1 /*
2  * Copyright (c) 2022 Omar Polo <op@omarpolo.com>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/queue.h>
18 #include <sys/tree.h>
19 #include <sys/socket.h>
20 
21 #include <netinet/in.h>
22 #include <arpa/inet.h>
23 
24 #include <errno.h>
25 #include <event.h>
26 #include <limits.h>
27 #include <stdarg.h>
28 #include <stdio.h>
29 #include <stdlib.h>
30 #include <stdint.h>
31 #include <string.h>
32 #include <unistd.h>
33 
34 #include "log.h"
35 
36 #include "galileo.h"
37 
38 #define MIN(a, b)	((a) < (b) ? (a) : (b))
39 
40 struct fcgi_header {
41 	unsigned char version;
42 	unsigned char type;
43 	unsigned char req_id1;
44 	unsigned char req_id0;
45 	unsigned char content_len1;
46 	unsigned char content_len0;
47 	unsigned char padding;
48 	unsigned char reserved;
49 } __attribute__((packed));
50 
51 /*
52  * number of bytes in a FCGI_HEADER.  Future version of the protocol
53  * will not reduce this number.
54  */
55 #define FCGI_HEADER_LEN	8
56 
57 /*
58  * values for the version component
59  */
60 #define FCGI_VERSION_1	1
61 
62 /*
63  * values for the type component
64  */
65 #define FCGI_BEGIN_REQUEST	 1
66 #define FCGI_ABORT_REQUEST	 2
67 #define FCGI_END_REQUEST	 3
68 #define FCGI_PARAMS		 4
69 #define FCGI_STDIN		 5
70 #define FCGI_STDOUT		 6
71 #define FCGI_STDERR		 7
72 #define FCGI_DATA		 8
73 #define FCGI_GET_VALUES		 9
74 #define FCGI_GET_VALUES_RESULT	10
75 #define FCGI_UNKNOWN_TYPE	11
76 #define FCGI_MAXTYPE		(FCGI_UNKNOWN_TYPE)
77 
78 struct fcgi_begin_req {
79 	unsigned char role1;
80 	unsigned char role0;
81 	unsigned char flags;
82 	unsigned char reserved[5];
83 };
84 
85 struct fcgi_begin_req_record {
86 	struct fcgi_header	header;
87 	struct fcgi_begin_req	body;
88 };
89 
90 /*
91  * mask for flags;
92  */
93 #define FCGI_KEEP_CONN		1
94 
95 /*
96  * values for the role
97  */
98 #define FCGI_RESPONDER	1
99 #define FCGI_AUTHORIZER	2
100 #define FCGI_FILTER	3
101 
102 struct fcgi_end_req_body {
103 	unsigned char app_status3;
104 	unsigned char app_status2;
105 	unsigned char app_status1;
106 	unsigned char app_status0;
107 	unsigned char proto_status;
108 	unsigned char reserved[3];
109 };
110 
111 /*
112  * values for proto_status
113  */
114 #define FCGI_REQUEST_COMPLETE	0
115 #define FCGI_CANT_MPX_CONN	1
116 #define FCGI_OVERLOADED		2
117 #define FCGI_UNKNOWN_ROLE	3
118 
119 /*
120  * Variable names for FCGI_GET_VALUES / FCGI_GET_VALUES_RESULT
121  * records.
