Botan::HTTP Namespace Reference

Classes
struct	Case_Insensitive_Less
class	HTTP_Error
class	RequestLimits
class	Response

Typedefs
using	Headers = std::map<std::string, std::string, Case_Insensitive_Less>
typedef std::function< Response(std::string_view, std::string_view, std::string_view, std::optional< size_t >)>	http_exch_fn

Functions
Response	GET_sync (const URI &uri, const RequestLimits &limits)
Response	http_sync (const http_exch_fn &http_transact, std::string_view verb, const URI &uri, std::string_view content_type, const std::vector< uint8_t > &body, const RequestLimits &limits)
Response	http_sync (std::string_view verb, const URI &uri, std::string_view content_type, const std::vector< uint8_t > &body, const RequestLimits &limits)
std::ostream &	operator<< (std::ostream &o, const Response &resp)
Response	POST_sync (const URI &uri, std::string_view content_type, const std::vector< uint8_t > &body, const RequestLimits &limits)
Response	read_response_from_socket (OS::Socket &socket, std::chrono::milliseconds timeout, std::optional< size_t > max_body_size)
std::string	url_encode (std::string_view in)

Typedef Documentation

Headers

using Botan::HTTP::Headers = std::map<std::string, std::string, Case_Insensitive_Less>

Definition at line 61 of file http_util.h.

http_exch_fn

typedef std::function<Response(std::string_view, std::string_view, std::string_view, std::optional<size_t>)> Botan::HTTP::http_exch_fn

Definition at line 131 of file http_util.h.

Function Documentation

GET_sync()

Response BOTAN_TEST_API Botan::HTTP::GET_sync	(	const URI &	uri,
		const RequestLimits &	limits )

Definition at line 399 of file http_util.cpp.

                                                               {
   return http_sync("GET", uri, "", std::vector<uint8_t>(), limits);
}

References http_sync().

http_sync() [1/2]

Response BOTAN_TEST_API Botan::HTTP::http_sync	(	const http_exch_fn &	http_transact,
		std::string_view	verb,
		const URI &	uri,
		std::string_view	content_type,
		const std::vector< uint8_t > &	body,
		const RequestLimits &	limits )

Definition at line 296 of file http_util.cpp.

                                                {
   if(uri.scheme() != "http") {
      throw HTTP_Error(fmt("Cannot initiate HTTP request to URI with scheme of '{}'", uri.scheme()));
   }
 
   const auto& authority = uri.authority();
   if(!authority.has_value()) {
      throw HTTP_Error("Cannot initiate HTTP request to URI without authority");
   }
 
   check_no_crlf_nul("verb", verb);
   check_no_crlf_nul("content type", content_type);
 
   const std::string hostname = authority->host_to_string();
   const auto port = authority->port();
   const std::string service = port.has_value() ? std::to_string(*port) : uri.scheme();
 
   // RFC 9112 3.2.1: request-target origin-form is "absolute-path [ '?' query ]".
   // If the URI has an empty path, the client MUST send "/". Fragment is
   // excluded from the request-target per RFC 9110 7.1.
   std::string loc = uri.path().empty() ? "/" : uri.path();
   if(const auto& q = uri.query()) {
      loc += '?';
      loc += *q;
   }
 
   const std::string host_header = [&]() -> std::string {
      const std::string h = (authority->host_kind() == URI::HostKind::IPv6) ? "[" + hostname + "]" : hostname;
      return port.has_value() ? h + ":" + std::to_string(*port) : h;
   }();
 
   std::ostringstream outbuf;
 
   outbuf << verb << " " << loc << " HTTP/1.0\r\n";
   outbuf << "Host: " << host_header << "\r\n";
 
   if(verb == "GET") {
      outbuf << "Accept: */*\r\n";
      outbuf << "Cache-Control: no-cache\r\n";
   } else if(verb == "POST") {
      outbuf << "Content-Length: " << body.size() << "\r\n";
   }
 
   if(!content_type.empty()) {
      outbuf << "Content-Type: " << content_type << "\r\n";
   }
   outbuf << "Connection: close\r\n\r\n";
   outbuf.write(cast_uint8_ptr_to_char(body.data()), body.size());
 
