[Olsr-dev] [PATCH] jsoninfo: HTTP headers with CORS (if requested)

Ferry Huberts (spam-protected)
Fri May 16 18:13:14 CEST 2014


there still are no overrun checks in the build_http_header. check the 
snprintf man page and pay very close attention to the 'return value' 
section.

if there is an overrun, you have a heartbleed like bug: you increase 
size higher and higher, resulting in random memory being output.

which is why I asked for usage of abuf

On 16/05/14 17:59, Alessio Caiazza wrote:
> The new "httpheaders" parameter prepends HTTP headers to the reply.
> If not set it will default to "no" and have the same behaviour as before.
> Cross-origin resource sharing headers (CORS) are included in reply allowing the
> json retrieval by javascript applications not served by olsrd itself.
> This will allow to easily develop js applications running directly in the
> browser.
> ---
>   lib/jsoninfo/README_JSONINFO      |  8 +++++
>   lib/jsoninfo/src/olsrd_jsoninfo.c | 68 +++++++++++++++++++++++++++++++++++++--
>   lib/jsoninfo/src/olsrd_jsoninfo.h |  1 +
>   lib/jsoninfo/src/olsrd_plugin.c   | 17 ++++++++++
>   4 files changed, 91 insertions(+), 3 deletions(-)
>
> diff --git a/lib/jsoninfo/README_JSONINFO b/lib/jsoninfo/README_JSONINFO
> index a102a56..4e63859 100644
> --- a/lib/jsoninfo/README_JSONINFO
> +++ b/lib/jsoninfo/README_JSONINFO
> @@ -73,6 +73,14 @@ LoadPlugin "olsrd_jsoninfo.so.0.0"
>       # if you set it to 0.0.0.0, it will accept all connections
>       #PlParam      "accept" "0.0.0.0"
>
> +    # The "httpheaders" parameter prepends HTTP headers to the reply.
> +    # If not set it will default to "no" and have the same behaviour as before.
> +    # Among with a minimal set of headers also Cross-origin resource sharing
> +    # headers (CORS) are included in reply allowing the json retrieval by
> +    # javascript applications not served by olsrd itself.
> +    # You can enable it uncommenting the following line:
> +    #PlParam      "httpheaders" "yes"
> +
>       # specify a UUID for this node to track it for debugging
>       #PlParam      "UUIDFile" "/etc/olsrd/olsrd.uuid"
>   }
> diff --git a/lib/jsoninfo/src/olsrd_jsoninfo.c b/lib/jsoninfo/src/olsrd_jsoninfo.c
> index 9db99b8..c9d1284 100644
> --- a/lib/jsoninfo/src/olsrd_jsoninfo.c
> +++ b/lib/jsoninfo/src/olsrd_jsoninfo.c
> @@ -96,6 +96,9 @@
>
>   static int ipc_socket;
>
> +/**Response types */
> +#define HTTP_200 "HTTP/1.1 200 OK"
> +
>   /* IPC initialization function */
>   static int plugin_ipc_init(void);
>
> @@ -126,6 +129,9 @@ static void ipc_print_interfaces(struct autobuf *);
>   static void ipc_print_plugins(struct autobuf *);
>   static void ipc_print_olsrd_conf(struct autobuf *abuf);
>
> +static size_t build_http_header(const char *status, const char *mime,
> +  uint32_t msgsize, char *buf, uint32_t bufsize);
> +
>   #define TXT_IPC_BUFSIZE 256
>
>   /* these provide all of the runtime status info */
> @@ -151,6 +157,7 @@ static void ipc_print_olsrd_conf(struct autobuf *abuf);
>   #define SIW_OLSRD_CONF 0x1000
>
>   #define MAX_CLIENTS 3
> +#define MAX_HTTPHEADER_SIZE 1024
>
>   static char *outbuffer[MAX_CLIENTS];
>   static size_t outbuffer_size[MAX_CLIENTS];
> @@ -1282,6 +1289,9 @@ static void
>   send_info(unsigned int send_what, int the_socket)
>   {
>     struct autobuf abuf;
> +  size_t header_len = 0;
> +  char header_buf[MAX_HTTPHEADER_SIZE];
> +  const char *content_type = "application/json";
>
>     /* global variables for tracking when to put a comma in for JSON */
>     entrynumber[0] = 0;
> @@ -1320,12 +1330,17 @@ send_info(unsigned int send_what, int the_socket)
>       ipc_print_olsrd_conf(&abuf);
>     }
>
> -  outbuffer[outbuffer_count] = olsr_malloc(abuf.len, "txt output buffer");
> -  outbuffer_size[outbuffer_count] = abuf.len;
> +  if(http_headers) {
> +    header_len = build_http_header(HTTP_200, content_type, abuf.len, header_buf, sizeof(header_buf));
> +  }
> +
> +  outbuffer[outbuffer_count] = olsr_malloc(header_len + abuf.len, "json output buffer");
> +  outbuffer_size[outbuffer_count] = header_len + abuf.len;
>     outbuffer_written[outbuffer_count] = 0;
>     outbuffer_socket[outbuffer_count] = the_socket;
>
> -  memcpy(outbuffer[outbuffer_count], abuf.buf, abuf.len);
> +  memcpy(outbuffer[outbuffer_count], header_buf, header_len);
