# HG changeset patch # User JinNyung Kim # Date 1441350618 -32400 # Fri Sep 04 16:10:18 2015 +0900 # Node ID 75a68b581b8dc76a779773e83f5908093de208b1 # Parent ea892e00498fd4cf2a366732ecf77658fbeb7d1d Logging header information including spaces Using option "log_spaces_in_headers" diff -r ea892e00498f -r 75a68b581b8d src/http/ngx_http_request.c --- a/src/http/ngx_http_request.c Fri Sep 04 16:03:14 2015 +0900 +++ b/src/http/ngx_http_request.c Fri Sep 04 16:10:18 2015 +0900 @@ -1287,6 +1287,11 @@ h->value.data = r->header_start; h->value.data[h->value.len] = '\0'; + if (r->include_space_header && cscf->log_spaces_in_headers) { + ngx_log_error(NGX_LOG_ERR, c->log, 0, + "[Spaces in Header] %s=%s ", h->key.data, h->value.data); + } + h->lowcase_key = ngx_pnalloc(r->pool, h->key.len); if (h->lowcase_key == NULL) { ngx_http_close_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR); # HG changeset patch # User JinNyung Kim # Date 1441350194 -32400 # Fri Sep 04 16:03:14 2015 +0900 # Node ID ea892e00498fd4cf2a366732ecf77658fbeb7d1d # Parent 0e3a45ec2a3aacfe3076b87f5fe472f871f746e1 spaces in header name is permitted using http_core_module option "spaces_in_headers" like underscores_in_headers and logging its header name using option "log_spaces_in_headers" diff -r 0e3a45ec2a3a -r ea892e00498f src/http/modules/ngx_http_fastcgi_module.c --- a/src/http/modules/ngx_http_fastcgi_module.c Thu Sep 03 15:09:21 2015 +0300 +++ b/src/http/modules/ngx_http_fastcgi_module.c Fri Sep 04 16:03:14 2015 +0900 @@ -1829,7 +1829,7 @@ part_start = u->buffer.pos; part_end = u->buffer.last; - rc = ngx_http_parse_header_line(r, &u->buffer, 1); + rc = ngx_http_parse_header_line(r, &u->buffer, 1, 1); ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "http fastcgi parser: %d", rc); @@ -1874,7 +1874,7 @@ f->split_parts->nelts = 0; - rc = ngx_http_parse_header_line(r, &buf, 1); + rc = ngx_http_parse_header_line(r, &buf, 1, 1); if (rc != NGX_OK) { ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0, diff -r 0e3a45ec2a3a -r ea892e00498f src/http/modules/ngx_http_proxy_module.c --- a/src/http/modules/ngx_http_proxy_module.c Thu Sep 03 15:09:21 2015 +0300 +++ b/src/http/modules/ngx_http_proxy_module.c Fri Sep 04 16:03:14 2015 +0900 @@ -1754,7 +1754,7 @@ for ( ;; ) { - rc = ngx_http_parse_header_line(r, &r->upstream->buffer, 1); + rc = ngx_http_parse_header_line(r, &r->upstream->buffer, 1, 1); if (rc == NGX_OK) { diff -r 0e3a45ec2a3a -r ea892e00498f src/http/modules/ngx_http_scgi_module.c --- a/src/http/modules/ngx_http_scgi_module.c Thu Sep 03 15:09:21 2015 +0300 +++ b/src/http/modules/ngx_http_scgi_module.c Fri Sep 04 16:03:14 2015 +0900 @@ -1005,7 +1005,7 @@ for ( ;; ) { - rc = ngx_http_parse_header_line(r, &r->upstream->buffer, 1); + rc = ngx_http_parse_header_line(r, &r->upstream->buffer, 1, 1); if (rc == NGX_OK) { diff -r 0e3a45ec2a3a -r ea892e00498f src/http/modules/ngx_http_uwsgi_module.c --- a/src/http/modules/ngx_http_uwsgi_module.c Thu Sep 03 15:09:21 2015 +0300 +++ b/src/http/modules/ngx_http_uwsgi_module.c Fri Sep 04 16:03:14 2015 +0900 @@ -1208,7 +1208,7 @@ for ( ;; ) { - rc = ngx_http_parse_header_line(r, &r->upstream->buffer, 1); + rc = ngx_http_parse_header_line(r, &r->upstream->buffer, 1, 1); if (rc == NGX_OK) { diff -r 0e3a45ec2a3a -r ea892e00498f src/http/ngx_http.h --- a/src/http/ngx_http.h Thu Sep 03 15:09:21 2015 +0300 +++ b/src/http/ngx_http.h Fri Sep 04 16:03:14 2015 +0900 @@ -101,7 +101,7 @@ ngx_int_t ngx_http_parse_unsafe_uri(ngx_http_request_t *r, ngx_str_t *uri, ngx_str_t *args, ngx_uint_t *flags); ngx_int_t ngx_http_parse_header_line(ngx_http_request_t *r, ngx_buf_t *b, - ngx_uint_t allow_underscores); + ngx_uint_t allow_underscores, ngx_uint_t allow_spacebars); ngx_int_t ngx_http_parse_multi_header_lines(ngx_array_t *headers, ngx_str_t *name, ngx_str_t *value); ngx_int_t