X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=filters.c;h=a7f622a91872b59f25528a5715aec9c0e2e34cab;hp=2de5e29d0f1bc900d24e5e343287620dd0b4c1b7;hb=09cb5b63402bb444511ee32baadf720274039c63;hpb=2935a01f7fffce53f81e235557f3ae5459e200e6 diff --git a/filters.c b/filters.c index 2de5e29d..a7f622a9 100644 --- a/filters.c +++ b/filters.c @@ -1,24 +1,18 @@ -const char filters_rcs[] = "$Id: filters.c,v 1.11 2001/05/29 11:53:23 oes Exp $"; +const char filters_rcs[] = "$Id: filters.c,v 1.174 2012/10/21 12:35:15 fabiankeil Exp $"; /********************************************************************* * * File : $Source: /cvsroot/ijbswa/current/filters.c,v $ * * Purpose : Declares functions to parse/crunch headers and pages. - * Functions declared include: - * `acl_addr', `add_stats', `block_acl', `block_imageurl', - * `block_url', `url_permissions', `domaincmp', `dsplit', - * `filter_popups', `forward_url', 'redirect_url', - * `ij_untrusted_url', `intercept_url', `re_process_buffer', - * `show_proxy_args', 'ijb_send_banner', and `trust_url' * - * Copyright : Written by and Copyright (C) 2001 the SourceForge - * IJBSWA team. http://ijbswa.sourceforge.net + * Copyright : Written by and Copyright (C) 2001-2011 the + * Privoxy team. http://www.privoxy.org/ * * Based on the Internet Junkbuster originally written - * by and Copyright (C) 1997 Anonymous Coders and + * by and Copyright (C) 1997 Anonymous Coders and * Junkbusters Corporation. http://www.junkbusters.com * - * This program is free software; you can redistribute it + * This program is free software; you can redistribute it * and/or modify it under the terms of the GNU General * Public License as published by the Free Software * Foundation; either version 2 of the License, or (at @@ -36,130 +30,8 @@ const char filters_rcs[] = "$Id: filters.c,v 1.11 2001/05/29 11:53:23 oes Exp $" * or write to the Free Software Foundation, Inc., 59 * Temple Place - Suite 330, Boston, MA 02111-1307, USA. * - * Revisions : - * $Log: filters.c,v $ - * Revision 1.11 2001/05/29 11:53:23 oes - * "See why" link added to "blocked" page - * - * Revision 1.10 2001/05/29 09:50:24 jongfoster - * Unified blocklist/imagelist/permissionslist. - * File format is still under discussion, but the internal changes - * are (mostly) done. - * - * Also modified interceptor behaviour: - * - We now intercept all URLs beginning with one of the following - * prefixes (and *only* these prefixes): - * * http://i.j.b/ - * * http://ijbswa.sf.net/config/ - * * http://ijbswa.sourceforge.net/config/ - * - New interceptors "home page" - go to http://i.j.b/ to see it. - * - Internal changes so that intercepted and fast redirect pages - * are not replaced with an image. - * - Interceptors now have the option to send a binary page direct - * to the client. (i.e. ijb-send-banner uses this) - * - Implemented show-url-info interceptor. (Which is why I needed - * the above interceptors changes - a typical URL is - * "http://i.j.b/show-url-info?url=www.somesite.com/banner.gif". - * The previous mechanism would not have intercepted that, and - * if it had been intercepted then it then it would have replaced - * it with an image.) - * - * Revision 1.9 2001/05/27 22:17:04 oes - * - * - re_process_buffer no longer writes the modified buffer - * to the client, which was very ugly. It now returns the - * buffer, which it is then written by chat. - * - * - content_length now adjusts the Content-Length: header - * for modified documents rather than crunch()ing it. - * (Length info in csp->content_length, which is 0 for - * unmodified documents) - * - * - For this to work, sed() is called twice when filtering. - * - * Revision 1.8 2001/05/26 17:13:28 jongfoster - * Filled in a function comment. - * - * Revision 1.7 2001/05/26 15:26:15 jongfoster - * ACL feature now provides more security by immediately dropping - * connections from untrusted hosts. - * - * Revision 1.6 2001/05/26 00:28:36 jongfoster - * Automatic reloading of config file. - * Removed obsolete SIGHUP support (Unix) and Reload menu option (Win32). - * Most of the global variables have been moved to a new - * struct configuration_spec, accessed through csp->config->globalname - * Most of the globals remaining are used by the Win32 GUI. - * - * Revision 1.5 2001/05/25 22:34:30 jongfoster - * Hard tabs->Spaces - * - * Revision 1.4 2001/05/22 18:46:04 oes - * - * - Enabled filtering banners by size rather than URL - * by adding patterns that replace all standard banner - * sizes with the "Junkbuster" gif to the re_filterfile - * - * - Enabled filtering WebBugs by providing a pattern - * which kills all 1x1 images - * - * - Added support for PCRE_UNGREEDY behaviour to pcrs, - * which is selected by the (nonstandard and therefore - * capital) letter 'U' in the option string. - * It causes the quantifiers to be ungreedy by default. - * Appending a ? turns back to greedy (!). - * - * - Added a new interceptor ijb-send-banner, which - * sends back the "Junkbuster" gif. Without imagelist or - * MSIE detection support, or if tinygif = 1, or the - * URL isn't recognized as an imageurl, a lame HTML - * explanation is sent instead. - * - * - Added new feature, which permits blocking remote - * script redirects and firing back a local redirect - * to the browser. - * The feature is conditionally compiled, i.e. it - * can be disabled with --disable-fast-redirects, - * plus it must be activated by a "fast-redirects" - * line in the config file, has its own log level - * and of course wants to be displayed by show-proxy-args - * Note: Boy, all the #ifdefs in 1001 locations and - * all the fumbling with configure.in and acconfig.h - * were *way* more work than the feature itself :-( - * - * - Because a generic redirect template was needed for - * this, tinygif = 3 now uses the same. - * - * - Moved GIFs, and other static HTTP response templates - * to project.h - * - * - Some minor fixes - * - * - Removed some >400 CRs again (Jon, you really worked - * a lot! ;-) - * - * Revision 1.3 2001/05/20 16:44:47 jongfoster - * Removing last hardcoded JunkBusters.com URLs. - * - * Revision 1.2 2001/05/20 01:21:20 jongfoster - * Version 2.9.4 checkin. - * - Merged popupfile and cookiefile, and added control over PCRS - * filtering, in new "permissionsfile". - * - Implemented LOG_LEVEL_FATAL, so that if there is a configuration - * file error you now get a message box (in the Win32 GUI) rather - * than the program exiting with no explanation. - * - Made killpopup use the PCRS MIME-type checking and HTTP-header - * skipping. - * - Removed tabs from "config" - * - Moved duplicated url parsing code in "loaders.c" to a new funcition. - * - Bumped up version number. - * - * Revision 1.1.1.1 2001/05/15 13:58:52 oes - * Initial import of version 2.9.3 source tree - * - * *********************************************************************/ - + #include "config.h" @@ -168,26 +40,35 @@ const char filters_rcs[] = "$Id: filters.c,v 1.11 2001/05/29 11:53:23 oes Exp $" #include #include #include +#include #ifndef _WIN32 +#ifndef __OS2__ #include +#endif /* ndef __OS2__ */ #include #else #include -#endif +#endif /* ndef _WIN32 */ + +#ifdef __OS2__ +#include +#endif /* def __OS2__ */ #include "project.h" #include "filters.h" #include "encode.h" -#include "jcc.h" -#include "showargs.h" #include "parsers.h" #include "ssplit.h" -#include "gateway.h" -#include "jbsockets.h" #include "errlog.h" #include "jbsockets.h" #include "miscutil.h" +#include "actions.h" +#include "cgi.h" +#include "list.h" +#include "deanimate.h" +#include "urlmatch.h" +#include "loaders.h" #ifdef _WIN32 #include "win32.h" @@ -195,71 +76,156 @@ const char filters_rcs[] = "$Id: filters.c,v 1.11 2001/05/29 11:53:23 oes Exp $" const char filters_h_rcs[] = FILTERS_H_VERSION; -/* Fix a problem with Solaris. There should be no effect on other - * platforms. - * Solaris's isspace() is a macro which uses it's argument directly - * as an array index. Therefore we need to make sure that high-bit - * characters generate +ve values, and ideally we also want to make - * the argument match the declared parameter type of "int". - */ -#define ijb_isdigit(__X) isdigit((int)(unsigned char)(__X)) - - -static const char CBLOCK[] = -#ifdef AMIGA - "HTTP/1.0 403 Request for blocked URL\n" -#else /* ifndef AMIGA */ - "HTTP/1.0 202 Request for blocked URL\n" -#endif /* ndef AMIGA */ - "Pragma: no-cache\n" - "Last-Modified: Thu Jul 31, 1997 07:42:22 pm GMT\n" - "Expires: Thu Jul 31, 1997 07:42:22 pm GMT\n" - "Content-Type: text/html\n\n" - "\n" - "\n" - "Internet Junkbuster: Request for blocked URL\n" - "\n" - WHITEBG - "

" - BANNER - "

\n" - "

Your request for %s%s\n" - "was blocked.
See why" -#ifdef FORCE_LOAD - " or " - "go there anyway." -#endif /* def FORCE_LOAD */ - "

