op public repos

Blob

Date:: Thu Jul 14 13:30:52 2022 UTC
Message:: import gotwebd thread fcgi response to client for rendering in browser as data is returned fix potential problem with a stuck loop if the client is hammering the server with random clicks and stop/restarts render our index! WOOHOO! small var refactoring. fcgi.c to handle all clean-up, various error clean-up remove output used to trace down got bug temporarily stop overloading a socket, but a better solution needs to be found return on fcgi_gen_response, so we can track if a client is writable or not this stops page creation when the client is unavailable remove old comments enable profile building, although, i don't think this works thoroughly in a priv/proc daemon catch more errors correctly count repos remove temp logger we don't need to start our responder thread so early. move it to fcgi.c and start when we start processing html kill the unneeded thread, stop queueing responses, and just write to clients immediately clean up some memory leaks and dead stores rework querystring so an error can be displayed instead of showing the index on querystring error get framework in place for the rest of the content add server struct to response struct bo last commit get back a usable gotweb. not sure what i was thinking yesterday properly move our structs around this time remember index page for sitelink, fix leak unused var is annoying, so stop it for now. don't forget to change this! style briefs nearly completed. finish briefs output add briefs to summary cleanup some html properly retrieve next and previous commit ids for list navigation follow naddy's stailq macro change we will never have a previous link on the summary page goto correct label, so we get a previous link on the last page of briefs don't wrap short line simplify got_get_repo_commits code start rendering a diff start rendering a diff this was by accident finish diff output functions cleanup prepare for fd request that was a stupid idea, just flush the priv_fd bo that too. that won't work eith with append in mkstemp that isn't going to work actually zero out the priv_fd missed seek to beginning of file was overwriting first line of diff fsync our fd as well add link to repo path by sitelink and add back verbose fcgi debugging that was removed add modest write heuristics to fcgi_send_response fix dead assignments and XXX comment where a leak is happening that I can't find right now there was no leak. stsp is brilliant and knew it was the cache growing prevent double-free, render prettier err output if we can remove unused variables correctly fix double-free fix gotwebd to build with main's changes after rebase fix double-free don't error on index if pack files missing and fixup some error handling render commits finish up tag briefs and start the tag page finish up tag page unbreak TAGS and SUMMARY actions grab the correct tag from the queue unbreak TAGS and SUMMARY actions again update some error handling clean up unneeded code and start tree output render tree render branches remove tags from summary if there aren't any fix tree div structure and start blob render render blob render blame fix tree href in briefs clean up some css add headref to querystrings load correct commit for tree and diff fixup some error output update some copyright dates add