Revision control
++ // Copyright (C) 2022 The Qt Company Ltd.
++ // SPDX-License-Identifier: LicenseRef-Qt-Commercial OR GPL-3.0-only
++ // Qt-Security score:significant reason:default
++
++ #include <QtHttpServer/qabstracthttpserver.h>
++
++ #include <QtHttpServer/qhttpserverrequest.h>
++ #include <QtHttpServer/qhttpserverresponder.h>
++
++ #include <private/qabstracthttpserver_p.h>
++ #include <private/qhttpserverhttp1protocolhandler_p.h>
++ #include <private/qhttpserverrequest_p.h>
++
++ #include <QtCore/qloggingcategory.h>
++ #include <QtNetwork/qtcpserver.h>
++ #include <QtNetwork/qtcpsocket.h>
++ #if QT_CONFIG(ssl) && QT_CONFIG(http)
++ #include <QtNetwork/private/qhttp2connection_p.h>
++ #endif
++
++ #if QT_CONFIG(localserver)
++ #include <QtNetwork/qlocalserver.h>
++ #include <QtNetwork/qlocalsocket.h>
++ #endif
++
++ #if QT_CONFIG(ssl)
++ #include <QtNetwork/qsslserver.h>
++ #endif
++
++ #if QT_CONFIG(http) && QT_CONFIG(ssl)
++ #include <private/qhttpserverhttp2protocolhandler_p.h>
++ #endif
++
++ #include <algorithm>
++
++ QT_BEGIN_NAMESPACE
++
++ Q_STATIC_LOGGING_CATEGORY(lcHttpServer, "qt.httpserver", QtWarningMsg)
++
++ bool LessHostAddress::operator()(const QHostAddress &lhs, const QHostAddress &rhs) const
++ {
++ bool lhsIsIPv4 = false;
++ bool rhsIsIPv4 = false;
++ quint32 lhsIpAddressV4 = lhs.toIPv4Address(&lhsIsIPv4);
++ quint32 rhsIpAddressV4 = rhs.toIPv4Address(&rhsIsIPv4);
++ if (lhsIsIPv4 != rhsIsIPv4)
++ return lhsIsIPv4;
++ if (lhsIsIPv4)
++ return lhsIpAddressV4 < rhsIpAddressV4;
++
++ Q_IPV6ADDR lhsIpAddressV6 = lhs.toIPv6Address();
++ Q_IPV6ADDR rhsIpAddressV6 = rhs.toIPv6Address();
++ for (int i = 0; i < 16; ++i) {
++ if (lhsIpAddressV6[i] != rhsIpAddressV6[i])
++ return lhsIpAddressV6[i] < rhsIpAddressV6[i];
++ }
++
++ return false;
++ }
++
++
++ /*!
++ \internal
++ */
++ QAbstractHttpServerPrivate::QAbstractHttpServerPrivate()
++ {
++ restartHeartbeatTimer();
++ }
++
++ /*!
++ \internal
++ */
++ void QAbstractHttpServerPrivate::handleNewConnections()
++ {
++ Q_Q(QAbstractHttpServer);
++
++ #if QT_CONFIG(ssl) && QT_CONFIG(http)
++ if (auto *sslServer = qobject_cast<QSslServer *>(q->sender())) {
++ while (auto socket = qobject_cast<QSslSocket *>(sslServer->nextPendingConnection())) {
++ if (socket->sslConfiguration().nextNegotiatedProtocol()
++ == QSslConfiguration::ALPNProtocolHTTP2) {
++ createHttp2Handler(socket);
++ } else {
++ createHttp1Handler(socket);
++ }
++ }
++ return;
++ }
++ #endif
++
++ auto tcpServer = qobject_cast<QTcpServer *>(q->sender());
++ Q_ASSERT(tcpServer);
++
++ while (auto socket = tcpServer->nextPendingConnection())
++ createHttp1Handler(socket);
++ }
++
++ /*!