ngx_http_parse_set_cookie_lines(ngx_array_t *headers, diff -r 0e3a45ec2a3a -r ea892e00498f src/http/ngx_http_core_module.c --- a/src/http/ngx_http_core_module.c Thu Sep 03 15:09:21 2015 +0300 +++ b/src/http/ngx_http_core_module.c Fri Sep 04 16:03:14 2015 +0900 @@ -264,6 +264,20 @@ offsetof(ngx_http_core_srv_conf_t, underscores_in_headers), NULL }, + { ngx_string("spaces_in_headers"), + NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, + ngx_conf_set_flag_slot, + NGX_HTTP_SRV_CONF_OFFSET, + offsetof(ngx_http_core_srv_conf_t, spaces_in_headers), + NULL }, + + { ngx_string("log_spaces_in_headers"), + NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, + ngx_conf_set_flag_slot, + NGX_HTTP_SRV_CONF_OFFSET, + offsetof(ngx_http_core_srv_conf_t, log_spaces_in_headers), + NULL }, + { ngx_string("location"), NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_BLOCK|NGX_CONF_TAKE12, ngx_http_core_location, @@ -3493,6 +3507,8 @@ cscf->ignore_invalid_headers = NGX_CONF_UNSET; cscf->merge_slashes = NGX_CONF_UNSET; cscf->underscores_in_headers = NGX_CONF_UNSET; + cscf->spaces_in_headers = NGX_CONF_UNSET; + cscf->log_spaces_in_headers = NGX_CONF_UNSET; return cscf; } @@ -3536,6 +3552,12 @@ ngx_conf_merge_value(conf->underscores_in_headers, prev->underscores_in_headers, 0); + ngx_conf_merge_value(conf->spaces_in_headers, + prev->spaces_in_headers, 0); + + ngx_conf_merge_value(conf->log_spaces_in_headers, + prev->log_spaces_in_headers, 0); + if (conf->server_names.nelts == 0) { /* the array has 4 empty preallocated elements, so push cannot fail */ sn = ngx_array_push(&conf->server_names); diff -r 0e3a45ec2a3a -r ea892e00498f src/http/ngx_http_core_module.h --- a/src/http/ngx_http_core_module.h Thu Sep 03 15:09:21 2015 +0300 +++ b/src/http/ngx_http_core_module.h Fri Sep 04 16:03:14 2015 +0900 @@ -209,6 +209,8 @@ ngx_flag_t ignore_invalid_headers; ngx_flag_t merge_slashes; ngx_flag_t underscores_in_headers; + ngx_flag_t spaces_in_headers; + ngx_flag_t log_spaces_in_headers; unsigned listen:1; #if (NGX_PCRE) diff -r 0e3a45ec2a3a -r ea892e00498f src/http/ngx_http_parse.c --- a/src/http/ngx_http_parse.c Thu Sep 03 15:09:21 2015 +0300 +++ b/src/http/ngx_http_parse.c Fri Sep 04 16:03:14 2015 +0900 @@ -825,7 +825,7 @@ ngx_int_t ngx_http_parse_header_line(ngx_http_request_t *r, ngx_buf_t *b, - ngx_uint_t allow_underscores) + ngx_uint_t allow_underscores, ngx_uint_t allow_spacebars) { u_char c, ch, *p; ngx_uint_t hash, i; @@ -865,6 +865,7 @@ case sw_start: r->header_name_start = p; r->invalid_header = 0; + r->include_space_header = 0; switch (ch) { case CR: @@ -935,7 +936,9 @@ } if (ch == ':') { - r->header_name_end = p; + if (!r->include_space_header){ + r->header_name_end = p; + } state = sw_space_before_value; break; } @@ -969,6 +972,16 @@ return NGX_HTTP_PARSE_INVALID_HEADER; } + if (ch == ' ') { + if (allow_spacebars) { + if(!r->include_space_header) { + r->header_name_end = p; + r->include_space_header = 1; + } // second space : do nothing + break; + } + } + r->invalid_header = 1; break; diff -r 0e3a45ec2a3a -r ea892e00498f src/http/ngx_http_request.c --- a/src/http/ngx_http_request.c Thu Sep 03 15:09:21 2015 +0300 +++ b/src/http/ngx_http_request.c Fri Sep 04 16:03:14 2015 +0900 @@ -1251,7 +1251,8 @@ cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module); rc = ngx_http_parse_header_line(r, r->header_in, - cscf->underscores_in_headers); + cscf->underscores_in_headers, + cscf->spaces_in_headers); if (rc == NGX_OK) { diff -r 0e3a45ec2a3a -r ea892e00498f src/http/ngx_http_request.h --- a/src/http/ngx_http_request.h Thu Sep 03 15:09:21 2015 +0300 +++ b/src/http/ngx_http_request.h Fri Sep 04 16:03:14 2015 +0900 @@ -460,6 +460,7 @@ unsigned space_in_uri:1; unsigned invalid_header:1; + unsigned include_space_header:1; unsigned add_uri_to_alias:1; unsigned valid_location:1;