\n" - "\n" - "\n"; - -#ifdef TRUST_FILES -static const char CTRUST[] = -#ifdef AMIGA - "HTTP/1.0 403 Request for untrusted URL\n" -#else /* ifndef AMIGA */ - "HTTP/1.0 202 Request for untrusted URL\n" -#endif /* ndef AMIGA */ - "Pragma: no-cache\n" - "Last-Modified: Thu Jul 31, 1997 07:42:22 pm GMT\n" - "Expires: Thu Jul 31, 1997 07:42:22 pm GMT\n" - "Content-Type: text/html\n\n" - "\n" - "\n" - "Internet Junkbuster: Request for untrusted URL\n" - "\n" - WHITEBG - "
" - "" - BANNER - "" - "
" - "\n" - "\n"; -#endif /* def TRUST_FILES */ - - -#ifdef ACL_FILES +typedef char *(*filter_function_ptr)(); +static filter_function_ptr get_filter_function(const struct client_state *csp); +static jb_err remove_chunked_transfer_coding(char *buffer, size_t *size); +static jb_err prepare_for_filtering(struct client_state *csp); + +#ifdef FEATURE_ACL +#ifdef HAVE_RFC2553 +/********************************************************************* + * + * Function : sockaddr_storage_to_ip + * + * Description : Access internal structure of sockaddr_storage + * + * Parameters : + * 1 : addr = socket address + * 2 : ip = IP address as array of octets in network order + * (it points into addr) + * 3 : len = length of IP address in octets + * 4 : port = port number in network order; + * + * Returns : 0 = no errror; -1 otherwise. + * + *********************************************************************/ +static int sockaddr_storage_to_ip(const struct sockaddr_storage *addr, + uint8_t **ip, unsigned int *len, + in_port_t **port) +{ + if (NULL == addr) + { + return(-1); + } + + switch (addr->ss_family) + { + case AF_INET: + if (NULL != len) + { + *len = 4; + } + if (NULL != ip) + { + *ip = (uint8_t *) + &(((struct sockaddr_in *)addr)->sin_addr.s_addr); + } + if (NULL != port) + { + *port = &((struct sockaddr_in *)addr)->sin_port; + } + break; + + case AF_INET6: + if (NULL != len) + { + *len = 16; + } + if (NULL != ip) + { + *ip = ((struct sockaddr_in6 *)addr)->sin6_addr.s6_addr; + } + if (NULL != port) + { + *port = &((struct sockaddr_in6 *)addr)->sin6_port; + } + break; + + default: + /* Unsupported address family */ + return(-1); + } + + return(0); +} + + +/********************************************************************* + * + * Function : match_sockaddr + * + * Description : Check whether address matches network (IP address and port) + * + * Parameters : + * 1 : network = socket address of subnework + * 2 : netmask = network mask as socket address + * 3 : address = checked socket address against given network + * + * Returns : 0 = doesn't match; 1 = does match + * + *********************************************************************/ +static int match_sockaddr(const struct sockaddr_storage *network, + const struct sockaddr_storage *netmask, + const struct sockaddr_storage *address) +{ + uint8_t *network_addr, *netmask_addr, *address_addr; + unsigned int addr_len; + in_port_t *network_port, *netmask_port, *address_port; + int i; + + if (network->ss_family != netmask->ss_family) + { + /* This should never happen */ + assert(network->ss_family == netmask->ss_family); + log_error(LOG_LEVEL_FATAL, "Network and netmask differ in family."); + } + + sockaddr_storage_to_ip(network, &network_addr, &addr_len, &network_port); + sockaddr_storage_to_ip(netmask, &netmask_addr, NULL, &netmask_port); + sockaddr_storage_to_ip(address, &address_addr, NULL, &address_port); + + /* Check for family */ + if ((network->ss_family == AF_INET) && (address->ss_family == AF_INET6) + && IN6_IS_ADDR_V4MAPPED((struct in6_addr *)address_addr)) + { + /* Map AF_INET6 V4MAPPED address into AF_INET */ + address_addr += 12; + addr_len = 4; + } + else if ((network->ss_family == AF_INET6) && (address->ss_family == AF_INET) + && IN6_IS_ADDR_V4MAPPED((struct in6_addr *)network_addr)) + { + /* Map AF_INET6 V4MAPPED network into AF_INET */ + network_addr += 12; + netmask_addr += 12; + addr_len = 4; + } + else if (network->ss_family != address->ss_family) + { + return 0; + } + + /* XXX: Port check is signaled in netmask */ + if (*netmask_port && *network_port != *address_port) + { + return 0; + } + + /* TODO: Optimize by checking by words insted of octets */ + for (i = 0; (i < addr_len) && netmask_addr[i]; i++) + { + if ((network_addr[i] & netmask_addr[i]) != + (address_addr[i] & netmask_addr[i])) + { + return 0; + } + } + + return 1; +} +#endif /* def HAVE_RFC2553 */ + + /********************************************************************* * * Function : block_acl @@ -276,36 +242,58 @@ static const char CTRUST[] = * Returns : 0 = FALSE (don't block) and 1 = TRUE (do block) * *********************************************************************/ -int block_acl(struct access_control_addr *dst, - struct client_state *csp) +int block_acl(const struct access_control_addr *dst, const struct client_state *csp) { - struct file_list *fl; - struct access_control_list *a, *acl; + struct access_control_list *acl = csp->config->acl; /* if not using an access control list, then permit the connection */ - if (((fl = csp->alist) == NULL) || - ((acl = (struct access_control_list *) fl->f) == NULL)) + if (acl == NULL) { return(0); } /* search the list */ - for (a = acl->next ; a ; a = a->next) + while (acl != NULL) { - if ((csp->ip_addr_long & a->src->mask) == a->src->addr) + if ( +#ifdef HAVE_RFC2553 + match_sockaddr(&acl->src->addr, &acl->src->mask, &csp->tcp_addr) +#else + (csp->ip_addr_long & acl->src->mask) == acl->src->addr +#endif + ) { if (dst == NULL) { /* Just want to check if they have any access */ - if (a->action == ACL_PERMIT) + if (acl->action == ACL_PERMIT) { return(0); } + else + { + return(1); + } } - else if ( ((dst->addr & a->dst->mask) == a->dst->addr) - && ((dst->port == a->dst->port) || (a->dst->port == 0))) + else if ( +#ifdef HAVE_RFC2553 + /* + * XXX: An undefined acl->dst is full of zeros and should be + * considered a wildcard address. sockaddr_storage_to_ip() + * fails on such destinations because of unknown sa_familly + * (glibc only?). However this test is not portable. + * + * So, we signal the acl->dst is wildcard in wildcard_dst. + */ + acl->wildcard_dst || + match_sockaddr(&acl->dst->addr, &acl->dst->mask, &dst->addr) +#else + ((dst->addr & acl->dst->mask) == acl->dst->addr) + && ((dst->port == acl->dst->port) || (acl->dst->port == 0)) +#endif + ) { - if (a->action == ACL_PERMIT) + if (acl->action == ACL_PERMIT) { return(0); } @@ -315,6 +303,7 @@ int block_acl(struct access_control_addr *dst, } } } + acl = acl->next; } return(1); @@ -326,7 +315,7 @@ int block_acl(struct access_control_addr *dst, * * Function : acl_addr * - * Description : Called from `load_aclfile' to parse an ACL address. + * Description : Called from `load_config' to parse an ACL address. * * Parameters : * 1 : aspec = String specifying ACL address. @@ -335,1476 +324,2108 @@ int block_acl(struct access_control_addr *dst, * Returns : 0 => Ok, everything else is an error. * *********************************************************************/ -int acl_addr(char *aspec, struct access_control_addr *aca) +int acl_addr(const char *aspec, struct access_control_addr *aca) { - int i, masklength, port; + int i, masklength; +#ifdef HAVE_RFC2553 + struct addrinfo hints, *result; + uint8_t *mask_data; + in_port_t *mask_port; + unsigned int addr_len; +#else + long port; +#endif /* def HAVE_RFC2553 */ char *p; + char *acl_spec = NULL; +#ifdef HAVE_RFC2553 + /* XXX: Depend on ai_family */ + masklength = 128; +#else masklength = 32; port = 0; +#endif - if ((p = strchr(aspec, '/'))) + /* + * Use a temporary acl spec copy so we can log + * the unmodified original in case of parse errors. + */ + acl_spec = strdup(aspec); + if (acl_spec == NULL) { - *p++ = '\0'; + /* XXX: This will be logged as parse error. */ + return(-1); + } - if (ijb_isdigit(*p) == 0) + if ((p = strchr(acl_spec, '/')) != NULL) + { + *p++ = '\0'; + if (privoxy_isdigit(*p) == 0) { + freez(acl_spec); return(-1); } masklength = atoi(p); } - if ((masklength < 0) || (masklength > 32)) + if ((masklength < 0) || +#ifdef HAVE_RFC2553 + (masklength > 128) +#else + (masklength > 32) +#endif + ) { + freez(acl_spec); return(-1); } - if ((p = strchr(aspec, ':'))) + if ((*acl_spec == '[') && (NULL != (p = strchr(acl_spec, ']')))) { - *p++ = '\0'; + *p = '\0'; + memmove(acl_spec, acl_spec + 1, (size_t)(p - acl_spec)); - if (ijb_isdigit(*p) == 0) + if (*++p != ':') { - return(-1); + p = NULL; } - port = atoi(p); + } + else + { + p = strchr(acl_spec, ':'); } - aca->port = port; +#ifdef HAVE_RFC2553 + memset(&hints, 0, sizeof(struct addrinfo)); + hints.ai_family = AF_UNSPEC; + hints.ai_socktype = SOCK_STREAM; - aca->addr = ntohl(resolve_hostname_to_ip(aspec)); + i = getaddrinfo(acl_spec, ((p) ? ++p : NULL), &hints, &result); - if (aca->addr == -1) + if (i != 0) { - log_error(LOG_LEVEL_ERROR, "can't resolve address for %s", aspec); + log_error(LOG_LEVEL_ERROR, "Can not resolve [%s]:%s: %s", + acl_spec, p, gai_strerror(i)); + freez(acl_spec); return(-1); } + freez(acl_spec); - /* build the netmask */ - aca->mask = 0; - for (i=1; i <= masklength ; i++) + /* TODO: Allow multihomed hostnames */ + memcpy(&(aca->addr), result->ai_addr, result->ai_addrlen); + freeaddrinfo(result); +#else + if (p != NULL) { - aca->mask |= (1 << (32 - i)); - } + char *endptr; - /* now mask off the host portion of the ip address - * (i.e. save on the network portion of the address). - */ - aca->addr = aca->addr & aca->mask; + *p++ = '\0'; + port = strtol(p, &endptr, 10); - return(0); + if (port <= 0 || port > 65535 || *endptr != '\0') + { + freez(acl_spec); + return(-1); + } + } -} -#endif /* def ACL_FILES */ + aca->port = (unsigned long)port; + aca->addr = ntohl(resolve_hostname_to_ip(acl_spec)); + freez(acl_spec); -/********************************************************************* - * - * Function : block_url - * - * Description : Called from `chat'. Check to see if we need to block this. - * - * Parameters : - * 1 : http = http_request request to "check" for blocked - * 2 : csp = Current client state (buffers, headers, etc...) - * - * Returns : NULL => unblocked, else string to HTML block description. - * - *********************************************************************/ -char *block_url(struct http_request *http, struct client_state *csp) -{ - char *p; - int n; - int factor = 2; + if (aca->addr == INADDR_NONE) + { + /* XXX: This will be logged as parse error. */ + return(-1); + } +#endif /* def HAVE_RFC2553 */ - if ((csp->permissions & PERMIT_BLOCK) == 0) + /* build the netmask */ +#ifdef HAVE_RFC2553 + /* Clip masklength according to current family. */ + if ((aca->addr.ss_family == AF_INET) && (masklength > 32)) { - return(NULL); + masklength = 32; } - else + + aca->mask.ss_family = aca->addr.ss_family; + if (sockaddr_storage_to_ip(&aca->mask, &mask_data, &addr_len, &mask_port)) { -#ifdef FORCE_LOAD - factor++; -#endif /* def FORCE_LOAD */ + return(-1); + } - n = strlen(CBLOCK); - n += factor * strlen(http->hostport); - n += factor * strlen(http->path); + if (p) + { + /* ACL contains a port number, check ports in the future. */ + *mask_port = 1; + } - p = (char *)malloc(n); + /* + * XXX: This could be optimized to operate on whole words instead + * of octets (128-bit CPU could do it in one iteration). + */ + /* + * Octets after prefix can be omitted because of + * previous initialization to zeros. + */ + for (i = 0; (i < addr_len) && masklength; i++) + { + if (masklength >= 8) + { + mask_data[i] = 0xFF; + masklength -= 8; + } + else + { + /* + * XXX: This assumes MSB of octet is on the left side. + * This should be true for all architectures or solved + * by the link layer. + */ + mask_data[i] = (uint8_t)~((1 << (8 - masklength)) - 1); + masklength = 0; + } + } -#ifdef FORCE_LOAD - sprintf(p, CBLOCK, http->hostport, http->path, http->hostport, http->path, - http->hostport, http->path); #else - sprintf(p, CBLOCK, http->hostport, http->path, http->hostport, http->path); -#endif /* def FORCE_LOAD */ - - return(p); + aca->mask = 0; + for (i=1; i <= masklength ; i++) + { + aca->mask |= (1U << (32 - i)); } + + /* now mask off the host portion of the ip address + * (i.e. save on the network portion of the address). + */ + aca->addr = aca->addr & aca->mask; +#endif /* def HAVE_RFC2553 */ + + return(0); + } +#endif /* def FEATURE_ACL */ -#ifdef IMAGE_BLOCKING /********************************************************************* * - * Function : block_imageurl + * Function : connect_port_is_forbidden * - * Description : Given a URL which is blocked, decide whether to - * send the "blocked" image or HTML. + * Description : Check to see if CONNECT requests to the destination + * port of this request are forbidden. The check is + * independend of the actual request method. * * Parameters : - * 1 : http = URL to check. - * 2 : csp = Current client state (buffers, headers, etc...) + * 1 : csp = Current client state (buffers, headers, etc...) * - * Returns : True (nonzero) if URL is in image list, false (0) - * otherwise + * Returns : True if yes, false otherwise. * *********************************************************************/ -int block_imageurl(struct http_request *http, struct client_state *csp) +int connect_port_is_forbidden(const struct client_state *csp) { -#ifdef DETECT_MSIE_IMAGES - if ((csp->accept_types - & (ACCEPT_TYPE_IS_MSIE|ACCEPT_TYPE_MSIE_IMAGE|ACCEPT_TYPE_MSIE_HTML)) - == (ACCEPT_TYPE_IS_MSIE|ACCEPT_TYPE_MSIE_IMAGE)) - { - return 1; - } - else if ((csp->accept_types - & (ACCEPT_TYPE_IS_MSIE|ACCEPT_TYPE_MSIE_IMAGE|ACCEPT_TYPE_MSIE_HTML)) - == (ACCEPT_TYPE_IS_MSIE|ACCEPT_TYPE_MSIE_HTML)) - { - return 0; - } -#endif - - return ((csp->permissions & PERMIT_IMAGE) != 0); + return ((csp->action->flags & ACTION_LIMIT_CONNECT) && + !match_portlist(csp->action->string[ACTION_STRING_LIMIT_CONNECT], + csp->http->port)); } -#endif /* def IMAGE_BLOCKING */ -#ifdef PCRS /********************************************************************* * - * Function : re_process_buffer + * Function : block_url * - * Description : Apply all jobs from the joblist (aka. Perl regexp's) to - * the text buffer that's been accumulated in csp->iob->buf - * and set csp->content_length to the modified size. + * Description : Called from `chat'. Check to see if we need to block this. * * Parameters : * 1 : csp = Current client state (buffers, headers, etc...) * - * Returns : a pointer to the (newly allocated) modified buffer. - * + * Returns : NULL => unblocked, else HTTP block response * *********************************************************************/ -char *re_process_buffer(struct client_state *csp) +struct http_response *block_url(struct client_state *csp) { - int hits=0; - int size = csp->iob->eod - csp->iob->cur; - char *old=csp->iob->cur, *new = NULL; - pcrs_job *job, *joblist; - - struct file_list *fl; - struct re_filterfile_spec *b; + struct http_response *rsp; + const char *new_content_type = NULL; - /* Sanity first ;-) */ - if (size <= 0) + /* + * If it's not blocked, don't block it ;-) + */ + if ((csp->action->flags & ACTION_BLOCK) == 0) { - return(strdup("")); + return NULL; } - - if ( ( NULL == (fl = csp->rlist) ) || ( NULL == (b = fl->f) ) ) + if (csp->action->flags & ACTION_REDIRECT) { - log_error(LOG_LEVEL_ERROR, "Unable to get current state of regexp filtering."); - return(strdup("")); + log_error(LOG_LEVEL_ERROR, "redirect{} overruled by block."); } - - joblist = b->joblist; - - - log_error(LOG_LEVEL_RE_FILTER, "re_filtering %s%s (size %d) ...", - csp->http->hostport, csp->http->path, size); - - /* Apply all jobs from the joblist */ - for (job = joblist; NULL != job; job = job->next) + /* + * Else, prepare a response + */ + if (NULL == (rsp = alloc_http_response())) { - hits += pcrs_exec_substitution(job, old, size, &new, &size); - if (old != csp->iob->cur) free(old); - old=new; + return cgi_error_memory(); } - log_error(LOG_LEVEL_RE_FILTER, " produced %d hits (new size %d).", hits, size); + /* + * If it's an image-url, send back an image or redirect + * as specified by the relevant +image action + */ +#ifdef FEATURE_IMAGE_BLOCKING + if (((csp->action->flags & ACTION_IMAGE_BLOCKER) != 0) + && is_imageurl(csp)) + { + char *p; + /* determine HOW images should be blocked */ + p = csp->action->string[ACTION_STRING_IMAGE_BLOCKER]; - csp->content_length = size; + if (csp->action->flags & ACTION_HANDLE_AS_EMPTY_DOCUMENT) + { + log_error(LOG_LEVEL_ERROR, "handle-as-empty-document overruled by handle-as-image."); + } - /* fwiw, reset the iob */ - IOB_RESET(csp); - return(new); + /* and handle accordingly: */ + if ((p == NULL) || (0 == strcmpic(p, "pattern"))) + { + rsp->status = strdup("403 Request blocked by Privoxy"); + if (rsp->status == NULL) + { + free_http_response(rsp); + return cgi_error_memory(); + } + rsp->body = bindup(image_pattern_data, image_pattern_length); + if (rsp->body == NULL) + { + free_http_response(rsp); + return cgi_error_memory(); + } + rsp->content_length = image_pattern_length; -} -#endif /* def PCRS */ + if (enlist_unique_header(rsp->headers, "Content-Type", BUILTIN_IMAGE_MIMETYPE)) + { + free_http_response(rsp); + return cgi_error_memory(); + } + } + else if (0 == strcmpic(p, "blank")) + { + rsp->status = strdup("403 Request blocked by Privoxy"); + if (rsp->status == NULL) + { + free_http_response(rsp); + return cgi_error_memory(); + } + rsp->body = bindup(image_blank_data, image_blank_length); + if (rsp->body == NULL) + { + free_http_response(rsp); + return cgi_error_memory(); + } + rsp->content_length = image_blank_length; + if (enlist_unique_header(rsp->headers, "Content-Type", BUILTIN_IMAGE_MIMETYPE)) + { + free_http_response(rsp); + return cgi_error_memory(); + } + } + else + { + rsp->status = strdup("302 Local Redirect from Privoxy"); + if (rsp->status == NULL) + { + free_http_response(rsp); + return cgi_error_memory(); + } -#ifdef TRUST_FILES -/********************************************************************* - * - * Function : trust_url - * - * Description : Should we "trust" this URL? See "trustfile" line in config. - * - * Parameters : - * 1 : http = http_request request for requested URL - * 2 : csp = Current client state (buffers, headers, etc...) - * - * Returns : NULL => trusted, else string to HTML "untrusted" description. - * - *********************************************************************/ -char *trust_url(struct http_request *http, struct client_state *csp) -{ - struct file_list *fl; - struct block_spec *b; - struct url_spec url[1], **tl, *t; - char *p, *h; - char *hostport, *path, *refer; - struct http_request rhttp[1]; - int n; + if (enlist_unique_header(rsp->headers, "Location", p)) + { + free_http_response(rsp); + return cgi_error_memory(); + } + } - if (((fl = csp->tlist) == NULL) || ((b = fl->f) == NULL)) - { - return(NULL); } + else +#endif /* def FEATURE_IMAGE_BLOCKING */ + if (csp->action->flags & ACTION_HANDLE_AS_EMPTY_DOCUMENT) + { + /* + * Send empty document. + */ + new_content_type = csp->action->string[ACTION_STRING_CONTENT_TYPE]; - *url = dsplit(http->host); - - /* if splitting the domain fails, punt */ - if (url->dbuf == NULL) return(NULL); + freez(rsp->body); + rsp->body = strdup(" "); + rsp->content_length = 1; - memset(rhttp, '\0', sizeof(*rhttp)); + if (csp->config->feature_flags & RUNTIME_FEATURE_EMPTY_DOC_RETURNS_OK) + { + /* + * Workaround for firefox bug 492459 + * https://bugzilla.mozilla.org/show_bug.cgi?id=492459 + * Return a 200 OK status for pages blocked with +handle-as-empty-document + * if the "handle-as-empty-doc-returns-ok" runtime config option is set. + */ + rsp->status = strdup("200 Request blocked by Privoxy"); + } + else + { + rsp->status = strdup("403 Request blocked by Privoxy"); + } - for (b = b->next; b ; b = b->next) - { - if ((b->url->port == 0) || (b->url->port == http->port)) + if (rsp->status == NULL) { - if ((b->url->domain[0] == '\0') || (domaincmp(b->url, url) == 0)) + free_http_response(rsp); + return cgi_error_memory(); + } + if (new_content_type != 0) + { + log_error(LOG_LEVEL_HEADER, "Overwriting Content-Type with %s", new_content_type); + if (enlist_unique_header(rsp->headers, "Content-Type", new_content_type)) { - if ((b->url->path == NULL) || -#ifdef REGEX - (regexec(b->url->preg, http->path, 0, NULL, 0) == 0) -#else - (strncmp(b->url->path, http->path, b->url->pathlen) == 0) -#endif - ) - { - freez(url->dbuf); - freez(url->dvec); - - if (b->reject == 0) return(NULL); - - hostport = url_encode(http->hostport); - path = url_encode(http->path); - - if (csp->referrer) - { - refer = url_encode(csp->referrer); - } - else - { - refer = url_encode("undefined"); - } + free_http_response(rsp); + return cgi_error_memory(); + } + } + } + else - n = strlen(CTRUST); - n += strlen(hostport); - n += strlen(path); - n += strlen(refer); + /* + * Else, generate an HTML "blocked" message: + */ + { + jb_err err; + struct map * exports; - p = (char *)malloc(n); + rsp->status = strdup("403 Request blocked by Privoxy"); + if (rsp->status == NULL) + { + free_http_response(rsp); + return cgi_error_memory(); + } - sprintf(p, CTRUST, hostport, path, refer); + exports = default_exports(csp, NULL); + if (exports == NULL) + { + free_http_response(rsp); + return cgi_error_memory(); + } - freez(hostport); - freez(path); - freez(refer); +#ifdef FEATURE_FORCE_LOAD + err = map(exports, "force-prefix", 1, FORCE_PREFIX, 1); + /* + * Export the force conditional block killer if + * + * - Privoxy was compiled