/* Licensed to the Apache Software Foundation (ASF) under one or more

 * contributor license agreements.  See the NOTICE file distributed with

 * this work for additional information regarding copyright ownership.

 * The ASF licenses this file to You under the Apache License, Version 2.0

 * (the "License"); you may not use this file except in compliance with

 * the License.  You may obtain a copy of the License at

 *

 *     http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */

/*

 * protocol.c --- routines which directly communicate with the client.

 *

 * Code originally by Rob McCool; much redone by Robert S. Thau

 * and the Apache Software Foundation.

 */

#include "apr.h"

#include "apr_strings.h"

#include "apr_buckets.h"

#include "apr_lib.h"

#include "apr_signal.h"

#include "apr_strmatch.h"

#define APR_WANT_STDIO          /* for sscanf */

#define APR_WANT_STRFUNC

#define APR_WANT_MEMFUNC

#include "apr_want.h"

#include "util_filter.h"

#include "ap_config.h"

#include "httpd.h"

#include "http_config.h"

#include "http_core.h"

#include "http_protocol.h"

#include "http_main.h"

#include "http_request.h"

#include "http_vhost.h"

#include "http_log.h"           /* For errors detected in basic auth common

                                 * support code... */

#include "mod_core.h"

#include "util_charset.h"

#include "util_ebcdic.h"

#include "scoreboard.h"

#if APR_HAVE_STDARG_H

#include <stdarg.h>

#endif

#if APR_HAVE_UNISTD_H

#include <unistd.h>

#endif

/* we know core's module_index is 0 */

#undef APLOG_MODULE_INDEX

#define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX

APR_HOOK_STRUCT(

    APR_HOOK_LINK(pre_read_request)

    APR_HOOK_LINK(post_read_request)

    APR_HOOK_LINK(log_transaction)

    APR_HOOK_LINK(http_scheme)

    APR_HOOK_LINK(default_port)

    APR_HOOK_LINK(note_auth_failure)

    APR_HOOK_LINK(protocol_propose)

    APR_HOOK_LINK(protocol_switch)

    APR_HOOK_LINK(protocol_get)

)

AP_DECLARE_DATA ap_filter_rec_t *ap_old_write_func = NULL;

/* Patterns to match in ap_make_content_type() */

static const char *needcset[] = {

    "text/plain",

    "text/html",

    NULL

};

static const apr_strmatch_pattern **needcset_patterns;

static const apr_strmatch_pattern *charset_pattern;

AP_DECLARE(void) ap_setup_make_content_type(apr_pool_t *pool)

{

    int i;

    for (i = 0; needcset[i]; i++) {

        continue;

    }

    needcset_patterns = (const apr_strmatch_pattern **)

        apr_palloc(pool, (i + 1) * sizeof(apr_strmatch_pattern *));

    for (i = 0; needcset[i]; i++) {

        needcset_patterns[i] = apr_strmatch_precompile(pool, needcset[i], 0);

    }

    needcset_patterns[i] = NULL;

    charset_pattern = apr_strmatch_precompile(pool, "charset=", 0);

}

/*

 * Builds the content-type that should be sent to the client from the

 * content-type specified.  The following rules are followed:

 *    - if type is NULL or "", return NULL (do not set content-type).

 *    - if charset adding is disabled, stop processing and return type.

 *    - then, if there are no parameters on type, add the default charset

 *    - return type

 */

AP_DECLARE(const char *)ap_make_content_type(request_rec *r, const char *type)

{

    const apr_strmatch_pattern **pcset;

    core_dir_config *conf =

        (core_dir_config *)ap_get_core_module_config(r->per_dir_config);

    core_request_config *request_conf;

    apr_size_t type_len;

    if (!type || *type == '\0') {

        return NULL;

    }

    if (conf->add_default_charset != ADD_DEFAULT_CHARSET_ON) {

        return type;

    }

    request_conf = ap_get_core_module_config(r->request_config);

    if (request_conf->suppress_charset) {

        return type;

    }

    type_len = strlen(type);

    if (apr_strmatch(charset_pattern, type, type_len) != NULL) {

        /* already has parameter, do nothing */

        /* XXX we don't check the validity */

        ;

    }

    else {

        /* see if it makes sense to add the charset. At present,

         * we only add it if the Content-type is one of needcset[]

