1//===--- HTTPClient.cpp - HTTP client library -----------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8///
9/// \file
10/// This file defines the implementation of the HTTPClient library for issuing
11/// HTTP requests and handling the responses.
12///
13//===----------------------------------------------------------------------===//
14
15#include "llvm/HTTP/HTTPClient.h"
16
17#include "llvm/ADT/APInt.h"
18#include "llvm/ADT/StringRef.h"
19#include "llvm/Support/Errc.h"
20#include "llvm/Support/Error.h"
21#include "llvm/Support/ManagedStatic.h"
22#include "llvm/Support/MemoryBuffer.h"
23#ifdef LLVM_ENABLE_CURL
24#include <curl/curl.h>
25#endif
26#ifdef _WIN32
27#include "llvm/Support/ConvertUTF.h"
28#endif
29
30using namespace llvm;
31
32HTTPRequest::HTTPRequest(StringRef Url) { this->Url = Url.str(); }
33
34bool operator==(const HTTPRequest &A, const HTTPRequest &B) {
35 return A.Url == B.Url && A.Method == B.Method &&
36 A.FollowRedirects == B.FollowRedirects &&
37 A.PinnedCertFingerprint == B.PinnedCertFingerprint;
38}
39
40HTTPResponseHandler::~HTTPResponseHandler() = default;
41
42bool HTTPClient::IsInitialized = false;
43
44class HTTPClientCleanup {
45public:
46 ~HTTPClientCleanup() { HTTPClient::cleanup(); }
47};
48ManagedStatic<HTTPClientCleanup> Cleanup;
49
50#ifdef LLVM_ENABLE_CURL
51
52bool HTTPClient::isAvailable() { return true; }
53
54void HTTPClient::initialize() {
55 if (!IsInitialized) {
56 curl_global_init(CURL_GLOBAL_ALL);
57 IsInitialized = true;
58 }
59}
60
61void HTTPClient::cleanup() {
62 if (IsInitialized) {
63 curl_global_cleanup();
64 IsInitialized = false;
65 }
66}
67
68void HTTPClient::setTimeout(std::chrono::milliseconds Timeout) {
69 if (Timeout < std::chrono::milliseconds(0))
70 Timeout = std::chrono::milliseconds(0);
71 curl_easy_setopt(Handle, CURLOPT_TIMEOUT_MS, Timeout.count());
72}
73
74/// CurlHTTPRequest and the curl{Header,Write}Function are implementation
75/// details used to work with Curl. Curl makes callbacks with a single
76/// customizable pointer parameter.
77struct CurlHTTPRequest {
78 CurlHTTPRequest(HTTPResponseHandler &Handler) : Handler(Handler) {}
79 void storeError(Error Err) {
80 ErrorState = joinErrors(std::move(Err), std::move(ErrorState));
81 }
82 HTTPResponseHandler &Handler;
83 llvm::Error ErrorState = Error::success();
84};
85
86static size_t curlWriteFunction(char *Contents, size_t Size, size_t NMemb,
87 CurlHTTPRequest *CurlRequest) {
88 Size *= NMemb;
89 if (Error Err =
90 CurlRequest->Handler.handleBodyChunk(StringRef(Contents, Size))) {
91 CurlRequest->storeError(std::move(Err));
92 return 0;
93 }
94 return Size;
95}
96
97HTTPClient::HTTPClient() {
98 assert(IsInitialized &&
99 "Must call HTTPClient::initialize() at the beginning of main().");
100 if (Handle)
101 return;
102 Handle = curl_easy_init();
103 assert(Handle && "Curl could not be initialized");
104 // Set the callback hooks.
105 curl_easy_setopt(Handle, CURLOPT_WRITEFUNCTION, curlWriteFunction);
106 // Detect supported compressed encodings and accept all.