   Response resp = http_transact(hostname, service, outbuf.str(), limits.max_body_size());
 
   const auto sc = resp.status_code();
   const bool is_redirect = (sc == 301 || sc == 302 || sc == 303 || sc == 307 || sc == 308);
   if(is_redirect) {
      const auto loc_it = resp.headers().find("Location");
      if(loc_it != resp.headers().end()) {
         if(limits.max_redirects() == 0) {
            throw HTTP_Error("HTTP redirection count exceeded");
         }
         auto redir = resolve_location(uri, loc_it->second);
         if(!redir) {
            throw HTTP_Error("HTTP redirected to invalid URL");
         }
         RequestLimits next = limits;
         next.set_max_redirects(limits.max_redirects() - 1);
 
         // 303 (RFC 9110 15.4.4) re-issues as GET; 301/302/307/308 preserve the
         // original method and content. The POST->GET downgrade allowed for
         // 301/302 by RFC 9110 15.4.2/3 exists for browser form-submission
         // legacy and would silently drop the request body, which is wrong here.
         //
         // The recursion goes through the same http_exch_fn so a test seam (or
         // any caller wrapping the network layer) sees every hop.
         if(sc == 303) {
            return http_sync(http_transact, "GET", *redir, "", std::vector<uint8_t>(), next);
         } else {
            return http_sync(http_transact, verb, *redir, content_type, body, next);
         }
      }
   }
 
   return resp;
}

References Botan::URI::authority(), Botan::cast_uint8_ptr_to_char(), Botan::fmt(), Botan::HTTP::Response::headers(), http_sync(), Botan::HTTP::RequestLimits::max_body_size(), Botan::HTTP::RequestLimits::max_redirects(), Botan::URI::path(), Botan::URI::query(), Botan::URI::scheme(), Botan::HTTP::RequestLimits::set_max_redirects(), and Botan::HTTP::Response::status_code().

Referenced by GET_sync(), http_sync(), http_sync(), and POST_sync().

http_sync() [2/2]

Response Botan::HTTP::http_sync	(	std::string_view	verb,
		const URI &	uri,
		std::string_view	content_type,
		const std::vector< uint8_t > &	body,
		const RequestLimits &	limits )

Definition at line 385 of file http_util.cpp.

                                                {
   auto transact_with_timeout =
      [timeout = limits.timeout()](
         std::string_view hostname, std::string_view service, std::string_view message, std::optional<size_t> mbs) {
         return http_transact(hostname, service, message, timeout, mbs);
      };
 
   return http_sync(transact_with_timeout, verb, uri, content_type, body, limits);
}

References http_sync(), and Botan::HTTP::RequestLimits::timeout().

operator<<()

BOTAN_TEST_API std::ostream & Botan::HTTP::operator<<	(	std::ostream &	o,
		const Response &	resp )

Definition at line 286 of file http_util.cpp.

                                                            {
   o << "HTTP " << resp.status_code() << " " << resp.status_message() << "\n";
   for(const auto& h : resp.headers()) {
      o << "Header '" << h.first << "' = '" << h.second << "'\n";
   }
   o << "Body " << std::to_string(resp.body().size()) << " bytes:\n";
   o.write(cast_uint8_ptr_to_char(resp.body().data()), resp.body().size());
   return o;
}

References Botan::HTTP::Response::body(), Botan::cast_uint8_ptr_to_char(), Botan::HTTP::Response::headers(), Botan::HTTP::Response::status_code(), and Botan::HTTP::Response::status_message().

POST_sync()

Response Botan::HTTP::POST_sync	(	const URI &	uri,
		std::string_view	content_type,
		const std::vector< uint8_t > &	body,
		const RequestLimits &	limits )

Definition at line 403 of file http_util.cpp.

                                                {
   return http_sync("POST", uri, content_type, body, limits);
}

References http_sync().

read_response_from_socket()

Response BOTAN_TEST_API Botan::HTTP::read_response_from_socket	(	OS::Socket &	socket,
		std::chrono::milliseconds	timeout,
		std::optional< size_t >	max_body_size )

Read a complete HTTP/1.0 response from an already-connected socket and return the parsed Response. Enforces header- and body-size limits during the read. Exposed via BOTAN_TEST_API so the parser can be exercised against a fake socket; production code reaches it through http_transact.

Definition at line 190 of file http_util.cpp.

                                                                      {
   const auto start_time = std::chrono::system_clock::now();
   const auto deadline_exceeded = [&] { return std::chrono::system_clock::now() - start_time > timeout; };
 
   if(deadline_exceeded()) {
      throw HTTP_Error("Timeout before reading response");
   }
 
   std::string buf;
   std::vector<uint8_t> chunk(DefaultBufferSize);
   size_t header_end = std::string::npos;
 
   while(header_end == std::string::npos) {
      const size_t got = socket.read(chunk.data(), chunk.size());
      if(got == 0) {
         throw HTTP_Error("Server closed connection before headers complete");
      }
      if(deadline_exceeded()) {
         throw HTTP_Error("Timeout while reading headers");
      }
      buf.append(cast_uint8_ptr_to_char(chunk.data()), got);
      header_end = buf.find("\r\n\r\n");
      if(header_end == std::string::npos && buf.size() > MaxHeaderBytes) {
         throw HTTP_Error("HTTP headers exceed maximum size");
      }
   }
 
   // Same cap re-checked once the terminator is found, since the terminator
   // can arrive in the chunk that crosses the limit.
   if(header_end > MaxHeaderBytes) {
      throw HTTP_Error("HTTP headers exceed maximum size");
   }
 
   auto parsed = parse_status_and_headers(std::string_view(buf).substr(0, header_end));
   const auto content_length = validate_response_headers(parsed.headers, max_body_size);
 
   const size_t body_cap = std::min(max_body_size.value_or(std::numeric_limits<size_t>::max()),
                                    content_length.value_or(std::numeric_limits<size_t>::max()));
 
   std::vector<uint8_t> body;
   if(content_length) {
      body.reserve(*content_length);
   }
   const size_t body_start = header_end + 4;
   if(body_start < buf.size()) {
      const size_t spill = buf.size() - body_start;
      if(spill > body_cap) {
         throw HTTP_Error("Response body exceeds maximum size");
      }
      body.insert(body.end(),
                  reinterpret_cast<const uint8_t*>(buf.data() + body_start),
                  reinterpret_cast<const uint8_t*>(buf.data() + buf.size()));
   }
 
   while(!content_length || body.size() < *content_length) {
      const size_t got = socket.read(chunk.data(), chunk.size());
      if(got == 0) {
         break;
      }
      if(deadline_exceeded()) {
         throw HTTP_Error("Timeout while reading body");
      }
      if(body.size() + got > body_cap) {
         throw HTTP_Error("Response body exceeds maximum size");
      }
      body.insert(body.end(), chunk.data(), chunk.data() + got);
   }
 
   if(content_length && body.size() != *content_length) {
      throw HTTP_Error(fmt("Content-Length disagreement, header says {} got {}", *content_length, body.size()));
   }
 
   return Response(parsed.status_code, std::move(parsed.status_message), std::move(body), std::move(parsed.headers));
}

References Botan::cast_uint8_ptr_to_char(), Botan::DefaultBufferSize, Botan::fmt(), and Botan::OS::Socket::read().

url_encode()

std::string BOTAN_TEST_API Botan::HTTP::url_encode

(

std::string_view

in

)

Definition at line 267 of file http_util.cpp.

                                        {
   constexpr auto needs_url_encoding = CharacterValidityTable::alpha_numeric_plus("-_.~").invert();
   constexpr std::string_view hex_digits = "0123456789ABCDEF";
 
   std::string out;
   out.reserve(in.size());
   for(const char c : in) {
      if(needs_url_encoding(c)) {
         const auto byte = static_cast<uint8_t>(c);
         out += '%';
         out += hex_digits[byte >> 4];
         out += hex_digits[byte & 0x0F];
      } else {
         out += c;
      }
   }
   return out;
}

References Botan::CharacterValidityTable::alpha_numeric_plus(), and Botan::CharacterValidityTable::invert().