server.py

#!/usr/bin/env python3
import socket
import threading
import os
import sys
import datetime
import json
import random
import string
from urllib.parse import unquote, urlparse


# ----------- Configuration ----------- #
HOST = '127.0.0.1'
PORT = 8080
MAX_THREADS = 10
RESOURCES_DIR = 'resources'
UPLOAD_DIR = os.path.join(RESOURCES_DIR, 'uploads')
CONNECTION_TIMEOUT = 30
MAX_PERSISTENT_REQUESTS = 100
QUEUE_SIZE = 50


# Thread management variables
active_threads_lock = threading.Lock()
active_threads = 0
connection_queue = []
connection_queue_lock = threading.Lock()


# ----------- Logging ----------- #
def log(message):
    """Log a message with a timestamp."""
    timestamp = datetime.datetime.now().strftime("[%Y-%m-%d %H:%M:%S]")
    print(f"{timestamp} {message}")

def log_thread(message):
    """Log a message with the thread ID."""
    log(f"[Thread-{threading.current_thread().name}] {message}")


# ----------- Helper Functions ----------- #
def build_http_response(status_code, headers, body):
    """Build an HTTP response."""
    response_line = f"HTTP/1.1 {status_code}\r\n"
    headers_lines = ''.join(f"{k}: {v}\r\n" for k, v in headers.items())
    blank_line = "\r\n"
    return response_line.encode() + headers_lines.encode() + blank_line.encode() + body


def parse_http_request(request_data):
    """Parse an HTTP request - using your friend's approach."""
    try:
        lines = request_data.split("\r\n")
        request_line = lines[0].split()
        if len(request_line) != 3:
            return None, None, None, None, None
        method, path, version = request_line
        headers = {}
        i = 1
        while i < len(lines) and lines[i]:
            if ":" in lines[i]:
                key, value = lines[i].split(":", 1)
                headers[key.strip()] = value.strip()
            i += 1
        body = "\r\n".join(lines[i+1:]) if i+1 < len(lines) else ""
        return method.upper(), path, version, headers, body
    except Exception:
        return None, None, None, None, None


def safe_path(request_path):
    """Validate and canonicalize the requested path - using your friend's logging approach."""
    if request_path is None:
        return None
    
    # 1) decode percent-encoding and strip spaces - LOG THE RAW PATH FIRST
    raw = unquote(request_path).strip()
    
    log_thread(f'Processing path: {repr(raw)}')
    
    # 2) Check for any traversal patterns - BEFORE any processing
    if '..' in raw or raw.startswith('/etc/') or raw.startswith('/config') or 'server.py' in raw:
        log_thread(f'Blocked suspicious path: {repr(raw)}')
        return None
    
    # 3) Normalize the path
    if raw.startswith('/'):
        normalized = os.path.normpath(raw)
    else:
        normalized = os.path.normpath('/' + raw)
    
    log_thread(f'Normalized path: {repr(normalized)}')
    
    # 4) Additional checks after normalization
    if '..' in normalized or normalized.startswith('/..') or '/etc/' in normalized:
        log_thread(f'Blocked normalized path: {repr(normalized)}')
        return None
    
    # 5) Remove leading slash
    if normalized.startswith('/'):
        rel_path = normalized[1:]
    else:
        rel_path = normalized
        
    # 6) Handle empty path
    if rel_path == '':
        rel_path = 'index.html'
    
    # 7) Build the file path
    candidate = os.path.join(RESOURCES_DIR, rel_path)
    real_res_dir = os.path.realpath(RESOURCES_DIR)
    real_target = os.path.realpath(candidate)
    
    log_thread(f'File candidate: {repr(candidate)}')
    log_thread(f'Real target: {repr(real_target)}')
    log_thread(f'Resource dir: {repr(real_res_dir)}')
    
    # 8) Must stay inside resources root
    if not real_target.startswith(real_res_dir + os.sep) and real_target != real_res_dir:
        log_thread(f'Blocked path outside resource dir: {repr(real_target)}')
        return None
    
    # 9) Check if it's a directory - your friend blocks directories
    if os.path.isdir(real_target):
        # Handle index.html for directories
        index_path = os.path.join(real_target, 'index.html')
        if os.path.exists(index_path):
            log_thread(f'Directory access, serving index.html: {repr(index_path)}')
            return index_path
        else:
            log_thread(f'Blocked directory access: {repr(real_target)}')
            return None
    
    log_thread(f'Approved path: {repr(real_target)}')
    return real_target


def generate_filename():
    """Generate a unique filename for uploaded files."""
    timestamp = datetime.datetime.now().strftime("%Y%m%d_%H%M%S")
    random_id = ''.join(random.choices(string.ascii_lowercase + string.digits, k=4))
    return f"upload_{timestamp}_{random_id}.json"


