* move stuff from Hdr into substruct that may be easily wiped by memset 0'ing them
[citadel.git] / webcit / context_loop.c
index db6fd289a5afce695f9413237901a664de60e45b..abe5dd3635e4f2bcda6e7d379816ddd3b5a2e3e5 100644 (file)
@@ -137,42 +137,6 @@ int GenerateSessionID(void)
 }
 
 
-/*
- * lingering_close() a`la Apache. see
- * http://www.apache.org/docs/misc/fin_wait_2.html for rationale
- */
-int lingering_close(int fd)
-{
-       char buf[SIZ];
-       int i;
-       fd_set set;
-       struct timeval tv, start;
-
-       gettimeofday(&start, NULL);
-       shutdown(fd, 1);
-       do {
-               do {
-                       gettimeofday(&tv, NULL);
-                       tv.tv_sec = SLEEPING - (tv.tv_sec - start.tv_sec);
-                       tv.tv_usec = start.tv_usec - tv.tv_usec;
-                       if (tv.tv_usec < 0) {
-                               tv.tv_sec--;
-                               tv.tv_usec += 1000000;
-                       }
-                       FD_ZERO(&set);
-                       FD_SET(fd, &set);
-                       i = select(fd + 1, &set, NULL, NULL, &tv);
-               } while (i == -1 && errno == EINTR);
-
-               if (i <= 0)
-                       break;
-
-               i = read(fd, buf, sizeof buf);
-       } while (i != 0 && (i != -1 || errno == EINTR));
-
-       return close(fd);
-}
-
 
 
 
@@ -195,40 +159,15 @@ int is_mobile_ua(char *user_agent) {
       return 0;
 }
 
-
-
-/*
- * Look for commonly-found probes of malware such as worms, viruses, trojans, and Microsoft Office.
- * Short-circuit these requests so we don't have to send them through the full processing loop.
- */
-int is_bogus(StrBuf *http_cmd) {////TODO!
-       const char *url;
-       int i, max;
-       const char *bogus_prefixes[] = {
-               "/scripts/root.exe",    /* Worms and trojans and viruses, oh my! */
-               "/c/winnt",
-               "/MSADC/",
-               "/_vti",                /* Broken Microsoft DAV implementation */
-               "/MSOffice",            /* Stoopid MSOffice thinks everyone is IIS */
-               "/nonexistenshit"       /* Exploit found in the wild January 2009 */
-       };
-
-       url = ChrPtr(http_cmd);
-       if (IsEmptyStr(url)) return(1);
-       ++url;
-
-       max = sizeof(bogus_prefixes) / sizeof(char *);
-
-       for (i=0; i<max; ++i) {
-               if (!strncasecmp(url, bogus_prefixes[i], strlen(bogus_prefixes[i]))) {
-                       return(2);
-               }
-       }
-
-       return(0);      /* probably ok */
+/* If it's a "force 404" situation then display the error and bail. */
+void do_404(void)
+{
+       hprintf("HTTP/1.1 404 Not found\r\n");
+       hprintf("Content-Type: text/plain\r\n");
+       wprintf("Not found\r\n");
+       end_burst();
 }
 
-
 int ReadHttpSubject(ParsedHttpHdrs *Hdr, StrBuf *Line, StrBuf *Buf)
 {
        const char *Args;
@@ -236,67 +175,75 @@ int ReadHttpSubject(ParsedHttpHdrs *Hdr, StrBuf *Line, StrBuf *Buf)
        const char *Pos = NULL;
 
 
-       Hdr->ReqLine = Line;
+       Hdr->HR.ReqLine = Line;
        /* The requesttype... GET, POST... */
-       StrBufExtract_token(Buf, Hdr->ReqLine, 0, ' ');
+       StrBufExtract_token(Buf, Hdr->HR.ReqLine, 0, ' ');
        if (GetHash(HttpReqTypes, SKEY(Buf), &vLine) &&
            (vLine != NULL))
        {
-               Hdr->eReqType = *(long*)vLine;
+               Hdr->HR.eReqType = *(long*)vLine;
        }
        else {
-               Hdr->eReqType = eGET;
+               Hdr->HR.eReqType = eGET;
                return 1;
        }
-       StrBufCutLeft(Hdr->ReqLine, StrLength(Buf) + 1);
+       StrBufCutLeft(Hdr->HR.ReqLine, StrLength(Buf) + 1);
 
        /* the HTTP Version... */
-       StrBufExtract_token(Buf, Hdr->ReqLine, 1, ' ');
-       StrBufCutRight(Hdr->ReqLine, StrLength(Buf) + 1);
-       if ((StrLength(Buf) == 0) ||
-           is_bogus(Hdr->ReqLine)) {
-               Hdr->eReqType = eGET;
+       StrBufExtract_token(Buf, Hdr->HR.ReqLine, 1, ' ');
+       StrBufCutRight(Hdr->HR.ReqLine, StrLength(Buf) + 1);
+       
+       if (StrLength(Buf) == 0) {
+               Hdr->HR.eReqType = eGET;
                return 1;
        }
 
-       Hdr->this_page = NewStrBufDup(Hdr->ReqLine);
+       Hdr->this_page = NewStrBufDup(Hdr->HR.ReqLine);
        /* chop Filename / query arguments */
-       Args = strchr(ChrPtr(Hdr->ReqLine), '?');
+       Args = strchr(ChrPtr(Hdr->HR.ReqLine), '?');
        if (Args == NULL) /* whe're not that picky about params... TODO: this will spoil '&' in filenames.*/
-               Args = strchr(ChrPtr(Hdr->ReqLine), '&');
+               Args = strchr(ChrPtr(Hdr->HR.ReqLine), '&');
        if (Args != NULL) {
+               Args ++; /* skip the ? */
                Hdr->PlainArgs = NewStrBufPlain(
                        Args, 
-                       StrLength(Hdr->ReqLine) -
-                       (Args - ChrPtr(Hdr->ReqLine)));
-               StrBufCutAt(Hdr->ReqLine, 0, Args);
+                       StrLength(Hdr->HR.ReqLine) -
+                       (Args - ChrPtr(Hdr->HR.ReqLine)));
+               StrBufCutAt(Hdr->HR.ReqLine, 0, Args - 1);
        } /* don't parse them yet, maybe we don't even care... */
        
        /* now lookup what we are going to do with this... */
        /* skip first slash */
-       StrBufExtract_NextToken(Buf, Hdr->ReqLine, &Pos, '/');
+       StrBufExtract_NextToken(Buf, Hdr->HR.ReqLine, &Pos, '/');
        do {
-               StrBufExtract_NextToken(Buf, Hdr->ReqLine, &Pos, '/');
+               StrBufExtract_NextToken(Buf, Hdr->HR.ReqLine, &Pos, '/');
 
                GetHash(HandlerHash, SKEY(Buf), &vHandler),
-               Hdr->Handler = (WebcitHandler*) vHandler;
-               if (Hdr->Handler == NULL)
-                       break;
-               /* are we about to ignore some prefix like webcit/ ? */
-               if ((Hdr->Handler->Flags & URLNAMESPACE) == 0)
+               Hdr->HR.Handler = (WebcitHandler*) vHandler;
+               if (Hdr->HR.Handler == NULL)
                        break;
+               /*
+                * If the request is prefixed by "/webcit" then chop that off.  This
+                * allows a front end web server to forward all /webcit requests to us
+                * while still using the same web server port for other things.
+                */
+               if ((Hdr->HR.Handler->Flags & URLNAMESPACE) != 0)
+                       continue;
+               break;
        } while (1);
        /* remove the handlername from the URL */
        if (Pos != NULL) {
-               StrBufCutLeft(Hdr->ReqLine, 
-                             Pos - ChrPtr(Hdr->ReqLine));
+               StrBufCutLeft(Hdr->HR.ReqLine, 
+                             Pos - ChrPtr(Hdr->HR.ReqLine));
+       }
+
+       if (Hdr->HR.Handler != NULL) {
+               if ((Hdr->HR.Handler->Flags & BOGUS) != 0)
+                       return 1;
+               Hdr->HR.DontNeedAuth = (Hdr->HR.Handler->Flags & ISSTATIC) != 0;
        }
-/*
-       if (Hdr->Handler == NULL)
-               return 1;
-*/
-       Hdr->HTTPHeaders = NewHash(1, NULL);
 