107 curl_easy_setopt(Handle, CURLOPT_ACCEPT_ENCODING, "");
108}
109
110HTTPClient::~HTTPClient() { curl_easy_cleanup(Handle); }
111
112Error HTTPClient::perform(const HTTPRequest &Request,
113 HTTPResponseHandler &Handler) {
114 if (Request.Method != HTTPMethod::GET)
115 return createStringError(errc::invalid_argument,
116 "Unsupported CURL request method.");
117
118 SmallString<128> Url = Request.Url;
119 curl_easy_setopt(Handle, CURLOPT_URL, Url.c_str());
120 curl_easy_setopt(Handle, CURLOPT_FOLLOWLOCATION, Request.FollowRedirects);
121
122 curl_slist *Headers = nullptr;
123 for (const std::string &Header : Request.Headers)
124 Headers = curl_slist_append(Headers, Header.c_str());
125 curl_easy_setopt(Handle, CURLOPT_HTTPHEADER, Headers);
126
127 CurlHTTPRequest CurlRequest(Handler);
128 curl_easy_setopt(Handle, CURLOPT_WRITEDATA, &CurlRequest);
129 CURLcode CurlRes = curl_easy_perform(Handle);
130 curl_slist_free_all(Headers);
131 if (CurlRes != CURLE_OK)
132 return joinErrors(std::move(CurlRequest.ErrorState),
133 createStringError(errc::io_error,
134 "curl_easy_perform() failed: %s\n",
135 curl_easy_strerror(CurlRes)));
136 return std::move(CurlRequest.ErrorState);
137}
138
139unsigned HTTPClient::responseCode() {
140 long Code = 0;
141 curl_easy_getinfo(Handle, CURLINFO_RESPONSE_CODE, &Code);
142 return Code;
143}
144
145#else
146
147#ifdef _WIN32
148
149// We cannot sort these headers alphabetically.
150// clang-format off
151#include <windows.h>
152#include <wincrypt.h>
153#include <winhttp.h>
154// clang-format on
155
156namespace {
157
158struct WinHTTPSession {
159 HINTERNET SessionHandle = nullptr;
160 HINTERNET ConnectHandle = nullptr;
161 HINTERNET RequestHandle = nullptr;
162 DWORD ResponseCode = 0;
163 DWORD TimeoutMs = 30000;
164
165 ~WinHTTPSession() {
166 if (RequestHandle)
167 WinHttpCloseHandle(RequestHandle);
168 if (ConnectHandle)
169 WinHttpCloseHandle(ConnectHandle);
170 if (SessionHandle)
171 WinHttpCloseHandle(SessionHandle);
172 }
173};
174
175bool parseURL(StringRef Url, std::wstring &Host, std::wstring &Path,
176 INTERNET_PORT &Port, bool &Secure) {
177 // Parse URL: http://host:port/path
178 if (Url.starts_with("https://")) {
179 Secure = true;
180 Url = Url.drop_front(8);
181 } else if (Url.starts_with("http://")) {
182 Secure = false;
183 Url = Url.drop_front(7);
184 } else {
185 return false;
186 }
187
188 size_t SlashPos = Url.find('/');
189 StringRef HostPort =
190 (SlashPos != StringRef::npos) ? Url.substr(0, SlashPos) : Url;
191 StringRef PathPart =
192 (SlashPos != StringRef::npos) ? Url.substr(SlashPos) : StringRef("/");
193
194 size_t ColonPos = HostPort.find(':');
195 StringRef HostStr =
196 (ColonPos != StringRef::npos) ? HostPort.substr(0, ColonPos) : HostPort;
197
198 if (!llvm::ConvertUTF8toWide(HostStr, Host))
199 return false;
200 if (!llvm::ConvertUTF8toWide(PathPart, Path))
201 return false;
202
203 if (ColonPos != StringRef::npos) {
204 StringRef PortStr = HostPort.substr(ColonPos + 1);
205 Port = static_cast<INTERNET_PORT>(std::stoi(PortStr.str()));
206 } else {
207 Port = Secure ? INTERNET_DEFAULT_HTTPS_PORT : INTERNET_DEFAULT_HTTP_PORT;
208 }
209
210 return true;
211}
212
213} // namespace
214
215HTTPClient::HTTPClient() : Handle(new WinHTTPSession()) {}
216
217HTTPClient::~HTTPClient() { delete static_cast<WinHTTPSession *>(Handle); }
218
219bool HTTPClient::isAvailable() { return true; }
220
221void HTTPClient::initialize() {
222 if (!IsInitialized) {
223 IsInitialized = true;
224 }
225}
226
227void HTTPClient::cleanup() {
228 if (IsInitialized) {
229 IsInitialized = false;
230 }
231}
232
233void HTTPClient::setTimeout(std::chrono::milliseconds Timeout) {
234 WinHTTPSession *Session = static_cast<WinHTTPSession *>(Handle);
235 Session->TimeoutMs = static_cast<DWORD>(Timeout.count());
236}
237
238static Error VerifyTLSCertWinHTTP(HINTERNET RequestHandle,
239 const std::string &PinnedFingerprint) {
240 // Decode the expected fingerprint from hex into binary.