++ \internal
++ */
++ bool QAbstractHttpServerPrivate::verifyThreadAffinity(const QObject *contextObject) const {
++ Q_Q(const QAbstractHttpServer);
++ if (contextObject && (contextObject->thread() != q->thread())) {
++ qCWarning(lcHttpServer, "QAbstractHttpServer: "
++ "the context object must reside in the same thread");
++ return false;
++ }
++ return true;
++ }
++
++ void QAbstractHttpServerPrivate::createHttp1Handler(QIODevice *socket)
++ {
++ using namespace std::chrono_literals;
++ Q_Q(QAbstractHttpServer);
++
++ if (hasTooManyConnections(socket)) {
++ if (auto tcpSocket = qobject_cast<QTcpSocket *>(socket)) {
++ QByteArray buffer;
++ buffer.append("HTTP/1.1 429 Too Many Requests");
++ buffer.append("\r\nConnection: close\r\n\r\n");
++ tcpSocket->write(buffer);
++ tcpSocket->flush();
++ QTimer::singleShot(1s, tcpSocket, &QObject::deleteLater);
++ }
++ return;
++ }
++
++ auto handler = new QHttpServerHttp1ProtocolHandler(q, socket, &requestFilter, &configuration);
++ updateSocketCounter(socket);
++ QObject::connect(&heartbeatTimer, &QTimer::timeout,
++ handler, &QHttpServerHttp1ProtocolHandler::checkKeepAliveTimeout);
++ }
++
++ #if QT_CONFIG(ssl) && QT_CONFIG(http)
++ void QAbstractHttpServerPrivate::createHttp2Handler(QIODevice *socket)
++ {
++ using namespace std::chrono_literals;
++ Q_Q(QAbstractHttpServer);
++
++ if (hasTooManyConnections(socket)) {
++ if (auto tcpSocket = qobject_cast<QTcpSocket *>(socket)) {
++ auto *connection = QHttp2Connection::createDirectServerConnection(
++ socket, q->http2Configuration());
++ connection->close(Http2::Http2Error::ENHANCE_YOUR_CALM);
++ QTimer::singleShot(1s, tcpSocket, &QObject::deleteLater);
++ }
++ return;
++ }
++
++ auto handler = new QHttpServerHttp2ProtocolHandler(q, socket, &requestFilter);
++ updateSocketCounter(socket);
++ QObject::connect(&heartbeatTimer, &QTimer::timeout,
++ handler, &QHttpServerHttp2ProtocolHandler::checkKeepAliveTimeout);
++ }
++ #endif
++
++ bool QAbstractHttpServerPrivate::hasTooManyConnections(QIODevice *socket)
++ {
++ if (configuration.maximumConnections() != 0
++ && totalConnections >= configuration.maximumConnections())
++ return true;
++
++ if (configuration.maximumConnectionsPerHost() == 0)
++ return false;
++
++ if (auto tcpSocket = qobject_cast<QTcpSocket *>(socket)) {
++ auto foundNumberOfConnections = connectionsPerHost.find(tcpSocket->peerAddress());
++ if (foundNumberOfConnections != connectionsPerHost.end()) {
++ if (foundNumberOfConnections->second >= configuration.maximumConnectionsPerHost()) {
++ qCInfo(lcHttpServer) << "QAbstractHttpServer:"
++ << "closing socket: too many connections from"
++ << tcpSocket->peerAddress().toString();
++ return true;
++ }
++ }
++ }
++ return false;
++ }
++
++ void QAbstractHttpServerPrivate::updateSocketCounter(QIODevice *socket)
++ {
++ // If there are no limits on connections per host or in total, there's no point in tracking
++ // the amount of connections, so we skip doing so.