full SNI support rm debug line found by Lucas6023, notified via IRC. thanks!! fix tree fix crash when querystring is manipulated to not have a commit id in certain instances. also break a stuck while loop on client error. fix for new got_object_id_by_path arguments rebase and fix prep for multiple fds per socket, instead of just one fix overlooked shift/reduce conflicts backout priv_fds as a list. after discussion with stsp, an array and length are the better direction prepare array of fds to pass into got functions make a new set of pack fds, which will be passed to got_repo_open work with new pack_fds in got_repo_open give output when no tags exist escape html in blame output change files listed in tree view to show blob, file commits, and blame, instead of blob, blob, blame. idea from mp4 on irc. this is way more handy. stop populating the queue from the headref and figure out previous commit id while iterating. this should reduce some overhead. actually purge our sockets instead of not using the function start work with new blob rm volatile use new diff change func names no more temp files increase blame number line width set content-type to text/plain so firefox won't download files rm test infra for now account for -Wwrite-strings fix for sigs and algorithm choice clean up some leaks and other mistakes
Actions:: History | Blame | Raw File

1 /*
2  * Copyright (c) 2016, 2019, 2020-2021 Tracey Emery <tracey@traceyemery.net>
3  * Copyright (c) 2015 Mike Larkin <mlarkin@openbsd.org>
4  * Copyright (c) 2013 David Gwynne <dlg@openbsd.org>
5  * Copyright (c) 2013 Florian Obser <florian@openbsd.org>
6  *
7  * Permission to use, copy, modify, and distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 #include <sys/param.h>
21 #include <sys/ioctl.h>
22 #include <sys/queue.h>
23 #include <sys/wait.h>
24 #include <sys/uio.h>
25 #include <sys/resource.h>
26 #include <sys/socket.h>
27 #include <sys/stat.h>
28 #include <sys/time.h>
29 #include <sys/types.h>
30 #include <sys/mman.h>
31 #include <sys/un.h>
32 
33 #include <net/if.h>
34 #include <netinet/in.h>
35 
36 #include <errno.h>
37 #include <event.h>
38 #include <fcntl.h>
39 #include <ifaddrs.h>
40 #include <imsg.h>
41 #include <limits.h>
42 #include <netdb.h>
43 #include <poll.h>
44 #include <pwd.h>
45 #include <stddef.h>
46 #include <stdio.h>
47 #include <stdlib.h>
48 #include <string.h>
49 #include <unistd.h>
50 #include <util.h>
51 
52 #include "got_error.h"
53 #include "got_opentemp.h"
54 
55 #include "proc.h"
56 #include "gotwebd.h"
57 
58 #define SOCKS_BACKLOG 5
59 #define MAXIMUM(a, b)	(((a) > (b)) ? (a) : (b))
60 
61 
62 volatile int client_cnt;
63 
64 struct timeval	timeout = { TIMEOUT_DEFAULT, 0 };
65 
66 void	 sockets_sighdlr(int, short, void *);
67 void	 sockets_run(struct privsep *, struct privsep_proc *, void *);
68 void	 sockets_launch(void);
69 void	 sockets_purge(struct gotwebd *);
70 void	 sockets_accept_paused(int, short, void *);
71 void	 sockets_dup_new_socket(struct socket *, struct socket *);
72 void	 sockets_rlimit(int);
73 
74 
75 int	 sockets_dispatch_gotwebd(int, struct privsep_proc *, struct imsg *);
76 int	 sockets_unix_socket_listen(struct privsep *, struct socket *);
77 int	 sockets_create_socket(struct addresslist *, in_port_t);
78 int	 sockets_socket_af(struct sockaddr_storage *, in_port_t);
