ISAPI (Internet Server Application Programming Interface As an optional to replace CGI)
The law is the API standard on the web server proposed by Microsoft and Process Software. ISAPI combines with the web server
Secret, powerful, can get a lot of information, so use ISAPI to develop a flexible and efficient web server enhancement program
. Due to the ISAPI program and the Web server, it has a certain research value in terms of security. Mainly
Discuss the implementation of ISAPI in IIS and VC 6.0.
ISAPI interface and the CGI interface.
The ISAPI program and the CGI program complete a similar feature, but the implementation method is different.
1. The ISAPI program is loaded into its own process space in DLL, so the same address is shared with the server.
In the room, it can be uninstalled from memory when there is no customer request; and each request for the client to the CGI program is required.
To serve a server separately, this requires a lot of time and memory. When the number of concurrent requests is large,
It is not as efficient with CGI to be in terms of ISAPI.
2, the CGI program communicates with the web server through the environment block and standard input, and the ISAPI program is more combined with the server.
Tight, share the same process context with the server, mainly interacting with the server through a parameter block, can be from the server
There is a lot of information about the current HTTP connection.
ISAPI is mainly divided into ISA and ISAPI Filter. ISA methods are relatively traditional, using some special links
Point to the server's job, designed some extension features for program developers; and ISAPI filters tend to construct the server
A module that is directly called, providing a seamless link component for monitoring HTTP requests directly from the server.
Second, ISA
ISA (Internet Server Application) can also be called ISAPI DLL, its functionality and CGI program function directly correspond
, Use methods and CGIs are similar, and the client specifies its name in the URL. For example, the following request will call the server
Function.dll under the virtual executable directory Scripts (ISAPI DLL must be placed in a virtual executable of the server):
http://www.abc.com/scripts/function.dll?
There are two main interfaces between ISA and servers: getExtentionVersion () and HTTPEXTENTIONPROC (). any
Both ISA must define these two extraction functions in the extraction table of their PE file header to call the web server when appropriate.
1. When the server just loads ISA, it will call the getExtentionVersion () provided by the ISA to get the item required for this ISA.
The server version and compared with your own version to ensure that the version is compatible. The function prototype is as follows:
BOOL WINAPI GETEXTENTIONVERSION (HSE_VERSION_INFO * VERSION);
Typedef struct _hse_version_info
{
DWORD DWEXTENSIONVERSION; // version number
Char lpszextensionDesc [hse_max_ext_dll_name_len]; / / About ISA Description Strings
} HSE_VERSION_INFO, * LPHSE_VERSION_INFO;
2, the true entrance of ISA is httpextionProc (), which is equivalent to the main () function of the normal C program, in this function
Different processing according to different customer requests. Server and HTTPEXTENTIONPROC () are communicated by Extension Control Block, that is, the ECB is stored in port parameters and export parameters, including servers.
Several callback functions of the entrance address. The function prototype is as follows:
DWORD HTTPEXTENSIONPROC (Extension_Control_block * PECB);
The structure of the ECB is defined as follows (in indicates the entrance parameters, OUT indicates the exit parameters):
Typedef struct _extension_control_block
{
DWORD CBSIZE; // IN, the size of this structure, read only
DWORD DWVERSION / / IN, version number, high 16-bit, low 16 bits as secondary version number
HCONN Connid; // IN, connection handle, by server, ISA can only read this value
DWORD DWHTTPSTATUSCODE; // OUT, currently completed transaction status
Char lpszlogdata [hse_log_buffer_len]; // OUT, you need to write to the contents of the log file
LPSTR LPSZMETHOD; // IN, equivalent to CGI environment variables Request_Method
LPSTR LPSZQUERYSTRING; // IN, equivalent environment variable QUERY_STRING
LPSTR LPSZPATHINFO; // IN, equivalent to environmental variables PATH_INFO
LPSTR LPSZPATHTRANSLATED; // IN, equivalent environment variable PATH_TRANSLATED
DWORD CBTOTALBYTES; // IN, equivalent environment variable Content_Length
DWORD CBAVAILABLE; // IN, number of available bytes in the buffer
LPBYTE LPBDATA; // IN, buffer pointer, pointing to the client
LPSTR LPSZCONTENTTYPE; // IN, equivalent to environmental variables Content_Type
// Tune function, use to return information or specific server details of the server
Bool (WinApi * GetSerVariable)
(HCONN HCONN,
LPSTR LPSZVARIABLENAME,
LPVOID LPVBUFFER,
LPDWORD LPDWSIZE);
Bool (WinApi * WriteClient) // callback function reads data from the client's HTTP request
(HCONN ConnID,
LPVOID BUFFER,
LPDWORD LPDWBYTES,
DWORD DWRESERVED);
Bool (winapi * readclient) // callback function, send data to the client
(HCONN ConnID,
LPVOID LPVBUFFER,
LPDWORD LPDWSIZE);
Bool (WinAPI * ServersupportFunction) // Tune function, access server's general and specific features
(HCONN HCONN,
DWORD DWHSERREQUEST,
LPVOID LPVBUFFER,
LPDWORD LPDWSIZE,
LPDWORD LPDWDATYPE);
} EXTENSION_CONTROL_BLOCK, * LPEXTENSION_CONTROL_BLOCK;
In the above ECB, the server not only provides the current HTTP connection handle and some variables, but also provides 4 callback functions.