++ if (configuration.maximumConnectionsPerHost() == 0 && configuration.maximumConnections() == 0)
++ return;
++
++ if (auto tcpSocket = qobject_cast<QTcpSocket *>(socket)) {
++ auto [it, _] = connectionsPerHost.try_emplace(tcpSocket->peerAddress(), 0);
++ ++(it->second);
++ ++totalConnections;
++ QObjectPrivate::connect(tcpSocket, &QAbstractSocket::disconnected, this,
++ &QAbstractHttpServerPrivate::socketDisconnected);
++ }
++ }
++
++ void QAbstractHttpServerPrivate::socketDisconnected()
++ {
++
++ Q_Q(QAbstractHttpServer);
++ if (auto tcpSocket = qobject_cast<QTcpSocket *>(q->sender())) {
++ --totalConnections;
++ auto foundNumberOfConnections = connectionsPerHost.find(tcpSocket->peerAddress());
++ if (foundNumberOfConnections != connectionsPerHost.end()) {
++ if (foundNumberOfConnections->second == 1)
++ connectionsPerHost.erase(foundNumberOfConnections);
++ else
++ --(foundNumberOfConnections->second);
++ }
++ }
++ }
++
++ #if QT_CONFIG(ssl)
++ void QAbstractHttpServerPrivate::handleStartedEncryptionHandshake(QSslSocket *socket)
++ {
++ if (hasTooManyConnections(socket))
++ socket->close();
++ }
++ #endif
++
++ void QAbstractHttpServerPrivate::restartHeartbeatTimer()
++ {
++ if (heartbeatTimer.isActive())
++ heartbeatTimer.stop();
++
++ const auto timerInterval = qMax(configuration.keepAliveTimeout() / 2,
++ std::chrono::seconds(5));
++ heartbeatTimer.start(timerInterval);
++ }
++
++
++ #if QT_CONFIG(localserver)
++ /*!
++ \internal
++ */
++ void QAbstractHttpServerPrivate::handleNewLocalConnections()
++ {
++ Q_Q(QAbstractHttpServer);
++ auto localServer = qobject_cast<QLocalServer *>(q->sender());
++ Q_ASSERT(localServer);
++
++ while (auto socket = localServer->nextPendingConnection())
++ createHttp1Handler(socket);
++ }
++ #endif
++
++ /*!
++ \class QAbstractHttpServer
++ \since 6.4
++ \inmodule QtHttpServer
++ \brief API to subclass to implement an HTTP server.
++
++ Subclass this class and override handleRequest() and missingHandler() to
++ create an HTTP server. Use bind() to start listening to all the incoming
++ connections to a server.
++
++ This is a low level API, see \l QHttpServer for a higher level API to
++ implement an HTTP server.
++ */
++
++ /*!
++ Creates an instance of QAbstractHttpServer with the parent \a parent.
++ */
++ QAbstractHttpServer::QAbstractHttpServer(QObject *parent)
++ : QAbstractHttpServer(*new QAbstractHttpServerPrivate, parent)
++ {}
++
++ /*!
++ Destroys an instance of QAbstractHttpServer.
++ */
++ QAbstractHttpServer::~QAbstractHttpServer()
++ = default;
++
++ /*!
++ \internal
++ */
++ QAbstractHttpServer::QAbstractHttpServer(QAbstractHttpServerPrivate &dd, QObject *parent)
++ : QObject(dd, parent)
++ {
++ #if defined(QT_WEBSOCKETS_LIB)
++ Q_D(QAbstractHttpServer);
++ connect(&d->websocketServer, &QWebSocketServer::newConnection,
++ this, &QAbstractHttpServer::newWebSocketConnection);
++ #endif
++ }
++
++ /*!
++ Returns the list of ports this instance of QAbstractHttpServer
++ is listening to.
++
++ This function has the same guarantee as QObject::children,
++ the latest server added is the last entry in the vector.