without FEATURE_FORCE_LOAD, or + * - Privoxy is configured to enforce blocks, or + * - it's a CONNECT request and enforcing wouldn't work anyway. + */ + if ((csp->config->feature_flags & RUNTIME_FEATURE_ENFORCE_BLOCKS) + || (0 == strcmpic(csp->http->gpc, "connect"))) +#endif /* ndef FEATURE_FORCE_LOAD */ + { + err = map_block_killer(exports, "force-support"); + } - return(p); - } + if (!err) err = map(exports, "protocol", 1, csp->http->ssl ? "https://" : "http://", 1); + if (!err) err = map(exports, "hostport", 1, html_encode(csp->http->hostport), 0); + if (!err) err = map(exports, "path", 1, html_encode(csp->http->path), 0); + if (!err) err = map(exports, "path-ue", 1, url_encode(csp->http->path), 0); + if (!err) + { + const char *block_reason; + if (csp->action->string[ACTION_STRING_BLOCK] != NULL) + { + block_reason = csp->action->string[ACTION_STRING_BLOCK]; } + else + { + assert(connect_port_is_forbidden(csp)); + block_reason = "Forbidden CONNECT port."; + } + err = map(exports, "block-reason", 1, html_encode(block_reason), 0); + } + if (err) + { + free_map(exports); + free_http_response(rsp); + return cgi_error_memory(); + } + + err = template_fill_for_cgi(csp, "blocked", exports, rsp); + if (err) + { + free_http_response(rsp); + return cgi_error_memory(); } } + rsp->crunch_reason = BLOCKED; + + return finish_http_response(csp, rsp); + +} - freez(url->dbuf); - freez(url->dvec); - if ((csp->referrer == NULL)|| (strlen(csp->referrer) <= 9)) +#ifdef FEATURE_TRUST +/********************************************************************* + * + * Function : trust_url FIXME: I should be called distrust_url + * + * Description : Calls is_untrusted_url to determine if the URL is trusted + * and if not, returns a HTTP 403 response with a reject message. + * + * Parameters : + * 1 : csp = Current client state (buffers, headers, etc...) + * + * Returns : NULL => trusted, else http_response. + * + *********************************************************************/ +struct http_response *trust_url(struct client_state *csp) +{ + struct http_response *rsp; + struct map * exports; + char buf[BUFFER_SIZE]; + char *p; + struct url_spec **tl; + struct url_spec *t; + jb_err err; + + /* + * Don't bother to work on trusted URLs + */ + if (!is_untrusted_url(csp)) { - /* no referrer was supplied */ - goto trust_url_not_trusted; + return NULL; } - /* forge a URL from the referrer so we can use - * convert_url() to parse it into its components. + /* + * Else, prepare a response: */ + if (NULL == (rsp = alloc_http_response())) + { + return cgi_error_memory(); + } - p = NULL; - p = strsav(p, "GET "); - p = strsav(p, csp->referrer + 9); /* skip over "Referer: " */ - p = strsav(p, " HTTP/1.0"); + rsp->status = strdup("403 Request blocked by Privoxy"); + exports = default_exports(csp, NULL); + if (exports == NULL || rsp->status == NULL) + { + free_http_response(rsp); + return cgi_error_memory(); + } - parse_http_request(p, rhttp, csp); + /* + * Export the protocol, host, port, and referrer information + */ + err = map(exports, "hostport", 1, csp->http->hostport, 1); + if (!err) err = map(exports, "protocol", 1, csp->http->ssl ? "https://" : "http://", 1); + if (!err) err = map(exports, "path", 1, csp->http->path, 1); - if (rhttp->cmd == NULL) + if (NULL != (p = get_header_value(csp->headers, "Referer:"))) + { + if (!err) err = map(exports, "referrer", 1, html_encode(p), 0); + } + else { - freez(p); - goto trust_url_not_trusted; + if (!err) err = map(exports, "referrer", 1, "none set", 1); } - freez(p); + if (err) + { + free_map(exports); + free_http_response(rsp); + return cgi_error_memory(); + } - *url = dsplit(rhttp->host); + /* + * Export the trust list + */ + p = strdup(""); + for (tl = csp->config->trust_list; (t = *tl) != NULL ; tl++) + { + snprintf(buf, sizeof(buf), "
  • %s
    • \n", t->spec); + string_append(&p, buf); + } + err = map(exports, "trusted-referrers", 1, p, 0); - /* if splitting the domain fails, punt */ - if (url->dbuf == NULL) goto trust_url_not_trusted; + if (err) + { + free_map(exports); + free_http_response(rsp); + return cgi_error_memory(); + } - for (tl = csp->config->trust_list; (t = *tl) ; tl++) + /* + * Export the trust info, if available + */ + if (csp->config->trust_info->first) { - if ((t->port == 0) || (t->port == rhttp->port)) + struct list_entry *l; + + p = strdup(""); + for (l = csp->config->trust_info->first; l ; l = l->next) { - if ((t->domain[0] == '\0') || domaincmp(t, url) == 0) - { - if ((t->path == NULL) || -#ifdef REGEX - (regexec(t->preg, rhttp->path, 0, NULL, 0) == 0) -#else - (strncmp(t->path, rhttp->path, t->pathlen) == 0) -#endif - ) - { - /* if the URL's referrer is from a trusted referrer, then - * add the target spec to the trustfile as an unblocked - * domain and return NULL (which means it's OK). - */ + snprintf(buf, sizeof(buf), "
  • %s
    \n", l->str, l->str); + string_append(&p, buf); + } + err = map(exports, "trust-info", 1, p, 0); + } + else + { + err = map_block_killer(exports, "have-trust-info"); + } - FILE *fp; + if (err) + { + free_map(exports); + free_http_response(rsp); + return cgi_error_memory(); + } - freez(url->dbuf); - freez(url->dvec); + /* + * Export the force conditional block killer if + * + * - Privoxy was compiled without FEATURE_FORCE_LOAD, or + * - Privoxy is configured to enforce blocks, or + * - it's a CONNECT request and enforcing wouldn't work anyway. + */ +#ifdef FEATURE_FORCE_LOAD + if ((csp->config->feature_flags & RUNTIME_FEATURE_ENFORCE_BLOCKS) + || (0 == strcmpic(csp->http->gpc, "connect"))) + { + err = map_block_killer(exports, "force-support"); + } + else + { + err = map(exports, "force-prefix", 1, FORCE_PREFIX, 1); + } +#else /* ifndef FEATURE_FORCE_LOAD */ + err = map_block_killer(exports, "force-support"); +#endif /* ndef FEATURE_FORCE_LOAD */ - if ((fp = fopen(csp->config->trustfile, "a"))) - { - h = NULL; + if (err) + { + free_map(exports); + free_http_response(rsp); + return cgi_error_memory(); + } - h = strsav(h, "~"); - h = strsav(h, http->hostport); + /* + * Build the response + */ + err = template_fill_for_cgi(csp, "untrusted", exports, rsp); + if (err) + { + free_http_response(rsp); + return cgi_error_memory(); + } + rsp->crunch_reason = UNTRUSTED; - p = http->path; - if ((*p++ == '/') - && (*p++ == '~')) - { - /* since this path points into a user's home space - * be sure to include this spec in the trustfile. - */ - if ((p = strchr(p, '/'))) - { - *p = '\0'; - h = strsav(h, http->path); - h = strsav(h, "/"); - } - } + return finish_http_response(csp, rsp); +} +#endif /* def FEATURE_TRUST */ - free_http_request(rhttp); - fprintf(fp, "%s\n", h); - freez(h); - fclose(fp); - } - return(NULL); - } +/********************************************************************* + * + * Function : compile_dynamic_pcrs_job_list + * + * Description : Compiles a dynamic pcrs job list (one with variables + * resolved at request time) + * + * Parameters : + * 1 : csp = Current client state (buffers, headers, etc...) + * 2 : b = The filter list to compile + * + * Returns : NULL in case of errors, otherwise the + * pcrs job list. + * + *********************************************************************/ +pcrs_job *compile_dynamic_pcrs_job_list(const struct client_state *csp, const struct re_filterfile_spec *b) +{ + struct list_entry *pattern; + pcrs_job *job_list = NULL; + pcrs_job *dummy = NULL; + pcrs_job *lastjob = NULL; + int error = 0; + + const struct pcrs_variable variables[] = + { + {"url", csp->http->url, 1}, + {"path", csp->http->path, 1}, + {"host", csp->http->host, 1}, + {"origin", csp->ip_addr_str, 1}, + {NULL, NULL, 1} + }; + + for (pattern = b->patterns->first; pattern != NULL; pattern = pattern->next) + { + assert(pattern->str != NULL); + + dummy = pcrs_compile_dynamic_command(pattern->str, variables, &error); + if (NULL == dummy) + { + log_error(LOG_LEVEL_ERROR, + "Compiling dynamic pcrs job '%s' for '%s' failed with error code %d: %s", + pattern->str, b->name, error, pcrs_strerror(error)); + continue; + } + else + { + if (error == PCRS_WARN_TRUNCATION) + { + log_error(LOG_LEVEL_ERROR, + "At least one of the variables in \'%s\' had to " + "be truncated before compilation", pattern->str); + } + if (job_list == NULL) + { + job_list = dummy; + } + else + { + lastjob->next = dummy; } + lastjob = dummy; } } -trust_url_not_trusted: - free_http_request(rhttp); + return job_list; +} + + +/********************************************************************* + * + * Function : rewrite_url + * + * Description : Rewrites a URL with a single pcrs command + * and returns the result if it differs from the + * original and isn't obviously invalid. + * + * Parameters : + * 1 : old_url = URL to rewrite. + * 2 : pcrs_command = pcrs command formatted as string (s@foo@bar@) + * + * + * Returns : NULL if the pcrs_command didn't change the url, or + * the result of the modification. + * + *********************************************************************/ +char *rewrite_url(char *old_url, const char *pcrs_command) +{ + char *new_url = NULL; + int hits; + + assert(old_url); + assert(pcrs_command); - hostport = url_encode(http->hostport); - path = url_encode(http->path); + new_url = pcrs_execute_single_command(old_url, pcrs_command, &hits); - if (csp->referrer) + if (hits == 0) + { + log_error(LOG_LEVEL_REDIRECTS, + "pcrs command \"%s\" didn't change \"%s\".", + pcrs_command, old_url); + freez(new_url); + } + else if (hits < 0) + { + log_error(LOG_LEVEL_REDIRECTS, + "executing pcrs command \"%s\" to rewrite %s failed: %s", + pcrs_command, old_url, pcrs_strerror(hits)); + freez(new_url); + } + else if (strncmpic(new_url, "http://", 7) && strncmpic(new_url, "https://", 8)) { - refer = url_encode(csp->referrer); + log_error(LOG_LEVEL_ERROR, + "pcrs command \"%s\" changed \"%s\" to \"%s\" (%u hi%s), " + "but the result doesn't look like a valid URL and will be ignored.", + pcrs_command, old_url, new_url, hits, (hits == 1) ? "t" : "ts"); + freez(new_url); } else { - refer = url_encode("undefined"); + log_error(LOG_LEVEL_REDIRECTS, + "pcrs command \"%s\" changed \"%s\" to \"%s\" (%u hi%s).", + pcrs_command, old_url, new_url, hits, (hits == 1) ? "t" : "ts"); } - n = strlen(CTRUST); - n += strlen(hostport); - n += strlen(path); - n += strlen(refer); - - p = (char *)malloc(n); - sprintf(p, CTRUST, hostport, path, refer); - - freez(hostport); - freez(path); - freez(refer); - - return(p); + return new_url; } -#endif /* def TRUST_FILES */ - - -static const char C_HOME_PAGE[] = - "HTTP/1.0 200 OK\n" - "Pragma: no-cache\n" - "Expires: Thu Jul 31, 1997 07:42:22 pm GMT\n" - "Content-Type: text/html\n\n" - "\n" - "\n" - "Internet Junkbuster: Information\n" - "\n" - BODY - "

