1 /*
2  * Copyright (c) 2021 Omar Polo <op@omarpolo.com>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include "gmid.h"
18 
19 #include <sys/un.h>
20 
21 #include <err.h>
22 #include <errno.h>
23 
24 #include <event.h>
25 #include <fcntl.h>
26 #include <libgen.h>
27 #include <limits.h>
28 #include <signal.h>
29 #include <stdarg.h>
30 #include <string.h>
31 
32 static void	handle_imsg_cgi_req(struct imsgbuf*, struct imsg*, size_t);
33 static void	handle_imsg_fcgi_req(struct imsgbuf*, struct imsg*, size_t);
34 static void	handle_imsg_quit(struct imsgbuf*, struct imsg*, size_t);
35 static void	handle_dispatch_imsg(int, short, void*);
36 
37 static imsg_handlerfn *handlers[] = {
38 	[IMSG_FCGI_REQ] = handle_imsg_fcgi_req,
39 	[IMSG_CGI_REQ] = handle_imsg_cgi_req,
40 	[IMSG_QUIT] = handle_imsg_quit,
41 };
42 
43 static inline void
44 safe_setenv(const char *name, const char *val)
45 {
46 	if (val == NULL)
47 		val = "";
48 	setenv(name, val, 1);
49 }
50 
51 static char *
52 xasprintf(const char *fmt, ...)
53 {
54 	va_list ap;
55 	char *s;
56 
57 	va_start(ap, fmt);
58 	if (vasprintf(&s, fmt, ap) == -1)
59 		s = NULL;
60 	va_end(ap);
61 
62 	return s;
63 }
64 
65 static void
66 do_exec(const char *ex, const char *spath, char *query)
67 {
68 	char **argv, buf[PATH_MAX], *sname, *t;
69 	size_t i, n;
70 
71 	/* restore the default handlers */
72 	signal(SIGPIPE, SIG_DFL);
73 	signal(SIGCHLD, SIG_DFL);
74 	signal(SIGHUP,  SIG_DFL);
75 	signal(SIGINT,  SIG_DFL);
76 	signal(SIGTERM, SIG_DFL);
77 
78 	strlcpy(buf, spath, sizeof(buf));
79 	sname = basename(buf);
80 
81 	if (query == NULL || strchr(query, '=') != NULL) {
82 		if ((argv = calloc(2, sizeof(char*))) == NULL)
83 			err(1, "calloc");
84 		argv[0] = sname;
85 		execvp(ex, argv);
86 		warn("execvp: %s", argv[0]);
87 		return;
88 	}
89 
90 	n = 1;
91 	for (t = query ;; t++, n++) {
92 		if ((t = strchr(t, '+')) == NULL)
93 			break;
94 	}
95 
96 	if ((argv = calloc(n+2, sizeof(char*))) == NULL)
97 		err(1, "calloc");
98 
99 	argv[0] = sname;
100 	for (i = 0; i < n; ++i) {
101 		t = strchr(query, '+');
102 		if (t != NULL)
103 			*t = '\0';
104 		argv[i+1] = pct_decode_str(query);
105 		query = t+1;
106 	}
107 
108 	execvp(ex, argv);
109 	warn("execvp: %s", argv[0]);
110 }
111 
112 static inline void
113 setenv_time(const char *var, time_t t)
114 {
115 	char timebuf[21];
116 	struct tm tminfo;
117 
118 	if (t == -1)
119 		return;
120 
121 	strftime(timebuf, sizeof(timebuf), "%FT%TZ",
122 	    gmtime_r(&t, &tminfo));
123 	setenv(var, timebuf, 1);
124 }
125 
126 /* fd or -1 on error */
127 static int
128 launch_cgi(struct iri *iri, struct cgireq *req, struct vhost *vhost,
129     struct location *loc)
130 {
131 	int p[2], errp[2];	/* read end, write end */
132 
133 	if (pipe(p) == -1)