++
++ \sa servers()
++ */
++ QList<quint16> QAbstractHttpServer::serverPorts() const
++ {
++ QList<quint16> ports;
++ auto children = findChildren<QTcpServer *>();
++ ports.reserve(children.size());
++ std::transform(children.cbegin(), children.cend(), std::back_inserter(ports),
++ [](const QTcpServer *server) { return server->serverPort(); });
++ return ports;
++ }
++
++ /*!
++ Bind the given TCP \a server, over which the transmission happens,
++ to the HTTP server. It is possible to call this function
++ multiple times with different instances of TCP \a server to
++ handle multiple connections and ports, for example both SSL and
++ non-encrypted connections.
++
++ After calling this function, every \e new connection will be
++ handled and forwarded by the HTTP server.
++
++ It is the user's responsibility to call QTcpServer::listen() on
++ the \a server before calling this function. If \a server is not
++ listening, nothing will happen and \c false will be returned.
++
++ If successful the \a server will be parented to this HTTP server
++ and \c true is returned.
++
++ To allow usage of HTTP 2, bind to a QSslServer where
++ QSslConfiguration::setAllowedNextProtocols() has been called with
++ the arguments \c {{ QSslConfiguration::ALPNProtocolHTTP2 }}.
++
++ \sa QTcpServer, QTcpServer::listen(), QSslConfiguration::setAllowedNextProtocols()
++ */
++ bool QAbstractHttpServer::bind(QTcpServer *server)
++ {
++ Q_D(QAbstractHttpServer);
++ if (!server)
++ return false;
++
++ if (!server->isListening()) {
++ qCWarning(lcHttpServer) << "The TCP server" << server << "is not listening.";
++ return false;
++ }
++ server->setParent(this);
++ QObjectPrivate::connect(server, &QTcpServer::pendingConnectionAvailable, d,
++ &QAbstractHttpServerPrivate::handleNewConnections,
++ Qt::UniqueConnection);
++ #if QT_CONFIG(ssl)
++ if (auto *sslServer = qobject_cast<QSslServer *>(server)) {
++ QObjectPrivate::connect(sslServer,&QSslServer::startedEncryptionHandshake, d,
++ &QAbstractHttpServerPrivate::handleStartedEncryptionHandshake,
++ Qt::UniqueConnection);
++ }
++ #endif
++ return true;
++ }
++
++ #if QT_CONFIG(localserver)
++ /*!
++ Bind the given QLocalServer \a server, over which the transmission
++ happens, to the HTTP server. It is possible to call this function
++ multiple times with different instances of \a server to
++ handle multiple connections.
++
++ After calling this function, every \e new connection will be
++ handled and forwarded by the HTTP server.
++
++ It is the user's responsibility to call QLocalServer::listen() on
++ the \a server before calling this function. If \a server is not
++ listening, nothing will happen and \c false will be returned.
++
++ If the \a server is nullptr false is returned.
++
++ If successful the \a server will be parented to this HTTP server
++ and \c true is returned.
++
++ \sa QLocalServer, QLocalServer::listen()
++ */
++ bool QAbstractHttpServer::bind(QLocalServer *server)
++ {
++ Q_D(QAbstractHttpServer);
++ if (!server)
++ return false;
++
++ if (!server->isListening()) {
++ qCWarning(lcHttpServer) << "The local server" << server << "is not listening.";
++ return false;
++ }
++ server->setParent(this);
++ QObjectPrivate::connect(server, &QLocalServer::newConnection,
++ d, &QAbstractHttpServerPrivate::handleNewLocalConnections,
++ Qt::UniqueConnection);
++ return true;
++ }
++ #endif
++
++ /*!
++ Returns the TCP and SSL servers this HTTP server will handle connections from.
++
++ \sa serverPorts()
++ */
++ QList<QTcpServer *> QAbstractHttpServer::servers() const
++ {
++ return findChildren<QTcpServer *>();
++ }
++
++ #if QT_CONFIG(localserver)
++ /*!