    " - BANNER - "

    \n" - "

    JunkBuster web site

    \n" - "

    Proxy configuration

    \n" - "

    Look up a URL

    \n" - "\n" - "\n"; +#ifdef FEATURE_FAST_REDIRECTS /********************************************************************* * - * Function : intercept_url + * Function : get_last_url * - * Description : checks the URL `basename' against a list of URLs to - * snarf. If it matches, it calls the associated function - * which returns an HTML page to send back to the client. - * Right now, we snarf: - * "show-proxy-args", and - * "ij-untrusted-url" (optional w/TRUST_FILES) + * Description : Search for the last URL inside a string. + * If the string already is a URL, it will + * be the first URL found. * * Parameters : - * 1 : http = http_request request, check `basename's of blocklist - * 2 : csp = Current client state (buffers, headers, etc...) + * 1 : subject = the string to check + * 2 : redirect_mode = +fast-redirect{} mode * - * Returns : 1 if it intercepts & handles the request. + * Returns : NULL if no URL was found, or + * the last URL found. * *********************************************************************/ -int intercept_url(struct http_request *http, struct client_state *csp) +char *get_last_url(char *subject, const char *redirect_mode) { - char *basename = NULL; - const struct interceptors *v; + char *new_url = NULL; + char *tmp; + + assert(subject); + assert(redirect_mode); - if (0 == strcmpic(http->host,"i.j.b")) + subject = strdup(subject); + if (subject == NULL) { + log_error(LOG_LEVEL_ERROR, "Out of memory while searching for redirects."); + return NULL; + } + + if (0 == strcmpic(redirect_mode, "check-decoded-url") && strchr(subject, '%')) + { + char *url_segment = NULL; + char **url_segments; + size_t max_segments; + int segments; + + log_error(LOG_LEVEL_REDIRECTS, + "Checking \"%s\" for encoded redirects.", subject); + /* - * Catch http://i.j.b/... + * Check each parameter in the URL separately. + * Sectionize the URL at "?" and "&", + * go backwards through the segments, URL-decode them + * and look for a URL in the decoded result. + * Stop the search after the first match. + * + * XXX: This estimate is guaranteed to be high enough as we + * let ssplit() ignore empty fields, but also a bit wasteful. */ - basename = http->path; + max_segments = strlen(subject) / 2; + url_segments = malloc(max_segments * sizeof(char *)); + + if (NULL == url_segments) + { + log_error(LOG_LEVEL_ERROR, + "Out of memory while decoding URL: %s", subject); + freez(subject); + return NULL; + } + + segments = ssplit(subject, "?&", url_segments, max_segments); + + while (segments-- > 0) + { + char *dtoken = url_decode(url_segments[segments]); + if (NULL == dtoken) + { + log_error(LOG_LEVEL_ERROR, "Unable to decode \"%s\".", url_segments[segments]); + continue; + } + url_segment = strstr(dtoken, "http://"); + if (NULL == url_segment) + { + url_segment = strstr(dtoken, "https://"); + } + if (NULL != url_segment) + { + url_segment = strdup(url_segment); + freez(dtoken); + if (url_segment == NULL) + { + log_error(LOG_LEVEL_ERROR, + "Out of memory while searching for redirects."); + return NULL; + } + break; + } + freez(dtoken); + } + freez(subject); + freez(url_segments); + + if (url_segment == NULL) + { + return NULL; + } + subject = url_segment; + } + else + { + /* Look for a URL inside this one, without decoding anything. */ + log_error(LOG_LEVEL_REDIRECTS, + "Checking \"%s\" for unencoded redirects.", subject); + } + + /* + * Find the last URL encoded in the request + */ + tmp = subject; + while ((tmp = strstr(tmp, "http://")) != NULL) + { + new_url = tmp++; + } + tmp = (new_url != NULL) ? new_url : subject; + while ((tmp = strstr(tmp, "https://")) != NULL) + { + new_url = tmp++; } - else if ( ( (0 == strcmpic(http->host,"ijbswa.sourceforge.net")) - || (0 == strcmpic(http->host,"ijbswa.sf.net")) ) - && (0 == strncmpic(http->path,"/config", 7)) - && ((http->path[7] == '/') || (http->path[7] == '\0'))) + + if ((new_url != NULL) + && ( (new_url != subject) + || (0 == strncmpic(subject, "http://", 7)) + || (0 == strncmpic(subject, "https://", 8)) + )) { /* - * Catch http://ijbswa.sourceforge.net/config/... - * and http://ijbswa.sf.net/config/... + * Return new URL if we found a redirect + * or if the subject already was a URL. + * + * The second case makes sure that we can + * chain get_last_url after another redirection check + * (like rewrite_url) without losing earlier redirects. */ - basename = http->path + 7; + new_url = strdup(new_url); + freez(subject); + return new_url; } - if (!basename) + freez(subject); + return NULL; + +} +#endif /* def FEATURE_FAST_REDIRECTS */ + + +/********************************************************************* + * + * Function : redirect_url + * + * Description : Checks if Privoxy should answer the request with + * a HTTP redirect and generates the redirect if + * necessary. + * + * Parameters : + * 1 : csp = Current client state (buffers, headers, etc...) + * + * Returns : NULL if the request can pass, HTTP redirect otherwise. + * + *********************************************************************/ +struct http_response *redirect_url(struct client_state *csp) +{ + struct http_response *rsp; +#ifdef FEATURE_FAST_REDIRECTS + /* + * XXX: Do we still need FEATURE_FAST_REDIRECTS + * as compile-time option? The user can easily disable + * it in his action file. + */ + char * redirect_mode; +#endif /* def FEATURE_FAST_REDIRECTS */ + char *old_url = NULL; + char *new_url = NULL; + char *redirection_string; + + if ((csp->action->flags & ACTION_REDIRECT)) { - /* Don't want to intercept */ - return(0); - } + redirection_string = csp->action->string[ACTION_STRING_REDIRECT]; - /* We have intercepted it. */ + /* + * If the redirection string begins with 's', + * assume it's a pcrs command, otherwise treat it as + * properly formatted URL and use it for the redirection + * directly. + * + * According to RFC 2616 section 14.30 the URL + * has to be absolute and if the user tries: + * +redirect{shit/this/will/be/parsed/as/pcrs_command.html} + * she would get undefined results anyway. + * + */ - /* remove any leading slash */ - if (*basename == '/') + if (*redirection_string == 's') + { + old_url = csp->http->url; + new_url = rewrite_url(old_url, redirection_string); + } + else + { + log_error(LOG_LEVEL_REDIRECTS, + "No pcrs command recognized, assuming that \"%s\" is already properly formatted.", + redirection_string); + new_url = strdup(redirection_string); + } + } + +#ifdef FEATURE_FAST_REDIRECTS + if ((csp->action->flags & ACTION_FAST_REDIRECTS)) { - basename++; + redirect_mode = csp->action->string[ACTION_STRING_FAST_REDIRECTS]; + + /* + * If it exists, use the previously rewritten URL as input + * otherwise just use the old path. + */ + old_url = (new_url != NULL) ? new_url : strdup(csp->http->path); + new_url = get_last_url(old_url, redirect_mode); + freez(old_url); } - log_error(LOG_LEVEL_GPC, "%s%s intercepted!", http->hostport, http->path); - log_error(LOG_LEVEL_CLF, "%s - - [%T] \"%s\" 200 3", - csp->ip_addr_str, http->cmd); + /* + * Disable redirect checkers, so that they + * will be only run more than once if the user + * also enables them through tags. + * + * From a performance point of view + * it doesn't matter, but the duplicated + * log messages are annoying. + */ + csp->action->flags &= ~ACTION_FAST_REDIRECTS; +#endif /* def FEATURE_FAST_REDIRECTS */ + csp->action->flags &= ~ACTION_REDIRECT; - for (v = intercept_patterns; v->str; v++) + /* Did any redirect action trigger? */ + if (new_url) { - if (strncmp(basename, v->str, v->len) == 0) + if (url_requires_percent_encoding(new_url)) { - char * p = ((v->interceptor)(http, csp)); + char *encoded_url; + log_error(LOG_LEVEL_REDIRECTS, "Percent-encoding redirect URL: %N", + strlen(new_url), new_url); + encoded_url = percent_encode_url(new_url); + freez(new_url); + if (encoded_url == NULL) + { + return cgi_error_memory(); + } + new_url = encoded_url; + assert(FALSE == url_requires_percent_encoding(new_url)); + } + + if (0 == strcmpic(new_url, csp->http->url)) + { + log_error(LOG_LEVEL_ERROR, + "New URL \"%s\" and old URL \"%s\" are the same. Redirection loop prevented.", + csp->http->url, new_url); + freez(new_url); + } + else + { + log_error(LOG_LEVEL_REDIRECTS, "New URL is: %s", new_url); - if (p != NULL) + if (NULL == (rsp = alloc_http_response())) { - /* Send HTML redirection result */ - write_socket(csp->cfd, p, strlen(p)); + freez(new_url); + return cgi_error_memory(); + } - freez(p); + if (enlist_unique_header(rsp->headers, "Location", new_url) + || (NULL == (rsp->status = strdup("302 Local Redirect from Privoxy")))) + { + freez(new_url); + free_http_response(rsp); + return cgi_error_memory(); } - return(1); + rsp->crunch_reason = REDIRECTED; + freez(new_url); + + return finish_http_response(csp, rsp); } } - write_socket(csp->cfd, C_HOME_PAGE, strlen(C_HOME_PAGE)); + /* Only reached if no redirect is required */ + return NULL; - return(1); } -#ifdef FAST_REDIRECTS + +#ifdef FEATURE_IMAGE_BLOCKING /********************************************************************* * - * Function : redirect_url + * Function : is_imageurl * - * Description : Checks for redirection URLs and returns a HTTP redirect - * to the destination URL. + * Description : Given a URL, decide whether it is an image or not, + * using either the info from a previous +image action + * or, #ifdef FEATURE_IMAGE_DETECT_MSIE, and the browser + * is MSIE and not on a Mac, tell from the browser's accept + * header. * * Parameters : - * 1 : http = http_request request, check `basename's of blocklist - * 2 : csp = Current client state (buffers, headers, etc...) + * 1 : csp = Current client state (buffers, headers, etc...) * - * Returns : NULL if URL was clean, HTTP redirect otherwise. + * Returns : True (nonzero) if URL is an image, false (0) + * otherwise * *********************************************************************/ -char *redirect_url(struct http_request *http, struct client_state *csp) +int is_imageurl(const struct client_state *csp) { - char *p, *q; +#ifdef FEATURE_IMAGE_DETECT_MSIE + char *tmp; - p = q = csp->http->path; - log_error(LOG_LEVEL_REDIRECTS, "checking path: %s", p); - - /* find the last URL encoded in the request */ - while (p = strstr(p, "http://")) + tmp = get_header_value(csp->headers, "User-Agent:"); + if (tmp && strstr(tmp, "MSIE") && !strstr(tmp, "Mac_")) { - q = p++; + tmp = get_header_value(csp->headers, "Accept:"); + if (tmp && strstr(tmp, "image/gif")) + { + /* Client will accept HTML. If this seems counterintuitive, + * blame Microsoft. + */ + return(0); + } + else + { + return(1); + } } +#endif /* def FEATURE_IMAGE_DETECT_MSIE */ - /* if there was any, generate and return a HTTP redirect */ - if (q != csp->http->path) - { - log_error(LOG_LEVEL_REDIRECTS, "redirecting to: %s", q); - - p = (char *)malloc(strlen(HTTP_REDIRECT_TEMPLATE) + strlen(q)); - sprintf(p, HTTP_REDIRECT_TEMPLATE, q); - return(p); - } - else - { - return(NULL); - } + return ((csp->action->flags & ACTION_IMAGE) != 0); } -#endif /* def FAST_REDIRECTS */ +#endif /* def FEATURE_IMAGE_BLOCKING */ + +#ifdef FEATURE_TRUST /********************************************************************* * - * Function : url_permissions + * Function : is_untrusted_url * - * Description : Gets the permissions for this URL. + * Description : Should we "distrust" this URL (and block it)? + * + * Yes if it matches a line in the trustfile, or if the + * referrer matches a line starting with "+" in the + * trustfile. + * No otherwise. * * Parameters : - * 1 : http = http_request request for blocked URLs - * 2 : csp = Current client state (buffers, headers, etc...) + * 1 : csp = Current client state (buffers, headers, etc...) * - * Returns : permissions bitmask specifiying what this URL can do. - * If not on list, will be default_permissions. + * Returns : 0 => trusted, 1 => untrusted * *********************************************************************/ -int url_permissions(struct http_request *http, struct client_state *csp) +int is_untrusted_url(const struct client_state *csp) { struct file_list *fl; - struct permissions_spec *b; - struct url_spec url[1]; - int permissions = csp->config->default_permissions; + struct block_spec *b; + struct url_spec **trusted_url; + struct http_request rhttp[1]; + const char * referer; + jb_err err; - if (((fl = csp->permissions_list) == NULL) || ((b = fl->f) == NULL)) + /* + * If we don't have a trustlist, we trust everybody + */ + if (((fl = csp->tlist) == NULL) || ((b = fl->f) == NULL)) { - return(permissions); + return 0; } - *url = dsplit(http->host); + memset(rhttp, '\0', sizeof(*rhttp)); - /* if splitting the domain fails, punt */ - if (url->dbuf == NULL) + /* + * Do we trust the request URL itself? + */ + for (b = b->next; b ; b = b->next) { - return(permissions); + if (url_match(b->url, csp->http)) + { + return b->reject; + } } - for (b = b->next; NULL != b; b = b->next) + if (NULL == (referer = get_header_value(csp->headers, "Referer:"))) + { + /* no referrer was supplied */ + return 1; + } + + + /* + * If not, do we maybe trust its referrer? + */ + err = parse_http_url(referer, rhttp, REQUIRE_PROTOCOL); + if (err) + { + return 1; + } + + for (trusted_url = csp->config->trust_list; *trusted_url != NULL; trusted_url++) { - if ((b->url->port == 0) || (b->url->port == http->port)) + if (url_match(*trusted_url, rhttp)) { - if ((b->url->domain[0] == '\0') || (domaincmp(b->url, url) == 0)) + /* if the URL's referrer is from a trusted referrer, then + * add the target spec to the trustfile as an unblocked + * domain and return 0 (which means it's OK). + */ + + FILE *fp; + + if (NULL != (fp = fopen(csp->config->trustfile, "a"))) { - if ((b->url->path == NULL) || -#ifdef REGEX - (regexec(b->url->preg, http->path, 0, NULL, 0) == 0) -#else - (strncmp(b->url->path, http->path, b->url->pathlen) == 0) -#endif - ) + char * path; + char * path_end; + char * new_entry = strdup("~"); + + string_append(&new_entry, csp->http->hostport); + + path = csp->http->path; + if ( (path[0] == '/') + && (path[1] == '~') + && ((path_end = strchr(path + 2, '/')) != NULL)) + { + /* since this path points into a user's home space + * be sure to include this spec in the trustfile. + */ + long path_len = path_end - path; /* save offset */ + path = strdup(path); /* Copy string */ + if (path != NULL) + { + path_end = path + path_len; /* regenerate ptr to new buffer */ + *(path_end + 1) = '\0'; /* Truncate path after '/' */ + } + string_join(&new_entry, path); + } + + /* + * Give a reason for generating this entry. + */ + string_append(&new_entry, " # Trusted referrer was: "); + string_append(&new_entry, referer); + + if (new_entry != NULL) { - permissions &= b->mask; - permissions |= b->add; + if (-1 == fprintf(fp, "%s\n", new_entry)) + { + log_error(LOG_LEVEL_ERROR, "Failed to append \'%s\' to trustfile \'%s\': %E", + new_entry, csp->config->trustfile); + } + freez(new_entry); } + else + { + /* FIXME: No way to handle out-of memory, so mostly ignoring it */ + log_error(LOG_LEVEL_ERROR, "Out of memory adding pattern to trust file"); + } + + fclose(fp); + } + else + { + log_error(LOG_LEVEL_ERROR, "Failed to append new entry for \'%s\' to trustfile \'%s\': %E", + csp->http->hostport, csp->config->trustfile); } + return 0; } } - freez(url->dbuf); - freez(url->dvec); - return(permissions); - + return 1; } +#endif /* def FEATURE_TRUST */ /********************************************************************* * - * Function : forward_url + * Function : pcrs_filter_response * - * Description : Should we forward this to another proxy? + * Description : Execute all text substitutions from all applying + * +filter actions on the text buffer that's been + * accumulated in csp->iob->buf. * * Parameters : - * 1 : http = http_request request for current URL - * 2 : csp = Current client state (buffers, headers, etc...) + * 1 : csp = Current client state (buffers, headers, etc...) * - * Returns : Return gw_default for no forward match, - * else a gateway pointer to a specific forwarding proxy. + * Returns : a pointer to the (newly allocated) modified buffer. + * or NULL if there were no hits or something went wrong * *********************************************************************/ -const struct gateway *forward_url(struct http_request *http, struct client_state *csp) +static char *pcrs_filter_response(struct client_state *csp) { + int hits = 0; + int i; + size_t size, prev_size; + + char *old = NULL; + char *new = NULL; + pcrs_job *job; + struct file_list *fl; - struct forward_spec *b; - struct url_spec url[1]; + struct re_filterfile_spec *b; + struct list_entry *filtername; - if (((fl = csp->flist) == NULL) || ((b = fl->f) == NULL)) + /* + * Sanity first + */ + if (csp->iob->cur >= csp->iob->eod) { - return(gw_default); + return(NULL); } - *url = dsplit(http->host); + if (filters_available(csp) == FALSE) + { + log_error(LOG_LEVEL_ERROR, "Inconsistent configuration: " + "content filtering enabled, but no content filters available."); + return(NULL); + } - /* if splitting the domain fails, punt */ - if (url->dbuf == NULL) return(gw_default); + size = (size_t)(csp->iob->eod - csp->iob->cur); + old = csp->iob->cur; - for (b = b->next; b ; b = b->next) + for (i = 0; i < MAX_AF_FILES; i++) + { + fl = csp->rlist[i]; + if ((NULL == fl) || (NULL == fl->f)) + { + /* + * Either there are no filter files + * left, or this filter file just + * contains no valid filters. + * + * Continue to be sure we don't miss + * valid filter files that are chained + * after empty or invalid ones. + */ + continue; + } + /* + * For all applying +filter actions, look if a filter by that + * name exists and if yes, execute it's pcrs_joblist on the + * buffer. + */ + for (b = fl->f; b; b = b->next) { - if ((b->url->port == 0) || (b->url->port == http->port)) + if (b->type != FT_CONTENT_FILTER) + { + /* Skip header filters */ + continue; + } + + for (filtername = csp->action->multi[ACTION_MULTI_FILTER]->first; + filtername ; filtername = filtername->next) { - if ((b->url->domain[0] == '\0') || (domaincmp(b->url, url) == 0)) + if (strcmp(b->name, filtername->str) == 0) { - if ((b->url->path == NULL) || -#ifdef REGEX - (regexec(b->url->preg, http->path, 0, NULL, 0) == 0) -#else - (strncmp(b->url->path, http->path, b->url->pathlen) == 0) -#endif - ) + int current_hits = 0; /* Number of hits caused by this filter */ + int job_number = 0; /* Which job we're currently executing */ + int job_hits = 0; /* How many hits the current job caused */ + pcrs_job *joblist = b->joblist; + + if (b->dynamic) joblist = compile_dynamic_pcrs_job_list(csp, b); + + if (NULL == joblist) + { + log_error(LOG_LEVEL_RE_FILTER, "Filter %s has empty joblist. Nothing to do.", b->name); + continue; + } + + prev_size = size; + /* Apply all jobs from the joblist */ + for (job = joblist; NULL != job; job = job->next) { - freez(url->dbuf); - freez(url->dvec); - return(b->gw); + job_number++; + job_hits = pcrs_execute(job, old, size, &new, &size); + + if (job_hits >= 0) + { + /* + * That went well. Continue filtering + * and use the result of this job as + * input for the next one. + */ + current_hits += job_hits; + if (old != csp->iob->cur) + { + freez(old); + } + old = new; + } + else + { + /* + * This job caused an unexpected error. Inform the user + * and skip the rest of the jobs in this filter. We could + * continue with the next job, but usually the jobs + * depend on each other or are similar enough to + * fail for the same reason. + * + * At the moment our pcrs expects the error codes of pcre 3.4, + * but newer pcre versions can return additional error codes. + * As a result pcrs_strerror()'s error message might be + * "Unknown error ...", therefore we print the numerical value + * as well. + * + * XXX: Is this important enough for LOG_LEVEL_ERROR or + * should we use LOG_LEVEL_RE_FILTER instead? + */ + log_error(LOG_LEVEL_ERROR, "Skipped filter \'%s\' after job number %u: %s (%d)", + b->name, job_number, pcrs_strerror(job_hits), job_hits); + break; + } } + + if (b->dynamic) pcrs_free_joblist(joblist); + + log_error(LOG_LEVEL_RE_FILTER, + "filtering %s%s (size %d) with \'%s\' produced %d hits (new size %d).", + csp->http->hostport, csp->http->path, prev_size, b->name, current_hits, size); + + hits += current_hits; } } } + } - freez(url->dbuf); - freez(url->dvec); - return(gw_default); + /* + * If there were no hits, destroy our copy and let + * chat() use the original in csp->iob + */ + if (!hits) + { + freez(new); + return(NULL); + } + + csp->flags |= CSP_FLAG_MODIFIED; + csp->content_length = size; + clear_iob(csp->iob); + + return(new); + +} + + +/********************************************************************* + * + * Function : gif_deanimate_response + * + * Description : Deanimate the GIF image that has been accumulated in + * csp->iob->buf, set csp->content_length to the modified + * size and raise the CSP_FLAG_MODIFIED flag. + * + * Parameters : + * 1 : csp = Current client state (buffers, headers, etc...) + * + * Returns : a pointer to the (newly allocated) modified buffer. + * or NULL in case something went wrong. + * + *********************************************************************/ +static char *gif_deanimate_response(struct client_state *csp) +{ + struct binbuffer *in, *out; + char *p; + size_t size; + + size = (size_t)(csp->iob->eod - csp->iob->cur); + + if ( (NULL == (in = (struct binbuffer *)zalloc(sizeof *in ))) + || (NULL == (out = (struct binbuffer *)zalloc(sizeof *out))) ) + { + log_error(LOG_LEVEL_DEANIMATE, "failed! (no mem)"); + return NULL; + } + + in->buffer = csp->iob->cur; + in->size = size; + + if (gif_deanimate(in, out, strncmp("last", csp->action->string[ACTION_STRING_DEANIMATE], 4))) + { + log_error(LOG_LEVEL_DEANIMATE, "failed! (gif parsing)"); + freez(in); + buf_free(out); + return(NULL); + } + else + { + if ((int)size == out->offset) + { + log_error(LOG_LEVEL_DEANIMATE, "GIF not changed."); + } + else + { + log_error(LOG_LEVEL_DEANIMATE, "Success! GIF shrunk from %d bytes to %d.", size, out->offset); + } + csp->content_length = out->offset; + csp->flags |= CSP_FLAG_MODIFIED; + p = out->buffer; + freez(in); + freez(out); + return(p); + } } /********************************************************************* * - * Function : dsplit + * Function : get_filter_function * - * Description : Takes a domain and returns a pointer to a url_spec - * structure populated with dbuf, dcnt and dvec. The - * other fields in the structure that is returned are zero. + * Description : Decides which content filter function has + * to be applied (if any). * * Parameters : - * 1 : domain = a URL address + * 1 : csp = Current client state (buffers, headers, etc...) * - * Returns : url_spec structure populated with dbuf, dcnt and dvec. + * Returns : The content filter function to run, or + * NULL if no content filter is active * *********************************************************************/ -struct url_spec dsplit(char *domain) +static filter_function_ptr get_filter_function(const struct client_state *csp) { - struct url_spec ret[1]; - char *v[BUFSIZ]; - int size; - char *p; - - memset(ret, '\0', sizeof(*ret)); - - ret->unanchored = (domain[strlen(domain) - 1] == '.'); + filter_function_ptr filter_function = NULL; - ret->dbuf = strdup(domain); - - /* map to lower case */ - for (p = ret->dbuf; *p ; p++) *p = tolower(*p); - - /* split the domain name into components */ - ret->dcnt = ssplit(ret->dbuf, ".", v, SZ(v), 1, 1); - - if (ret->dcnt <= 0) + /* + * Choose the applying filter function based on + * the content type and action settings. + */ + if ((csp->content_type & CT_TEXT) && + (csp->rlist != NULL) && + (!list_is_empty(csp->action->multi[ACTION_MULTI_FILTER]))) { - memset(ret, '\0', sizeof(ret)); - return(*ret); + filter_function = pcrs_filter_response; } - - /* save a copy of the pointers in dvec */ - size = ret->dcnt * sizeof(*ret->dvec); - - if ((ret->dvec = (char **)malloc(size))) + else if ((csp->content_type & CT_GIF) && + (csp->action->flags & ACTION_DEANIMATE)) { - memcpy(ret->dvec, v, size); + filter_function = gif_deanimate_response; } - - return(*ret); - + return filter_function; } /********************************************************************* * - * Function : domaincmp - * - * Description : Compare domain names. - * domaincmp("a.b.c", "a.b.c") => 0 (MATCH) - * domaincmp("a*.b.c", "a.b.c") => 0 (MATCH) - * domaincmp("a*.b.c", "abc.b.c") => 0 (MATCH) - * domaincmp("a*c.b.c","abbc.b.c") => 0 (MATCH) - * domaincmp("*a.b.c", "dabc.b.c") => 0 (MATCH) - * domaincmp("b.c" , "a.b.c") => 0 (MATCH) - * domaincmp("a.b" , "a.b.c") => 1 (DIFF) - * domaincmp("a.b." , "a.b.c") => 0 (MATCH) - * domaincmp("" , "a.b.c") => 0 (MATCH) - * - * FIXME: I need a definition! + * Function : remove_chunked_transfer_coding + * + * Description : In-situ remove the "chunked" transfer coding as defined + * in rfc2616 from a buffer. * * Parameters : - * 1 : pattern = a domain that may contain a '*' as a wildcard. - * 2 : fqdn = domain name against which the patterns are compared. + * 1 : buffer = Pointer to the text buffer + * 2 : size = In: Number of bytes to be processed, + * Out: Number of bytes after de-chunking. + * (undefined in case of errors) * - * Returns : 0 => domains are equivalent, else no match. + * Returns : JB_ERR_OK for success, + * JB_ERR_PARSE otherwise * *********************************************************************/ -int domaincmp(struct url_spec *pattern, struct url_spec *fqdn) +static jb_err remove_chunked_transfer_coding(char *buffer, size_t *size) { - char **pv, **fv; /* vectors */ - int pn, fn; /* counters */ - char *p, *f; /* chars */ + size_t newsize = 0; + unsigned int chunksize = 0; + char *from_p, *to_p; - pv = pattern->dvec; - fv = fqdn->dvec; - fn = pn = 0; + assert(buffer); + from_p = to_p = buffer; + + if (sscanf(buffer, "%x", &chunksize) != 1) + { + log_error(LOG_LEVEL_ERROR, "Invalid first chunksize while stripping \"chunked\" transfer coding"); + return JB_ERR_PARSE; + } - while (fn < fqdn->dcnt && pn < pattern->dcnt) + while (chunksize > 0U) { - p = pv[pn]; - f = fv[fn]; + if (NULL == (from_p = strstr(from_p, "\r\n"))) + { + log_error(LOG_LEVEL_ERROR, "Parse error while stripping \"chunked\" transfer coding"); + return JB_ERR_PARSE; + } - if (trivimatch(p, f)) + if (chunksize >= *size - newsize) { - if(pn) - { - return 1; - } + log_error(LOG_LEVEL_ERROR, + "Chunk size %u exceeds buffered data left. " + "Already digested %u of %u buffered bytes.", + chunksize, (unsigned int)newsize, (unsigned int)*size); + return JB_ERR_PARSE; } - else + newsize += chunksize; + from_p += 2; + + memmove(to_p, from_p, (size_t) chunksize); + to_p = buffer + newsize; + from_p += chunksize + 2; + + if (sscanf(from_p, "%x", &chunksize) != 1) { - pn++; + log_error(LOG_LEVEL_INFO, "Invalid \"chunked\" transfer encoding detected and ignored."); + break; } - fn++; } - return ((pn < pattern->dcnt) || ((fn < fqdn->dcnt) && !pattern->unanchored)); + /* XXX: Should get its own loglevel. */ + log_error(LOG_LEVEL_RE_FILTER, "De-chunking successful. Shrunk from %d to %d", *size, newsize); -} + *size = newsize; + + return JB_ERR_OK; +} -/* intercept functions */ /********************************************************************* * - * Function : show_proxy_args + * Function : prepare_for_filtering * - * Description : This "crunch"es "http:/any.thing/show-proxy-args" and - * returns a web page describing the current status of IJB. + * Description : If necessary, de-chunks and decompresses + * the content so it can get filterd. * * Parameters : - * 1 : http = ignored - * 2 : csp = Current client state (buffers, headers, etc...) + * 1 : csp = Current client state (buffers, headers, etc...) * - * Returns : A string that contains the current status of IJB. + * Returns : JB_ERR_OK for success, + * JB_ERR_PARSE otherwise * *********************************************************************/ -char *show_proxy_args(struct http_request *http, struct client_state *csp) +static jb_err prepare_for_filtering(struct client_state *csp) { - char *s = NULL; - -#ifdef SPLIT_PROXY_ARGS - FILE * fp; - char buf[BUFSIZ]; - char * p; - const char * filename = NULL; - const char * file_description = NULL; - char * query_string = strrchr(http->path, '?'); - char which_file = '\0'; + jb_err err = JB_ERR_OK; - - if (query_string != NULL) - { - /* first char past the last '?' (maybe '\0')*/ - which_file = query_string[1]; - } - switch (which_file) + /* + * If the body has a "chunked" transfer-encoding, + * get rid of it, adjusting size and iob->eod + */ + if (csp->flags & CSP_FLAG_CHUNKED) { - case 'p': - if (csp->permissions_list) + size_t size = (size_t)(csp->iob->eod - csp->iob->cur); + + log_error(LOG_LEVEL_RE_FILTER, "Need to de-chunk first"); + err = remove_chunked_transfer_coding(csp->iob->cur, &size); + if (JB_ERR_OK == err) { - filename = csp->permissions_list->filename; - file_description = "Permissions List"; + csp->iob->eod = csp->iob->cur + size; + csp->flags |= CSP_FLAG_MODIFIED; } - break; - case 'f': - if (csp->flist) + else { - filename = csp->flist->filename; - file_description = "Forward List"; + return JB_ERR_PARSE; } - break; + } -#ifdef ACL_FILES - case 'a': - if (csp->alist) +#ifdef FEATURE_ZLIB + /* + * If the body has a supported transfer-encoding, + * decompress it, adjusting size and iob->eod. + */ + if (csp->content_type & (CT_GZIP|CT_DEFLATE)) + { + if (0 == csp->iob->eod - csp->iob->cur) { - filename = csp->alist->filename; - file_description = "Access Control List"; + /* Nothing left after de-chunking. */ + return JB_ERR_OK; } - break; -#endif /* def ACL_FILES */ -#ifdef PCRS - case 'r': - if (csp->rlist) - { - filename = csp->rlist->filename; - file_description = "RE Filter List"; - } - break; -#endif /* def PCRS */ + err = decompress_iob(csp); -#ifdef TRUST_FILES - case 't': - if (csp->tlist) - { - filename = csp->tlist->filename; - file_description = "Trust List"; - } - break; -#endif /* def TRUST_FILES */ - } - - if (filename) - { - /* Display specified file */ - /* FIXME: Add HTTP headers so this isn't cached */ - s = strsav(s, - "HTTP/1.0 200 OK\n" - "Server: IJ/" VERSION "\n" - "Content-type: text/html\n" - "Pragma: no-cache\n" - "Last-Modified: Thu Jul 31, 1997 07:42:22 pm GMT\n" - "Expires: Thu Jul 31, 1997 07:42:22 pm GMT\n" - "\n" - - "" - "" - "Internet Junkbuster Proxy Status - "); - s = strsav(s, file_description); - s = strsav(s, - "" - "\n" - "\n" - "
    \n" - "