134 		return -1;
135 	if (pipe(errp) == -1)
136 		return -1;
137 
138 	switch (fork()) {
139 	case -1:
140 		return -1;
141 
142 	case 0: {		/* child */
143 		char *ex, *pwd;
144 		char iribuf[GEMINI_URL_LEN];
145 		char path[PATH_MAX];
146 		struct envlist *e;
147 
148 		close(p[0]);
149 		if (dup2(p[1], 1) == -1)
150 			goto childerr;
151 
152 		close(errp[0]);
153 		if (dup2(errp[1], 2) == -1)
154 			goto childerr;
155 
156 		ex = xasprintf("%s/%s", loc->dir, req->spath);
157 
158 		serialize_iri(iri, iribuf, sizeof(iribuf));
159 
160 		safe_setenv("GATEWAY_INTERFACE", "CGI/1.1");
161 		safe_setenv("GEMINI_DOCUMENT_ROOT", loc->dir);
162 		safe_setenv("GEMINI_SCRIPT_FILENAME",
163 		    xasprintf("%s/%s", loc->dir, req->spath));
164 		safe_setenv("GEMINI_URL", iribuf);
165 
166 		strlcpy(path, "/", sizeof(path));
167 		strlcat(path, req->spath, sizeof(path));
168 		safe_setenv("GEMINI_URL_PATH", path);
169 
170 		if (*req->relpath != '\0') {
171 			strlcpy(path, "/", sizeof(path));
172 			strlcat(path, req->relpath, sizeof(path));
173 			safe_setenv("PATH_INFO", path);
174 
175 			strlcpy(path, loc->dir, sizeof(path));
176 			strlcat(path, "/", sizeof(path));
177 			strlcat(path, req->relpath, sizeof(path));
178 			safe_setenv("PATH_TRANSLATED", path);
179 		}
180 
181 		safe_setenv("QUERY_STRING", iri->query);
182 		safe_setenv("REMOTE_ADDR", req->addr);
183 		safe_setenv("REMOTE_HOST", req->addr);
184 		safe_setenv("REQUEST_METHOD", "");
185 
186 		strlcpy(path, "/", sizeof(path));
187 		strlcat(path, req->spath, sizeof(path));
188 		safe_setenv("SCRIPT_NAME", path);
189 
190 		safe_setenv("SERVER_NAME", iri->host);
191 
192 		snprintf(path, sizeof(path), "%d", conf.port);
193 		safe_setenv("SERVER_PORT", path);
194 
195 		safe_setenv("SERVER_PROTOCOL", "GEMINI");
196 		safe_setenv("SERVER_SOFTWARE", GMID_VERSION);
197 
198 		if (*req->subject != '\0')
199 			safe_setenv("AUTH_TYPE", "Certificate");
200 		else
201 			safe_setenv("AUTH_TYPE", "");
202 
203 		safe_setenv("REMOTE_USER", req->subject);
204 		safe_setenv("TLS_CLIENT_ISSUER", req->issuer);
205 		safe_setenv("TLS_CLIENT_HASH", req->hash);
206 		safe_setenv("TLS_VERSION", req->version);
207 		safe_setenv("TLS_CIPHER", req->cipher);
208 
209 		snprintf(path, sizeof(path), "%d", req->cipher_strength);
210 		safe_setenv("TLS_CIPHER_STRENGTH", path);
211 
212 		setenv_time("TLS_CLIENT_NOT_AFTER", req->notafter);
213 		setenv_time("TLS_CLIENT_NOT_BEFORE", req->notbefore);
214 
215 		TAILQ_FOREACH(e, &vhost->env, envs) {
216 			safe_setenv(e->name, e->value);
217 		}
218 
219 		strlcpy(path, ex, sizeof(path));
220 
221 		pwd = dirname(path);
222 		if (chdir(pwd)) {
223 			warn("chdir");
224 			goto childerr;
225 		}
226 
227 		do_exec(ex, req->spath, iri->query);
228 		goto childerr;