+       Hdr->HTTPHeaders = NewHash(1, NULL);
        return 0;
 }
 
@@ -340,13 +287,18 @@ int ReadHTTPRequset (ParsedHttpHdrs *Hdr)
                nLine ++;
                Line = NewStrBuf();
 
-               if (ClientGetLine(&Hdr->http_sock, Line, Hdr->ReadBuf, &Hdr->Pos) < 0) return 1;
+               if (ClientGetLine(Hdr, Line) < 0) return 1;
 
                if (StrLength(Line) == 0) {
                        FreeStrBuf(&Line);
                        continue;
                }
                if (nLine == 1) {
+                       pHdr = (OneHttpHeader*) malloc(sizeof(OneHttpHeader));
+                       memset(pHdr, 0, sizeof(OneHttpHeader));
+                       pHdr->Val = Line;
+                       Put(Hdr->HTTPHeaders, HKEY("GET /"), pHdr, DestroyHttpHeaderHandler);
+                       lprintf(9, "%s\n", ChrPtr(Line));
                        isbogus = ReadHttpSubject(Hdr, Line, HeaderName);
                        if (isbogus) break;
                        continue;
@@ -361,6 +313,7 @@ int ReadHTTPRequset (ParsedHttpHdrs *Hdr)
                                pch ++;
                        StrBufCutLeft(Line, pch - pchs);
                        StrBufAppendBuf(LastLine, Line, 0);
+
                        FreeStrBuf(&Line);
                        continue;
                }
@@ -412,9 +365,8 @@ int ReadHTTPRequset (ParsedHttpHdrs *Hdr)
  * function returns, the worker thread is then free to handle another
  * transaction.
  */
-void context_loop(int *sock)
+void context_loop(ParsedHttpHdrs *Hdr)
 {
-       ParsedHttpHdrs Hdr;
        int isbogus = 0;
        wcsession *TheSession, *sptr;
        struct timeval tx_start;
@@ -422,40 +374,73 @@ void context_loop(int *sock)
        
        gettimeofday(&tx_start, NULL);          /* start a stopwatch for performance timing */
 
-       memset(&Hdr, 0, sizeof(ParsedHttpHdrs));
-       Hdr.eReqType = eGET;
-       Hdr.http_sock = *sock;
        /*
         * Find out what it is that the web browser is asking for
         */
-       isbogus = ReadHTTPRequset(&Hdr);
+       isbogus = ReadHTTPRequset(Hdr);
 
        if (!isbogus)
-               isbogus = AnalyseHeaders(&Hdr);
-/*
-       if (isbogus)
-               StrBufPlain(ReqLine, HKEY("/404"));
-*/
+               isbogus = AnalyseHeaders(Hdr);
 
-/*     dbg_PrintHash(HTTPHeaders, nix, NULL);  */
+       if ((isbogus) ||
+           ((Hdr->HR.Handler != NULL) &&
+            ((Hdr->HR.Handler->Flags & BOGUS) != 0)))
+       {
+               wcsession *Bogus;
+               Bogus = (wcsession *)
+                       malloc(sizeof(wcsession));
+               memset(Bogus, 0, sizeof(wcsession));
+               pthread_setspecific(MyConKey, (void *)Bogus);
+               Bogus->Hdr = Hdr;
+               session_new_modules(Bogus);
+               do_404();
+               session_detach_modules(Bogus);
+               http_destroy_modules(Hdr);
+               session_destroy_modules(&Bogus);
+               return;
+       }
 
+       if ((Hdr->HR.Handler != NULL) && 
+           ((Hdr->HR.Handler->Flags & ISSTATIC) != 0))
+       {
+               wcsession *Static;
 
-///HttpHeaderHandler
+               Static = (wcsession *)
+                       malloc(sizeof(wcsession));
+               memset(Static, 0, sizeof(wcsession));
+               pthread_setspecific(MyConKey, (void *)Static);
+               Static->Hdr = Hdr;
+               Static->serv_sock = (-1);
+               Static->chat_sock = (-1);
+               Static->is_mobile = -1;
+               session_new_modules(Static);
+               
+               Hdr->HR.Handler->F();
 
