op public repos

Blob

Date:: Sat May 15 11:11:56 2021 UTC
Message:: define and use GMID_VERSION
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2021 Omar Polo <op@omarpolo.com>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include "gmid.h"
18 
19 #include <sys/un.h>
20 
21 #include <err.h>
22 #include <errno.h>
23 
24 #include <event.h>
25 #include <fcntl.h>
26 #include <libgen.h>
27 #include <limits.h>
28 #include <signal.h>
29 #include <stdarg.h>
30 #include <string.h>
31 
32 static void	handle_imsg_cgi_req(struct imsgbuf*, struct imsg*, size_t);
33 static void	handle_imsg_fcgi_req(struct imsgbuf*, struct imsg*, size_t);
34 static void	handle_imsg_quit(struct imsgbuf*, struct imsg*, size_t);
35 static void	handle_dispatch_imsg(int, short, void*);
36 
37 static imsg_handlerfn *handlers[] = {
38 	[IMSG_FCGI_REQ] = handle_imsg_fcgi_req,
39 	[IMSG_CGI_REQ] = handle_imsg_cgi_req,
40 	[IMSG_QUIT] = handle_imsg_quit,
41 };
42 
43 static inline void
44 safe_setenv(const char *name, const char *val)
45 {
46 	if (val == NULL)
47 		val = "";
48 	setenv(name, val, 1);
49 }
50 
51 static char *
52 xasprintf(const char *fmt, ...)
53 {
54 	va_list ap;
55 	char *s;
56 
57 	va_start(ap, fmt);
58 	if (vasprintf(&s, fmt, ap) == -1)
59 		s = NULL;
60 	va_end(ap);
61 
62 	return s;
63 }
64 
65 static void
66 do_exec(const char *ex, const char *spath, char *query)
67 {
68 	char **argv, buf[PATH_MAX], *sname, *t;
69 	size_t i, n;
70 
71 	/* restore the default handlers */
72 	signal(SIGPIPE, SIG_DFL);
73 	signal(SIGCHLD, SIG_DFL);
74 	signal(SIGHUP,  SIG_DFL);
75 	signal(SIGINT,  SIG_DFL);
76 	signal(SIGTERM, SIG_DFL);
77 
78 	strlcpy(buf, spath, sizeof(buf));
79 	sname = basename(buf);
80 
81 	if (query == NULL || strchr(query, '=') != NULL) {
82 		if ((argv = calloc(2, sizeof(char*))) == NULL)
83 			err(1, "calloc");
84 		argv[0] = sname;
85 		execvp(ex, argv);
86 		warn("execvp: %s", argv[0]);
87 		return;
88 	}
89 
90 	n = 1;
91 	for (t = query ;; t++, n++) {
92 		if ((t = strchr(t, '+')) == NULL)
93 			break;
94 	}
95 
96 	if ((argv = calloc(n+2, sizeof(char*))) == NULL)
97 		err(1, "calloc");
98 
99 	argv[0] = sname;
100 	for (i = 0; i < n; ++i) {
101 		t = strchr(query, '+');
102 		if (t != NULL)
103 			*t = '\0';
104 		argv[i+1] = pct_decode_str(query);
105 		query = t+1;
106 	}
107 
108 	execvp(ex, argv);
109 	warn("execvp: %s", argv[0]);
110 }
111 
112 static inline void
113 setenv_time(const char *var, time_t t)
114 {
115 	char timebuf[21];
116 	struct tm tminfo;
117 
118 	if (t == -1)
119 		return;
120 
121 	strftime(timebuf, sizeof(timebuf), "%FT%TZ",
122 	    gmtime_r(&t, &tminfo));
123 	setenv(var, timebuf, 1);
124 }
125 
126 /* fd or -1 on error */
127 static int
128 launch_cgi(struct iri *iri, struct cgireq *req, struct vhost *vhost,