    " BANNER "\n"); - s = strsav(s, file_description); - s = strsav(s, - "

    \n" - "

    Back to proxy status

    \n" - "

    "); - s = strsav(s, file_description); - s = strsav(s, - "

    \n" - "Contents of file ""); - p = html_encode(filename); - s = strsav(s, p); - freez(p); - s = strsav(s, - "":
    \n" - "

    \n" - "
    ");
-      
-      if ((fp = fopen(filename, "r")) == NULL)
+      if (JB_ERR_OK == err)
       {
-         s = strsav(s, "

    ERROR OPENING FILE!

    ");
+         csp->flags |= CSP_FLAG_MODIFIED;
+         csp->content_type &= ~CT_TABOO;
       }
       else
       {
-         while (fgets(buf, sizeof(buf), fp))
-         {
-            p = html_encode(buf);
-            if (p)
-            {
-               s = strsav(s, p);
-               freez(p);
-               s = strsav(s, "
    ");
-            }
-         }
-         fclose(fp);
+         /*
+          * Unset CT_GZIP and CT_DEFLATE to remember not
+          * to modify the Content-Encoding header later.
+          */
+         csp->content_type &= ~CT_GZIP;
+         csp->content_type &= ~CT_DEFLATE;
       }
-
-      s = strsav(s,
-         "
    \n" - "
    \n" - "

    Back to proxy status

    \n" - "
    \n" - "

    \n" - "The " BANNER " Proxy - \n" - "" HOME_PAGE_URL "\n" - "" - "\n"); - return(s); } -#endif /* def SPLIT_PROXY_ARGS */ - - s = strsav(s, csp->config->proxy_args_header); - s = strsav(s, csp->config->proxy_args_invocation); -#ifdef STATISTICS - s = add_stats(s); -#endif /* def STATISTICS */ - s = strsav(s, csp->config->proxy_args_gateways); +#endif -#ifdef SPLIT_PROXY_ARGS - s = strsav(s, - "

    The following files are in use:

    \n" - "

    (Click a filename to view it)

    \n" - "
      \n"); + return err; +} - if (csp->permissions_list) - { - s = strsav(s, "
    • Permissions List: "); - s = strsav(s, csp->permissions_list->filename); - s = strsav(s, "
      • \n"); - } - if (csp->flist) - { - s = strsav(s, "
    • Forward List: "); - s = strsav(s, csp->flist->filename); - s = strsav(s, "
      • \n"); - } +/********************************************************************* + * + * Function : execute_content_filters + * + * Description : Executes a given content filter. + * + * Parameters : + * 1 : csp = Current client state (buffers, headers, etc...) + * + * Returns : Pointer to the modified buffer, or + * NULL if filtering failed or wasn't necessary. + * + *********************************************************************/ +char *execute_content_filters(struct client_state *csp) +{ + filter_function_ptr content_filter; -#ifdef ACL_FILES - if (csp->alist) - { - s = strsav(s, "
    • Access Control List: "); - s = strsav(s, csp->alist->filename); - s = strsav(s, "
      • \n"); - } -#endif /* def ACL_FILES */ + assert(content_filters_enabled(csp->action)); -#ifdef PCRS - if (csp->rlist) + if (0 == csp->iob->eod - csp->iob->cur) { - s = strsav(s, "
    • RE Filter List: "); - s = strsav(s, csp->rlist->filename); - s = strsav(s, "
      • \n"); + /* + * No content (probably status code 301, 302 ...), + * no filtering necessary. + */ + return NULL; } -#endif /* def PCRS */ -#ifdef TRUST_FILES - if (csp->tlist) + if (JB_ERR_OK != prepare_for_filtering(csp)) { - s = strsav(s, "
    • Trust List: "); - s = strsav(s, csp->tlist->filename); - s = strsav(s, "
      • \n"); + /* + * failed to de-chunk or decompress. + */ + return NULL; } -#endif /* def TRUST_FILES */ - s = strsav(s, "
    "); - -#else /* ifndef SPLIT_PROXY_ARGS */ - if (csp->clist) + if (0 == csp->iob->eod - csp->iob->cur) { - s = strsav(s, csp->clist->proxy_args); + /* + * Clown alarm: chunked and/or compressed nothing delivered. + */ + return NULL; } - if (csp->flist) - { - s = strsav(s, csp->flist->proxy_args); - } + content_filter = get_filter_function(csp); -#ifdef ACL_FILES - if (csp->alist) - { - s = strsav(s, csp->alist->proxy_args); - } -#endif /* def ACL_FILES */ + return ((*content_filter)(csp)); +} -#ifdef PCRS - if (csp->rlist) - { - s = strsav(s, csp->rlist->proxy_args); - } -#endif /* def PCRS */ -#ifdef TRUST_FILES - if (csp->tlist) - { - s = strsav(s, csp->tlist->proxy_args); - } -#endif /* def TRUST_FILES */ +/********************************************************************* + * + * Function : get_url_actions + * + * Description : Gets the actions for this URL. + * + * Parameters : + * 1 : csp = Current client state (buffers, headers, etc...) + * 2 : http = http_request request for blocked URLs + * + * Returns : N/A + * + *********************************************************************/ +void get_url_actions(struct client_state *csp, struct http_request *http) +{ + struct file_list *fl; + struct url_actions *b; + int i; -#endif /* ndef SPLIT_PROXY_ARGS */ + init_current_action(csp->action); - s = strsav(s, csp->config->proxy_args_trailer); + for (i = 0; i < MAX_AF_FILES; i++) + { + if (((fl = csp->actions_list[i]) == NULL) || ((b = fl->f) == NULL)) + { + return; + } - return(s); + apply_url_actions(csp->action, http, b); + } + return; } -static const char C_URL_INFO_HEADER[] = - "HTTP/1.0 200 OK\n" - "Pragma: no-cache\n" - "Expires: Thu Jul 31, 1997 07:42:22 pm GMT\n" - "Content-Type: text/html\n\n" - "\n" - "\n" - "Internet Junkbuster: URL Info\n" - "\n" - BODY - "

    " - BANNER - "

    \n" - "

    Information for: http://%s

    \n"; -static const char C_URL_INFO_FOOTER[] = - "\n

    \n" - "\n" - "\n"; - -static const char C_URL_INFO_FORM[] = - "HTTP/1.0 200 OK\n" - "Pragma: no-cache\n" - "Expires: Thu Jul 31, 1997 07:42:22 pm GMT\n" - "Content-Type: text/html\n\n" - "\n" - "\n" - "Internet Junkbuster: URL Info\n" - "\n" - BODY - "

    " - BANNER - "

    \n" - "
    \n" - "

    Please enter a URL, without the leading "http://":

    " - "

    " - "

    \n" - "
    \n" - "\n" - "\n"; - - /********************************************************************* * - * Function : permissions_to_text + * Function : apply_url_actions * - * Description : Converts a permissionsfil entry from numeric form - * ("mask" and "add") to text. + * Description : Applies a list of URL actions. * * Parameters : - * 1 : mask = As from struct permissions_spec - * 2 : add = As from struct permissions_spec + * 1 : action = Destination. + * 2 : http = Current URL + * 3 : b = list of URL actions to apply * - * Returns : A string. Caller must free it. + * Returns : N/A * *********************************************************************/ -char * permissions_to_text(unsigned mask, unsigned add) +void apply_url_actions(struct current_action_spec *action, + struct http_request *http, + struct url_actions *b) { - char * result = strdup(""); - - /* sanity - prevents "-feature +feature" */ - mask |= add; - -#define PERMISSION_TO_TEXT(__bit, __name) \ - if (!(mask & __bit)) \ - { \ - result = strsav(result, " -" __name); \ - } \ - else if (add & __bit) \ - { \ - result = strsav(result, " +" __name); \ - } - - PERMISSION_TO_TEXT(PERMIT_COOKIE_SET, "cookies-set"); - PERMISSION_TO_TEXT(PERMIT_COOKIE_READ, "cookies-read"); - PERMISSION_TO_TEXT(PERMIT_RE_FILTER, "filter"); - PERMISSION_TO_TEXT(PERMIT_POPUPS, "popup"); - PERMISSION_TO_TEXT(PERMIT_REFERER, "referer"); - PERMISSION_TO_TEXT(PERMIT_FAST_REDIRECTS, "fast-redirects"); - PERMISSION_TO_TEXT(PERMIT_BLOCK, "block"); - PERMISSION_TO_TEXT(PERMIT_IMAGE, "image"); - - return result; + if (b == NULL) + { + /* Should never happen */ + return; + } + + for (b = b->next; NULL != b; b = b->next) + { + if (url_match(b->url, http)) + { + merge_current_action(action, b->action); + } + } } - /********************************************************************* +/********************************************************************* + * + * Function : get_forward_override_settings + * + * Description : Returns forward settings as specified with the + * forward-override{} action. forward-override accepts + * forward lines similar to the one used in the + * configuration file, but without the URL pattern. * - * Function : ijb_show_url_info + * For example: * - * Description : (please fill me in) + * forward / . + * + * in the configuration file can be replaced with + * the action section: + * + * {+forward-override{forward .}} + * / * * Parameters : - * 1 : http = http_request request for crunched URL - * 2 : csp = Current client state (buffers, headers, etc...) + * 1 : csp = Current client state (buffers, headers, etc...) * - * Returns : ???FIXME + * Returns : Pointer to forwarding structure in case of success. + * Invalid syntax is fatal. * *********************************************************************/ -char *ijb_show_url_info(struct http_request *http, struct client_state *csp) +const static struct forward_spec *get_forward_override_settings(struct client_state *csp) { - char * query_string = strchr(http->path, '?'); - char * host = NULL; - - if (query_string != NULL) + const char *forward_override_line = csp->action->string[ACTION_STRING_FORWARD_OVERRIDE]; + char forward_settings[BUFFER_SIZE]; + char *http_parent = NULL; + /* variable names were chosen for consistency reasons. */ + struct forward_spec *fwd = NULL; + int vec_count; + char *vec[3]; + + assert(csp->action->flags & ACTION_FORWARD_OVERRIDE); + /* Should be enforced by load_one_actions_file() */ + assert(strlen(forward_override_line) < sizeof(forward_settings) - 1); + + /* Create a copy ssplit can modify */ + strlcpy(forward_settings, forward_override_line, sizeof(forward_settings)); + + if (NULL != csp->fwd) { - query_string = url_decode(query_string + 1); - if (strncmpic(query_string, "url=", 4) == 0) - { - host = strdup(query_string + 4); - } - freez(query_string); - } - if (host != NULL) - { - char * result; - char * path; - char * s; - int port = 80; - struct file_list *fl; - struct permissions_spec *b; - struct url_spec url[1]; - int permissions = csp->config->default_permissions; - - result = (char *)malloc(sizeof(C_URL_INFO_HEADER) + 2 * strlen(host)); - sprintf(result, C_URL_INFO_HEADER, host, host); - - s = permissions_to_text(permissions, permissions); - result = strsav(result, "

    Defaults:

    \n

    {"); - result = strsav(result, s); - result = strsav(result, " }

    \n

    Patterns affecting the URL:

    \n

    \n"); - freez(s); - - s = strchr(host, '/'); - if (s != NULL) + /* + * XXX: Currently necessary to prevent memory + * leaks when the show-url-info cgi page is visited. + */ + unload_forward_spec(csp->fwd); + } + + /* + * allocate a new forward node, valid only for + * the lifetime of this request. Save its location + * in csp as well, so sweep() can free it later on. + */ + fwd = csp->fwd = zalloc(sizeof(*fwd)); + if (NULL == fwd) + { + log_error(LOG_LEVEL_FATAL, + "can't allocate memory for forward-override{%s}", forward_override_line); + /* Never get here - LOG_LEVEL_FATAL causes program exit */ + return NULL; + } + + vec_count = ssplit(forward_settings, " \t", vec, SZ(vec)); + if ((vec_count == 2) && !strcasecmp(vec[0], "forward")) + { + fwd->type = SOCKS_NONE; + + /* Parse the parent HTTP proxy host:port */ + http_parent = vec[1]; + + } + else if (vec_count == 3) + { + char *socks_proxy = NULL; + + if (!strcasecmp(vec[0], "forward-socks4")) { - path = strdup(s); - *s = '\0'; + fwd->type = SOCKS_4; + socks_proxy = vec[1]; } - else + else if (!strcasecmp(vec[0], "forward-socks4a")) { - path = strdup(""); + fwd->type = SOCKS_4A; + socks_proxy = vec[1]; } - s = strchr(host, ':'); - if (s != NULL) + else if (!strcasecmp(vec[0], "forward-socks5")) { - *s++ = '\0'; - port = atoi(s); + fwd->type = SOCKS_5; + socks_proxy = vec[1]; } - if (((fl = csp->permissions_list) == NULL) || ((b = fl->f) == NULL)) + if (NULL != socks_proxy) { - freez(host); - freez(path); - result = strsav(result, C_URL_INFO_FOOTER); - return result; - } - - *url = dsplit(host); + /* Parse the SOCKS proxy host[:port] */ + fwd->gateway_port = 1080; + parse_forwarder_address(socks_proxy, + &fwd->gateway_host, &fwd->gateway_port); - /* if splitting the domain fails, punt */ - if (url->dbuf == NULL) - { - freez(host); - freez(path); - result = strsav(result, C_URL_INFO_FOOTER); - return result; + http_parent = vec[2]; } + } - for (b = b->next; NULL != b; b = b->next) - { - if ((b->url->port == 0) || (b->url->port == port)) - { - if ((b->url->domain[0] == '\0') || (domaincmp(b->url, url) == 0)) - { - if ((b->url->path == NULL) || -#ifdef REGEX - (regexec(b->url->preg, path, 0, NULL, 0) == 0) -#else - (strncmp(b->url->path, path, b->url->pathlen) == 0) -#endif - ) - { - s = permissions_to_text(b->mask, b->add); - result = strsav(result, "{"); - result = strsav(result, s); - result = strsav(result, " }
    \n"); - result = strsav(result, b->url->spec); - result = strsav(result, "
    \n
    \n"); - freez(s); - permissions &= b->mask; - permissions |= b->add; - } - } - } - } + if (NULL == http_parent) + { + log_error(LOG_LEVEL_FATAL, + "Invalid forward-override syntax in: %s", forward_override_line); + /* Never get here - LOG_LEVEL_FATAL causes program exit */ + } - freez(url->dbuf); - freez(url->dvec); + /* Parse http forwarding settings */ + if (strcmp(http_parent, ".") != 0) + { + fwd->forward_port = 8000; + parse_forwarder_address(http_parent, + &fwd->forward_host, &fwd->forward_port); + } - freez(host); - freez(path); + assert (NULL != fwd); - s = permissions_to_text(permissions, permissions); - result = strsav(result, "

    \n

    Final Results:

    \n

    {"); - result = strsav(result, s); - result = strsav(result, " }
    \n
    \n"); - freez(s); + log_error(LOG_LEVEL_CONNECT, + "Overriding forwarding settings based on \'%s\'", forward_override_line); - result = strsav(result, C_URL_INFO_FOOTER); - return result; - } - else - { - return strdup(C_URL_INFO_FORM); - } + return fwd; } /********************************************************************* * - * Function : ijb_send_banner + * Function : forward_url * - * Description : This "crunch"es "http://i.j.b/ijb-send-banner and - * sends the image. + * Description : Should we forward this to another proxy? * * Parameters : - * 1 : http = http_request request for crunched URL - * 2 : csp = Current client state (buffers, headers, etc...) + * 1 : csp = Current client state (buffers, headers, etc...) + * 2 : http = http_request request for current URL * - * Returns : NULL, indicating that it has already sent the data. + * Returns : Pointer to forwarding information. * *********************************************************************/ -char *ijb_send_banner(struct http_request *http, struct client_state *csp) +const struct forward_spec *forward_url(struct client_state *csp, + const struct http_request *http) { - write_socket(csp->cfd, JBGIF, sizeof(JBGIF)-1); - - return(NULL); + static const struct forward_spec fwd_default[1] = { FORWARD_SPEC_INITIALIZER }; + struct forward_spec *fwd = csp->config->forward; + + if (csp->action->flags & ACTION_FORWARD_OVERRIDE) + { + return get_forward_override_settings(csp); + } + + if (fwd == NULL) + { + return fwd_default; + } + + while (fwd != NULL) + { + if (url_match(fwd->url, http)) + { + return fwd; + } + fwd = fwd->next; + } + + return fwd_default; } -#ifdef TRUST_FILES + /********************************************************************* * - * Function : ij_untrusted_url + * Function : direct_response + * + * Description : Check if Max-Forwards == 0 for an OPTIONS or TRACE + * request and if so, return a HTTP 501 to the client. * - * Description : This "crunch"es "http:/any.thing/ij-untrusted-url" and - * returns a web page describing why it was untrusted. + * FIXME: I have a stupid name and I should handle the + * requests properly. Still, what we do here is rfc- + * compliant, whereas ignoring or forwarding are not. * * Parameters : - * 1 : http = http_request request for crunched URL - * 2 : csp = Current client state (buffers, headers, etc...) + * 1 : csp = Current client state (buffers, headers, etc...) * - * Returns : A string that contains why this was untrusted. + * Returns : http_response if , NULL if nonmatch or handler fail * *********************************************************************/ -char *ij_untrusted_url(struct http_request *http, struct client_state *csp) +struct http_response *direct_response(struct client_state *csp) { - int n; - char *hostport, *path, *refer, *p, *v[9]; - char buf[BUFSIZ]; - struct url_spec **tl, *t; - - - static const char format[] = - "HTTP/1.0 200 OK\r\n" - "Pragma: no-cache\n" - "Last-Modified: Thu Jul 31, 1997 07:42:22 pm GMT\n" - "Expires: Thu Jul 31, 1997 07:42:22 pm GMT\n" - "Content-Type: text/html\n\n" - "\n" - "\n" - "Internet Junkbuster: Request for untrusted URL\n" - "\n" - BODY - "

    " - BANNER - "

    " - "The " BANNER " Proxy " - "" - "(" HOME_PAGE_URL ") " - "intercepted the request for %s%s\n" - "because the URL is not trusted.\n" - "

    \n"; - - if ((n = ssplit(http->path, "?+", v, SZ(v), 0, 0)) == 4) - { - hostport = url_decode(v[1]); - path = url_decode(v[2]); - refer = url_decode(v[3]); - } - else - { - hostport = strdup("undefined_host"); - path = strdup("/undefined_path"); - refer = strdup("undefined"); - } + struct http_response *rsp; + struct list_entry *p; - n = sizeof(format); - n += strlen(hostport); - n += strlen(path ); - - if ((p = (char *)malloc(n))) + if ((0 == strcmpic(csp->http->gpc, "trace")) + || (0 == strcmpic(csp->http->gpc, "options"))) { - sprintf(p, format, hostport, path); - } - - strsav(p, "The referrer in this request was "); - strsav(p, refer); - strsav(p, "
    \n"); - - freez(hostport); - freez(path ); - freez(refer ); - - p = strsav(p, "

    The following referrers are trusted

    \n"); + for (p = csp->headers->first; (p != NULL) ; p = p->next) + { + if (!strncmpic(p->str, "Max-Forwards:", 13)) + { + unsigned int max_forwards; - for (tl = csp->config->trust_list; (t = *tl) ; tl++) - { - sprintf(buf, "%s
    \n", t->spec); - p = strsav(p, buf); - } + /* + * If it's a Max-Forwards value of zero, + * we have to intercept the request. + */ + if (1 == sscanf(p->str+12, ": %u", &max_forwards) && max_forwards == 0) + { + /* + * FIXME: We could handle at least TRACE here, + * but that would require a verbatim copy of + * the request which we don't have anymore + */ + log_error(LOG_LEVEL_HEADER, + "Detected header \'%s\' in OPTIONS or TRACE request. Returning 501.", + p->str); - if (csp->config->trust_info->next) - { - struct list *l; + /* Get mem for response or fail*/ + if (NULL == (rsp = alloc_http_response())) + { + return cgi_error_memory(); + } - strcpy(buf, - "

    " - "You can learn more about what this means " - "and what you may be able to do about it by " - "reading the following documents:
    \n" - "

      \n" - ); + if (NULL == (rsp->status = strdup("501 Not Implemented"))) + { + free_http_response(rsp); + return cgi_error_memory(); + } - p = strsav(p, buf); + rsp->is_static = 1; + rsp->crunch_reason = UNSUPPORTED; - for (l = csp->config->trust_info->next; l ; l = l->next) - { - sprintf(buf, - "
    1. %s
      \n", - l->str, l->str); - p = strsav(p, buf); + return(finish_http_response(csp, rsp)); + } + } } - - p = strsav(p, "
    \n"); } - - p = strsav(p, "\n" "\n"); - - return(p); - + return NULL; } -#endif /* def TRUST_FILES */ -#ifdef STATISTICS /********************************************************************* * - * Function : add_stats + * Function : content_requires_filtering * - * Description : Statistics function of JB. Called by `show_proxy_args'. + * Description : Checks whether there are any content filters + * enabled for the current request and if they + * can actually be applied.. * * Parameters : - * 1 : s = string that holds the proxy args description page + * 1 : csp = Current client state (buffers, headers, etc...) * - * Returns : A pointer to the descriptive status web page. + * Returns : TRUE for yes, FALSE otherwise * *********************************************************************/ -char *add_stats(char *s) +int content_requires_filtering(struct client_state *csp) { + if ((csp->content_type & CT_TABOO) + && !(csp->action->flags & ACTION_FORCE_TEXT_MODE)) + { + return FALSE; + } + /* - * Output details of the number of requests rejected and - * accepted. This is switchable in the junkbuster config. - * Does nothing if this option is not enabled. + * Are we enabling text mode by force? */ + if (csp->action->flags & ACTION_FORCE_TEXT_MODE) + { + /* + * Do we really have to? + */ + if (csp->content_type & CT_TEXT) + { + log_error(LOG_LEVEL_HEADER, "Text mode is already enabled."); + } + else + { + csp->content_type |= CT_TEXT; + log_error(LOG_LEVEL_HEADER, "Text mode enabled by force. Take cover!"); + } + } - float perc_rej; /* Percentage of http requests rejected */ - char out_str[81]; - int local_urls_read = urls_read; - int local_urls_rejected = urls_rejected; + if (!(csp->content_type & CT_DECLARED)) + { + /* + * The server didn't bother to declare a MIME-Type. + * Assume it's text that can be filtered. + * + * This also regulary happens with 304 responses, + * therefore logging anything here would cause + * too much noise. + */ + csp->content_type |= CT_TEXT; + } /* - * Need to alter the stats not to include the fetch of this - * page. - * - * Can't do following thread safely! doh! - * - * urls_read--; - * urls_rejected--; * This will be incremented subsequently * + * Choose the applying filter function based on + * the content type and action settings. */ - - s = strsav(s,"

    Statistics for this " BANNER ":

    \n"); - - if (local_urls_read == 0) + if ((csp->content_type & CT_TEXT) && + (csp->rlist != NULL) && + (!list_is_empty(csp->action->multi[ACTION_MULTI_FILTER]))) { - - s = strsav(s,"No activity so far!\n"); - + return TRUE; } - else + else if ((csp->content_type & CT_GIF) && + (csp->action->flags & ACTION_DEANIMATE)) { + return TRUE; + } - perc_rej = (float)local_urls_rejected * 100.0F / - (float)local_urls_read; + return FALSE; - sprintf(out_str, - "%d requests received, %d filtered " - "(%6.2f %%).", - local_urls_read, - local_urls_rejected, perc_rej); +} + + +/********************************************************************* + * + * Function : content_filters_enabled + * + * Description : Checks whether there are any content filters + * enabled for the current request. + * + * Parameters : + * 1 : action = Action spec to check. + * + * Returns : TRUE for yes, FALSE otherwise + * + *********************************************************************/ +int content_filters_enabled(const struct current_action_spec *action) +{ + return ((action->flags & ACTION_DEANIMATE) || + !list_is_empty(action->multi[ACTION_MULTI_FILTER])); +} - s = strsav(s,out_str); - } - return(s); +/********************************************************************* + * + * Function : filters_available + * + * Description : Checks whether there are any filters available. + * + * Parameters : + * 1 : csp = Current client state (buffers, headers, etc...) + * + * Returns : TRUE for yes, FALSE otherwise. + * + *********************************************************************/ +int filters_available(const struct client_state *csp) +{ + int i; + for (i = 0; i < MAX_AF_FILES; i++) + { + const struct file_list *fl = csp->rlist[i]; + if ((NULL != fl) && (NULL != fl->f)) + { + return TRUE; + } + } + return FALSE; } -#endif /* def STATISTICS */ /*