|
| 1 | +#!/usr/bin/env python3 |
| 2 | +"""Origin that sends a 301 without consuming the request body, then checks |
| 3 | +whether a reused connection carries leftover (corrupted) data. Handles |
| 4 | +multiple connections so that a fixed ATS can open a fresh one for the |
| 5 | +second request.""" |
| 6 | + |
| 7 | +# Licensed to the Apache Software Foundation (ASF) under one |
| 8 | +# or more contributor license agreements. See the NOTICE file |
| 9 | +# distributed with this work for additional information |
| 10 | +# regarding copyright ownership. The ASF licenses this file |
| 11 | +# to you under the Apache License, Version 2.0 (the |
| 12 | +# "License"); you may not use this file except in compliance |
| 13 | +# with the License. You may obtain a copy of the License at |
| 14 | +# |
| 15 | +# http://www.apache.org/licenses/LICENSE-2.0 |
| 16 | +# |
| 17 | +# Unless required by applicable law or agreed to in writing, software |
| 18 | +# distributed under the License is distributed on an "AS IS" BASIS, |
| 19 | +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 20 | +# See the License for the specific language governing permissions and |
| 21 | +# limitations under the License. |
| 22 | + |
| 23 | +import argparse |
| 24 | +import socket |
| 25 | +import sys |
| 26 | +import threading |
| 27 | +import time |
| 28 | + |
| 29 | +VALID_METHODS = {'GET', 'POST', 'PUT', 'DELETE', 'HEAD', 'OPTIONS', 'PATCH'} |
| 30 | + |
| 31 | + |
| 32 | +def read_until_headers_complete(conn: socket.socket) -> bytes: |
| 33 | + data = b'' |
| 34 | + while b'\r\n\r\n' not in data: |
| 35 | + chunk = conn.recv(4096) |
| 36 | + if not chunk: |
| 37 | + return data |
| 38 | + data += chunk |
| 39 | + return data |
| 40 | + |
| 41 | + |
| 42 | +def is_valid_http_request_line(line: str) -> bool: |
| 43 | + parts = line.strip().split(' ') |
| 44 | + if len(parts) < 3: |
| 45 | + return False |
| 46 | + return parts[0] in VALID_METHODS and parts[-1].startswith('HTTP/') |
| 47 | + |
| 48 | + |
| 49 | +def send_200(conn: socket.socket) -> None: |
| 50 | + ok_body = b'OK' |
| 51 | + conn.sendall(b'HTTP/1.1 200 OK\r\n' |
| 52 | + b'Content-Length: ' + str(len(ok_body)).encode() + b'\r\n' |
| 53 | + b'\r\n' + ok_body) |
| 54 | + |
| 55 | + |
| 56 | +def handle_connection(conn: socket.socket, args: argparse.Namespace, result: dict) -> None: |
| 57 | + try: |
| 58 | + data = read_until_headers_complete(conn) |
| 59 | + if not data: |
| 60 | + # Readiness probe. |
| 61 | + conn.close() |
| 62 | + return |
| 63 | + |
| 64 | + first_line = data.split(b'\r\n')[0].decode('utf-8', errors='replace') |
| 65 | + |
| 66 | + if first_line.startswith('POST'): |
| 67 | + # First request: send 301 without consuming the body. |
| 68 | + time.sleep(args.delay) |
| 69 | + |
| 70 | + body = b'Redirecting' |
| 71 | + response = ( |
| 72 | + b'HTTP/1.1 301 Moved Permanently\r\n' |
| 73 | + b'Location: http://example.com/\r\n' |
| 74 | + b'Connection: keep-alive\r\n' |
| 75 | + b'Content-Length: ' + str(len(body)).encode() + b'\r\n' |
| 76 | + b'\r\n' + body) |
| 77 | + conn.sendall(response) |
| 78 | + |
| 79 | + # Wait for potential reuse on this connection. |
| 80 | + conn.settimeout(args.timeout) |
| 81 | + try: |
| 82 | + second_data = b'' |
| 83 | + while b'\r\n' not in second_data: |
| 84 | + chunk = conn.recv(4096) |
| 85 | + if not chunk: |
| 86 | + break |
| 87 | + second_data += chunk |
| 88 | + |
| 89 | + if second_data: |
| 90 | + second_line = second_data.split(b'\r\n')[0].decode('utf-8', errors='replace') |
| 91 | + if is_valid_http_request_line(second_line): |
| 92 | + send_200(conn) |
| 93 | + else: |
| 94 | + result['corrupted'] = True |
| 95 | + err_body = b'corrupted' |
| 96 | + conn.sendall( |
| 97 | + b'HTTP/1.1 400 Bad Request\r\n' |
| 98 | + b'Content-Length: ' + str(len(err_body)).encode() + b'\r\n' |
| 99 | + b'\r\n' + err_body) |
| 100 | + except socket.timeout: |
| 101 | + pass |
| 102 | + |
| 103 | + elif first_line.startswith('GET'): |
| 104 | + # Second request on a new connection (fix is working). |
| 105 | + result['new_connection'] = True |
| 106 | + send_200(conn) |
| 107 | + |
| 108 | + conn.close() |
| 109 | + except Exception: |
| 110 | + try: |
| 111 | + conn.close() |
| 112 | + except Exception: |
| 113 | + pass |
| 114 | + |
| 115 | + |
| 116 | +def main() -> int: |
| 117 | + parser = argparse.ArgumentParser() |
| 118 | + parser.add_argument('port', type=int) |
| 119 | + parser.add_argument('--delay', type=float, default=1.0) |
| 120 | + parser.add_argument('--timeout', type=float, default=5.0) |
| 121 | + args = parser.parse_args() |
| 122 | + |
| 123 | + sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) |
| 124 | + sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) |
| 125 | + sock.bind(('', args.port)) |
| 126 | + sock.listen(5) |
| 127 | + sock.settimeout(args.timeout + 5) |
| 128 | + |
| 129 | + result = {'corrupted': False, 'new_connection': False} |
| 130 | + threads = [] |
| 131 | + connections_handled = 0 |
| 132 | + |
| 133 | + try: |
| 134 | + while connections_handled < 10: |
| 135 | + try: |
| 136 | + conn, _ = sock.accept() |
| 137 | + t = threading.Thread(target=handle_connection, args=(conn, args, result)) |
| 138 | + t.daemon = True |
| 139 | + t.start() |
| 140 | + threads.append(t) |
| 141 | + connections_handled += 1 |
| 142 | + except socket.timeout: |
| 143 | + break |
| 144 | + except Exception: |
| 145 | + pass |
| 146 | + |
| 147 | + for t in threads: |
| 148 | + t.join(timeout=args.timeout + 2) |
| 149 | + |
| 150 | + sock.close() |
| 151 | + return 0 |
| 152 | + |
| 153 | + |
| 154 | +if __name__ == '__main__': |
| 155 | + sys.exit(main()) |
0 commit comments