1 /*
2  * Copyright (c) 2021 Omar Polo <op@omarpolo.com>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include "gmid.h"
18 
19 #include <err.h>
20 #include <errno.h>
21 
22 #include <event.h>
23 #include <fcntl.h>
24 #include <libgen.h>
25 #include <limits.h>
26 #include <signal.h>
27 #include <stdarg.h>
28 #include <string.h>
29 
30 int
31 send_string(int fd, const char *str)
32 {
33 	ssize_t len;
34 
35 	if (str == NULL)
36 		len = 0;
37 	else
38 		len = strlen(str);
39 
40 	if (write(fd, &len, sizeof(len)) != sizeof(len))
41 		return 0;
42 
43 	if (len != 0)
44 		if (write(fd, str, len) != len)
45 			return 0;
46 
47 	return 1;
48 }
49 
50 int
51 recv_string(int fd, char **ret)
52 {
53 	ssize_t len;
54 
55 	if (read(fd, &len, sizeof(len)) != sizeof(len))
56 		return 0;
57 
58 	if (len == 0) {
59 		*ret = NULL;
60 		return 1;
61 	}
62 
63 	if ((*ret = calloc(1, len+1)) == NULL)
64 		return 0;
65 
66 	if (read(fd, *ret, len) != len)
67 		return 0;
68 	return 1;
69 }
70 
71 int
72 send_iri(int fd, struct iri *i)
73 {
74 	return send_string(fd, i->schema)
75 		&& send_string(fd, i->host)
76 		&& send_string(fd, i->port)
77 		&& send_string(fd, i->path)
78 		&& send_string(fd, i->query);
79 }
80 
81 int
82 recv_iri(int fd, struct iri *i)
83 {
84 	memset(i, 0, sizeof(*i));
85 
86 	if (!recv_string(fd, &i->schema)
87 	    || !recv_string(fd, &i->host)
88 	    || !recv_string(fd, &i->port)
89 	    || !recv_string(fd, &i->path)
90 	    || !recv_string(fd, &i->query))
91 		return 0;
92 
93 	return 1;
94 }
95 
96 void
97 free_recvd_iri(struct iri *i)
98 {
99 	free(i->schema);
100 	free(i->host);
101 	free(i->port);
102 	free(i->path);
103 	free(i->query);
104 }
105 
106 int
107 send_vhost(int fd, struct vhost *vhost)
108 {
109 	ssize_t n;
110 
111 	if (vhost < hosts || vhost > hosts + HOSTSLEN)
112 		return 0;
113 
114 	n = vhost - hosts;
115 	return write(fd, &n, sizeof(n)) == sizeof(n);
116 }
117 
118 int
119 recv_vhost(int fd, struct vhost **vhost)
120 {
121 	ssize_t n;
122 
123 	if (read(fd, &n, sizeof(n)) != sizeof(n))
124 		return 0;
125 
126 	if (n < 0 || n > HOSTSLEN)
127 		return 0;
128 
129 	*vhost = &hosts[n];
130 	if ((*vhost)->domain == NULL)
131 		return 0;
132 	return 1;
133 }
134 
135 int
136 send_time(int fd, time_t t)
137 {
138 	return write(fd, &t, sizeof(t)) == sizeof(t);
139 }
140 
141 int
142 recv_time(int fd, time_t *t)
143 {
144 	return read(fd, t, sizeof(*t)) == sizeof(*t);
145 }
146 
147 /* send d though fd. see /usr/src/usr.sbin/syslogd/privsep_fdpass.c
148  * for an example */
149 int
150 send_fd(int fd, int d)
151 {
152 	struct msghdr msg;
153 	union {
154 		struct cmsghdr hdr;
155 		unsigned char buf[CMSG_SPACE(sizeof(int))];
156 	} cmsgbuf;
157 	struct cmsghdr *cmsg;
158 	struct iovec vec;
159 	int result = 1;
160 	ssize_t n;
161 
162 	memset(&msg, 0, sizeof(msg));
163 
164 	if (d >= 0) {
165 		msg.msg_control = &cmsgbuf.buf;
166 		msg.msg_controllen = sizeof(cmsgbuf.buf);
167 		cmsg = CMSG_FIRSTHDR(&msg);
168 		cmsg->cmsg_len = CMSG_LEN(sizeof(int));
169 		cmsg->cmsg_level = SOL_SOCKET;
170 		cmsg->cmsg_type = SCM_RIGHTS;
171 		*(int*)CMSG_DATA(cmsg) = d;
172 	} else
173 		result = 0;
174 
175 	vec.iov_base = &result;
176 	vec.iov_len = sizeof(int);
177 	msg.msg_iov = &vec;
178 	msg.msg_iovlen = 1;
179 
180 	if ((n = sendmsg(fd, &msg, 0)) == -1 || n != sizeof(int)) {
181                 log_err(NULL, "sendmsg: got %zu but wanted %zu: (errno) %s",
182 		    n, sizeof(int), strerror(errno));
183 		return 0;
184 	}
185 	return 1;
186 }
187 