         */

        for (pcset = needcset_patterns; *pcset ; pcset++) {

            if (apr_strmatch(*pcset, type, type_len) != NULL) {

                struct iovec concat[3];

                concat[0].iov_base = (void *)type;

                concat[0].iov_len = type_len;

                concat[1].iov_base = (void *)"; charset=";

                concat[1].iov_len = sizeof("; charset=") - 1;

                concat[2].iov_base = (void *)(conf->add_default_charset_name);

                concat[2].iov_len = strlen(conf->add_default_charset_name);

                type = apr_pstrcatv(r->pool, concat, 3, NULL);

                break;

            }

        }

    }

    return type;

}

AP_DECLARE(void) ap_set_content_length(request_rec *r, apr_off_t clength)

{

    r->clength = clength;

    apr_table_setn(r->headers_out, "Content-Length",

                   apr_off_t_toa(r->pool, clength));

}

/*

 * Return the latest rational time from a request/mtime (modification time)

 * pair.  We return the mtime unless it's in the future, in which case we

 * return the current time.  We use the request time as a reference in order

 * to limit the number of calls to time().  We don't check for futurosity

 * unless the mtime is at least as new as the reference.

 */

AP_DECLARE(apr_time_t) ap_rationalize_mtime(request_rec *r, apr_time_t mtime)

{

    apr_time_t now;

    /* For all static responses, it's almost certain that the file was

     * last modified before the beginning of the request.  So there's

     * no reason to call time(NULL) again.  But if the response has been

     * created on demand, then it might be newer than the time the request

     * started.  In this event we really have to call time(NULL) again

     * so that we can give the clients the most accurate Last-Modified.  If we

     * were given a time in the future, we return the current time - the

     * Last-Modified can't be in the future.

     */

    now = (mtime < r->request_time) ? r->request_time : apr_time_now();

    return (mtime > now) ? now : mtime;

}

/* Get a line of protocol input, including any continuation lines

 * caused by MIME folding (or broken clients) if fold != 0, and place it

 * in the buffer s, of size n bytes, without the ending newline.

 * 

 * Pulls from r->proto_input_filters instead of r->input_filters for

 * stricter protocol adherence and better input filter behavior during

 * chunked trailer processing (for http).

 *

 * If s is NULL, ap_rgetline_core will allocate necessary memory from r->pool.

 *

 * Returns APR_SUCCESS if there are no problems and sets *read to be

 * the full length of s.

 *

 * APR_ENOSPC is returned if there is not enough buffer space.

 * Other errors may be returned on other errors.

 *

 * The [CR]LF are *not* returned in the buffer.  Therefore, a *read of 0

 * indicates that an empty line was read.

 *

 * Notes: Because the buffer uses 1 char for NUL, the most we can return is

 *        (n - 1) actual characters.

 *

 *        If no LF is detected on the last line due to a dropped connection

 *        or a full buffer, that's considered an error.

 */

AP_DECLARE(apr_status_t) ap_rgetline_core(char **s, apr_size_t n,

                                          apr_size_t *read, request_rec *r,

                                          int flags, apr_bucket_brigade *bb)

{

    apr_status_t rv;

    apr_bucket *e;

    apr_size_t bytes_handled = 0, current_alloc = 0;

    char *pos, *last_char = *s;

    int do_alloc = (*s == NULL), saw_eos = 0;

    int fold = flags & AP_GETLINE_FOLD;

    int crlf = flags & AP_GETLINE_CRLF;

    int nospc_eol = flags & AP_GETLINE_NOSPC_EOL;

    int saw_eol = 0, saw_nospc = 0;

    if (!n) {

        /* Needs room for NUL byte at least */

        *read = 0;

        return APR_BADARG;

    }

    /*

     * Initialize last_char as otherwise a random value will be compared

     * against APR_ASCII_LF at the end of the loop if bb only contains

     * zero-length buckets.

     */

    if (last_char)

        *last_char = '\0';

    do {

        apr_brigade_cleanup(bb);

        rv = ap_get_brigade(r->proto_input_filters, bb, AP_MODE_GETLINE,

                            APR_BLOCK_READ, 0);

        if (rv != APR_SUCCESS) {

            goto cleanup;

        }

        /* Something horribly wrong happened.  Someone didn't block! 