129     struct location *loc)
130 {
131 	int p[2];		/* read end, write end */
132 
133 	if (pipe(p) == -1)
134 		return -1;
135 
136 	switch (fork()) {
137 	case -1:
138 		return -1;
139 
140 	case 0: {		/* child */
141 		char *ex, *pwd;
142 		char iribuf[GEMINI_URL_LEN];
143 		char path[PATH_MAX];
144 		struct envlist *e;
145 
146 		close(p[0]);
147 		if (dup2(p[1], 1) == -1)
148 			goto childerr;
149 
150 		ex = xasprintf("%s/%s", loc->dir, req->spath);
151 
152 		serialize_iri(iri, iribuf, sizeof(iribuf));
153 
154 		safe_setenv("GATEWAY_INTERFACE", "CGI/1.1");
155 		safe_setenv("GEMINI_DOCUMENT_ROOT", loc->dir);
156 		safe_setenv("GEMINI_SCRIPT_FILENAME",
157 		    xasprintf("%s/%s", loc->dir, req->spath));
158 		safe_setenv("GEMINI_URL", iribuf);
159 
160 		strlcpy(path, "/", sizeof(path));
161 		strlcat(path, req->spath, sizeof(path));
162 		safe_setenv("GEMINI_URL_PATH", path);
163 
164 		if (*req->relpath != '\0') {
165 			strlcpy(path, "/", sizeof(path));
166 			strlcat(path, req->relpath, sizeof(path));
167 			safe_setenv("PATH_INFO", path);
168 
169 			strlcpy(path, loc->dir, sizeof(path));
170 			strlcat(path, "/", sizeof(path));
171 			strlcat(path, req->relpath, sizeof(path));
172 			safe_setenv("PATH_TRANSLATED", path);
173 		}
174 
175 		safe_setenv("QUERY_STRING", iri->query);
176 		safe_setenv("REMOTE_ADDR", req->addr);
177 		safe_setenv("REMOTE_HOST", req->addr);
178 		safe_setenv("REQUEST_METHOD", "");
179 
180 		strlcpy(path, "/", sizeof(path));
181 		strlcat(path, req->spath, sizeof(path));
182 		safe_setenv("SCRIPT_NAME", path);
183 
184 		safe_setenv("SERVER_NAME", iri->host);
185 
186 		snprintf(path, sizeof(path), "%d", conf.port);
187 		safe_setenv("SERVER_PORT", path);
188 
189 		safe_setenv("SERVER_PROTOCOL", "GEMINI");
190 		safe_setenv("SERVER_SOFTWARE", GMID_VERSION);
191 
192 		if (*req->subject != '\0')
193 			safe_setenv("AUTH_TYPE", "Certificate");
194 		else
195 			safe_setenv("AUTH_TYPE", "");
196 
197 		safe_setenv("REMOTE_USER", req->subject);
198 		safe_setenv("TLS_CLIENT_ISSUER", req->issuer);
199 		safe_setenv("TLS_CLIENT_HASH", req->hash);
200 		safe_setenv("TLS_VERSION", req->version);
201 		safe_setenv("TLS_CIPHER", req->cipher);
202 
203 		snprintf(path, sizeof(path), "%d", req->cipher_strength);
204 		safe_setenv("TLS_CIPHER_STRENGTH", path);
205 
206 		setenv_time("TLS_CLIENT_NOT_AFTER", req->notafter);
207 		setenv_time("TLS_CLIENT_NOT_BEFORE", req->notbefore);
208 
209 		TAILQ_FOREACH(e, &vhost->env, envs) {
210 			safe_setenv(e->name, e->value);
211 		}
212 
213 		strlcpy(path, ex, sizeof(path));
214 
215 		pwd = dirname(path);
216 		if (chdir(pwd)) {
217 			warn("chdir");
218 			goto childerr;
219 		}
220 
221 		do_exec(ex, req->spath, iri->query);