229 	}
230 
231 	default:
232 		close(p[1]);
233 		close(errp[1]);
234 		mark_nonblock(p[0]);
235 		return p[0];
236 	}
237 
238 childerr:
239 	dprintf(p[1], "%d internal server error\r\n", TEMP_FAILURE);
240 	_exit(1);
241 }
242 
243 static struct vhost *
244 host_nth(size_t n)
245 {
246 	struct vhost *h;
247 
248 	TAILQ_FOREACH(h, &hosts, vhosts) {
249 		if (n == 0)
250 			return h;
251 		n--;
252 	}
253 
254 	return NULL;
255 }
256 
257 static struct location *
258 loc_nth(struct vhost *vhost, size_t n)
259 {
260 	struct location *loc;
261 
262 	TAILQ_FOREACH(loc, &vhost->locations, locations) {
263 		if (n == 0)
264 			return loc;
265 		n--;
266 	}
267 
268 	return NULL;
269 }
270 
271 static void
272 handle_imsg_cgi_req(struct imsgbuf *ibuf, struct imsg *imsg, size_t datalen)
273 {
274 	struct vhost	*h;
275 	struct location	*l;
276 	struct cgireq	 req;
277 	struct iri	 iri;
278 	int		 fd;
279 
280 	if (datalen != sizeof(req))
281 		abort();
282 
283 	memcpy(&req, imsg->data, datalen);
284 
285 	iri.schema = req.iri_schema_off + req.buf;
286 	iri.host = req.iri_host_off + req.buf;
287 	iri.port = req.iri_port_off + req.buf;
288 	iri.path = req.iri_path_off + req.buf;
289 	iri.query = req.iri_query_off + req.buf;
290 	iri.fragment = req.iri_fragment_off + req.buf;
291 
292 	/* patch the query, otherwise do_exec will always pass "" as
293 	 * first argument to the script. */
294 	if (*iri.query == '\0')
295 		iri.query = NULL;
296 
297 	if ((h = host_nth(req.host_off)) == NULL)
298 		abort();
299 
300 	if ((l = loc_nth(h, req.loc_off)) == NULL)
301 		abort();
302 
303 	fd = launch_cgi(&iri, &req, h, l);
304 	imsg_compose(ibuf, IMSG_CGI_RES, imsg->hdr.peerid, 0, fd, NULL, 0);
305 	imsg_flush(ibuf);
306 }
307 
308 static int
309 fcgi_open_prog(struct fcgi *f)
310 {
311 	int s[2];
312 	pid_t p;
313 
314 	/* XXX! */
315 
316 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNIX, s) == -1)
317 		err(1, "socketpair");
318 
319 	switch (p = fork()) {
320 	case -1:
321 		err(1, "fork");
322 	case 0:
323 		close(s[0]);
324 		if (dup2(s[1], 0) == -1)
325 			err(1, "dup2");
326 		execl(f->prog, f->prog, NULL);
327 		err(1, "execl %s", f->prog);
328 	default:
329 		close(s[1]);
330 		return s[0];
331 	}
332 }
333 
334 static int
335 fcgi_open_sock(struct fcgi *f)
336 {
337 	struct sockaddr_un	addr;
338 	int			fd;
339 
340 	if ((fd = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) {
341 		log_err(NULL, "socket: %s", strerror(errno));
342 		return -1;
343 	}
344 
345 	memset(&addr, 0, sizeof(addr));
346 	addr.sun_family = AF_UNIX;
347 	strlcpy(addr.sun_path, f->path, sizeof(addr.sun_path));
348 
349 	if (connect(fd, (struct sockaddr*)&addr, sizeof(addr)) == -1) {
350 		log_warn(NULL, "failed to connect to %s: %s", f->path,
