1 /*
2  * Copyright (c) 2021 Omar Polo <op@omarpolo.com>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include "gmid.h"
18 
19 #include <err.h>
20 #include <errno.h>
21 
22 #include <event.h>
23 #include <fcntl.h>
24 #include <libgen.h>
25 #include <limits.h>
26 #include <signal.h>
27 #include <stdarg.h>
28 #include <string.h>
29 
30 static void	handle_imsg_cgi_req(struct imsgbuf*, struct imsg*, size_t);
31 static void	handle_imsg_quit(struct imsgbuf*, struct imsg*, size_t);
32 static void	handle_dispatch_imsg(int, short, void*);
33 
34 static imsg_handlerfn *handlers[] = {
35 	[IMSG_CGI_REQ] = handle_imsg_cgi_req,
36 	[IMSG_QUIT] = handle_imsg_quit,
37 };
38 
39 static inline void
40 safe_setenv(const char *name, const char *val)
41 {
42 	if (val == NULL)
43 		val = "";
44 	setenv(name, val, 1);
45 }
46 
47 static char *
48 xasprintf(const char *fmt, ...)
49 {
50 	va_list ap;
51 	char *s;
52 
53 	va_start(ap, fmt);
54 	if (vasprintf(&s, fmt, ap) == -1)
55 		s = NULL;
56 	va_end(ap);
57 
58 	return s;
59 }
60 
61 static void
62 do_exec(const char *ex, const char *spath, char *query)
63 {
64 	char **argv, buf[PATH_MAX], *sname, *t;
65 	size_t i, n;
66 
67 	strlcpy(buf, spath, sizeof(buf));
68 	sname = basename(buf);
69 
70 	if (query == NULL || strchr(query, '=') != NULL) {
71 		if ((argv = calloc(2, sizeof(char*))) == NULL)
72 			err(1, "calloc");
73 		argv[0] = sname;
74 		execvp(ex, argv);
75 		warn("execvp: %s", argv[0]);
76 		return;
77 	}
78 
79 	n = 1;
80 	for (t = query ;; t++, n++) {
81 		if ((t = strchr(t, '+')) == NULL)
82 			break;
83 	}
84 
85 	if ((argv = calloc(n+2, sizeof(char*))) == NULL)
86 		err(1, "calloc");
87 
88 	argv[0] = sname;
89 	for (i = 0; i < n; ++i) {
90 		t = strchr(query, '+');
91 		if (t != NULL)
92 			*t = '\0';
93 		argv[i+1] = pct_decode_str(query);
94 		query = t+1;
95 	}
96 
97 	execvp(ex, argv);
98 	warn("execvp: %s", argv[0]);
99 }
100 
101 static inline void
102 setenv_time(const char *var, time_t t)
103 {
104 	char timebuf[21];
105 	struct tm tminfo;
106 
107 	if (t == -1)
108 		return;
109 
110 	strftime(timebuf, sizeof(timebuf), "%FT%TZ",
111 	    gmtime_r(&t, &tminfo));
112 	setenv(var, timebuf, 1);
113 }
114 
115 /* fd or -1 on error */
116 static int
117 launch_cgi(struct iri *iri, struct cgireq *req, struct vhost *vhost)
118 {
119 	int p[2];		/* read end, write end */
120 
121 	if (pipe(p) == -1)
122 		return -1;
123 
124 	switch (fork()) {
125 	case -1:
126 		return -1;
127 
128 	case 0: {		/* child */
129 		char *ex, *pwd;
130 		char iribuf[GEMINI_URL_LEN];
131 		char path[PATH_MAX];
132 
133 		close(p[0]);
134 		if (dup2(p[1], 1) == -1)
135 			goto childerr;
136 
137 		ex = xasprintf("%s/%s", vhost->dir, req->spath);
138 
139 		serialize_iri(iri, iribuf, sizeof(iribuf));
140 
141 		safe_setenv("GATEWAY_INTERFACE", "CGI/1.1");
142 		safe_setenv("GEMINI_DOCUMENT_ROOT", vhost->dir);
143 		safe_setenv("GEMINI_SCRIPT_FILENAME",
144 		    xasprintf("%s/%s", vhost->dir, req->spath));
145 		safe_setenv("GEMINI_URL", iribuf);
146 
147 		strlcpy(path, "/", sizeof(path));
148 		strlcat(path, req->spath, sizeof(path));
149 		safe_setenv("GEMINI_URL_PATH", path);
150 
151 		if (*req->relpath != '\0') {
152 			strlcpy(path, "/", sizeof(path));
153 			strlcat(path, req->relpath, sizeof(path));
154 			safe_setenv("PATH_INFO", path);
155 
156 			strlcpy(path, vhost->dir, sizeof(path));
157 			strlcat(path, "/", sizeof(path));
158 			strlcat(path, req->relpath, sizeof(path));
159 			safe_setenv("PATH_TRANSLATED", path);
160 		}
161 
162 		safe_setenv("QUERY_STRING", iri->query);
163 		safe_setenv("REMOTE_ADDR", req->addr);
164 		safe_setenv("REMOTE_HOST", req->addr);
165 		safe_setenv("REQUEST_METHOD", "");
166 