def rfc7231_date():
    """Generate a date string in RFC 7231 format."""
    return datetime.datetime.utcnow().strftime("%a, %d %b %Y %H:%M:%S GMT")


def valid_host(host_header, host_setting, port_setting):
    """Validate the Host header against the server's host and port."""
    if not host_header:
        return False
    valid_hosts = {
        f"localhost:{port_setting}", 
        f"127.0.0.1:{port_setting}", 
        f"{host_setting}:{port_setting}",
        "localhost",
        "127.0.0.1",
        host_setting
    }
    return host_header in valid_hosts


def is_supported_file(filename):
    """Check if the file extension is supported."""
    if '.' not in filename:
        return False
    ext = filename.lower().split('.')[-1]
    return ext in ['html', 'txt', 'png', 'jpg', 'jpeg']


def get_content_headers(full_path):
    """Generate HTTP headers for the requested file."""
    try:
        if not os.path.exists(full_path):
            return None
        ext = full_path.lower().split('.')[-1]
        basename = os.path.basename(full_path)
        headers = {
            "Content-Length": str(os.path.getsize(full_path)),
            "Date": rfc7231_date(),
            "Server": "Multi-threaded HTTP Server",
            "Connection": "keep-alive",
        }
        if ext == "html":
            headers["Content-Type"] = "text/html; charset=utf-8"
        elif ext == "txt":
            headers["Content-Type"] = "application/octet-stream"
            headers["Content-Disposition"] = f'attachment; filename="{basename}"'
        elif ext in ("png", "jpg", "jpeg"):
            headers["Content-Type"] = "application/octet-stream"
            headers["Content-Disposition"] = f'attachment; filename="{basename}"'
        else:
            return None
        return headers
    except Exception:
        return None


def send_response(client_socket, status_code, headers, body):
    """Send HTTP response with error handling."""
    try:
        response = build_http_response(status_code, headers, body)
        client_socket.sendall(response)
        return True
    except (socket.error, OSError, BrokenPipeError) as e:
        log_thread(f"Socket error while sending response: {str(e)}")
        return False


def handle_get(client_socket, path, headers, client_address, request_line, host_header):
    try:
        log_thread(f"Connection from {client_address[0]}:{client_address[1]}")
        log_thread(f"Request: {request_line}")
        
        host_ok = valid_host(host_header, HOST, PORT)
        host_msg = "✓" if host_ok else "✗"
        log_thread(f"Host validation: {host_header} {host_msg}")
        
        if not host_ok:
            send_response(
                client_socket,
                "403 Forbidden",
                {"Content-Type": "text/plain", "Connection": "close"},
                b"403 Forbidden"
            )
            log_thread(f"Host validation failed: {host_header}")
            return False
        
        full_path = safe_path(path)
        if full_path is None:
            send_response(
                client_socket,
                "403 Forbidden",
                {"Content-Type": "text/plain", "Connection": "close"},
                b"403 Forbidden"
            )
            log_thread(f"Path traversal/forbidden: {path}")
            return False

        if not os.path.isfile(full_path):
            send_response(
                client_socket,
                "404 Not Found",
                {"Content-Type": "text/plain", "Connection": "close"},
                b"404 Not Found"
            )
            log_thread(f"File not found: {full_path}")
            return False

        if not is_supported_file(full_path):
            send_response(
                client_socket,
                "415 Unsupported Media Type",
                {"Content-Type": "text/plain", "Connection": "close"},
                b"415 Unsupported Media Type"
            )
            log_thread(f"Unsupported file type: {full_path}")
            return False

        headers_response = get_content_headers(full_path)
        if not headers_response:
            send_response(
                client_socket,
                "500 Internal Server Error",
                {"Content-Type": "text/plain", "Connection": "close"},
                b"500 Internal Server Error"
            )
            return False
        
        if headers.get("Connection", "").lower() == "close":
            headers_response["Connection"] = "close"
        else:
            headers_response["Keep-Alive"] = "timeout=30, max=100"

        ext = full_path.lower().split('.')[-1]
        try:
            buffer_size = 8192
            with open(full_path, "rb") as f:
                if ext in ["png", "jpg", "jpeg", "txt"]:
                    log_thread(f"Starting binary file transfer: {os.path.basename(full_path)}")
                else:
                    log_thread(f"Starting text/html file transfer: {os.path.basename(full_path)}")
                
                headers_response["Transfer-Encoding"] = "chunked"
                header_response = build_http_response("200 OK", headers_response, b"")
                client_socket.sendall(header_response)
                
                total_sent = 0
                while True:
                    chunk = f.read(buffer_size)
                    if not chunk:
                        break
                    chunk_header = f"{len(chunk):X}\r\n".encode()
                    client_socket.sendall(chunk_header)
                    client_socket.sendall(chunk)
                    client_socket.sendall(b"\r\n")
                    total_sent += len(chunk)
                
