1 /*
2  * Copyright (c) 2021 Omar Polo <op@omarpolo.com>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <err.h>
18 #include <errno.h>
19 
20 #include <fcntl.h>
21 #include <signal.h>
22 #include <string.h>
23 
24 #include "gmid.h"
25 
26 int
27 send_string(int fd, const char *str)
28 {
29 	ssize_t len;
30 
31 	if (str == NULL)
32 		len = 0;
33 	else
34 		len = strlen(str);
35 
36 	if (write(fd, &len, sizeof(len)) != sizeof(len))
37 		return 0;
38 
39 	if (len != 0)
40 		if (write(fd, str, len) != len)
41 			return 0;
42 
43 	return 1;
44 }
45 
46 int
47 recv_string(int fd, char **ret)
48 {
49 	ssize_t len;
50 
51 	if (read(fd, &len, sizeof(len)) != sizeof(len))
52 		return 0;
53 
54 	if (len == 0) {
55 		*ret = NULL;
56 		return 1;
57 	}
58 
59 	if ((*ret = calloc(1, len+1)) == NULL)
60 		return 0;
61 
62 	if (read(fd, *ret, len) != len)
63 		return 0;
64 	return 1;
65 }
66 
67 int
68 send_vhost(int fd, struct vhost *vhost)
69 {
70 	ssize_t n;
71 
72 	if (vhost < hosts || vhost > hosts + HOSTSLEN)
73 		return 0;
74 
75 	n = hosts - vhost;
76 	return write(fd, &n, sizeof(n)) == sizeof(n);
77 }
78 
79 int
80 recv_vhost(int fd, struct vhost **vhost)
81 {
82 	ssize_t n;
83 
84 	if (read(fd, &n, sizeof(n)) != sizeof(n))
85 		return 0;
86 
87 	if (n < 0 || n > HOSTSLEN)
88 		return 0;
89 
90 	*vhost = &hosts[n];
91 	if ((*vhost)->domain == NULL)
92 		return 0;
93 	return 1;
94 }
95 
96 /* send d though fd. see /usr/src/usr.sbin/syslogd/privsep_fdpass.c
97  * for an example */
98 int
99 send_fd(int fd, int d)
100 {
101 	struct msghdr msg;
102 	union {
103 		struct cmsghdr hdr;
104 		unsigned char buf[CMSG_SPACE(sizeof(int))];
105 	} cmsgbuf;
106 	struct cmsghdr *cmsg;
107 	struct iovec vec;
108 	int result = 1;
109 	ssize_t n;
110 
111 	memset(&msg, 0, sizeof(msg));
112 
113 	if (d >= 0) {
114 		msg.msg_control = &cmsgbuf.buf;
115 		msg.msg_controllen = sizeof(cmsgbuf.buf);
116 		cmsg = CMSG_FIRSTHDR(&msg);
117 		cmsg->cmsg_len = CMSG_LEN(sizeof(int));
118 		cmsg->cmsg_level = SOL_SOCKET;
119 		cmsg->cmsg_type = SCM_RIGHTS;
120 		*(int*)CMSG_DATA(cmsg) = d;
121 	} else
122 		result = 0;
123 
124 	vec.iov_base = &result;
125 	vec.iov_len = sizeof(int);
126 	msg.msg_iov = &vec;
127 	msg.msg_iovlen = 1;
128 
129 	if ((n = sendmsg(fd, &msg, 0)) == -1 || n != sizeof(int)) {
130                 fprintf(stderr, "sendmsg: got %zu but wanted %zu: (errno) %s",
131 		    n, sizeof(int), strerror(errno));
132 		return 0;
133 	}
134 	return 1;
135 }
136 
137 /* receive a descriptor via fd */
138 int
139 recv_fd(int fd)
140 {
141 	struct msghdr msg;
142 	union {
143 		struct cmsghdr hdr;
144 		char buf[CMSG_SPACE(sizeof(int))];
145 	} cmsgbuf;
146 	struct cmsghdr *cmsg;
147 	struct iovec vec;
148 	ssize_t n;
149 	int result;
150 
151 	memset(&msg, 0, sizeof(msg));
152 	vec.iov_base = &result;
153 	vec.iov_len = sizeof(int);
154 	msg.msg_iov = &vec;
155 	msg.msg_iovlen = 1;
156 	msg.msg_control = &cmsgbuf.buf;
157 	msg.msg_controllen = sizeof(cmsgbuf.buf);
158 
159 	if ((n = recvmsg(fd, &msg, 0)) != sizeof(int)) {
160 		fprintf(stderr, "read %zu bytes bu wanted %zu\n", n, sizeof(int));
161 		return -1;
162 	}
163 
164 	if (result) {
165 		cmsg = CMSG_FIRSTHDR(&msg);
166 		if (cmsg == NULL || cmsg->cmsg_type != SCM_RIGHTS)
167 			return -1;
168 		return (*(int *)CMSG_DATA(cmsg));
169 	} else
170 		return -1;
171 }
172 
173 static inline void
174 safe_setenv(const char *name, const char *val)
175 {
176 	if (val == NULL)
177 		val = "";
178 	setenv(name, val, 1);
179 }
180 
181 /* fd or -1 on error */
182 static int
183 launch_cgi(const char *spath, const char *relpath, const char *query,
184     const char *addr, const char *ruser, const char *cissuer, const char *chash,
185     struct vhost *vhost)
186 {
187 	int p[2];		/* read end, write end */
188 
189 	if (pipe2(p, O_NONBLOCK) == -1)
190 		return -1;
191 
192 	switch (fork()) {
193 	case -1:
194 		return -1;
195 
196 	case 0: {		/* child */
197 		char *portno, *ex, *requri;
198 		char *argv[] = { NULL, NULL, NULL };
199 
200 		close(p[0]);
201 		if (dup2(p[1], 1) == -1)
202 			goto childerr;
203 
204 		if (asprintf(&portno, "%d", conf.port) == -1)
205 			goto childerr;
206 
207 		if (asprintf(&ex, "%s/%s", vhost->dir, spath) == -1)
208 			goto childerr;
209 
210 		if (asprintf(&requri, "%s%s%s", spath,
211 		    (relpath != NULL && *relpath == '\0') ? "" : "/",
212 		    (relpath != NULL ? relpath : "")) == -1)
213 			goto childerr;
214 
215 		argv[0] = argv[1] = ex;
216 
217 		safe_setenv("GATEWAY_INTERFACE", "CGI/1.1");
218 		safe_setenv("SERVER_PROTOCOL", "GEMINI");
219 		safe_setenv("SERVER_SOFTWARE", "gmid");
220 		safe_setenv("SERVER_PORT", portno);
221 
222 		if (!strcmp(vhost->domain, "*"))
223 			safe_setenv("SERVER_NAME", vhost->domain);
224 
225 		safe_setenv("SCRIPT_NAME", spath);
226 		safe_setenv("SCRIPT_EXECUTABLE", ex);
227 		safe_setenv("REQUEST_URI", requri);
228 		safe_setenv("REQUEST_RELATIVE", relpath);
229 		safe_setenv("QUERY_STRING", query);
230 		safe_setenv("REMOTE_HOST", addr);
231 		safe_setenv("REMOTE_ADDR", addr);
232 		safe_setenv("DOCUMENT_ROOT", vhost->dir);
233 
234 		if (ruser != NULL) {
235 			safe_setenv("AUTH_TYPE", "Certificate");
236 			safe_setenv("REMOTE_USER", ruser);
237 			safe_setenv("TLS_CLIENT_ISSUER", cissuer);
238 			safe_setenv("TLS_CLIENT_HASH", chash);
239 		}
240 
241 		fchdir(vhost->dirfd);
242 
243 		execvp(ex, argv);
244 		goto childerr;
245 	}
246 
247 	default:
248 		close(p[1]);
249 		return p[0];
250 	}
251 
252 childerr:
253 	dprintf(p[1], "%d internal server error\r\n", TEMP_FAILURE);
254 	_exit(1);
255 }
256 
257 int
258 executor_main(int fd)
259 {
260 	char *spath, *relpath, *query, *addr, *ruser, *cissuer, *chash;
261         struct vhost *vhost;
262 	int d;
263 
264 #ifdef __OpenBSD__
265 	pledge("stdio sendfd proc exec", NULL);
266 #endif
267 
268 	for (;;) {
269 		if (!recv_string(fd, &spath)
270 		    || !recv_string(fd, &relpath)
271 		    || !recv_string(fd, &query)
272 		    || !recv_string(fd, &addr)
273 		    || !recv_string(fd, &ruser)
274 		    || !recv_string(fd, &cissuer)
275 		    || !recv_string(fd, &chash)
276 		    || !recv_vhost(fd, &vhost))
277 			break;
278 
279 		d = launch_cgi(spath, relpath, query,
280 		    addr, ruser, cissuer, chash, vhost);
281 		if (!send_fd(fd, d))
282 			break;
283 		close(d);
284 
285 		free(spath);
286 		free(relpath);
287 		free(query);
288 		free(addr);
289 		free(ruser);
290 		free(cissuer);
291 		free(chash);
292 	}
293 
294 	/* kill all process in my group.  This means the listener and
295 	 * every pending CGI script. */
296 	kill(0, SIGINT);
297 	return 1;
298 }