+               /* How long did this transaction take? */
+               gettimeofday(&tx_finish, NULL);
+               
+               lprintf(9, "SL: Transaction [%s] completed in %ld.%06ld seconds.\n",
+                       ChrPtr(Hdr->this_page),
+                       ((tx_finish.tv_sec*1000000 + tx_finish.tv_usec) - (tx_start.tv_sec*1000000 + tx_start.tv_usec)) / 1000000,
+                       ((tx_finish.tv_sec*1000000 + tx_finish.tv_usec) - (tx_start.tv_sec*1000000 + tx_start.tv_usec)) % 1000000
+                       );
+
+               session_detach_modules(Static);
+               http_destroy_modules(Hdr);
+               session_destroy_modules(&Static);
+               return;
+       }
 
+       if (Hdr->HR.got_auth == AUTH_BASIC) 
+               CheckAuthBasic(Hdr);
 
+/*
+TODO    HKEY("/static/nocookies.html?force_close_session=yes"));
+*/
 
+/*     dbg_PrintHash(HTTPHeaders, nix, NULL);  */
 
-       /*
-        * If the request is prefixed by "/webcit" then chop that off.  This
-        * allows a front end web server to forward all /webcit requests to us
-        * while still using the same web server port for other things.
-        * /
-       if (!isbogus &&
-           (StrLength(ReqLine) >= 8) && 
-           (strstr(ChrPtr(ReqLine), "/webcit/")) ) {
-               StrBufCutLeft(ReqLine, 7);
-       }
 
        /* Begin parsing the request. * /
 #ifdef TECH_PREVIEW
@@ -483,18 +468,26 @@ void context_loop(int *sock)
                     ((sptr != NULL) && (TheSession == NULL)); 
                      sptr = sptr->next) {
 
-                       /** If HTTP-AUTH, look for a session with matching credentials * /
-                       if ( (////TODO check auth type here...
-                            &&(!strcasecmp(ChrPtr(sptr->httpauth_user), httpauth_user))
-                            &&(!strcasecmp(ChrPtr(sptr->httpauth_pass), httpauth_pass)) ) {
-                               TheSession = sptr;
-                       }
-
+                       /** If HTTP-AUTH, look for a session with matching credentials */
+                       switch (Hdr->HR.got_auth)
+                       {
+                       case AUTH_BASIC:
+                               if ( (Hdr->HR.SessionKey != sptr->SessionKey))
+                                       continue;
+                               GetAuthBasic(Hdr);
+                               if ((!strcasecmp(ChrPtr(Hdr->c_username), ChrPtr(sptr->wc_username))) &&
+                                   (!strcasecmp(ChrPtr(Hdr->c_password), ChrPtr(sptr->wc_password))) ) 
+                                       TheSession = sptr;
+                               break;
+                       case AUTH_COOKIE:
                        /** If cookie-session, look for a session with matching session ID */
-                       if ( (Hdr.desired_session != 0) && (sptr->wc_session == Hdr.desired_session)) {
-                               TheSession = sptr;
+                               if ( (Hdr->HR.desired_session != 0) && 
+                                    (sptr->wc_session == Hdr->HR.desired_session)) 
+                                       TheSession = sptr;
+                               break;                       
+                       case NO_AUTH:
+                            break;
                        }
-
                }
                pthread_mutex_unlock(&SessionListMutex);
        }
@@ -507,7 +500,8 @@ void context_loop(int *sock)
                TheSession = (wcsession *)
                        malloc(sizeof(wcsession));
                memset(TheSession, 0, sizeof(wcsession));
-               TheSession->Hdr = &Hdr;
+               TheSession->Hdr = Hdr;
+               TheSession->SessionKey = Hdr->HR.SessionKey;
                TheSession->serv_sock = (-1);
                TheSession->chat_sock = (-1);
        
@@ -517,16 +511,13 @@ void context_loop(int *sock)
                 * doesn't, and that's a Bad Thing because it causes lots of spurious sessions
                 * to get created.
                 */     
-               if (Hdr.desired_session == 0) {
+               if (Hdr->HR.desired_session == 0) {
                        TheSession->wc_session = GenerateSessionID();
                }
                else {
-                       TheSession->wc_session = Hdr.desired_session;
+                       TheSession->wc_session = Hdr->HR.desired_session;
                }
-/*
-               TheSession->httpauth_user = NewStrBufPlain(httpauth_user, -1);
-                       TheSession->httpauth_pass = NewStrBufPlain(httpauth_user, -1);
-*/
+
                pthread_setspecific(MyConKey, (void *)TheSession);
                session_new_modules(TheSession);
 