         * (this also happens at the end of each keepalive connection)

         */

        if (APR_BRIGADE_EMPTY(bb)) {

            rv = APR_EGENERAL;

            goto cleanup;

        }

        for (e = APR_BRIGADE_FIRST(bb);

             e != APR_BRIGADE_SENTINEL(bb);

             e = APR_BUCKET_NEXT(e))

        {

            const char *str;

            apr_size_t len;

            /* If we see an EOS, don't bother doing anything more. */

            if (APR_BUCKET_IS_EOS(e)) {

                saw_eos = 1;

                break;

            }

            rv = apr_bucket_read(e, &str, &len, APR_BLOCK_READ);

            if (rv != APR_SUCCESS) {

                goto cleanup;

            }

            if (len == 0) {

                /* no use attempting a zero-byte alloc (hurts when

                 * using --with-efence --enable-pool-debug) or

                 * doing any of the other logic either

                 */

                continue;

            }

            /* Would this overrun our buffer?  If so, we'll die. */

            if (n < bytes_handled + len) {

                /* Before we die, let's fill the buffer up to its limit (i.e.

                 * fall through with the remaining length, if any), setting

                 * saw_eol on LF to stop the outer loop appropriately; we may

                 * come back here once the buffer is filled (no LF seen), and

                 * either be done at that time or continue to wait for LF here

                 * if nospc_eol is set.

                 *

                 * But there is also a corner cases which we want to address,

                 * namely if the buffer is overrun by the final LF only (i.e.

                 * the CR fits in); this is not really an overrun since we'll

                 * strip the CR finally (and use it for NUL byte), but anyway

                 * we have to handle the case so that it's not returned to the

                 * caller as part of the truncated line (it's not!). This is

                 * easier to consider that LF is out of counting and thus fall

                 * through with no error (saw_eol is set to 2 so that we later

                 * ignore LF handling already done here), while folding and

                 * nospc_eol logics continue to work (or fail) appropriately.

                 */

                saw_eol = (str[len - 1] == APR_ASCII_LF);

                if (/* First time around */

                    saw_eol && !saw_nospc

                    /*  Single LF completing the buffered CR, */

                    && ((len == 1 && ((*s)[bytes_handled - 1] == APR_ASCII_CR))

                    /*  or trailing CRLF overuns by LF only */

                        || (len > 1 && str[len - 2] == APR_ASCII_CR

                            && n - bytes_handled + 1 == len))) {

                    /* In both cases *last_char is (to be) the CR stripped by

                     * later 'bytes_handled = last_char - *s'.

                     */

                    saw_eol = 2;

                }

                else {

                    /* In any other case we'd lose data. */

                    rv = APR_ENOSPC;

                    saw_nospc = 1;

                }

                len = n - bytes_handled;

                if (!len) {

                    if (saw_eol) {

                        break;

                    }

                    if (nospc_eol) {

                        continue;

                    }

                    goto cleanup;

                }

            }

            /* Do we have to handle the allocation ourselves? */

            if (do_alloc) {

                /* We'll assume the common case where one bucket is enough. */

                if (!*s) {

                    current_alloc = len;

                    *s = apr_palloc(r->pool, current_alloc + 1);

                }

                else if (bytes_handled + len > current_alloc) {

                    /* Increase the buffer size */

                    apr_size_t new_size = current_alloc * 2;

                    char *new_buffer;

                    if (bytes_handled + len > new_size) {

                        new_size = (bytes_handled + len) * 2;

                    }

                    new_buffer = apr_palloc(r->pool, new_size + 1);

                    /* Copy what we already had. */

                    memcpy(new_buffer, *s, bytes_handled);

                    current_alloc = new_size;

                    *s = new_buffer;

                }

            }

            /* Just copy the rest of the data to the end of the old buffer. */

            pos = *s + bytes_handled;

            memcpy(pos, str, len);

            last_char = pos + len - 1;

            /* We've now processed that new data - update accordingly. */

            bytes_handled += len;

        }

        /* If we got a full line of input, stop reading */

        if (last_char && (*last_char == APR_ASCII_LF)) {

            saw_eol = 1;

        }

    } while (!saw_eol);

    if (rv != APR_SUCCESS) {

        /* End of line after APR_ENOSPC above */

        goto cleanup;

    }

    /* Now terminate the string at the end of the line;

     * if the last-but-one character is a CR, terminate there.

     * LF is handled above (not accounted) when saw_eol == 2,

     * the last char is CR to terminate at still.