> +  memcpy((outbuffer[outbuffer_count]) + header_len, abuf.buf, abuf.len);
>     outbuffer_count++;
>
>     if (outbuffer_count == 1) {
> @@ -1340,6 +1355,53 @@ send_info(unsigned int send_what, int the_socket)
>     abuf_free(&abuf);
>   }
>
> +static size_t
> +build_http_header(const char *status, const char *mime, uint32_t msgsize,
> +  char *buf, uint32_t bufsize)
> +{
> +  time_t currtime;
> +  size_t size;
> +
> +  size = snprintf(buf, bufsize, "%s\r\n", status);
> +
> +  /* Date */
> +  time(&currtime);
> +  size += strftime(&buf[size], bufsize - size, "Date: %a, %d %b %Y %H:%M:%S GMT\r\n", localtime(&currtime));
> +
> +  /* Server version */
> +  size += snprintf(&buf[size], bufsize - size, "Server: OLSRD JSONInfo plugin\r\n");
> +
> +  /* connection-type */
> +  size += snprintf(&buf[size], bufsize - size, "Connection: closed\r\n");
> +
> +  /* MIME type */
> +  if(mime != NULL) {
> +    size += snprintf(&buf[size], bufsize - size, "Content-type: %s\r\n", mime);
> +  }
> +
> +  /* CORS data */
> +  /**No needs to be strict here, access control is based on source IP*/
> +  size += snprintf(&buf[size], bufsize - size, "Access-Control-Allow-Origin: *\r\n");
> +  size += snprintf(&buf[size], bufsize - size, "Access-Control-Allow-Methods: GET, POST, OPTIONS\r\n");
> +  size += snprintf(&buf[size], bufsize - size, "Access-Control-Allow-Headers: Accept, Origin, X-Requested-With\r\n");
> +  size += snprintf(&buf[size], bufsize - size, "Access-Control-Max-Age: 1728000\r\n");
> +
> +  /* Content length */
> +  if (msgsize > 0) {
> +    size += snprintf(&buf[size], bufsize - size, "Content-length: %i\r\n", msgsize);
> +  }
> +
> +  /* Cache-control
> +   * No caching dynamic pages
> +   */
> +  size += snprintf(&buf[size], bufsize - size, "Cache-Control: no-cache\r\n");
> +
> +  /* End header */
> +  size += snprintf(&buf[size], bufsize - size, "\r\n");
> +
> +  return size;
> +}
> +
>   /*
>    * Local Variables:
>    * mode: c
> diff --git a/lib/jsoninfo/src/olsrd_jsoninfo.h b/lib/jsoninfo/src/olsrd_jsoninfo.h
> index 8478f62..56acb70 100644
> --- a/lib/jsoninfo/src/olsrd_jsoninfo.h
> +++ b/lib/jsoninfo/src/olsrd_jsoninfo.h
> @@ -62,6 +62,7 @@ extern union olsr_ip_addr jsoninfo_accept_ip;
>   extern union olsr_ip_addr jsoninfo_listen_ip;
>   extern int ipc_port;
>   extern int nompr;
> +extern bool http_headers;
>
>   int olsrd_plugin_interface_version(void);
>   int olsrd_plugin_init(void);
> diff --git a/lib/jsoninfo/src/olsrd_plugin.c b/lib/jsoninfo/src/olsrd_plugin.c
> index 36550a8..03aa45f 100644
> --- a/lib/jsoninfo/src/olsrd_plugin.c
> +++ b/lib/jsoninfo/src/olsrd_plugin.c
> @@ -64,6 +64,7 @@ union olsr_ip_addr jsoninfo_accept_ip;
>   union olsr_ip_addr jsoninfo_listen_ip;
>   int ipc_port;
>   int nompr;
> +bool http_headers;
>
>   static void my_init(void) __attribute__ ((constructor));
>   static void my_fini(void) __attribute__ ((destructor));
> @@ -79,6 +80,7 @@ my_init(void)
>
>     /* defaults for parameters */
>     ipc_port = 9090;
> +  http_headers = false;
>     if (olsr_cnf->ip_version == AF_INET) {
>       jsoninfo_accept_ip.v4.s_addr = htonl(INADDR_LOOPBACK);
>       jsoninfo_listen_ip.v4.s_addr = htonl(INADDR_ANY);
> @@ -120,11 +122,26 @@ store_string(const char *value, void *data, set_plugin_parameter_addon addon __a
>     return 0;
>   }
>
> +static int
> +store_boolean(const char *value, void *data, set_plugin_parameter_addon addon __attribute__ ((unused)))
> +{
> +  bool *dest = data;
> +  if(strcmp(value, "yes") == 0)
> +    *dest = true;
> +  else if (strcmp(value, "no") == 0)
> +    *dest = false;
> +  else
> +    return 1; //error
> +
> +  return 0;
> +}
> +
>   static const struct olsrd_plugin_parameters plugin_parameters[] = {
>     {.name = "port",.set_plugin_parameter = &set_plugin_port,.data = &ipc_port},
>     {.name = "accept",.set_plugin_parameter = &set_plugin_ipaddress,.data = &jsoninfo_accept_ip},
>     {.name = "listen",.set_plugin_parameter = &set_plugin_ipaddress,.data = &jsoninfo_listen_ip},
>     {.name = "uuidfile",.set_plugin_parameter = &store_string,.data = uuidfile},
> +  {.name = "httpheaders",.set_plugin_parameter = &store_boolean,.data = &http_headers},
>   };
>
>   void
>

-- 
Ferry Huberts




More information about the Olsr-dev mailing list