@@ -537,6 +528,12 @@ void context_loop(int *sock)
                TheSession->is_mobile = -1;
                SessionList = TheSession;
                pthread_mutex_unlock(&SessionListMutex);
+
+               if (StrLength(Hdr->c_language) > 0) {
+                       lprintf(9, "Session cookie requests language '%s'\n", ChrPtr(Hdr->c_language));
+                       set_selected_language(ChrPtr(Hdr->c_language));
+                       go_selected_language();
+               }
        }
 
        /*
@@ -551,33 +548,27 @@ void context_loop(int *sock)
        pthread_setspecific(MyConKey, (void *)TheSession);
        
        TheSession->lastreq = time(NULL);                       /* log */
-       TheSession->Hdr = &Hdr;
+       TheSession->Hdr = Hdr;
 
        session_attach_modules(TheSession);
        session_loop();                         /* do transaction */
-       session_detach_modules(TheSession);
 
-       TheSession->Hdr = NULL;
-       pthread_mutex_unlock(&TheSession->SessionMutex);        /* unbind */
-/* TODO
 
-       FreeStrBuf(&c_username);
-       FreeStrBuf(&c_password);
-       FreeStrBuf(&c_roomname);
-       FreeStrBuf(&c_httpauth_user);
-       FreeStrBuf(&c_httpauth_pass);
-*/
-       /* Free the request buffer */
-       ///DeleteHash(&HTTPHeaders);
-       ///FreeStrBuf(&ReqLine);
-       
        /* How long did this transaction take? */
        gettimeofday(&tx_finish, NULL);
        
-       lprintf(9, "Transaction completed in %ld.%06ld seconds.\n",
+       lprintf(9, "Transaction [%s] completed in %ld.%06ld seconds.\n",
+               ChrPtr(Hdr->this_page),
                ((tx_finish.tv_sec*1000000 + tx_finish.tv_usec) - (tx_start.tv_sec*1000000 + tx_start.tv_usec)) / 1000000,
                ((tx_finish.tv_sec*1000000 + tx_finish.tv_usec) - (tx_start.tv_sec*1000000 + tx_start.tv_usec)) % 1000000
        );
+
+       session_detach_modules(TheSession);
+
+       TheSession->Hdr = NULL;
+       pthread_mutex_unlock(&TheSession->SessionMutex);        /* unbind */
+
+       http_destroy_modules(Hdr);
 }
 
 void tmplput_nonce(StrBuf *Target, WCTemplputParams *TP)
@@ -597,79 +588,19 @@ void tmplput_current_room(StrBuf *Target, WCTemplputParams *TP)
        StrBufAppendTemplate(Target, TP, WC->wc_roomname, 0); 
 }
 