188 /* receive a descriptor via fd */
189 int
190 recv_fd(int fd)
191 {
192 	struct msghdr msg;
193 	union {
194 		struct cmsghdr hdr;
195 		char buf[CMSG_SPACE(sizeof(int))];
196 	} cmsgbuf;
197 	struct cmsghdr *cmsg;
198 	struct iovec vec;
199 	ssize_t n;
200 	int result;
201 
202 	memset(&msg, 0, sizeof(msg));
203 	vec.iov_base = &result;
204 	vec.iov_len = sizeof(int);
205 	msg.msg_iov = &vec;
206 	msg.msg_iovlen = 1;
207 	msg.msg_control = &cmsgbuf.buf;
208 	msg.msg_controllen = sizeof(cmsgbuf.buf);
209 
210 	if ((n = recvmsg(fd, &msg, 0)) != sizeof(int)) {
211 		log_err(NULL, "read %zu bytes bu wanted %zu\n", n, sizeof(int));
212 		return -1;
213 	}
214 
215 	if (result) {
216 		cmsg = CMSG_FIRSTHDR(&msg);
217 		if (cmsg == NULL || cmsg->cmsg_type != SCM_RIGHTS)
218 			return -1;
219 		return (*(int *)CMSG_DATA(cmsg));
220 	} else
221 		return -1;
222 }
223 
224 static inline void
225 safe_setenv(const char *name, const char *val)
226 {
227 	if (val == NULL)
228 		val = "";
229 	setenv(name, val, 1);
230 }
231 
232 static char *
233 xasprintf(const char *fmt, ...)
234 {
235 	va_list ap;
236 	char *s;
237 
238 	va_start(ap, fmt);
239 	if (vasprintf(&s, fmt, ap) == -1)
240 		s = NULL;
241 	va_end(ap);
242 
243 	return s;
244 }
245 
246 static void
247 do_exec(const char *ex, const char *spath, char *query)
248 {
249 	char **argv, buf[PATH_MAX], *sname, *t;
250 	size_t i, n;
251 
252 	strlcpy(buf, spath, sizeof(buf));
253 	sname = basename(buf);
254 
255 	if (query == NULL || strchr(query, '=') != NULL) {
256 		if ((argv = calloc(2, sizeof(char*))) == NULL)
257 			err(1, "calloc");
258 		argv[0] = sname;
259 		execvp(ex, argv);
260 		warn("execvp: %s", argv[0]);
261 		return;
262 	}
263 
264 	n = 1;
265 	for (t = query ;; t++, n++) {
266 		if ((t = strchr(t, '+')) == NULL)
267 			break;
268 	}
269 
270 	if ((argv = calloc(n+2, sizeof(char*))) == NULL)
271 		err(1, "calloc");
272 
273 	argv[0] = sname;
274 	for (i = 0; i < n; ++i) {
275 		t = strchr(query, '+');
276 		if (t != NULL)
277 			*t = '\0';
278 		argv[i+1] = pct_decode_str(query);
279 		query = t+1;
280 	}
281 
282 	execvp(ex, argv);
283 	warn("execvp: %s", argv[0]);
284 }
285 
286 static inline void
287 setenv_time(const char *var, time_t t)
288 {
289 	char timebuf[21];
290 	struct tm tminfo;
291 
292 	if (t == -1)
293 		return;
294 
295 	strftime(timebuf, sizeof(timebuf), "%FT%TZ",
296 	    gmtime_r(&t, &tminfo));
297 	setenv(var, timebuf, 1);
298 }
299 
300 /* fd or -1 on error */
301 static int
302 launch_cgi(struct iri *iri, const char *spath, char *relpath,
303     const char *addr, const char *ruser, const char *cissuer,
304     const char *chash, time_t notbefore, time_t notafter,
305     struct vhost *vhost)
306 {
307 	int p[2];		/* read end, write end */
308 
309 	if (pipe(p) == -1)
310 		return -1;
311 
312 	switch (fork()) {
313 	case -1:
314 		return -1;
315 
316 	case 0: {		/* child */
317 		char *ex, *pwd;
318 		char iribuf[GEMINI_URL_LEN];
319 		char path[PATH_MAX];
320 
321 		close(p[0]);
322 		if (dup2(p[1], 1) == -1)
323 			goto childerr;
324 
325 		ex = xasprintf("%s/%s", vhost->dir, spath);
326 
327 		serialize_iri(iri, iribuf, sizeof(iribuf));
328 
329 		safe_setenv("GATEWAY_INTERFACE", "CGI/1.1");
330 		safe_setenv("GEMINI_DOCUMENT_ROOT", vhost->dir);
331 		safe_setenv("GEMINI_SCRIPT_FILENAME",
332 		    xasprintf("%s/%s", vhost->dir, spath));
333 		safe_setenv("GEMINI_URL", iribuf);
334 
335 		strlcpy(path, "/", sizeof(path));
336 		strlcat(path, spath, sizeof(path));
337 		safe_setenv("GEMINI_URL_PATH", path);