                client_socket.sendall(b"0\r\n\r\n")
                
                log_thread(f"Completed file transfer: {os.path.basename(full_path)} ({total_sent} bytes)")
                log_thread(f"Response: 200 OK ({total_sent} bytes transferred)")
                log_thread(f"Connection: {headers_response['Connection']}")
                
                return headers_response["Connection"] != "close"
        except IOError as e:
            log_thread(f"Error reading file: {str(e)}")
            send_response(
                client_socket,
                "500 Internal Server Error",
                {"Content-Type": "text/plain", "Connection": "close"},
                b"500 Internal Server Error"
            )
            return False
        except (socket.error, OSError, BrokenPipeError) as e:
            log_thread(f"Socket error during transfer: {str(e)}")
            raise
    except (socket.error, OSError, BrokenPipeError) as e:
        log_thread(f"Socket error in handle_get: {str(e)}")
        raise
    except Exception as e:
        log_thread(f"Unexpected error in handle_get: {str(e)}")
        send_response(
            client_socket,
            "500 Internal Server Error",
            {"Content-Type": "text/plain", "Connection": "close"},
            b"500 Internal Server Error"
        )
        return False


def handle_post(client_socket, path, headers, body):
    try:
        content_type = headers.get("Content-Type", "")
        if content_type != "application/json":
            send_response(
                client_socket,
                "415 Unsupported Media Type",
                {"Content-Type": "text/plain", "Connection": "close"},
                b"415 Unsupported Media Type"
            )
            log_thread(f"POST with wrong Content-Type: {content_type}")
            return False
            
        try:
            data = json.loads(body)
        except Exception as e:
            send_response(
                client_socket,
                "400 Bad Request",
                {"Content-Type": "text/plain", "Connection": "close"},
                b"400 Bad Request"
            )
            log_thread(f"Invalid JSON in POST: {str(e)}")
            return False

        os.makedirs(UPLOAD_DIR, exist_ok=True)
        filename = generate_filename()
        filepath = os.path.join(UPLOAD_DIR, filename)
        with open(filepath, "w", encoding="utf-8") as f:
            json.dump(data, f)

        response_body = json.dumps({
            "status": "success",
            "message": "File created successfully",
            "filepath": f"/uploads/{filename}"
        }).encode()

        headers_response = {
            "Content-Type": "application/json",
            "Content-Length": str(len(response_body)),
            "Date": rfc7231_date(),
            "Server": "Multi-threaded HTTP Server",
            "Connection": headers.get("Connection", "keep-alive"),
            "Keep-Alive": "timeout=30, max=100"
        }
        
        success = send_response(client_socket, "201 Created", headers_response, response_body)
        if success:
            log_thread(f"Saved POST JSON file: {filepath}")
        
        return headers_response["Connection"] != "close"
        
    except Exception as e:
        log_thread(f"Unexpected error in handle_post: {str(e)}")
        send_response(
            client_socket,
            "500 Internal Server Error",
            {"Content-Type": "text/plain", "Connection": "close"},
            b"500 Internal Server Error"
        )
        return False


def recv_until_double_crlf(sock):
    """Receive data until double CRLF - like your friend's approach."""
    data = b''
    sock.settimeout(5)
    try:
        while b'\r\n\r\n' not in data and len(data) < 8192:
            chunk = sock.recv(1024)
            if not chunk:
                break
            data += chunk
    except:
        pass
    return data


def handle_client(client_socket, client_address):
    """Handle a client connection - using your friend's raw HTTP logging approach."""
    global active_threads
    try:
        client_socket.settimeout(CONNECTION_TIMEOUT)
        persistent_requests = 0
        
        while True:
            try:
                # Use the same approach as your friend - receive until double CRLF
                raw_data = recv_until_double_crlf(client_socket)
                if not raw_data:
                    break
                
                # Log the RAW HTTP request EXACTLY like your friend does
                # log(f"RAW HTTP REQUEST:\n{raw_data.decode('utf-8', errors='ignore')}")
                
            except socket.timeout:
                log_thread("Connection timed out")
                break
            except (socket.error, OSError, BrokenPipeError) as e:
                log_thread(f"Socket error while receiving data: {str(e)}")
                break
            