-
-void Header_HandleCookie(StrBuf *Line, ParsedHttpHdrs *hdr)
-{
-       hdr->RawCookie = Line;
-       if (hdr->DontNeedAuth)
-               return;
-/*
-       c_username = NewStrBuf();
-       c_password = NewStrBuf();
-       c_roomname = NewStrBuf();
-       safestrncpy(c_httpauth_string, "", sizeof c_httpauth_string);
-       c_httpauth_user = NewStrBufPlain(HKEY(DEFAULT_HTTPAUTH_USER));
-       c_httpauth_pass = NewStrBufPlain(HKEY(DEFAULT_HTTPAUTH_PASS));
-*/
-       cookie_to_stuff(Line, &hdr->desired_session,
-                       hdr->c_username,
-                       hdr->c_password,
-                       hdr->c_roomname);
-       hdr->got_cookie = 1;
-}
-
-
-       /*
-        * Browser-based sessions use cookies for session authentication
-        * /
-       if (!isbogus &&
-           GetHash(HTTPHeaders, HKEY("COOKIE"), &vLine) && 
-           (vLine != NULL)) {
-               cookie_to_stuff(vLine, &desired_session,
-                               NULL, NULL, NULL);
-               got_cookie = 1;
-       }
-       */
-       /*
-        * GroupDAV-based sessions use HTTP authentication
-        */
-/*
-       if (!isbogus &&
-           GetHash(HTTPHeaders, HKEY("AUTHORIZATION"), &vLine) && 
-           (vLine != NULL)) {
-               Line = (StrBuf*)vLine;
-               if (strncasecmp(ChrPtr(Line), "Basic", 5) == 0) {
-                       StrBufCutLeft(Line, 6);
-                       CtdlDecodeBase64(httpauth_string, ChrPtr(Line), StrLength(Line));
-                       extract_token(httpauth_user, httpauth_string, 0, ':', sizeof httpauth_user);
-                       extract_token(httpauth_pass, httpauth_string, 1, ':', sizeof httpauth_pass);
-               }
-               else 
-                       lprintf(1, "Authentication scheme not supported! [%s]\n", ChrPtr(Line));
-       }
-
-*/
-void Header_HandleAuth(StrBuf *Line, ParsedHttpHdrs *hdr)
-{
-       const char *Pos = NULL;
-       StrBufDecodeBase64(Line);
-       StrBufExtract_NextToken(hdr->c_username, Line, &Pos, ':');
-       StrBufExtract_NextToken(hdr->c_password, Line, &Pos, ':');
-}
-
 void Header_HandleContentLength(StrBuf *Line, ParsedHttpHdrs *hdr)
 {
-       hdr->ContentLength = StrToi(Line);
+       hdr->HR.ContentLength = StrToi(Line);
 }
 
 void Header_HandleContentType(StrBuf *Line, ParsedHttpHdrs *hdr)
 {
-       hdr->ContentType = Line;
+       hdr->HR.ContentType = Line;
 }
 
 void Header_HandleUserAgent(StrBuf *Line, ParsedHttpHdrs *hdr)
 {
-       hdr->user_agent = Line;
+       hdr->HR.user_agent = Line;
 #ifdef TECH_PREVIEW
 /* TODO: do this later on session creating
        if ((WCC->is_mobile < 0) && is_mobile_ua(&buf[12])) {                   
@@ -685,32 +616,32 @@ void Header_HandleUserAgent(StrBuf *Line, ParsedHttpHdrs *hdr)
 
 void Header_HandleHost(StrBuf *Line, ParsedHttpHdrs *hdr)
 {
-       if ((follow_xff) && (hdr->http_host != NULL))
+       if ((follow_xff) && (hdr->HR.http_host != NULL))
                return;
        else
-               hdr->http_host = Line;
+               hdr->HR.http_host = Line;
 }
 
 void Header_HandleXFFHost(StrBuf *Line, ParsedHttpHdrs *hdr)
 {
        if (follow_xff)
-               hdr->http_host = Line;
+               hdr->HR.http_host = Line;
 }
 
 
 void Header_HandleXFF(StrBuf *Line, ParsedHttpHdrs *hdr)
 {
-       hdr->browser_host = Line;
+       hdr->HR.browser_host = Line;
 
-       while (StrBufNum_tokens(hdr->browser_host, ',') > 1) {
-               StrBufRemove_token(hdr->browser_host, 0, ',');
+       while (StrBufNum_tokens(hdr->HR.browser_host, ',') > 1) {
+               StrBufRemove_token(hdr->HR.browser_host, 0, ',');
        }
-       StrBufTrim(hdr->browser_host);
+       StrBufTrim(hdr->HR.browser_host);
 }
 
 void Header_HandleIfModSince(StrBuf *Line, ParsedHttpHdrs *hdr)
 {
-       hdr->if_modified_since = httpdate_to_timestamp(Line);
+       hdr->HR.if_modified_since = httpdate_to_timestamp(Line);
 }
 