     */

    if (saw_eol < 2) {

        if (last_char > *s && last_char[-1] == APR_ASCII_CR) {

            last_char--;

        }

        else if (crlf) {

            rv = APR_EINVAL;

            goto cleanup;

        }

    }

    bytes_handled = last_char - *s;

    /* If we're folding, we have more work to do.

     *

     * Note that if an EOS was seen, we know we can't have another line.

     */

    if (fold && bytes_handled && !saw_eos) {

        for (;;) {

            const char *str;

            apr_size_t len;

            char c;

            /* Clear the temp brigade for this filter read. */

            apr_brigade_cleanup(bb);

            /* We only care about the first byte. */

            rv = ap_get_brigade(r->proto_input_filters, bb, AP_MODE_SPECULATIVE,

                                APR_BLOCK_READ, 1);

            if (rv != APR_SUCCESS) {

                goto cleanup;

            }

            if (APR_BRIGADE_EMPTY(bb)) {

                break;

            }

            e = APR_BRIGADE_FIRST(bb);

            /* If we see an EOS, don't bother doing anything more. */

            if (APR_BUCKET_IS_EOS(e)) {

                break;

            }

            rv = apr_bucket_read(e, &str, &len, APR_BLOCK_READ);

            if (rv != APR_SUCCESS) {

                apr_brigade_cleanup(bb);

                goto cleanup;

            }

            /* Found one, so call ourselves again to get the next line.

             *

             * FIXME: If the folding line is completely blank, should we

             * stop folding?  Does that require also looking at the next

             * char?

             */

            /* When we call destroy, the buckets are deleted, so save that

             * one character we need.  This simplifies our execution paths

             * at the cost of one character read.

             */

            c = *str;

            if (c == APR_ASCII_BLANK || c == APR_ASCII_TAB) {

                /* Do we have enough space? We may be full now. */

                if (bytes_handled >= n) {

                    rv = APR_ENOSPC;

                    goto cleanup;

                }

                else {

                    apr_size_t next_size, next_len;

                    char *tmp;

                    /* If we're doing the allocations for them, we have to

                     * give ourselves a NULL and copy it on return.

                     */

                    if (do_alloc) {

                        tmp = NULL;

                    }

                    else {

                        tmp = last_char;

                    }

                    next_size = n - bytes_handled;

                    rv = ap_rgetline_core(&tmp, next_size, &next_len, r,

                                          flags & ~AP_GETLINE_FOLD, bb);

                    if (rv != APR_SUCCESS) {

                        goto cleanup;

                    }

                    if (do_alloc && next_len > 0) {

                        char *new_buffer;

                        apr_size_t new_size = bytes_handled + next_len + 1;

                        /* we need to alloc an extra byte for a null */

                        new_buffer = apr_palloc(r->pool, new_size);

                        /* Copy what we already had. */

                        memcpy(new_buffer, *s, bytes_handled);

                        /* copy the new line, including the trailing null */

                        memcpy(new_buffer + bytes_handled, tmp, next_len);

                        *s = new_buffer;

                    }

                    last_char += next_len;

                    bytes_handled += next_len;

                }

            }

            else { /* next character is not tab or space */

                break;

            }

        }

    }

cleanup:

    if (bytes_handled >= n) {

        bytes_handled = n - 1;

    }

    *read = bytes_handled;

    if (*s) {

        /* ensure the string is NUL terminated */

        (*s)[*read] = '\0';

        /* PR#43039: We shouldn't accept NULL bytes within the line */

        bytes_handled = strlen(*s);

        if (bytes_handled < *read) {

            *read = bytes_handled;

            if (rv == APR_SUCCESS) {

                rv = APR_EINVAL;

            }

        }

    }

    return rv;

}

#if APR_CHARSET_EBCDIC

AP_DECLARE(apr_status_t) ap_rgetline(char **s, apr_size_t n,

                                     apr_size_t *read, request_rec *r,

                                     int fold, apr_bucket_brigade *bb)

{

    /* on ASCII boxes, ap_rgetline is a macro which simply invokes

     * ap_rgetline_core with the same parms

     *

     * on EBCDIC boxes, each complete http protocol input line needs to be

     * translated into the code page used by the compiler.  Since

     * ap_rgetline_core uses recursion, we do the translation in a wrapper

     * function to ensure that each input character gets translated only once.

     */

    apr_status_t rv;

    rv = ap_rgetline_core(s, n, read, r, fold, bb);

    if (rv == APR_SUCCESS || APR_STATUS_IS_ENOSPC(rv)) {

        ap_xlate_proto_from_ascii(*s, *read);

    }

    return rv;

}

#endif

AP_DECLARE(int) ap_getline(char *s, int n, request_rec *r, int flags)

{

    char *tmp_s = s;

    apr_status_t rv;

    apr_size_t len;

    apr_bucket_brigade *tmp_bb;

    if (n < 1) {

        /* Can't work since we always NUL terminate */

        return -1;

    }

    tmp_bb = apr_brigade_create(r->pool, r->connection->bucket_alloc);

    rv = ap_rgetline(&tmp_s, n, &len, r, flags, tmp_bb);

    apr_brigade_destroy(tmp_bb);

    /* Map the out-of-space condition to the old API. */

    if (rv == APR_ENOSPC) {

        return n;

    }

    /* Anything else is just bad. */

    if (rv != APR_SUCCESS) {

        return -1;

    }

    return (int)len;

}

/* parse_uri: break apart the uri

 * Side Effects:

 * - sets r->args to rest after '?' (or NULL if no '?')

 * - sets r->uri to request uri (without r->args part)

 * - sets r->hostname (if not set already) from request (scheme://host:port)

 */

AP_CORE_DECLARE(void) ap_parse_uri(request_rec *r, const char *uri)

{

    int status = HTTP_OK;

    r->unparsed_uri = apr_pstrdup(r->pool, uri);

    /* http://issues.apache.org/bugzilla/show_bug.cgi?id=31875

     * http://issues.apache.org/bugzilla/show_bug.cgi?id=28450

     *

     * This is not in fact a URI, it's a path.  That matters in the

     * case of a leading double-slash.  We need to resolve the issue

     * by normalizing that out before treating it as a URI.

     */

    while ((uri[0] == '/') && (uri[1] == '/')) {

        ++uri ;

    }

    if (r->method_number == M_CONNECT) {

        status = apr_uri_parse_hostinfo(r->pool, uri, &r->parsed_uri);

    }

    else {

        status = apr_uri_parse(r->pool, uri, &r->parsed_uri);

    }

    if (status == APR_SUCCESS) {

        /* if it has a scheme we may need to do absoluteURI vhost stuff */

        if (r->parsed_uri.scheme

            && !strcasecmp(r->parsed_uri.scheme, ap_http_scheme(r))) {

            r->hostname = r->parsed_uri.hostname;

        }

        else if (r->method_number == M_CONNECT) {

            r->hostname = r->parsed_uri.hostname;

        }

        r->args = r->parsed_uri.query;

        r->uri = r->parsed_uri.path ? r->parsed_uri.path

                 : apr_pstrdup(r->pool, "/");

#if defined(OS2) || defined(WIN32)

        /* Handle path translations for OS/2 and plug security hole.

         * This will prevent "http://www.wherever.com/..\..\/" from

         * returning a directory for the root drive.

         */

        {

            char *x;

            for (x = r->uri; (x = strchr(x, '\\')) != NULL; )

                *x = '/';

        }

#endif /* OS2 || WIN32 */

    }

    else {

        r->args = NULL;

        r->hostname = NULL;

        r->status = HTTP_BAD_REQUEST;             /* set error status */

        r->uri = apr_pstrdup(r->pool, uri);

    }

}

/* get the length of the field name for logging, but no more than 80 bytes */

#define LOG_NAME_MAX_LEN 80

static int field_name_len(const char *field)

{

    const char *end = ap_strchr_c(field, ':');

    if (end == NULL || end - field > LOG_NAME_MAX_LEN)

        return LOG_NAME_MAX_LEN;

    return end - field;

}

static int read_request_line(request_rec *r, apr_bucket_brigade *bb)

{

    enum {

        rrl_none, rrl_badmethod, rrl_badwhitespace, rrl_excesswhitespace,

        rrl_missinguri, rrl_baduri, rrl_badprotocol, rrl_trailingtext,

        rrl_badmethod09, rrl_reject09

    } deferred_error = rrl_none;

    char *ll;

    char *uri;

    apr_size_t len;

    int num_blank_lines = DEFAULT_LIMIT_BLANK_LINES;

    core_server_config *conf = ap_get_core_module_config(r->server->module_config);

    int strict = (conf->http_conformance != AP_HTTP_CONFORMANCE_UNSAFE);

    /* Read past empty lines until we get a real request line,

     * a read error, the connection closes (EOF), or we timeout.