            # Parse request using your friend's logic
            parsed = parse_http_request(raw_data.decode('utf-8', errors='ignore'))
            if not parsed:
                send_response(
                    client_socket,
                    "400 Bad Request",
                    {"Content-Type": "text/plain", "Connection": "close"},
                    b"400 Bad Request"
                )
                log_thread("Failed to parse request")
                break
                
            method, path, version, headers, body = parsed
            
            # Log the parsed path - this will show the RAW path from the request line
            log_thread(f"Parsed path from request line: {repr(path)}")
            
            if not method or not path:
                send_response(
                    client_socket,
                    "400 Bad Request",
                    {"Content-Type": "text/plain", "Connection": "close"},
                    b"400 Bad Request"
                )
                log_thread("Failed to parse request")
                break
            
            host_header = headers.get("Host", "")
            if not host_header:
                send_response(
                    client_socket,
                    "400 Bad Request",
                    {"Content-Type": "text/plain", "Connection": "close"},
                    b"400 Bad Request"
                )
                log_thread("Missing Host header")
                break
            
            keep_alive = True
            try:
                if method == "GET":
                    requestline = f"{method} {path} {version}"
                    keep_alive = handle_get(client_socket, path, headers, client_address, requestline, host_header)
                elif method == "POST":
                    keep_alive = handle_post(client_socket, path, headers, body)
                else:
                    send_response(
                        client_socket,
                        "405 Method Not Allowed",
                        {"Content-Type": "text/plain", "Connection": "close"},
                        b"405 Method Not Allowed"
                    )
                    log_thread(f"Method Not Allowed: {method}")
                    break
            except (socket.error, OSError, BrokenPipeError) as e:
                log_thread(f"Socket error during request handling: {str(e)}")
                break
            
            persistent_requests += 1
            close_conn = (
                not keep_alive or 
                headers.get("Connection", "").lower() == "close" or 
                persistent_requests >= MAX_PERSISTENT_REQUESTS
            )
            
            if close_conn:
                log_thread("Closing persistent connection")
                break
                
    except Exception as e:
        log_thread(f"Server error: {e}")
        try:
            send_response(
                client_socket,
                "500 Internal Server Error",
                {"Content-Type": "text/plain", "Connection": "close"},
                b"500 Internal Server Error"
            )
        except Exception:
            pass
    finally:
        try:
            client_socket.close()
        except Exception:
            pass
        with active_threads_lock:
            active_threads -= 1
        log_thread("Connection closed")


def thread_pool_manager(client_socket, client_address):
    """Thread pool and connection queue manager."""
    global active_threads
    with active_threads_lock:
        with connection_queue_lock:
            status = "🟢"
            if active_threads >= MAX_THREADS - 2:
                status = "🟡"
            if active_threads >= MAX_THREADS:
                status = "🔴"
            log(f"{status} Thread pool: {active_threads}/{MAX_THREADS} active | Queue: {len(connection_queue)}/{QUEUE_SIZE}")
        
        if active_threads >= MAX_THREADS:
            with connection_queue_lock:
                if len(connection_queue) < QUEUE_SIZE:
                    log("Warning: Thread pool saturated, queuing connection")
                    connection_queue.append((client_socket, client_address))
                else:
                    try:
                        resp = build_http_response(
                            "503 Service Unavailable",
                            {
                                "Content-Type": "text/plain",
                                "Connection": "close", 
                                "Retry-After": "5",
                                "Date": rfc7231_date()
                            },
                            b"503 Service Unavailable\n"
                        )
                        client_socket.sendall(resp)
                    except (socket.error, OSError, BrokenPipeError):
                        pass
                    finally:
                        try:
                            client_socket.close()
                        except Exception:
                            pass
            return
        active_threads += 1

    t = threading.Thread(target=handle_client, args=(client_socket, client_address), daemon=True)
    t.start()


def start_server():
    """Start the HTTP server."""
    global HOST, PORT, MAX_THREADS
    if len(sys.argv) > 1:
        try: PORT = int(sys.argv[1])
        except: pass
    if len(sys.argv) > 2:
        HOST = sys.argv[2]
    if len(sys.argv) > 3:
        try: MAX_THREADS = int(sys.argv[3])
        except: pass
    os.makedirs(UPLOAD_DIR, exist_ok=True)
    
    server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    server_socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    server_socket.bind((HOST, PORT))
    server_socket.listen(QUEUE_SIZE)
    
    log(f"HTTP Server started on http://{HOST}:{PORT}")
    log(f"Thread pool size: {MAX_THREADS}")
    log(f"Serving files from '{RESOURCES_DIR}' directory")
    log("Press Ctrl+C to stop the server")

    try:
        while True:
            client_socket, client_address = server_socket.accept()
            thread_pool_manager(client_socket, client_address)
            while True:
                with active_threads_lock:
                    available = active_threads < MAX_THREADS
                with connection_queue_lock:
                    if available and connection_queue:
                        queued_socket, queued_addr = connection_queue.pop(0)
                        log(f"Connection dequeued, assigned to Thread-{threading.active_count()}")
                        thread_pool_manager(queued_socket, queued_addr)
                    else:
                        break
    except KeyboardInterrupt:
        log("Shutting down server...")
    finally:
        server_socket.close()


if __name__ == "__main__":
    start_server()