 void Header_HandleAcceptEncoding(StrBuf *Line, ParsedHttpHdrs *hdr)
@@ -719,34 +650,9 @@ void Header_HandleAcceptEncoding(StrBuf *Line, ParsedHttpHdrs *hdr)
         * Can we compress?
         */
        if (strstr(&ChrPtr(Line)[16], "gzip")) {
-               hdr->gzip_ok = 1;
+               hdr->HR.gzip_ok = 1;
        }
 }
-
-/*
-{
-       c_username = NewStrBuf();
-       c_password = NewStrBuf();
-       c_roomname = NewStrBuf();
-       safestrncpy(c_httpauth_string, "", sizeof c_httpauth_string);
-       c_httpauth_user = NewStrBufPlain(HKEY(DEFAULT_HTTPAUTH_USER));
-       c_httpauth_pass = NewStrBufPlain(HKEY(DEFAULT_HTTPAUTH_PASS));
-}
-*/
-       /* *
-        * These are the URL's which may be executed without a
-        * session cookie already set.  If it's not one of these,
-        * force the session to close because cookies are
-        * probably disabled on the client browser.
-        * /
-       else if ( (StrLength(ReqLine) > 1 )
-               && (strncasecmp(ChrPtr(ReqLine), "/404", 4))
-               && (Hdr.got_cookie == 0)) {
-               StrBufPlain(ReqLine, 
-                           HKEY("/static/nocookies.html"
-                                "?force_close_session=yes"));
-       }
-*/
 const char *ReqStrs[eNONE] = {
        "GET",
        "POST",
@@ -820,13 +726,12 @@ void RegisterHeaderHandler(const char *Name, long Len, Header_Evaluator F)
        pHdr->H = F;
        Put(HttpHeaderHandler, Name, Len, pHdr, DestroyHttpHeaderHandler);
 }
-extern void blank_page(void); ///TODO: remove me
+
+
 void 
 InitModule_CONTEXT
 (void)
 {
-       RegisterHeaderHandler(HKEY("COOKIE"), Header_HandleCookie);
-       RegisterHeaderHandler(HKEY("AUTHORIZATION"), Header_HandleAuth);
        RegisterHeaderHandler(HKEY("CONTENT-LENGTH"), Header_HandleContentLength);
        RegisterHeaderHandler(HKEY("CONTENT-TYPE"), Header_HandleContentType);
        RegisterHeaderHandler(HKEY("USER-AGENT"), Header_HandleUserAgent);
@@ -840,11 +745,28 @@ InitModule_CONTEXT
        RegisterNamespace("CURRENT_ROOM", 0, 1, tmplput_current_room, CTX_NONE);
        RegisterNamespace("NONCE", 0, 0, tmplput_nonce, 0);
 
+       WebcitAddUrlHandler(HKEY("404"), do_404, ANONYMOUS|COOKIEUNNEEDED);
+/*
+ * Look for commonly-found probes of malware such as worms, viruses, trojans, and Microsoft Office.
+ * Short-circuit these requests so we don't have to send them through the full processing loop.
+ */
+       WebcitAddUrlHandler(HKEY("scripts"), do_404, ANONYMOUS|BOGUS); /* /root.exe     /* Worms and trojans and viruses, oh my! */
+       WebcitAddUrlHandler(HKEY("c"), do_404, ANONYMOUS|BOGUS);        /* /winnt */
+       WebcitAddUrlHandler(HKEY("MSADC"), do_404, ANONYMOUS|BOGUS);
+       WebcitAddUrlHandler(HKEY("_vti"), do_404, ANONYMOUS|BOGUS);             /* Broken Microsoft DAV implementation */
+       WebcitAddUrlHandler(HKEY("MSOffice"), do_404, ANONYMOUS|BOGUS);         /* Stoopid MSOffice thinks everyone is IIS */
+       WebcitAddUrlHandler(HKEY("nonexistenshit"), do_404, ANONYMOUS|BOGUS);   /* Exploit found in the wild January 2009 */
+}
+       
 
 
-       WebcitAddUrlHandler(HKEY("blank"), blank_page, ANONYMOUS|BOGUS);
+void 
+HttpDestroyModule_CONTEXT
+(ParsedHttpHdrs *httpreq)
+{
+       FreeStrBuf(&httpreq->ReadBuf);
+       FreeStrBuf(&httpreq->PlainArgs);
+       FreeStrBuf(&httpreq->this_page);
+       DeleteHash(&httpreq->HTTPHeaders);
 
-       WebcitAddUrlHandler(HKEY("blank"), blank_page, URLNAMESPACE);
 }
-//FreeStrBuf(&WCC->this_page);
-