     *

     * We skip empty lines because browsers have to tack a CRLF on to the end

     * of POSTs to support old CERN webservers.  But note that we may not

     * have flushed any previous response completely to the client yet.

     * We delay the flush as long as possible so that we can improve

     * performance for clients that are pipelining requests.  If a request

     * is pipelined then we won't block during the (implicit) read() below.

     * If the requests aren't pipelined, then the client is still waiting

     * for the final buffer flush from us, and we will block in the implicit

     * read().  B_SAFEREAD ensures that the BUFF layer flushes if it will

     * have to block during a read.

     */

    do {

        apr_status_t rv;

        /* ensure ap_rgetline allocates memory each time thru the loop

         * if there are empty lines

         */

        r->the_request = NULL;

        rv = ap_rgetline(&(r->the_request), (apr_size_t)(r->server->limit_req_line + 2),

                         &len, r, strict ? AP_GETLINE_CRLF : 0, bb);

        if (rv != APR_SUCCESS) {

            r->request_time = apr_time_now();

            /* ap_rgetline returns APR_ENOSPC if it fills up the

             * buffer before finding the end-of-line.  This is only going to

             * happen if it exceeds the configured limit for a request-line.

             */

            if (APR_STATUS_IS_ENOSPC(rv)) {

                r->status = HTTP_REQUEST_URI_TOO_LARGE;

            }

            else if (APR_STATUS_IS_TIMEUP(rv)) {

                r->status = HTTP_REQUEST_TIME_OUT;

            }

            else if (APR_STATUS_IS_EINVAL(rv)) {

                r->status = HTTP_BAD_REQUEST;

            }

            r->proto_num = HTTP_VERSION(1,0);

            r->protocol  = apr_pstrdup(r->pool, "HTTP/1.0");

            return 0;

        }

    } while ((len <= 0) && (--num_blank_lines >= 0));

    if (APLOGrtrace5(r)) {

        ap_log_rerror(APLOG_MARK, APLOG_TRACE5, 0, r,

                      "Request received from client: %s",

                      ap_escape_logitem(r->pool, r->the_request));

    }

    r->request_time = apr_time_now();

    r->method = r->the_request;

    /* If there is whitespace before a method, skip it and mark in error */

    if (apr_isspace(*r->method)) {

        deferred_error = rrl_badwhitespace; 

        for ( ; apr_isspace(*r->method); ++r->method)

            ; 

    }

    /* Scan the method up to the next whitespace, ensure it contains only

     * valid http-token characters, otherwise mark in error

     */

    if (strict) {

        ll = (char*) ap_scan_http_token(r->method);

    }

    else {

        ll = (char*) ap_scan_vchar_obstext(r->method);

    }

    if (((ll == r->method) || (*ll && !apr_isspace(*ll)))

            && deferred_error == rrl_none) {

        deferred_error = rrl_badmethod;

        ll = strpbrk(ll, "\t\n\v\f\r ");

    }

    /* Verify method terminated with a single SP, or mark as specific error */

    if (!ll) {

        if (deferred_error == rrl_none)

            deferred_error = rrl_missinguri;

        r->protocol = uri = "";

        len = 0;

        goto rrl_done;

    }

    else if (strict && ll[0] && apr_isspace(ll[1])

             && deferred_error == rrl_none) {

        deferred_error = rrl_excesswhitespace; 

    }

    /* Advance uri pointer over leading whitespace, NUL terminate the method

     * If non-SP whitespace is encountered, mark as specific error

     */

    for (uri = ll; apr_isspace(*uri); ++uri) 

        if (*uri != ' ' && deferred_error == rrl_none)

            deferred_error = rrl_badwhitespace; 

    *ll = '\0';

    if (!*uri && deferred_error == rrl_none)

        deferred_error = rrl_missinguri;

    /* Scan the URI up to the next whitespace, ensure it contains no raw

     * control characters, otherwise mark in error

     */

    ll = (char*) ap_scan_vchar_obstext(uri);

    if (ll == uri || (*ll && !apr_isspace(*ll))) {

        deferred_error = rrl_baduri;

        ll = strpbrk(ll, "\t\n\v\f\r ");

    }

    /* Verify URI terminated with a single SP, or mark as specific error */

    if (!ll) {

        r->protocol = "";

        len = 0;

        goto rrl_done;

    }

    else if (strict && ll[0] && apr_isspace(ll[1])