222 		goto childerr;
223 	}
224 
225 	default:
226 		close(p[1]);
227 		mark_nonblock(p[0]);
228 		return p[0];
229 	}
230 
231 childerr:
232 	dprintf(p[1], "%d internal server error\r\n", TEMP_FAILURE);
233 	_exit(1);
234 }
235 
236 static struct vhost *
237 host_nth(size_t n)
238 {
239 	struct vhost *h;
240 
241 	TAILQ_FOREACH(h, &hosts, vhosts) {
242 		if (n == 0)
243 			return h;
244 		n--;
245 	}
246 
247 	return NULL;
248 }
249 
250 static struct location *
251 loc_nth(struct vhost *vhost, size_t n)
252 {
253 	struct location *loc;
254 
255 	TAILQ_FOREACH(loc, &vhost->locations, locations) {
256 		if (n == 0)
257 			return loc;
258 		n--;
259 	}
260 
261 	return NULL;
262 }
263 
264 static void
265 handle_imsg_cgi_req(struct imsgbuf *ibuf, struct imsg *imsg, size_t datalen)
266 {
267 	struct vhost	*h;
268 	struct location	*l;
269 	struct cgireq	 req;
270 	struct iri	 iri;
271 	int		 fd;
272 
273 	if (datalen != sizeof(req))
274 		abort();
275 
276 	memcpy(&req, imsg->data, datalen);
277 
278 	iri.schema = req.iri_schema_off + req.buf;
279 	iri.host = req.iri_host_off + req.buf;
280 	iri.port = req.iri_port_off + req.buf;
281 	iri.path = req.iri_path_off + req.buf;
282 	iri.query = req.iri_query_off + req.buf;
283 	iri.fragment = req.iri_fragment_off + req.buf;
284 
285 	/* patch the query, otherwise do_exec will always pass "" as
286 	 * first argument to the script. */
287 	if (*iri.query == '\0')
288 		iri.query = NULL;
289 
290 	if ((h = host_nth(req.host_off)) == NULL)
291 		abort();
292 
293 	if ((l = loc_nth(h, req.loc_off)) == NULL)
294 		abort();
295 
296 	fd = launch_cgi(&iri, &req, h, l);
297 	imsg_compose(ibuf, IMSG_CGI_RES, imsg->hdr.peerid, 0, fd, NULL, 0);
298 	imsg_flush(ibuf);
299 }
300 
301 static int
302 fcgi_open_prog(struct fcgi *f)
303 {
304 	int s[2];
305 	pid_t p;
306 
307 	/* XXX! */
308 
309 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNIX, s) == -1)
310 		err(1, "socketpair");
311 
312 	switch (p = fork()) {
313 	case -1:
314 		err(1, "fork");
315 	case 0:
316 		close(s[0]);
317 		if (dup2(s[1], 0) == -1)
318 			err(1, "dup2");
319 		execl(f->prog, f->prog, NULL);
320 		err(1, "execl %s", f->prog);
321 	default:
322 		close(s[1]);
323 		return s[0];
324 	}
325 }
326 
327 static int
328 fcgi_open_sock(struct fcgi *f)
329 {
330 	struct sockaddr_un	addr;
331 	int			fd;
332 
333 	if ((fd = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) {
334 		log_err(NULL, "socket: %s", strerror(errno));
335 		return -1;
336 	}
337 
338 	memset(&addr, 0, sizeof(addr));
339 	addr.sun_family = AF_UNIX;
340 	strlcpy(addr.sun_path, f->path, sizeof(addr.sun_path));
341 
342 	if (connect(fd, (struct sockaddr*)&addr, sizeof(addr)) == -1) {
343 		log_warn(NULL, "failed to connect to %s: %s", f->path,