79 int	 sockets_accept_reserve(int, struct sockaddr *, socklen_t *, int,
80 	    volatile int *);
81 
82 struct socket
83 	*sockets_conf_new_socket(struct gotwebd *, struct server *, int, int,
84 	    int);
85 
86 int cgi_inflight = 0;
87 
88 static struct privsep_proc procs[] = {
89 	{ "gotwebd",	PROC_GOTWEBD,	sockets_dispatch_gotwebd  },
90 };
91 
92 void
93 sockets(struct privsep *ps, struct privsep_proc *p)
94 {
95 	proc_run(ps, p, procs, nitems(procs), sockets_run, NULL);
96 }
97 
98 void
99 sockets_run(struct privsep *ps, struct privsep_proc *p, void *arg)
100 {
101 	if (config_init(ps->ps_env) == -1)
102 		fatal("failed to initialize configuration");
103 
104 	p->p_shutdown = sockets_shutdown;
105 
106 	sockets_rlimit(-1);
107 
108 	signal_del(&ps->ps_evsigchld);
109 	signal_set(&ps->ps_evsigchld, SIGCHLD, sockets_sighdlr, ps);
110 	signal_add(&ps->ps_evsigchld, NULL);
111 
112 #ifndef PROFILE
113 	if (pledge("stdio rpath wpath cpath inet recvfd proc exec sendfd",
114 	    NULL) == -1)
115 		fatal("pledge");
116 #endif
117 }
118 
119 void
120 sockets_parse_sockets(struct gotwebd *env)
121 {
122 	struct server *srv;
123 	struct socket *sock, *new_sock = NULL;
124 	struct address *a;
125 	int sock_id = 0, ipv4 = 0, ipv6 = 0;
126 
127 	TAILQ_FOREACH(srv, env->servers, entry) {
128 		if (srv->unix_socket) {
129 			sock_id++;
130 			new_sock = sockets_conf_new_socket(env, srv,
131 			    sock_id, UNIX, 0);
132 			TAILQ_INSERT_TAIL(env->sockets, new_sock, entry);
133 		}
134 
135 		if (srv->fcgi_socket) {
136 			sock_id++;
137 			new_sock = sockets_conf_new_socket(env, srv,
138 			    sock_id, FCGI, 0);
139 			TAILQ_INSERT_TAIL(env->sockets, new_sock, entry);
140 
141 			/* add ipv6 children */
142 			TAILQ_FOREACH(sock, env->sockets, entry) {
143 				ipv4 = ipv6 = 0;
144 
145 				TAILQ_FOREACH(a, sock->conf.al, entry) {
146 					if (a->ss.ss_family == AF_INET)
147 						ipv4 = 1;
148 					if (a->ss.ss_family == AF_INET6)
149 						ipv6 = 1;
150 				}
151 
152 				/* create ipv6 sock */
153 				if (ipv4 == 1 && ipv6 == 1) {
154 					sock_id++;
155 					sock->conf.child_id = sock_id;
156 					new_sock = sockets_conf_new_socket(env,
157 					    srv, sock_id, FCGI, 1);
158 					sockets_dup_new_socket(sock, new_sock);
159 					TAILQ_INSERT_TAIL(env->sockets,
160 					    new_sock, entry);
161 					continue;
162 				}
163 			}
164 		}
165 	}
166 }
167 
168 void
169 sockets_dup_new_socket(struct socket *p_sock, struct socket *sock)
170 {
171 	struct address *a, *acp;
172 	int n;
173 
174 	sock->conf.parent_id = p_sock->conf.id;
175 	sock->conf.ipv4 = 0;
176 	sock->conf.ipv6 = 1;
177 
178 	memcpy(&sock->conf.srv_name, p_sock->conf.srv_name,
179 	    sizeof(sock->conf.srv_name));
180 
181 	n = snprintf(sock->conf.name, GOTWEBD_MAXTEXT, "%s_child",
182 	    p_sock->conf.srv_name);
183 	if (n < 0) {
184 		free(p_sock->conf.al);
185 		free(p_sock);
186 		free(sock->conf.al);
187 		free(sock);
188 		fatalx("%s: snprintf", __func__);
189 	}
190 
191 	TAILQ_FOREACH(a, p_sock->conf.al, entry) {
192 		if (a->ss.ss_family == AF_INET)
193 			continue;
194 
195 		if ((acp = calloc(1, sizeof(*acp))) == NULL)
196 			fatal("%s: calloc", __func__);
197 		memcpy(&acp->ss, &a->ss, sizeof(acp->ss));
198 		acp->ipproto = a->ipproto;
199 		acp->prefixlen = a->prefixlen;
200 		acp->port = a->port;