241 BYTE Expected[32];
242 DWORD ExpectedSize = sizeof(Expected);
243 if (!CryptStringToBinaryA(
244 PinnedFingerprint.c_str(), (DWORD)PinnedFingerprint.size(),
245 CRYPT_STRING_HEXRAW, Expected, &ExpectedSize, nullptr, nullptr))
246 return createStringError(errc::invalid_argument,
247 "Invalid certificate fingerprint format");
248
249 // Retrieve the server certificate and compute its SHA-256 hash.
250 PCCERT_CONTEXT CertCtx = nullptr;
251 DWORD CertCtxSize = sizeof(CertCtx);
252 if (!WinHttpQueryOption(RequestHandle, WINHTTP_OPTION_SERVER_CERT_CONTEXT,
253 &CertCtx, &CertCtxSize))
254 return createStringError(errc::io_error,
255 "Failed to retrieve server certificate");
256
257 std::array<BYTE, 32> Actual;
258 DWORD ActualSize = Actual.size();
259 bool GotHash = CertGetCertificateContextProperty(
260 CertCtx, CERT_SHA256_HASH_PROP_ID, Actual.data(), &ActualSize);
261 CertFreeCertificateContext(CertCtx);
262 if (!GotHash)
263 return createStringError(errc::io_error,
264 "Failed to compute certificate fingerprint");
265
266 if (memcmp(Actual.data(), Expected, Actual.size()) != 0)
267 return createStringError(errc::permission_denied,
268 "Certificate fingerprint mismatch");
269
270 return Error::success();
271}
272
273Error HTTPClient::perform(const HTTPRequest &Request,
274 HTTPResponseHandler &Handler) {
275 if (Request.Method != HTTPMethod::GET)
276 return createStringError(errc::invalid_argument,
277 "Only GET requests are supported.");
278 for (const std::string &Header : Request.Headers)
279 if (Header.find("\r") != std::string::npos ||
280 Header.find("\n") != std::string::npos) {
281 return createStringError(errc::invalid_argument,
282 "Unsafe request can lead to header injection.");
283 }
284
285 WinHTTPSession *Session = static_cast<WinHTTPSession *>(Handle);
286 assert(!Session->SessionHandle && "perform() can only be called once");
287
288 // Parse URL
289 std::wstring Host, Path;
290 INTERNET_PORT Port = 0;
291 bool Secure = false;
292 if (!parseURL(Request.Url, Host, Path, Port, Secure))
293 return createStringError(errc::invalid_argument,
294 "Invalid URL: " + Request.Url);
295
296 // Create session
297 Session->SessionHandle =
298 WinHttpOpen(L"LLVM-HTTPClient/1.0", WINHTTP_ACCESS_TYPE_DEFAULT_PROXY,
299 WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, 0);
300 if (!Session->SessionHandle)
301 return createStringError(errc::io_error, "Failed to open WinHTTP session");
302
303 // Set timeouts for all 4 phases: resolve, connect, send and receive. Resolve
304 // and connect are hard-coded since they don't vary with different payloads.
