ex_http_req.c

n_http_req regression: valid requests parse, and the smuggling / malformed / oversized cases are rejected.

n_http_req regression: valid requests parse, and the smuggling / malformed / oversized cases are rejected.

Author

Castagnier Mickael

Version

1.0

/*
 * Nilorea Library
 * Copyright (C) 2005-2026 Castagnier Mickael
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
 * implied. See the License for the specific language governing
 * permissions and limitations under the License.
 *
 * SPDX-License-Identifier: Apache-2.0
 */

 
#include "nilorea/n_http_req.h"
#include "nilorea/n_log.h"
 
#include <string.h>
 
static int failures = 0;
 
/* Parse a NUL-terminated request literal (its byte length is the wire length). */
static n_http_req_status parse(const char* s, n_http_request* out) {
    return n_http_request_parse(s, strlen(s), out);
}
 
#define WANT(expr, want, msg)                  \
    do {                                       \
        if ((expr) != (want)) {                \
            n_log(LOG_ERR, "FAIL: %s", (msg)); \
            failures++;                        \
        }                                      \
    } while (0)
 
int main(void) {
    n_http_request r;
    set_log_level(LOG_NOTICE);
 
    /* a valid GET */
    WANT(parse("GET /v1/me?x=1 HTTP/1.1\r\nHost: e\r\n\r\n", &r), N_HTTP_REQ_OK,
         "valid GET should parse");
    WANT(r.method, N_HTTP_REQ_GET, "method GET");
    if (strcmp(r.path, "/v1/me?x=1") != 0) {
        n_log(LOG_ERR, "FAIL: GET path");
        failures++;
    }
 
    /* a valid POST with a body + an Authorization header */
    WANT(parse("POST /v1/send HTTP/1.1\r\nContent-Length: 5\r\n"
               "Authorization: Bearer tok\r\n\r\nhello",
               &r),
         N_HTTP_REQ_OK, "valid POST should parse");
    WANT(r.method, N_HTTP_REQ_POST, "method POST");
    if (r.content_length != 5) {
        n_log(LOG_ERR, "FAIL: content_length");
        failures++;
    }
    if (strcmp(r.authorization, "Bearer tok") != 0) {
        n_log(LOG_ERR, "FAIL: authorization capture");
        failures++;
    }
 
    /* rejections */
    WANT(parse("PUT / HTTP/1.1\r\n\r\n", &r), N_HTTP_REQ_ERROR,
         "unsupported method rejected");
    WANT(parse("GET http://e/x HTTP/1.1\r\n\r\n", &r), N_HTTP_REQ_ERROR,
         "non-origin-form target rejected");
    WANT(parse("GET /a#frag HTTP/1.1\r\n\r\n", &r), N_HTTP_REQ_ERROR,
         "fragment in target rejected");
    WANT(parse("GET / HTTP/2.0\r\n\r\n", &r), N_HTTP_REQ_ERROR,
         "unsupported version rejected");
    WANT(parse("POST / HTTP/1.1\r\nTransfer-Encoding: chunked\r\n\r\n", &r),
         N_HTTP_REQ_ERROR, "Transfer-Encoding rejected (smuggling)");
    WANT(parse("POST / HTTP/1.1\r\nContent-Length: 1\r\nContent-Length: 2\r\n"
               "\r\n",
               &r),
         N_HTTP_REQ_ERROR, "duplicate Content-Length rejected (smuggling)");
    WANT(parse("POST / HTTP/1.1\r\nContent-Length: abc\r\n\r\n", &r),
         N_HTTP_REQ_ERROR, "non-numeric Content-Length rejected");
 
    /* incomplete: no CRLFCRLF yet, still under the cap -> read more */
    WANT(parse("GET / HTTP/1.1\r\nHost: e", &r), N_HTTP_REQ_INCOMPLETE,
         "partial head is INCOMPLETE");
    /* shorter than the CRLFCRLF terminator: still just "read more" */
    WANT(n_http_request_parse("", 0, &r), N_HTTP_REQ_INCOMPLETE,
         "empty buffer is INCOMPLETE");
    WANT(n_http_request_parse("\r\n\r", 3, &r), N_HTTP_REQ_INCOMPLETE,
         "buffer shorter than CRLFCRLF is INCOMPLETE");
 
    /* NULL args */
    WANT(n_http_request_parse(NULL, 0, &r), N_HTTP_REQ_ERROR, "NULL buf");
 
    if (failures) {
        n_log(LOG_ERR, "ex_http_req: %d failure(s)", failures);
        return 1;
    }
    n_log(LOG_NOTICE, "ex_http_req: all checks passed");
    return 0;
}