201 		if (strlen(a->ifname) != 0) {
202 			if (strlcpy(acp->ifname, a->ifname,
203 			    sizeof(acp->ifname)) >= sizeof(acp->ifname)) {
204 				fatalx("%s: interface name truncated",
205 				    __func__);
206 			}
207 		}
208 
209 		TAILQ_INSERT_TAIL(sock->conf.al, acp, entry);
210 	}
211 }
212 
213 struct socket *
214 sockets_conf_new_socket(struct gotwebd *env, struct server *srv, int id,
215     int type, int is_dup)
216 {
217 	struct socket *sock;
218 	struct address *a, *acp;
219 	int n;
220 
221 	if ((sock = calloc(1, sizeof(*sock))) == NULL)
222 		fatalx("%s: calloc", __func__);
223 
224 	if ((sock->conf.al = calloc(1, sizeof(*sock->conf.al))) == NULL) {
225 		free(sock);
226 		fatalx("%s: calloc", __func__);
227 	}
228 	TAILQ_INIT(sock->conf.al);
229 
230 	sock->conf.parent_id = 0;
231 	sock->conf.id = id;
232 
233 	sock->fd = -1;
234 
235 	sock->conf.type = type;
236 
237 	if (type == UNIX) {
238 		if (strlcpy(sock->conf.unix_socket_name,
239 		    srv->unix_socket_name,
240 		    sizeof(sock->conf.unix_socket_name)) >=
241 		    sizeof(sock->conf.unix_socket_name)) {
242 			free(sock->conf.al);
243 			free(sock);
244 			fatalx("%s: strlcpy", __func__);
245 		}
246 	} else
247 		sock->conf.ipv4 = 1;
248 
249 	sock->conf.fcgi_socket_port = srv->fcgi_socket_port;
250 
251 	if (is_dup)
252 		goto done;
253 
254 	n = snprintf(sock->conf.name, GOTWEBD_MAXTEXT, "%s_parent",
255 	    srv->name);
256 	if (n < 0) {
257 		free(sock->conf.al);
258 		free(sock);
259 		fatalx("%s: snprintf", __func__);
260 	}
261 
262 	if (strlcpy(sock->conf.srv_name, srv->name,
263 	    sizeof(sock->conf.srv_name)) >= sizeof(sock->conf.srv_name)) {
264 		free(sock->conf.al);
265 		free(sock);
266 		fatalx("%s: strlcpy", __func__);
267 	}
268 
269 	TAILQ_FOREACH(a, srv->al, entry) {
270 		if ((acp = calloc(1, sizeof(*acp))) == NULL) {
271 			free(sock->conf.al);
272 			free(sock);
273 			fatal("%s: calloc", __func__);
274 		}
275 		memcpy(&acp->ss, &a->ss, sizeof(acp->ss));
276 		acp->ipproto = a->ipproto;
277 		acp->prefixlen = a->prefixlen;
278 		acp->port = a->port;
279 		if (strlen(a->ifname) != 0) {
280 			if (strlcpy(acp->ifname, a->ifname,
281 			    sizeof(acp->ifname)) >= sizeof(acp->ifname)) {
282 				fatalx("%s: interface name truncated",
283 				    __func__);
284 			}
285 		}
286 
287 		TAILQ_INSERT_TAIL(sock->conf.al, acp, entry);
288 	}
289 done:
290 	return (sock);
291 }
292 
293 int
294 sockets_socket_af(struct sockaddr_storage *ss, in_port_t port)
295 {
296 	switch (ss->ss_family) {
297 	case AF_INET:
298 		((struct sockaddr_in *)ss)->sin_port = port;
299 		((struct sockaddr_in *)ss)->sin_len =
300 		    sizeof(struct sockaddr_in);
301 		break;
302 	case AF_INET6:
303 		((struct sockaddr_in6 *)ss)->sin6_port = port;
304 		((struct sockaddr_in6 *)ss)->sin6_len =
305 		    sizeof(struct sockaddr_in6);
306 		break;
307 	default:
308 		return -1;
309 	}
310 
311 	return 0;
312 }
313 
314 void
315 sockets_launch(void)
316 {
317 	struct socket *sock;
318 
319 	TAILQ_FOREACH(sock, gotwebd_env->sockets, entry) {
320 		log_debug("%s: configuring socket %d (%d)", __func__,
321 		    sock->conf.id, sock->fd);
322 
323 		event_set(&sock->ev, sock->fd, EV_READ | EV_PERSIST,
324 		    sockets_socket_accept, sock);
325 
326 		if (event_add(&sock->ev, NULL))
327 			fatalx("event add sock");
328 