ISA calls so that ISA can obtain more detailed information. Third, ISAPI FILTER
The ISAPI Filter is located between the server and the client, and can pre-processed and post-processes communication between servers and clients.
For example, encrypt / decrypt communication, providing new methods for authenticating customers, providing custom logging, etc.
There is no part corresponding to the ISAPI Filter in the CGI.
There are two interfaces between the ISAPI Filter and the server: getFilterverse () and httpfilterproc (). any
Both ISAPI Filter must lead these two functions for server calls.
1. The file name of all ISAPI Filter is stored in the following key values of the registry, and the IIS server is obtained from this key value when the IIS server is started.
Filter's file name and load them.
HKEY_LOCAL_MACHINE / SYSTEM / CURRENTCONTROLSET / SERVICES / W3SVC / Parameters / Filterdll
2, then the server calls the getFilterVersion () function provided by each filter, get the version number and the Filter hopes
The process of processing, that is, ISAPI FILTER tells the server you want to handle by leading the getfilterversion () function.
What type of event is activated by an event to be activated by an event. When the condition is met, the server will
The main function httpfilterProc () that calls Filter is processed. GetFilterversion () prototype
under:
Bool WinApi getFilterVersion
DWORD DWSERVERFILTERVERSION; // IN, version specification for server use
DWORD DWFILTERVERSION; // OUT, version specification for filters
Char lpszfilterdesc [sf_max_filter_desc_len 1]; // OUT, description string of the filter
DWORD DWFLAGS / / OUT, Events and Priority Signs
);
The value of the event and priority flag dwflasg has a detailed explanation in the MSDN, including the priority of the Filter called, one
The default low priority should be used, otherwise it may have a big impact on the performance of the system.
3, httpfilterproc () is the main entrance function of ISAPI Filter, which makes different points according to the current events.
. The server interacts with the following parameter blocks and filters, and this parameter block is similar to the ECB in ISA.
Typedef struct_http_filter_context
{
DWORD CBSIZE; // IN, the size of this parameter block
DWord Revision; // in
PVOID ServerContext; // in, use this parameter by Server
DWORD ULRESERVED; // IN, use this parameter by Server
Bool Fissecureport; // IN, whether the event occurs on the security port
PVOID PFILTERCONTEXT; // IN / OUT, context related to this request
/ / The callback function obtains information about the server and this connection
Bool (WinApi * GetSerVariable) (
struct _http_filter_context * PFC,
LPSTR LPSZVARIABLENAME,
LPVOID LPVBUFFER,
LPDWORD LPDWSIZE
);
Bool (WinApi * addresponseheaders) (// callback function, add a header to the HTTP response
Struct_http_filter_context * PFC, LPSTR LPSZHEADERS,
DWORD DWRESERVED
);
Bool (WinApi * WriteClient) (// callback function sent the original data to the client
struct _http_filter_context * PFC,
LPVOID BUFFER,
LPDWORD LPDWBYTES,
DWORD DWRESERVED
);
Void * (WinApi * allocmem) (// callback function, allocated memory.
struct _http_filter_context * PFC,
DWORD CBSIZE,
DWORD DWRESERVED
);
Bool (WinApi * ServersupportFunction) (// callback function, general and specific features of the server
struct _http_filter_context * PFC,
ENUM SF_REQ_TYPE SFREQ,
PVOID PDATA,
DWORD UL1,
DWORD UL2
);
} Http_filter_context, * phttp_filter_context;
Fourth, support for ISAPI in VC 6.0
5 related classes are defined in VC 6.0 to simplify the ISAPI programming: Chttpserver, ChttpServerContext,
Chttpfilter, ChttpFilterContext, Chtmlstream, these five categories have no parent class. Where Chttpserver and
ChttpServerContext is mainly used to write ISA, ChttpFilter and ChttpFilterContext to write ISAPI
Filter, while ChtmlStream is used to operate HTML files in memory and serve other four classes. Chttpserver
Only one instance in each ISA, a chttpserver can correspond to multiple ChttpserverContext instances, each
ChttpServerContext processes a customer request, which can handle concurrent HTTP requests; ChttpFilter and
The relationship between ChttpFilterContext is similar to this, only one chttpfilter instance in each ISAPI Filter
However, there can be multiple ChttpFilterContext to process concurrent events. Chttpserver and Chttpfilter are independent
Class, they can coexist in a DLL, or in different DLLs, respectively.
An ISA can provide multiple commands, each command corresponds to a member function of Chttpserver (or its subclasses), client
You can specify a command name and its parameters in the URL. This corresponds to the Parse Map in VC 6.0.
Parse Map is similar to the Windows message distribution mechanism in the MFC, by using the DECLARE_PARSE_MAP provided by VC,
Begin_PARSE_MAP, ON_PARSE_COMMAND, ON_PARSE_COMMAND_PARAMS, DEFAULT_PARSE_COMMAND,
End_parse_map and other macros, you can implement processing of different commands. You can only create a PARSE in each Chttpserver
Map, when the client sent a command to the ISA, Parse Map can analyze the command name and its parameters in the HTTP request.
The command is associated with the corresponding member function, that is, the command is handled by the member function. Pinball in the MSDN
In this case, there is a form below:
