REDIRECTS, "checking path for redirects: %s", p); - /* + /* * find the last URL encoded in the request */ while ((p = strstr(p, "http://"))) @@ -700,7 +984,7 @@ struct http_response *redirect_url(struct client_state *csp) q = p++; } - /* + /* * if there was any, generate and return a HTTP redirect */ if (q != csp->http->path) @@ -709,17 +993,21 @@ struct http_response *redirect_url(struct client_state *csp) if (NULL == (rsp = alloc_http_response())) { - return NULL; + return cgi_error_memory(); } - rsp->status = strdup("302 Local Redirect from Junkbuster"); - enlist_unique_header(rsp->headers, "Location", q); + if ( enlist_unique_header(rsp->headers, "Location", q) + || (NULL == (rsp->status = strdup("302 Local Redirect from Junkbuster"))) ) + { + free_http_response(rsp); + return cgi_error_memory(); + } - return(finish_http_response(rsp)); + return finish_http_response(rsp); } else { - return(NULL); + return NULL; } } @@ -735,7 +1023,7 @@ struct http_response *redirect_url(struct client_state *csp) * using either the info from a previous +image action * or, #ifdef FEATURE_IMAGE_DETECT_MSIE, the info from * the browser's accept header. - * + * * Parameters : * 1 : csp = Current client state (buffers, headers, etc...) * @@ -746,17 +1034,23 @@ struct http_response *redirect_url(struct client_state *csp) int is_imageurl(struct client_state *csp) { #ifdef FEATURE_IMAGE_DETECT_MSIE - if ((csp->accept_types - & (ACCEPT_TYPE_IS_MSIE|ACCEPT_TYPE_MSIE_IMAGE|ACCEPT_TYPE_MSIE_HTML)) - == (ACCEPT_TYPE_IS_MSIE|ACCEPT_TYPE_MSIE_IMAGE)) - { - return 1; - } - else if ((csp->accept_types - & (ACCEPT_TYPE_IS_MSIE|ACCEPT_TYPE_MSIE_IMAGE|ACCEPT_TYPE_MSIE_HTML)) - == (ACCEPT_TYPE_IS_MSIE|ACCEPT_TYPE_MSIE_HTML)) + char *tmp; + + tmp = get_header_value(csp->headers, "User-Agent:"); + if (tmp && strstr(tmp, "MSIE")) { - return 0; + tmp = get_header_value(csp->headers, "Accept:"); + if (tmp && strstr(tmp, "image/gif")) + { + /* Client will accept HTML. If this seems counterintuitive, + * blame Microsoft. + */ + return(0); + } + else + { + return(1); + } } #endif /* def FEATURE_IMAGE_DETECT_MSIE */ @@ -788,145 +1082,107 @@ int is_untrusted_url(struct client_state *csp) { struct file_list *fl; struct block_spec *b; - struct url_spec url[1], **tl, *t; + struct url_spec **trusted_url; struct http_request rhttp[1]; - char *p, *h; + const char * referer; + jb_err err; /* * If we don't have a trustlist, we trust everybody */ if (((fl = csp->tlist) == NULL) || ((b = fl->f) == NULL)) { - return(0); + return 0; } + memset(rhttp, '\0', sizeof(*rhttp)); /* * Do we trust the request URL itself? */ - *url = dsplit(csp->http->host); - - /* if splitting the domain fails, punt */ - if (url->dbuf == NULL) return(0); - - memset(rhttp, '\0', sizeof(*rhttp)); - for (b = b->next; b ; b = b->next) { - if ((b->url->port == 0) || (b->url->port == csp->http->port)) + if (url_match(b->url, csp->http)) { - if ((b->url->domain[0] == '\0') || (domaincmp(b->url, url) == 0)) - { - if ((b->url->path == NULL) || -#ifdef REGEX - (regexec(b->url->preg, csp->http->path, 0, NULL, 0) == 0) -#else - (strncmp(b->url->path, csp->http->path, b->url->pathlen) == 0) -#endif - ) - { - freez(url->dbuf); - freez(url->dvec); - - if (b->reject == 0) return(0); - - return(1); - } - } + return b->reject; } } - freez(url->dbuf); - freez(url->dvec); - - if ((csp->referrer == NULL)|| (strlen(csp->referrer) <= 9)) + if (NULL == (referer = get_header_value(csp->headers, "Referer:"))) { /* no referrer was supplied */ - return(1); + return 1; } - /* forge a URL from the referrer so we can use - * convert_url() to parse it into its components. + /* + * If not, do we maybe trust its referrer? */ - p = NULL; - p = strsav(p, "GET "); - p = strsav(p, csp->referrer + 9); /* skip over "Referer: " */ - p = strsav(p, " HTTP/1.0"); - - parse_http_request(p, rhttp, csp); - freez(p); - - if (rhttp->cmd == NULL) - { - return(1); - } - /* - * If not, do we maybe trust its referrer? + * Parse the URL from the referrer */ - *url = dsplit(rhttp->host); - /* if splitting the domain fails, punt */ - if (url->dbuf == NULL) return(1); + err = parse_http_url(referer, rhttp, csp); + if (err) + { + return 1; + } - for (tl = csp->config->trust_list; (t = *tl) ; tl++) + for (trusted_url = csp->config->trust_list; *trusted_url != NULL; trusted_url++) { - if ((t->port == 0) || (t->port == rhttp->port)) + if (url_match(*trusted_url, rhttp)) { - if ((t->domain[0] == '\0') || domaincmp(t, url) == 0) - { - if ((t->path == NULL) || -#ifdef REGEX - (regexec(t->preg, rhttp->path, 0, NULL, 0) == 0) -#else - (strncmp(t->path, rhttp->path, t->pathlen) == 0) -#endif - ) - { - /* if the URL's referrer is from a trusted referrer, then - * add the target spec to the trustfile as an unblocked - * domain and return NULL (which means it's OK). - */ + /* if the URL's referrer is from a trusted referrer, then + * add the target spec to the trustfile as an unblocked + * domain and return NULL (which means it's OK). + */ + + FILE *fp; - FILE *fp; + if ((fp = fopen(csp->config->trustfile, "a"))) + { + char * path; + char * path_end; + char * new_entry = strdup("~"); - freez(url->dbuf); - freez(url->dvec); + string_append(&new_entry, csp->http->hostport); - if ((fp = fopen(csp->config->trustfile, "a"))) + path = csp->http->path; + if ( (path[0] == '/') + && (path[1] == '~') + && ((path_end = strchr(path + 2, '/')) != NULL)) + { + /* since this path points into a user's home space + * be sure to include this spec in the trustfile. + */ + int path_len = path_end - path; /* save offset */ + path = strdup(path); /* Copy string */ + if (path != NULL) { - h = NULL; - - h = strsav(h, "~"); - h = strsav(h, csp->http->hostport); - - p = csp->http->path; - if ((*p++ == '/') - && (*p++ == '~')) - { - /* since this path points into a user's home space - * be sure to include this spec in the trustfile. - */ - if ((p = strchr(p, '/'))) - { - *p = '\0'; - h = strsav(h, csp->http->path); /* FIXME: p?! */ - h = strsav(h, "/"); - } - } - - fprintf(fp, "%s\n", h); - freez(h); - fclose(fp); + path_end = path + path_len; /* regenerate ptr to new buffer */ + *(path_end + 1) = '\0'; /* Truncate path after '/' */ } - return(0); + string_join(&new_entry, path); + } + + if (new_entry != NULL) + { + fprintf(fp, "%s\n", new_entry); + free(new_entry); + } + else + { + /* FIXME: No way to handle out-of memory, so mostly ignoring it */ + log_error(LOG_LEVEL_ERROR, "Out of memory adding pattern to trust file"); } + + fclose(fp); } + return 0; } } - return(1); + return 1; } #endif /* def FEATURE_COOKIE_JAR */ @@ -935,64 +1191,109 @@ int is_untrusted_url(struct client_state *csp) * * Function : pcrs_filter_response * - * Description : Apply all the pcrs jobs from the joblist (re_filterfile) - * to the text buffer that's been accumulated in - * csp->iob->buf and set csp->content_length to the modified - * size. + * Description : Ecexute all text substitutions from all applying + * +filter actions on the text buffer that's been accumulated + * in csp->iob->buf. If this changes the contents, set + * csp->content_length to the modified size and raise the + * CSP_FLAG_MODIFIED flag. * * Parameters : * 1 : csp = Current client state (buffers, headers, etc...) * * Returns : a pointer to the (newly allocated) modified buffer. - * or NULL in case something went wrong - * + * or NULL if there were no hits or something went wrong + * *********************************************************************/ char *pcrs_filter_response(struct client_state *csp) { int hits=0; - int size = csp->iob->eod - csp->iob->cur; + size_t size; char *old = csp->iob->cur, *new = NULL; pcrs_job *job; struct file_list *fl; struct re_filterfile_spec *b; + struct list_entry *filtername; - /* Sanity first ;-) */ - if (size <= 0) + /* + * Sanity first + */ + if (csp->iob->cur >= csp->iob->eod) { return(NULL); } + size = csp->iob->eod - csp->iob->cur; - if ( ( NULL == (fl = csp->rlist) ) || ( NULL == (b = fl->f) ) ) + if ( ( NULL == (fl = csp->rlist) ) || ( NULL == fl->f) ) { log_error(LOG_LEVEL_ERROR, "Unable to get current state of regexp filtering."); return(NULL); } - if ( NULL == b->joblist ) + /* + * If the body has a "chunked" transfer-encoding, + * get rid of it first, adjusting size and iob->eod + */ + if (csp->flags & CSP_FLAG_CHUNKED) { - log_error(LOG_LEVEL_RE_FILTER, "Empty joblist. Nothing to do."); - return(NULL); + log_error(LOG_LEVEL_RE_FILTER, "Need to de-chunk first"); + if (0 == (size = remove_chunked_transfer_coding(csp->iob->cur, size))) + { + return(NULL); + } + csp->iob->eod = csp->iob->cur + size; + csp->flags |= CSP_FLAG_MODIFIED; } - log_error(LOG_LEVEL_RE_FILTER, "re_filtering %s%s (size %d) ...", - csp->http->hostport, csp->http->path, size); - - /* Apply all jobs from the joblist */ - for (job = b->joblist; NULL != job; job = job->next) + /* + * For all applying +filter actions, look if a filter by that + * name exists and if yes, execute it's pcrs_joblist on the + * buffer. + */ + for (b = fl->f; b; b = b->next) { - hits += pcrs_execute(job, old, size, &new, &size); - if (old != csp->iob->cur) free(old); - old=new; + for (filtername = csp->action->multi[ACTION_MULTI_FILTER]->first; + filtername ; filtername = filtername->next) + { + if (strcmp(b->filtername, filtername->str) == 0) + { + if ( NULL == b->joblist ) + { + log_error(LOG_LEVEL_RE_FILTER, "Filter %s has empty joblist. Nothing to do.", b->filtername); + return(NULL); + } + + log_error(LOG_LEVEL_RE_FILTER, "re_filtering %s%s (size %d) with filter %s...", + csp->http->hostport, csp->http->path, size, b->filtername); + + /* Apply all jobs from the joblist */ + for (job = b->joblist; NULL != job; job = job->next) + { + hits += pcrs_execute(job, old, size, &new, &size); + if (old != csp->iob->cur) free(old); + old=new; + } + + log_error(LOG_LEVEL_RE_FILTER, " ...produced %d hits (new size %d).", hits, size); + } + } } - log_error(LOG_LEVEL_RE_FILTER, " produced %d hits (new size %d).", hits, size); + /* + * If there were no hits, destroy our copy and let + * chat() use the original in csp->iob + */ + if (!hits) + { + free(new); + return(NULL); + } + csp->flags |= CSP_FLAG_MODIFIED; csp->content_length = size; - - /* fwiw, reset the iob */ IOB_RESET(csp); + return(new); } @@ -1002,22 +1303,37 @@ char *pcrs_filter_response(struct client_state *csp) * * Function : gif_deanimate_response * - * Description : Deanimate the GIF image that has been accumulated in - * csp->iob->buf and set csp->content_length to the modified - * size. + * Description : Deanimate the GIF image that has been accumulated in + * csp->iob->buf, set csp->content_length to the modified + * size and raise the CSP_FLAG_MODIFIED flag. * * Parameters : * 1 : csp = Current client state (buffers, headers, etc...) * * Returns : a pointer to the (newly allocated) modified buffer. * or NULL in case something went wrong. - * + * *********************************************************************/ char *gif_deanimate_response(struct client_state *csp) { struct binbuffer *in, *out; char *p; - int size = csp->iob->eod - csp->iob->cur; + size_t size = csp->iob->eod - csp->iob->cur; + + /* + * If the body has a "chunked" transfer-encoding, + * get rid of it first, adjusting size and iob->eod + */ + if (csp->flags & CSP_FLAG_CHUNKED) + { + log_error(LOG_LEVEL_DEANIMATE, "Need to de-chunk first"); + if (0 == (size = remove_chunked_transfer_coding(csp->iob->cur, size))) + { + return(NULL); + } + csp->iob->eod = csp->iob->cur + size; + csp->flags |= CSP_FLAG_MODIFIED; + } if ( (NULL == (in = (struct binbuffer *)zalloc(sizeof *in ))) || (NULL == (out = (struct binbuffer *)zalloc(sizeof *out))) ) @@ -1040,11 +1356,71 @@ char *gif_deanimate_response(struct client_state *csp) { log_error(LOG_LEVEL_DEANIMATE, "Success! GIF shrunk from %d bytes to %d.", size, out->offset); csp->content_length = out->offset; + csp->flags |= CSP_FLAG_MODIFIED; p = out->buffer; free(in); free(out); return(p); - } + } + +} + + +/********************************************************************* + * + * Function : remove_chunked_transfer_coding + * + * Description : In-situ remove the "chunked" transfer coding as defined + * in rfc2616 from a buffer. + * + * Parameters : + * 1 : buffer = Pointer to the text buffer + * 2 : size = Number of bytes to be processed + * + * Returns : The new size, i.e. the number of bytes from buffer which + * are occupied by the stripped body, or 0 in case something + * went wrong + * + *********************************************************************/ +int remove_chunked_transfer_coding(char *buffer, const size_t size) +{ + size_t newsize = 0; + unsigned int chunksize = 0; + char *from_p, *to_p; + + assert(buffer); + from_p = to_p = buffer; + + if (sscanf(buffer, "%x", &chunksize) != 1) + { + log_error(LOG_LEVEL_ERROR, "Invalid first chunksize while stripping \"chunked\" transfer coding"); + return(0); + } + + while (chunksize > 0) + { + if (NULL == (from_p = strstr(from_p, "\r\n"))) + { + log_error(LOG_LEVEL_ERROR, "Parse error while stripping \"chunked\" transfer coding"); + return(0); + } + newsize += chunksize; + from_p += 2; + + memmove(to_p, from_p, (size_t) chunksize); + to_p = buffer + newsize; + from_p += chunksize + 2; + + if (sscanf(from_p, "%x", &chunksize) != 1) + { + log_error(LOG_LEVEL_ERROR, "Parse error while stripping \"chunked\" transfer coding"); + return(0); + } + } + + /* FIXME: Should this get its own loglevel? */ + log_error(LOG_LEVEL_RE_FILTER, "De-chunking successful. Shrunk from %d to %d\n", size, newsize); + return(newsize); } @@ -1062,7 +1438,7 @@ char *gif_deanimate_response(struct client_state *csp) * Returns : N/A * *********************************************************************/ -void url_actions(struct http_request *http, +void url_actions(struct http_request *http, struct client_state *csp) { struct file_list *fl; @@ -1094,48 +1470,23 @@ void url_actions(struct http_request *http, * Returns : N/A * *********************************************************************/ -void apply_url_actions(struct current_action_spec *action, - struct http_request *http, +void apply_url_actions(struct current_action_spec *action, + struct http_request *http, struct url_actions *b) { - struct url_spec url[1]; - if (b == NULL) { /* Should never happen */ return; } - *url = dsplit(http->host); - - /* if splitting the domain fails, punt */ - if (url->dbuf == NULL) - { - return; - } - for (b = b->next; NULL != b; b = b->next) { - if ((b->url->port == 0) || (b->url->port == http->port)) + if (url_match(b->url, http)) { - if ((b->url->domain[0] == '\0') || (domaincmp(b->url, url) == 0)) - { - if ((b->url->path == NULL) || -#ifdef REGEX - (regexec(b->url->preg, http->path, 0, NULL, 0) == 0) -#else - (strncmp(b->url->path, http->path, b->url->pathlen) == 0) -#endif - ) - { - merge_current_action(action, b->action); - } - } + merge_current_action(action, b->action); } } - - freez(url->dbuf); - freez(url->dvec); } @@ -1157,227 +1508,22 @@ const struct forward_spec * forward_url(struct http_request *http, { static const struct forward_spec fwd_default[1] = { FORWARD_SPEC_INITIALIZER }; struct forward_spec *fwd = csp->config->forward; - struct url_spec url[1]; if (fwd == NULL) { - return(fwd_default); - } - - *url = dsplit(http->host); - - /* if splitting the domain fails, punt */ - if (url->dbuf == NULL) - { - return(fwd_default); + return fwd_default; } while (fwd != NULL) { - if ((fwd->url->port == 0) || (fwd->url->port == http->port)) + if (url_match(fwd->url, http)) { - if ((fwd->url->domain[0] == '\0') || (domaincmp(fwd->url, url) == 0)) - { - if ((fwd->url->path == NULL) || -#ifdef REGEX - (regexec(fwd->url->preg, http->path, 0, NULL, 0) == 0) -#else - (strncmp(fwd->url->path, http->path, fwd->url->pathlen) == 0) -#endif - ) - { - freez(url->dbuf); - freez(url->dvec); - return(fwd); - } - } + return fwd; } fwd = fwd->next; } - freez(url->dbuf); - freez(url->dvec); - return(fwd_default); - -} - - -/********************************************************************* - * - * Function : dsplit - * - * Description : Takes a domain and returns a pointer to a url_spec - * structure populated with dbuf, dcnt and dvec. The - * other fields in the structure that is returned are zero. - * - * Parameters : - * 1 : domain = a URL address - * - * Returns : url_spec structure populated with dbuf, dcnt and dvec. - * - *********************************************************************/ -struct url_spec dsplit(char *domain) -{ - struct url_spec ret[1]; - char *v[BUFFER_SIZE]; - int size; - char *p; - - memset(ret, '\0', sizeof(*ret)); - - if (domain[strlen(domain) - 1] == '.') - { - ret->unanchored |= ANCHOR_RIGHT; - } - - if (domain[0] == '.') - { - ret->unanchored |= ANCHOR_LEFT; - } - - ret->dbuf = strdup(domain); - - /* map to lower case */ - for (p = ret->dbuf; *p ; p++) *p = tolower(*p); - - /* split the domain name into components */ - ret->dcnt = ssplit(ret->dbuf, ".", v, SZ(v), 1, 1); - - if (ret->dcnt <= 0) - { - memset(ret, '\0', sizeof(ret)); - return(*ret); - } - - /* save a copy of the pointers in dvec */ - size = ret->dcnt * sizeof(*ret->dvec); - - if ((ret->dvec = (char **)malloc(size))) - { - memcpy(ret->dvec, v, size); - } - - return(*ret); - -} - - -/********************************************************************* - * - * Function : simple_domaincmp - * - * Description : Domain-wise Compare fqdn's. The comparison is - * both left- and right-anchored. The individual - * domain names are compared with simplematch(). - * This is only used by domaincmp. - * - * Parameters : - * 1 : pv = array of patterns to compare - * 2 : fv = array of domain components to compare - * 3 : len = length of the arrays (both arrays are the - * same length - if they weren't, it couldn't - * possibly be a match). - * - * Returns : 0 => domains are equivalent, else no match. - * - *********************************************************************/ -static int simple_domaincmp(char **pv, char **fv, int len) -{ - int n; - - for (n = 0; n < len; n++) - { - if (simplematch(pv[n], fv[n])) - { - return 1; - } - } - - return 0; - -} - - -/********************************************************************* - * - * Function : domaincmp - * - * Description : Domain-wise Compare fqdn's. Governed by the bimap in - * pattern->unachored, the comparison is un-, left-, - * right-anchored, or both. - * The individual domain names are compared with - * simplematch(). - * - * Parameters : - * 1 : pattern = a domain that may contain a '*' as a wildcard. - * 2 : fqdn = domain name against which the patterns are compared. - * - * Returns : 0 => domains are equivalent, else no match. - * - *********************************************************************/ -int domaincmp(struct url_spec *pattern, struct url_spec *fqdn) -{ - char **pv, **fv; /* vectors */ - int plen, flen; - int unanchored = pattern->unanchored & (ANCHOR_RIGHT | ANCHOR_LEFT); - - plen = pattern->dcnt; - flen = fqdn->dcnt; - - if (flen < plen) - { - /* fqdn is too short to match this pattern */ - return 1; - } - - pv = pattern->dvec; - fv = fqdn->dvec; - - if (unanchored == ANCHOR_LEFT) - { - /* - * Right anchored. - * - * Convert this into a fully anchored pattern with - * the fqdn and pattern the same length - */ - fv += (flen - plen); /* flen - plen >= 0 due to check above */ - return simple_domaincmp(pv, fv, plen); - } - else if (unanchored == 0) - { - /* Fully anchored, check length */ - if (flen != plen) - { - return 1; - } - return simple_domaincmp(pv, fv, plen); - } - else if (unanchored == ANCHOR_RIGHT) - { - /* Left anchored, ignore all extra in fqdn */ - return simple_domaincmp(pv, fv, plen); - } - else - { - /* Unanchored */ - int n; - int maxn = flen - plen; - for (n = 0; n <= maxn; n++) - { - if (!simple_domaincmp(pv, fv, plen)) - { - return 0; - } - /* - * Doesn't match from start of fqdn - * Try skipping first part of fqdn - */ - fv++; - } - return 1; - } - + return fwd_default; }