329 		evtimer_set(&sock->pause, sockets_accept_paused, sock);
330 
331 		log_debug("%s: running socket listener %d", __func__,
332 		    sock->conf.id);
333 	}
334 }
335 
336 void
337 sockets_purge(struct gotwebd *env)
338 {
339 	struct socket *sock, *tsock;
340 
341 	/* shutdown and remove sockets */
342 	TAILQ_FOREACH_SAFE(sock, env->sockets, entry, tsock) {
343 		if (event_initialized(&sock->ev))
344 			event_del(&sock->ev);
345 		if (evtimer_initialized(&sock->evt))
346 			evtimer_del(&sock->evt);
347 		if (evtimer_initialized(&sock->pause))
348 			evtimer_del(&sock->pause);
349 		if (sock->fd != -1)
350 			close(sock->fd);
351 		TAILQ_REMOVE(env->sockets, sock, entry);
352 	}
353 }
354 
355 int
356 sockets_dispatch_gotwebd(int fd, struct privsep_proc *p, struct imsg *imsg)
357 {
358 	struct privsep *ps = p->p_ps;
359 	int res = 0, cmd = 0, verbose;
360 
361 	switch (imsg->hdr.type) {
362 	case IMSG_CFG_SRV:
363 		config_getserver(gotwebd_env, imsg);
364 		break;
365 	case IMSG_CFG_SOCK:
366 		config_getsock(gotwebd_env, imsg);
367 		break;
368 	case IMSG_CFG_FD:
369 		config_getfd(gotwebd_env, imsg);
370 		break;
371 	case IMSG_CFG_DONE:
372 		config_getcfg(gotwebd_env, imsg);
373 		break;
374 	case IMSG_CTL_START:
375 		sockets_launch();
376 		break;
377 	case IMSG_CTL_VERBOSE:
378 		IMSG_SIZE_CHECK(imsg, &verbose);
379 		memcpy(&verbose, imsg->data, sizeof(verbose));
380 		log_setverbose(verbose);
381 		break;
382 	default:
383 		return -1;
384 	}
385 
386 	switch (cmd) {
387 	case 0:
388 		break;
389 	default:
390 		if (proc_compose_imsg(ps, PROC_GOTWEBD, -1, cmd,
391 		    imsg->hdr.peerid, -1, &res, sizeof(res)) == -1)
392 			return -1;
393 		break;
394 	}
395 
396 	return 0;
397 }
398 
399 void
400 sockets_sighdlr(int sig, short event, void *arg)
401 {
402 	switch (sig) {
403 	case SIGHUP:
404 		log_info("%s: ignoring SIGHUP", __func__);
405 		break;
406 	case SIGPIPE:
407 		log_info("%s: ignoring SIGPIPE", __func__);
408 		break;
409 	case SIGUSR1:
410 		log_info("%s: ignoring SIGUSR1", __func__);
411 		break;
412 	case SIGCHLD:
413 		break;
414 	default:
415 		log_info("SIGNAL: %d", sig);
416 		fatalx("unexpected signal");
417 	}
418 }
419 
420 void
421 sockets_shutdown(void)
422 {
423 	struct server *srv, *tsrv;
424 	struct socket *sock, *tsock;
425 
426 	sockets_purge(gotwebd_env);
427 
428 	/* clean sockets */
429 	TAILQ_FOREACH_SAFE(sock, gotwebd_env->sockets, entry, tsock) {
430 		TAILQ_REMOVE(gotwebd_env->sockets, sock, entry);
431 		close(sock->fd);
432 		free(sock);
433 	}
434 
435 	/* clean servers */
436 	TAILQ_FOREACH_SAFE(srv, gotwebd_env->servers, entry, tsrv)
437 		free(srv);
438 
439 	free(gotwebd_env->sockets);
440 	free(gotwebd_env->servers);
441 	free(gotwebd_env);
442 }
443 
444 int
445 sockets_privinit(struct gotwebd *env, struct socket *sock)
446 {
447 	struct privsep *ps = env->gotwebd_ps;
448 
449 	if (sock->conf.type == UNIX) {
450 		log_debug("%s: initializing unix socket %s", __func__,
451 		    sock->conf.unix_socket_name);
452 		sock->fd = sockets_unix_socket_listen(ps, sock);
453 		if (sock->fd == -1) {
454 			log_warnx("%s: create unix socket failed", __func__);
455 			return -1;
456 		}
457 	}
458 
459 	if (sock->conf.type == FCGI) {
460 		log_debug("%s: initializing fcgi socket for %s", __func__,
461 		    sock->conf.name);