338 
339 		if (relpath != NULL) {
340 			strlcpy(path, "/", sizeof(path));
341 			strlcat(path, relpath, sizeof(path));
342 			safe_setenv("PATH_INFO", path);
343 
344 			strlcpy(path, vhost->dir, sizeof(path));
345 			strlcat(path, "/", sizeof(path));
346 			strlcat(path, relpath, sizeof(path));
347 			safe_setenv("PATH_TRANSLATED", path);
348 		}
349 
350 		safe_setenv("QUERY_STRING", iri->query);
351 		safe_setenv("REMOTE_ADDR", addr);
352 		safe_setenv("REMOTE_HOST", addr);
353 		safe_setenv("REQUEST_METHOD", "");
354 
355 		strlcpy(path, "/", sizeof(path));
356 		strlcat(path, spath, sizeof(path));
357 		safe_setenv("SCRIPT_NAME", path);
358 
359 		safe_setenv("SERVER_NAME", iri->host);
360 
361 		snprintf(path, sizeof(path), "%d", conf.port);
362 		safe_setenv("SERVER_PORT", path);
363 
364 		safe_setenv("SERVER_PROTOCOL", "GEMINI");
365 		safe_setenv("SERVER_SOFTWARE", "gmid/1.5");
366 
367 		if (ruser != NULL)
368 			safe_setenv("AUTH_TYPE", "Certificate");
369 		else
370 			safe_setenv("AUTH_TYPE", "");
371 
372 		safe_setenv("REMOTE_USER", ruser);
373 		safe_setenv("TLS_CLIENT_ISSUER", cissuer);
374 		safe_setenv("TLS_CLIENT_HASH", chash);
375 		setenv_time("TLS_CLIENT_NOT_AFTER", notafter);
376 		setenv_time("TLS_CLIENT_NOT_BEFORE", notbefore);
377 
378 		strlcpy(path, ex, sizeof(path));
379 
380 		pwd = dirname(path);
381 		if (chdir(pwd)) {
382 			warn("chdir");
383 			goto childerr;
384 		}
385 
386 		do_exec(ex, spath, iri->query);
387 		goto childerr;
388 	}
389 
390 	default:
391 		close(p[1]);
392 		mark_nonblock(p[0]);
393 		return p[0];
394 	}
395 
396 childerr:
397 	dprintf(p[1], "%d internal server error\r\n", TEMP_FAILURE);
398 	_exit(1);
399 }
400 
401 static void
402 handle_fork_req(int fd, short ev, void *data)
403 {
404 	char *spath, *relpath, *addr, *ruser, *cissuer, *chash;
405 	struct vhost *vhost;
406 	struct iri iri;
407 	time_t notbefore, notafter;
408 	int d;
409 
410 	if (!recv_iri(fd, &iri)
411 	    || !recv_string(fd, &spath)
412 	    || !recv_string(fd, &relpath)
413 	    || !recv_string(fd, &addr)
414 	    || !recv_string(fd, &ruser)
415 	    || !recv_string(fd, &cissuer)
416 	    || !recv_string(fd, &chash)
417 	    || !recv_time(fd, &notbefore)
418 	    || !recv_time(fd, &notafter)
419 	    || !recv_vhost(fd, &vhost))
420 		fatal("failure in handling fork request");
421 
422 	d = launch_cgi(&iri, spath, relpath, addr, ruser, cissuer, chash,
423 	    notbefore, notafter, vhost);
424 	if (!send_fd(fd, d))
425 		fatal("failure in sending the fd to the server: %s",
426 		    strerror(errno));
427 	close(d);
428 
429 	free_recvd_iri(&iri);
430 	free(spath);
431 	free(relpath);
432 	free(addr);
433 	free(ruser);
434 	free(cissuer);
435 	free(chash);
436 }
437 
438 int
439 executor_main(void)
440 {
441 	struct vhost	*vhost;
442 	struct event	 evs[PROC_MAX];
443 	int		 i;
444 
445 #ifdef __OpenBSD__
446 	for (vhost = hosts; vhost->domain != NULL; ++vhost) {
447 		/* r so we can chdir into the correct directory */
448 		if (unveil(vhost->dir, "rx") == -1)
449 			err(1, "unveil %s for domain %s",
450 			    vhost->dir, vhost->domain);
451 	}
452 
453 	/* rpath to chdir into the correct directory */
454 	if (pledge("stdio rpath sendfd proc exec", NULL))
455 		err(1, "pledge");
456 #endif
457 
458 	event_init();
459 
460 	for (i = 0; i < conf.prefork; ++i) {
461 		event_set(&evs[i], servpipes[i], EV_READ | EV_PERSIST,
462 		    handle_fork_req, NULL);
463 		event_add(&evs[i], NULL);
464 	}
465 
466 	event_dispatch();
467 
468 	return 1;
469 }