344 		    strerror(errno));
345 		close(fd);
346 		return -1;
347 	}
348 
349 	return fd;
350 }
351 
352 static int
353 fcgi_open_conn(struct fcgi *f)
354 {
355 	struct addrinfo	hints, *servinfo, *p;
356 	int		r, sock;
357 
358 	memset(&hints, 0, sizeof(hints));
359 	hints.ai_family = AF_UNSPEC;
360 	hints.ai_socktype = SOCK_STREAM;
361 	hints.ai_flags = AI_ADDRCONFIG;
362 
363 	if ((r = getaddrinfo(f->path, f->port, &hints, &servinfo)) != 0) {
364 		log_warn(NULL, "getaddrinfo %s:%s: %s", f->path, f->port,
365 		    gai_strerror(r));
366 		return -1;
367 	}
368 
369 	for (p = servinfo; p != NULL; p = p->ai_next) {
370 		sock = socket(p->ai_family, p->ai_socktype, p->ai_protocol);
371 		if (sock == -1)
372 			continue;
373 		if (connect(sock, p->ai_addr, p->ai_addrlen) == -1) {
374 			close(sock);
375 			continue;
376 		}
377 		break;
378 	}
379 
380 	if (p == NULL) {
381 		log_warn(NULL, "couldn't connect to %s:%s", f->path, f->port);
382 		sock = -1;
383 	}
384 
385 	freeaddrinfo(servinfo);
386 	return sock;
387 }
388 
389 static void
390 handle_imsg_fcgi_req(struct imsgbuf *ibuf, struct imsg *imsg, size_t datalen)
391 {
392 	struct fcgi	*f;
393 	int		 id, fd;
394 
395 	if (datalen != sizeof(id))
396 		abort();
397 	memcpy(&id, imsg->data, datalen);
398 
399 	if (id > FCGI_MAX || (fcgi[id].path == NULL && fcgi[id].prog == NULL))
400 		abort();
401 
402 	f = &fcgi[id];
403 	if (f->prog != NULL)
404 		fd = fcgi_open_prog(f);
405 	else if (f->port != NULL)
406 		fd = fcgi_open_conn(f);
407 	else
408 		fd = fcgi_open_sock(f);
409 
410 	imsg_compose(ibuf, IMSG_FCGI_FD, id, 0, fd, NULL, 0);
411 	imsg_flush(ibuf);
412 }
413 
414 static void
415 handle_imsg_quit(struct imsgbuf *ibuf, struct imsg *imsg, size_t datalen)
416 {
417 	int i;
418 
419 	(void)ibuf;
420 	(void)imsg;
421 	(void)datalen;
422 
423 	for (i = 0; i < conf.prefork; ++i) {
424 		imsg_compose(&servibuf[i], IMSG_QUIT, 0, 0, -1, NULL, 0);
425 		imsg_flush(&exibuf);
426 		close(servibuf[i].fd);
427 	}
428 
429 	event_loopbreak();
430 }
431 
432 static void
433 handle_dispatch_imsg(int fd, short ev, void *d)
434 {
435 	struct imsgbuf *ibuf = d;
436 	dispatch_imsg(ibuf, handlers, sizeof(handlers));
437 }
438 
439 int
440 executor_main(struct imsgbuf *ibuf)
441 {
442 	struct event	 evs[PROC_MAX], imsgev;
443 	int		 i;
444 
445 	event_init();
446 
447 	if (ibuf != NULL) {
448 		event_set(&imsgev, ibuf->fd, EV_READ | EV_PERSIST,
449 		    handle_dispatch_imsg, ibuf);
450 		event_add(&imsgev, NULL);
451 	}
452 
453 	for (i = 0; i < conf.prefork; ++i) {
454 		event_set(&evs[i], servibuf[i].fd, EV_READ | EV_PERSIST,
455 		    handle_dispatch_imsg, &servibuf[i]);
456 		event_add(&evs[i], NULL);
457 	}
458 
459 	sandbox_executor_process();
460 
461 	event_dispatch();
462 
463 	return 1;
464 }