305 // Send and receive is configurable and defaults to 30000.
306 if (!WinHttpSetTimeouts(Session->SessionHandle, 5000, 10000,
307 Session->TimeoutMs, Session->TimeoutMs))
308 return createStringError(errc::io_error, "Failed to set WinHTTP timeout");
309
310 // Prevent fallback to TLS 1.0/1.1
311 DWORD SecureProtocols =
312 WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_2 | WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_3;
313 if (!WinHttpSetOption(Session->SessionHandle, WINHTTP_OPTION_SECURE_PROTOCOLS,
314 &SecureProtocols, sizeof(SecureProtocols))) {
315 // Fallback to TLS 1.2 if Windows does not support 1.3.
316 SecureProtocols = WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_2;
317 if (!WinHttpSetOption(Session->SessionHandle,
318 WINHTTP_OPTION_SECURE_PROTOCOLS, &SecureProtocols,
319 sizeof(SecureProtocols)))
320 return createStringError(errc::io_error,
321 "Failed to set secure protocols");
322 }
323
324 // Disallow redirects in general or HTTPS to HTTP only.
325 DWORD RedirectPolicy = WINHTTP_OPTION_REDIRECT_POLICY_DISALLOW_HTTPS_TO_HTTP;
326 if (!Request.FollowRedirects)
327 RedirectPolicy = WINHTTP_OPTION_REDIRECT_POLICY_NEVER;
328 if (!WinHttpSetOption(Session->SessionHandle, WINHTTP_OPTION_REDIRECT_POLICY,
329 &RedirectPolicy, sizeof(RedirectPolicy)))
330 return createStringError(errc::io_error, "Failed to set redirect policy");
331
332 // Use HTTP/2 if available
333 DWORD EnableHttp2 = WINHTTP_PROTOCOL_FLAG_HTTP2;
334 WinHttpSetOption(Session->SessionHandle, WINHTTP_OPTION_ENABLE_HTTP_PROTOCOL,
335 &EnableHttp2, sizeof(EnableHttp2));
336
337 // Create connection
338 Session->ConnectHandle =
339 WinHttpConnect(Session->SessionHandle, Host.c_str(), Port, 0);
340 if (!Session->ConnectHandle) {
341 return createStringError(errc::io_error,
342 "Failed to connect to host: " + Request.Url);
343 }
344
345 // Open request
346 DWORD Flags = WINHTTP_FLAG_REFRESH;
347 if (Secure)
348 Flags |= WINHTTP_FLAG_SECURE;
349
350 Session->RequestHandle = WinHttpOpenRequest(
351 Session->ConnectHandle, L"GET", Path.c_str(), nullptr, WINHTTP_NO_REFERER,
352 WINHTTP_DEFAULT_ACCEPT_TYPES, Flags);
353 if (!Session->RequestHandle)
354 return createStringError(errc::io_error, "Failed to open HTTP request");
355
356 DWORD SecurityFlags = 0;
357 if (Secure) {
358 // Enforce checks that certificate wasn't revoked.
359 DWORD EnableRevocationChecks = WINHTTP_ENABLE_SSL_REVOCATION;
360 if (!WinHttpSetOption(Session->RequestHandle, WINHTTP_OPTION_ENABLE_FEATURE,
361 &EnableRevocationChecks,
362 sizeof(EnableRevocationChecks)))
363 return createStringError(
364 errc::io_error, "Failed to enable certificate revocation checks");
365
366 // Bypass certificate chain validation with pinned certificates so
367 // that self-signed certificates are accepted at the WinHTTP level. Manual
368 // verification happens right after receiving the response.
369 if (Request.PinnedCertFingerprint)
370 SecurityFlags = (SecurityFlags | SECURITY_FLAG_IGNORE_UNKNOWN_CA);
371 if (!WinHttpSetOption(Session->RequestHandle, WINHTTP_OPTION_SECURITY_FLAGS,
372 &SecurityFlags, sizeof(SecurityFlags)))
373 return createStringError(errc::io_error,
374 "Failed to enforce security flags");
375 }
376
377 // Add headers
378 for (const std::string &Header : Request.Headers) {
379 std::wstring WideHeader;
380 if (!llvm::ConvertUTF8toWide(Header, WideHeader))
381 continue;
382 WinHttpAddRequestHeaders(Session->RequestHandle, WideHeader.c_str(),
383 static_cast<DWORD>(WideHeader.length()),
384 WINHTTP_ADDREQ_FLAG_ADD);
385 }
386
387 // Send request
388 if (!WinHttpSendRequest(Session->RequestHandle, WINHTTP_NO_ADDITIONAL_HEADERS,
389 0, nullptr, 0, 0, 0)) {
390 bool TimedOut = GetLastError() == ERROR_WINHTTP_TIMEOUT;
391 return createStringError(errc::io_error,
392 TimedOut ? "Timeout was reached"
393 : "Failed to send HTTP request");
394 }
395
396 // Receive response
397 if (!WinHttpReceiveResponse(Session->RequestHandle, nullptr)) {
398 bool TimedOut = GetLastError() == ERROR_WINHTTP_TIMEOUT;
399 return createStringError(errc::io_error,
400 TimedOut ? "Timeout was reached"
401 : "Failed to receive HTTP response");
402 }
403
404 // Verify the server certificate fingerprint if one was pinned.
405 if ((SecurityFlags & SECURITY_FLAG_IGNORE_UNKNOWN_CA) != 0)
406 if (Error Err = VerifyTLSCertWinHTTP(Session->RequestHandle,
407 *Request.PinnedCertFingerprint))
408 return Err;
409
410 // Get response code
411 DWORD CodeSize = sizeof(Session->ResponseCode);
412 if (!WinHttpQueryHeaders(Session->RequestHandle,
413 WINHTTP_QUERY_STATUS_CODE |
414 WINHTTP_QUERY_FLAG_NUMBER,
415 WINHTTP_HEADER_NAME_BY_INDEX, &Session->ResponseCode,
416 &CodeSize, nullptr))
417 Session->ResponseCode = 0;
418
419 // Read response body
420 DWORD BytesAvailable = 0;
421 while (WinHttpQueryDataAvailable(Session->RequestHandle, &BytesAvailable)) {
422 if (BytesAvailable == 0)
423 break;
424
425 std::vector<char> Buffer(BytesAvailable);
426 DWORD BytesRead = 0;
427 if (!WinHttpReadData(Session->RequestHandle, Buffer.data(), BytesAvailable,
428 &BytesRead))
429 return createStringError(errc::io_error, "Failed to read HTTP response");
430
431 if (BytesRead > 0) {
432 if (Error Err =
433 Handler.handleBodyChunk(StringRef(Buffer.data(), BytesRead)))
434 return Err;
435 }
436 }
437
438 return Error::success();
439}
440
441unsigned HTTPClient::responseCode() {
442 WinHTTPSession *Session = static_cast<WinHTTPSession *>(Handle);
443 return Session ? Session->ResponseCode : 0;
444}
445
446#else // _WIN32
447
448// Non-Windows, non-libcurl stub implementations
449HTTPClient::HTTPClient() = default;
450
451HTTPClient::~HTTPClient() = default;
452
453bool HTTPClient::isAvailable() { return false; }
454
455void HTTPClient::initialize() {}
456
457void HTTPClient::cleanup() {}
458
459void HTTPClient::setTimeout(std::chrono::milliseconds Timeout) {}
460
461Error HTTPClient::perform(const HTTPRequest &Request,
462 HTTPResponseHandler &Handler) {
463 llvm_unreachable("No HTTP Client implementation available.");
464}
465
466unsigned HTTPClient::responseCode() {
467 llvm_unreachable("No HTTP Client implementation available.");
468}
469
470#endif // _WIN32
471
472#endif
473