351 		    strerror(errno));
352 		close(fd);
353 		return -1;
354 	}
355 
356 	return fd;
357 }
358 
359 static int
360 fcgi_open_conn(struct fcgi *f)
361 {
362 	struct addrinfo	hints, *servinfo, *p;
363 	int		r, sock;
364 
365 	memset(&hints, 0, sizeof(hints));
366 	hints.ai_family = AF_UNSPEC;
367 	hints.ai_socktype = SOCK_STREAM;
368 	hints.ai_flags = AI_ADDRCONFIG;
369 
370 	if ((r = getaddrinfo(f->path, f->port, &hints, &servinfo)) != 0) {
371 		log_warn(NULL, "getaddrinfo %s:%s: %s", f->path, f->port,
372 		    gai_strerror(r));
373 		return -1;
374 	}
375 
376 	for (p = servinfo; p != NULL; p = p->ai_next) {
377 		sock = socket(p->ai_family, p->ai_socktype, p->ai_protocol);
378 		if (sock == -1)
379 			continue;
380 		if (connect(sock, p->ai_addr, p->ai_addrlen) == -1) {
381 			close(sock);
382 			continue;
383 		}
384 		break;
385 	}
386 
387 	if (p == NULL) {
388 		log_warn(NULL, "couldn't connect to %s:%s", f->path, f->port);
389 		sock = -1;
390 	}
391 
392 	freeaddrinfo(servinfo);
393 	return sock;
394 }
395 
396 static void
397 handle_imsg_fcgi_req(struct imsgbuf *ibuf, struct imsg *imsg, size_t datalen)
398 {
399 	struct fcgi	*f;
400 	int		 id, fd;
401 
402 	if (datalen != sizeof(id))
403 		abort();
404 	memcpy(&id, imsg->data, datalen);
405 
406 	if (id > FCGI_MAX || (fcgi[id].path == NULL && fcgi[id].prog == NULL))
407 		abort();
408 
409 	f = &fcgi[id];
410 	if (f->prog != NULL)
411 		fd = fcgi_open_prog(f);
412 	else if (f->port != NULL)
413 		fd = fcgi_open_conn(f);
414 	else
415 		fd = fcgi_open_sock(f);
416 
417 	imsg_compose(ibuf, IMSG_FCGI_FD, id, 0, fd, NULL, 0);
418 	imsg_flush(ibuf);
419 }
420 
421 static void
422 handle_imsg_quit(struct imsgbuf *ibuf, struct imsg *imsg, size_t datalen)
423 {
424 	int i;
425 
426 	(void)ibuf;
427 	(void)imsg;
428 	(void)datalen;
429 
430 	for (i = 0; i < conf.prefork; ++i) {
431 		imsg_compose(&servibuf[i], IMSG_QUIT, 0, 0, -1, NULL, 0);
432 		imsg_flush(&exibuf);
433 		close(servibuf[i].fd);
434 	}
435 
436 	event_loopbreak();
437 }
438 
439 static void
440 handle_dispatch_imsg(int fd, short ev, void *d)
441 {
442 	struct imsgbuf *ibuf = d;
443 	dispatch_imsg(ibuf, handlers, sizeof(handlers));
444 }
445 
446 int
447 executor_main(struct imsgbuf *ibuf)
448 {
449 	struct event	 evs[PROC_MAX], imsgev;
450 	int		 i;
451 
452 	event_init();
453 
454 	if (ibuf != NULL) {
455 		event_set(&imsgev, ibuf->fd, EV_READ | EV_PERSIST,
456 		    handle_dispatch_imsg, ibuf);
457 		event_add(&imsgev, NULL);
458 	}
459 
460 	for (i = 0; i < conf.prefork; ++i) {
461 		event_set(&evs[i], servibuf[i].fd, EV_READ | EV_PERSIST,
462 		    handle_dispatch_imsg, &servibuf[i]);
463 		event_add(&evs[i], NULL);
464 	}
465 
466 	sandbox_executor_process();
467 
468 	event_dispatch();
469 
470 	return 1;
471 }