++ Returns the local servers of this HTTP server.
++
++ \sa serverPorts()
++ */
++ QList<QLocalServer *> QAbstractHttpServer::localServers() const
++ {
++ return findChildren<QLocalServer *>();
++ }
++ #endif
++
++ #if defined(QT_WEBSOCKETS_LIB)
++ /*!
++ \fn QAbstractHttpServer::newWebSocketConnection()
++ This signal is emitted every time a new WebSocket connection is
++ available.
++
++ \sa hasPendingWebSocketConnections(), nextPendingWebSocketConnection(),
++ addWebSocketUpgradeVerifier()
++ */
++
++ /*!
++ Returns \c true if the server has pending WebSocket connections;
++ otherwise returns \c false.
++
++ \sa newWebSocketConnection(), nextPendingWebSocketConnection(),
++ addWebSocketUpgradeVerifier()
++ */
++ bool QAbstractHttpServer::hasPendingWebSocketConnections() const
++ {
++ Q_D(const QAbstractHttpServer);
++ return d->websocketServer.hasPendingConnections();
++ }
++
++ /*!
++ Returns the next pending connection as a connected QWebSocket
++ object. \nullptr is returned if this function is called when
++ there are no pending connections.
++
++ \note The returned QWebSocket object cannot be used from another
++ thread.
++
++ \sa newWebSocketConnection(), hasPendingWebSocketConnections(),
++ addWebSocketUpgradeVerifier()
++ */
++ std::unique_ptr<QWebSocket> QAbstractHttpServer::nextPendingWebSocketConnection()
++ {
++ Q_D(QAbstractHttpServer);
++ return std::unique_ptr<QWebSocket>(d->websocketServer.nextPendingConnection());
++ }
++
++ /*!
++ \internal
++ */
++ QHttpServerWebSocketUpgradeResponse
++ QAbstractHttpServer::verifyWebSocketUpgrade(const QHttpServerRequest &request) const
++ {
++ Q_D(const QAbstractHttpServer);
++ QScopedValueRollback guard(d->handlingWebSocketUpgrade, true);
++ for (auto &verifier : d->webSocketUpgradeVerifiers) {
++ if (verifier.context && verifier.slotObject && d->verifyThreadAffinity(verifier.context)) {
++ auto response = QHttpServerWebSocketUpgradeResponse::passToNext();
++ void *args[] = { &response, const_cast<QHttpServerRequest *>(&request) };
++ verifier.slotObject->call(const_cast<QObject *>(verifier.context.data()), args);
++ if (response.type() != QHttpServerWebSocketUpgradeResponse::ResponseType::PassToNext)
++ return response;
++ }
++ }
++ return QHttpServerWebSocketUpgradeResponse::passToNext();
++ }
++
++ /*!
++ \fn template <typename Handler> void QAbstractHttpServer::addWebSocketUpgradeVerifier(const QObject *context, Handler &&func)
++
++ Adds a callback function \a func that verifies incoming WebSocket
++ upgrades. It is called using the provided \a context object.
++ An upgrade succeeds if at least one registered callback returns
++ \l{QHttpServerWebSocketUpgradeResponse::ResponseType::}{Accept} and
++ no prior callback has returned
++ \l{QHttpServerWebSocketUpgradeResponse::ResponseType::}{Deny}. If no
++ callbacks are registered, or all return
++ \l{QHttpServerWebSocketUpgradeResponse::ResponseType::}{PassToNext},
++ the missingHandler() function is called. Callbacks are executed in the
++ order they were registered, and they cannot call this function
++ themselves.
++
++ \note The \a func has to implement the signature
++ \c{QHttpServerWebSocketUpgradeResponse (*)(const QHttpServerRequest &)}.
++
++ \code
++ server.addWebSocketUpgradeVerifier(
++ &server, [](const QHttpServerRequest &request) {
++ if (request.url().path() == "/allowed"_L1)
++ return QHttpServerWebSocketUpgradeResponse::accept();
++ else
++ return QHttpServerWebSocketUpgradeResponse::passToNext();
++ });
++ \endcode
++
++ \since 6.8
++ \sa QHttpServerRequest, QHttpServerWebSocketUpgradeResponse, hasPendingWebSocketConnections(),
++ nextPendingWebSocketConnection(), newWebSocketConnection(), missingHandler()
++ */
++
++ /*!
++ \internal
++ */
++ void QAbstractHttpServer::addWebSocketUpgradeVerifierImpl(const QObject *context,
++ QtPrivate::QSlotObjectBase *slotObjRaw)
++ {
++ QtPrivate::SlotObjUniquePtr slotObj{slotObjRaw}; // adopts
++ Q_ASSERT(slotObj);
++ Q_D(QAbstractHttpServer);
++ if (d->handlingWebSocketUpgrade) {
++ qWarning("Registering WebSocket upgrade verifiers while handling them is not allowed");
++ return;
++ }
++ d->webSocketUpgradeVerifiers.push_back({context, std::move(slotObj)});
++ }
++
++ #endif
++
++ /*!
++ \fn QAbstractHttpServer::handleRequest(const QHttpServerRequest &request,
++ QHttpServerResponder &responder)
++ Override this function to handle each incoming \a request, by examining
++ the \a request and sending the appropriate response back to \a responder.
++ Return \c true if the \a request was handled successfully. If this method
++ returns \c false, missingHandler() will be called afterwards.
++ */
++
++ /*!
++ \fn QAbstractHttpServer::missingHandler(const QHttpServerRequest &request,
++ QHttpServerResponder &responder)
++
++ Override this function to handle each incoming \a request that was not
++ handled by \l handleRequest(). This function is called whenever \l
++ handleRequest() returns \c false, or if there is a WebSocket upgrade
++ attempt and either there are no connections to newWebSocketConnection() or
++ there are no matching WebSocket verifiers. The \a request and \a responder
++ parameters are the same as handleRequest() was called with.
++
++ \sa handleRequest(), addWebSocketUpgradeVerifier()
++ */
++
++ #if QT_CONFIG(ssl)
++ /*!
++ \since 6.8
++
++ Returns server's HTTP/2 configuration parameters.
++
++ \sa setHttp2Configuration()
++ */
++ QHttp2Configuration QAbstractHttpServer::http2Configuration() const
++ {
++ Q_D(const QAbstractHttpServer);
++ return d->h2Configuration;
++ }
++
++ /*!
++ \since 6.8
++
++ Sets server's HTTP/2 configuration parameters.
++
++ The next HTTP/2 connection will use the given \a configuration.
++
++ \sa http2Configuration()
++ */
++ void QAbstractHttpServer::setHttp2Configuration(const QHttp2Configuration &configuration)
++ {
++ Q_D(QAbstractHttpServer);
++ d->h2Configuration = configuration;
++ }
++
++ #endif
++
++ /*!
++ \since 6.9
++
++ Sets this server's general configuration parameters to \a config.
++
++ \note The new configuration will be applied both to already established
++ connections and all next connections.
++
++ \sa configuration()
++ */
++ void QAbstractHttpServer::setConfiguration(const QHttpServerConfiguration &config)
++ {
++ Q_D(QAbstractHttpServer);
++ d->configuration = config;
++ d->requestFilter.setConfiguration(config);
++ d->restartHeartbeatTimer();
++ }
++
++ /*!
++ \since 6.9
++
++ Returns this server's general configuration parameters.
++
++ \sa setConfiguration()
++ */
++ QHttpServerConfiguration QAbstractHttpServer::configuration() const
++ {
++ Q_D(const QAbstractHttpServer);
++ return d->configuration;
++ }
++
++ QT_END_NAMESPACE
++
++ #include "moc_qabstracthttpserver.cpp"