462 		sock->fd = sockets_create_socket(sock->conf.al,
463 		    sock->conf.fcgi_socket_port);
464 		if (sock->fd == -1) {
465 			log_warnx("%s: create unix socket failed", __func__);
466 			return -1;
467 		}
468 	}
469 
470 	return 0;
471 }
472 
473 int
474 sockets_unix_socket_listen(struct privsep *ps, struct socket *sock)
475 {
476 	struct gotwebd *env = ps->ps_env;
477 	struct sockaddr_un sun;
478 	struct socket *tsock;
479 	int u_fd = -1;
480 	mode_t old_umask, mode;
481 
482 	TAILQ_FOREACH(tsock, env->sockets, entry) {
483 		if (strcmp(tsock->conf.unix_socket_name,
484 		    sock->conf.unix_socket_name) == 0 &&
485 		    tsock->fd != -1)
486 			return (tsock->fd);
487 	}
488 
489 	u_fd = socket(AF_UNIX, SOCK_STREAM | SOCK_NONBLOCK| SOCK_CLOEXEC, 0);
490 	if (u_fd == -1) {
491 		log_warn("%s: socket", __func__);
492 		return -1;
493 	}
494 
495 	sun.sun_family = AF_UNIX;
496 	if (strlcpy(sun.sun_path, sock->conf.unix_socket_name,
497 	    sizeof(sun.sun_path)) >= sizeof(sun.sun_path)) {
498 		log_warn("%s: %s name too long", __func__,
499 		    sock->conf.unix_socket_name);
500 		close(u_fd);
501 		return -1;
502 	}
503 
504 	if (unlink(sock->conf.unix_socket_name) == -1) {
505 		if (errno != ENOENT) {
506 			log_warn("%s: unlink %s", __func__,
507 			    sock->conf.unix_socket_name);
508 			close(u_fd);
509 			return -1;
510 		}
511 	}
512 
513 	old_umask = umask(S_IXUSR|S_IXGRP|S_IWOTH|S_IROTH|S_IXOTH);
514 	mode = S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP;
515 
516 	if (bind(u_fd, (struct sockaddr *)&sun, sizeof(sun)) == -1) {
517 		log_warn("%s: bind: %s", __func__, sock->conf.unix_socket_name);
518 		close(u_fd);
519 		(void)umask(old_umask);
520 		return -1;
521 	}
522 
523 	(void)umask(old_umask);
524 
525 	if (chmod(sock->conf.unix_socket_name, mode) == -1) {
526 		log_warn("%s: chmod", __func__);
527 		close(u_fd);
528 		(void)unlink(sock->conf.unix_socket_name);
529 		return -1;
530 	}
531 
532 	if (chown(sock->conf.unix_socket_name, ps->ps_pw->pw_uid,
533 	    ps->ps_pw->pw_gid) == -1) {
534 		log_warn("%s: chown", __func__);
535 		close(u_fd);
536 		(void)unlink(sock->conf.unix_socket_name);
537 		return -1;
538 	}
539 
540 	if (listen(u_fd, SOCKS_BACKLOG) == -1) {
541 		log_warn("%s: listen", __func__);
542 		return -1;
543 	}
544 
545 	return u_fd;
546 }
547 
548 int
549 sockets_create_socket(struct addresslist *al, in_port_t port)
550 {
551 	struct addrinfo hints;
552 	struct address *a;
553 	int fd = -1, o_val = 1, flags;
554 
555 	memset(&hints, 0, sizeof(hints));
556 	hints.ai_family = AF_UNSPEC;
557 	hints.ai_socktype = SOCK_STREAM;
558 	hints.ai_flags |= AI_PASSIVE;
559 
560 	TAILQ_FOREACH(a, al, entry) {
561 		if (sockets_socket_af(&a->ss, port) == -1) {
562 			log_warnx("%s: sockets_socket_af", __func__);
563 			goto fail;
564 		}
565 
566 		fd = socket(a->ss.ss_family, hints.ai_socktype,
567 		    a->ipproto);
568 			log_debug("%s: opening socket (%d) for %s", __func__,
569 			    fd, a->ifname);
570 
571 		if (setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &o_val,
572 		    sizeof(int)) == -1) {
573 			log_warn("%s: setsockopt error", __func__);
574 			return -1;
575 		}
576 
577 		/* non-blocking */
578 		flags = fcntl(fd, F_GETFL);
579 		flags |= O_NONBLOCK;
580 		fcntl(fd, F_SETFL, flags);
581 
582 		if (bind(fd, (struct sockaddr *)&a->ss, a->ss.ss_len) == -1) {