167 		strlcpy(path, "/", sizeof(path));
168 		strlcat(path, req->spath, sizeof(path));
169 		safe_setenv("SCRIPT_NAME", path);
170 
171 		safe_setenv("SERVER_NAME", iri->host);
172 
173 		snprintf(path, sizeof(path), "%d", conf.port);
174 		safe_setenv("SERVER_PORT", path);
175 
176 		safe_setenv("SERVER_PROTOCOL", "GEMINI");
177 		safe_setenv("SERVER_SOFTWARE", "gmid/1.6");
178 
179 		if (*req->subject != '\0')
180 			safe_setenv("AUTH_TYPE", "Certificate");
181 		else
182 			safe_setenv("AUTH_TYPE", "");
183 
184 		safe_setenv("REMOTE_USER", req->subject);
185 		safe_setenv("TLS_CLIENT_ISSUER", req->issuer);
186 		safe_setenv("TLS_CLIENT_HASH", req->hash);
187 		safe_setenv("TLS_VERSION", req->version);
188 		safe_setenv("TLS_CIPHER", req->cipher);
189 
190 		snprintf(path, sizeof(path), "%d", req->cipher_strength);
191 		safe_setenv("TLS_CIPHER_STRENGTH", path);
192 
193 		setenv_time("TLS_CLIENT_NOT_AFTER", req->notafter);
194 		setenv_time("TLS_CLIENT_NOT_BEFORE", req->notbefore);
195 
196 		strlcpy(path, ex, sizeof(path));
197 
198 		pwd = dirname(path);
199 		if (chdir(pwd)) {
200 			warn("chdir");
201 			goto childerr;
202 		}
203 
204 		do_exec(ex, req->spath, iri->query);
205 		goto childerr;
206 	}
207 
208 	default:
209 		close(p[1]);
210 		mark_nonblock(p[0]);
211 		return p[0];
212 	}
213 
214 childerr:
215 	dprintf(p[1], "%d internal server error\r\n", TEMP_FAILURE);
216 	_exit(1);
217 }
218 
219 static struct vhost *
220 host_nth(size_t n)
221 {
222 	struct vhost *h;
223 
224 	TAILQ_FOREACH(h, &hosts, vhosts) {
225 		if (n == 0)
226 			return h;
227 		n--;
228 	}
229 
230 	return NULL;
231 }
232 
233 static void
234 handle_imsg_cgi_req(struct imsgbuf *ibuf, struct imsg *imsg, size_t datalen)
235 {
236 	struct vhost	*h;
237 	struct cgireq	 req;
238 	struct iri	 iri;
239 	int		 fd;
240 
241 	if (datalen != sizeof(req))
242 		abort();
243 
244 	memcpy(&req, imsg->data, datalen);
245 
246 	iri.schema = req.iri_schema_off + req.buf;
247 	iri.host = req.iri_host_off + req.buf;
248 	iri.port = req.iri_port_off + req.buf;
249 	iri.path = req.iri_path_off + req.buf;
250 	iri.query = req.iri_query_off + req.buf;
251 	iri.fragment = req.iri_fragment_off + req.buf;
252 
253 	/* patch the query, otherwise do_exec will always pass "" as
254 	 * first argument to the script. */
255 	if (*iri.query == '\0')
256 		iri.query = NULL;
257 
258 	if ((h = host_nth(req.host_off)) == NULL)
259 		abort();
260 
261 	fd = launch_cgi(&iri, &req, h);
262 	imsg_compose(ibuf, IMSG_CGI_RES, imsg->hdr.peerid, 0, fd, NULL, 0);
263 	imsg_flush(ibuf);
264 }
265 
266 static void
267 handle_imsg_quit(struct imsgbuf *ibuf, struct imsg *imsg, size_t datalen)
268 {
269 	int i;
270 
271 	(void)ibuf;
272 	(void)imsg;
273 	(void)datalen;
274 
275 	for (i = 0; i < conf.prefork; ++i) {
276 		imsg_compose(&servibuf[i], IMSG_QUIT, 0, 0, -1, NULL, 0);
277 		imsg_flush(&exibuf);
278 		close(servibuf[i].fd);
279 	}
280 
281 	event_loopbreak();
282 }
283 
284 static void
285 handle_dispatch_imsg(int fd, short ev, void *d)
286 {
287 	struct imsgbuf *ibuf = d;
288 	dispatch_imsg(ibuf, handlers, sizeof(handlers));
289 }
290 
291 int
292 executor_main(struct imsgbuf *ibuf)
293 {
294 	struct event	 evs[PROC_MAX], imsgev;
295 	int		 i;
296 
297 	event_init();
298 
299 	if (ibuf != NULL) {
300 		event_set(&imsgev, ibuf->fd, EV_READ | EV_PERSIST,
301 		    handle_dispatch_imsg, ibuf);
302 		event_add(&imsgev, NULL);
303 	}
304 
305 	for (i = 0; i < conf.prefork; ++i) {
306 		event_set(&evs[i], servibuf[i].fd, EV_READ | EV_PERSIST,
307 		    handle_dispatch_imsg, &servibuf[i]);
308 		event_add(&evs[i], NULL);
309 	}
310 
311 	sandbox_executor_process();
312 
313 	event_dispatch();
314 
315 	return 1;
316 }