             && deferred_error == rrl_none) {

        deferred_error = rrl_excesswhitespace; 

    }

    /* Advance protocol pointer over leading whitespace, NUL terminate the uri

     * If non-SP whitespace is encountered, mark as specific error

     */

    for (r->protocol = ll; apr_isspace(*r->protocol); ++r->protocol) 

        if (*r->protocol != ' ' && deferred_error == rrl_none)

            deferred_error = rrl_badwhitespace; 

    *ll = '\0';

    /* Scan the protocol up to the next whitespace, validation comes later */

    if (!(ll = (char*) ap_scan_vchar_obstext(r->protocol))) {

        len = strlen(r->protocol);

        goto rrl_done;

    }

    len = ll - r->protocol;

    /* Advance over trailing whitespace, if found mark in error,

     * determine if trailing text is found, unconditionally mark in error,

     * finally NUL terminate the protocol string

     */

    if (*ll && !apr_isspace(*ll)) {

        deferred_error = rrl_badprotocol;

    }

    else if (strict && *ll) {

        deferred_error = rrl_excesswhitespace;

    }

    else {

        for ( ; apr_isspace(*ll); ++ll)

            if (*ll != ' ' && deferred_error == rrl_none)

                deferred_error = rrl_badwhitespace; 

        if (*ll && deferred_error == rrl_none)

            deferred_error = rrl_trailingtext;

    }

    *((char *)r->protocol + len) = '\0';

rrl_done:

    /* For internal integrity and palloc efficiency, reconstruct the_request

     * in one palloc, using only single SP characters, per spec.

     */

    r->the_request = apr_pstrcat(r->pool, r->method, *uri ? " " : NULL, uri,

                                 *r->protocol ? " " : NULL, r->protocol, NULL);

    if (len == 8

            && r->protocol[0] == 'H' && r->protocol[1] == 'T'

            && r->protocol[2] == 'T' && r->protocol[3] == 'P'

            && r->protocol[4] == '/' && apr_isdigit(r->protocol[5])

            && r->protocol[6] == '.' && apr_isdigit(r->protocol[7])

            && r->protocol[5] != '0') {

        r->assbackwards = 0;

        r->proto_num = HTTP_VERSION(r->protocol[5] - '0', r->protocol[7] - '0');

    }

    else if (len == 8

                 && (r->protocol[0] == 'H' || r->protocol[0] == 'h')

                 && (r->protocol[1] == 'T' || r->protocol[1] == 't')

                 && (r->protocol[2] == 'T' || r->protocol[2] == 't')

                 && (r->protocol[3] == 'P' || r->protocol[3] == 'p')

                 && r->protocol[4] == '/' && apr_isdigit(r->protocol[5])

                 && r->protocol[6] == '.' && apr_isdigit(r->protocol[7])

                 && r->protocol[5] != '0') {

        r->assbackwards = 0;

        r->proto_num = HTTP_VERSION(r->protocol[5] - '0', r->protocol[7] - '0');

        if (strict && deferred_error == rrl_none)

            deferred_error = rrl_badprotocol;

        else

            memcpy((char*)r->protocol, "HTTP", 4);

    }

    else if (r->protocol[0]) {

        r->proto_num = HTTP_VERSION(0, 9);

        /* Defer setting the r->protocol string till error msg is composed */

        if (deferred_error == rrl_none)

            deferred_error = rrl_badprotocol;

    }

    else {

        r->assbackwards = 1;

        r->protocol  = apr_pstrdup(r->pool, "HTTP/0.9");

        r->proto_num = HTTP_VERSION(0, 9);

    }

    /* Determine the method_number and parse the uri prior to invoking error

     * handling, such that these fields are available for substitution

     */

    r->method_number = ap_method_number_of(r->method);

    if (r->method_number == M_GET && r->method[0] == 'H')

        r->header_only = 1;

    ap_parse_uri(r, uri);

    /* With the request understood, we can consider HTTP/0.9 specific errors */

    if (r->proto_num == HTTP_VERSION(0, 9) && deferred_error == rrl_none) {

        if (conf->http09_enable == AP_HTTP09_DISABLE)

            deferred_error = rrl_reject09;

        else if (strict && (r->method_number != M_GET || r->header_only))

            deferred_error = rrl_badmethod09;

    }

    /* Now that the method, uri and protocol are all processed,

     * we can safely resume any deferred error reporting

     */