583 			close(fd);
584 			log_info("%s: can't bind to port %d", __func__,
585 			    ntohs(port));
586 			goto fail;
587 		}
588 
589 		if (listen(fd, SOMAXCONN) == -1) {
590 			log_warn("%s, unable to listen on socket", __func__);
591 			goto fail;
592 		}
593 	}
594 
595 	free(a);
596 	return (fd);
597 fail:
598 	free(a);
599 	return -1;
600 }
601 
602 int
603 sockets_accept_reserve(int sockfd, struct sockaddr *addr, socklen_t *addrlen,
604     int reserve, volatile int *counter)
605 {
606 	int ret;
607 
608 	if (getdtablecount() + reserve +
609 	    ((*counter + 1) * FD_NEEDED) >= getdtablesize()) {
610 		log_debug("inflight fds exceeded");
611 		errno = EMFILE;
612 		return -1;
613 	}
614 
615 	if ((ret = accept4(sockfd, addr, addrlen,
616 	    SOCK_NONBLOCK | SOCK_CLOEXEC)) > -1) {
617 		(*counter)++;
618 		log_debug("inflight incremented, now %d", *counter);
619 	}
620 
621 	return ret;
622 }
623 
624 void
625 sockets_accept_paused(int fd, short events, void *arg)
626 {
627 	struct socket *sock = (struct socket *)arg;
628 
629 	event_add(&sock->ev, NULL);
630 }
631 
632 void
633 sockets_socket_accept(int fd, short event, void *arg)
634 {
635 	struct socket *sock = (struct socket *)arg;
636 	struct sockaddr_storage ss;
637 	struct timeval backoff;
638 	struct request *c = NULL;
639 	socklen_t len;
640 	int s;
641 
642 	backoff.tv_sec = 1;
643 	backoff.tv_usec = 0;
644 
645 	event_add(&sock->ev, NULL);
646 	if (event & EV_TIMEOUT)
647 		return;
648 
649 	len = sizeof(ss);
650 
651 	s = sockets_accept_reserve(fd, (struct sockaddr *)&ss, &len,
652 	    FD_RESERVE, &cgi_inflight);
653 
654 	if (s == -1) {
655 		switch (errno) {
656 		case EINTR:
657 		case EWOULDBLOCK:
658 		case ECONNABORTED:
659 			return;
660 		case EMFILE:
661 		case ENFILE:
662 			event_del(&sock->ev);
663 			evtimer_add(&sock->pause, &backoff);
664 			return;
665 		default:
666 			log_warn("%s: accept", __func__);
667 		}
668 	}
669 
670 	if (client_cnt > GOTWEBD_MAXCLIENTS)
671 		goto err;
672 
673 	c = calloc(1, sizeof(struct request));
674 	if (c == NULL) {
675 		log_warn("%s", __func__);
676 		close(s);
677 		cgi_inflight--;
678 		return;
679 	}
680 
681 	c->fd = s;
682 	c->sock = sock;
683 	memcpy(c->priv_fd, sock->priv_fd, sizeof(c->priv_fd));
684 	c->buf_pos = 0;
685 	c->buf_len = 0;
686 	c->request_started = 0;
687 	c->sock->client_status = CLIENT_CONNECT;
688 
689 	event_set(&c->ev, s, EV_READ, fcgi_request, c);
690 	event_add(&c->ev, NULL);
691 
692 	evtimer_set(&c->tmo, fcgi_timeout, c);
693 	evtimer_add(&c->tmo, &timeout);
694 
695 	client_cnt++;
696 
697 	return;
698 err:
699 	cgi_inflight--;
700 	close(s);
701 	if (c != NULL)
702 		free(c);
703 }
704 
705 void
706 sockets_rlimit(int maxfd)
707 {
708 	struct rlimit rl;
709 
710 	if (getrlimit(RLIMIT_NOFILE, &rl) == -1)
711 		fatal("%s: failed to get resource limit", __func__);
712 	log_debug("%s: max open files %llu", __func__, rl.rlim_max);
713 
714 	/*
715 	 * Allow the maximum number of open file descriptors for this
716 	 * login class (which should be the class "daemon" by default).
717 	 */
718 	if (maxfd == -1)
719 		rl.rlim_cur = rl.rlim_max;
720 	else
721 		rl.rlim_cur = MAXIMUM(rl.rlim_max, (rlim_t)maxfd);
722 	if (setrlimit(RLIMIT_NOFILE, &rl) == -1)
723 		fatal("%s: failed to set resource limit", __func__);
724 }