122  */
123 #define FCGI_MAX_CONNS	"FCGI_MAX_CONNS"
124 #define FCGI_MAX_REQS	"FCGI_MAX_REQS"
125 #define FCGI_MPXS_CONNS	"FCGI_MPXS_CONNS"
126 
127 #define CAT(f0, f1)	((f0) + ((f1) << 8))
128 
129 enum {
130 	FCGI_RECORD_HEADER,
131 	FCGI_RECORD_BODY,
132 };
133 
134 volatile int fcgi_inflight;
135 
136 static int
137 fcgi_send_end_req(struct fcgi *fcgi, int id, int as, int ps)
138 {
139 	struct bufferevent	*bev = fcgi->fcg_bev;
140 	struct fcgi_header	 hdr;
141 	struct fcgi_end_req_body end;
142 
143 	memset(&hdr, 0, sizeof(hdr));
144 	memset(&end, 0, sizeof(end));
145 
146 	hdr.version = FCGI_VERSION_1;
147 	hdr.type = FCGI_END_REQUEST;
148 	hdr.req_id0 = (id & 0xFF);
149 	hdr.req_id1 = (id >> 8);
150 	hdr.content_len0 = sizeof(end);
151 
152 	end.app_status0 = (unsigned char)as;
153 	end.proto_status = (unsigned char)ps;
154 
155 	if (bufferevent_write(bev, &hdr, sizeof(hdr)) == -1)
156 		return (-1);
157 	if (bufferevent_write(bev, &end, sizeof(end)) == -1)
158 		return (-1);
159 	return (0);
160 }
161 
162 static int
163 end_request(struct client *clt, int status, int proto_status)
164 {
165 	struct fcgi		*fcgi = clt->clt_fcgi;
166 	int			 r;
167 
168 	if (clt_flush(clt) == -1)
169 		return (-1);
170 
171 	r = fcgi_send_end_req(fcgi, clt->clt_id, status,
172 	    proto_status);
173 	if (r == -1) {
174 		fcgi_error(fcgi->fcg_bev, EV_WRITE, fcgi);
175 		return (-1);
176 	}
177 
178 	SPLAY_REMOVE(client_tree, &fcgi->fcg_clients, clt);
179 	proxy_client_free(clt);
180 
181 	if (!fcgi->fcg_keep_conn)
182 		fcgi->fcg_done = 1;
183 
184 	return (0);
185 }
186 
187 int
188 fcgi_end_request(struct client *clt, int status)
189 {
190 	return (end_request(clt, status, FCGI_REQUEST_COMPLETE));
191 }
192 
193 int
194 fcgi_abort_request(struct client *clt)
195 {
196 	return (end_request(clt, 1, FCGI_OVERLOADED));
197 }
198 
199 static void
200 fcgi_inflight_dec(const char *why)
201 {
202 	fcgi_inflight--;
203 	log_debug("%s: fcgi inflight decremented, now %d, %s",
204 	    __func__, fcgi_inflight, why);
205 }
206 
207 void
208 fcgi_accept(int fd, short event, void *arg)
209 {
210 	struct galileo		*env = arg;
211 	struct fcgi		*fcgi = NULL;
212 	socklen_t		 slen;
213 	struct sockaddr_storage	 ss;
214 	int			 s = -1;
215 
216 	event_add(&env->sc_evpause, NULL);
217 	if ((event & EV_TIMEOUT))
218 		return;
219 
220 	slen = sizeof(ss);
221 	if ((s = accept_reserve(env->sc_sock_fd, (struct sockaddr *)&ss,
222 	    &slen, FD_RESERVE, &fcgi_inflight)) == -1) {
223 		/*
224 		 * Pause accept if we are out of file descriptors, or
225 		 * libevent will haunt us here too.
226 		 */
227 		if (errno == ENFILE || errno == EMFILE) {
228 			struct timeval evtpause = { 1, 0 };
229 
230 			event_del(&env->sc_evsock);
231 			evtimer_add(&env->sc_evpause, &evtpause);
232 			log_debug("%s: deferring connections", __func__);
233 		}
234 		return;
235 	}
236 
237 	if ((fcgi = calloc(1, sizeof(*fcgi))) == NULL)
238 		goto err;
239 
240 	fcgi->fcg_id = ++proxy_fcg_id;
241 	fcgi->fcg_s = s;
242 	fcgi->fcg_env = env;
243 	fcgi->fcg_want = FCGI_RECORD_HEADER;
244 	fcgi->fcg_toread = sizeof(struct fcgi_header);
245 	SPLAY_INIT(&fcgi->fcg_clients);
246 
247 	/* assume it's enabled until we get a FCGI_BEGIN_REQUEST */
248 	fcgi->fcg_keep_conn = 1;
249 
250 	fcgi->fcg_bev = bufferevent_new(fcgi->fcg_s, fcgi_read, fcgi_write,
251 	    fcgi_error, fcgi);
252 	if (fcgi->fcg_bev == NULL)
253 		goto err;
254 
255 	bufferevent_enable(fcgi->fcg_bev, EV_READ | EV_WRITE);
256 	return;
257 
258 err:
259 	if (s != -1) {
260 		close(s);
261 		free(fcgi);
262 		fcgi_inflight_dec(__func__);
263 	}
264 }
265 
266 static int
267 parse_len(struct fcgi *fcgi, struct evbuffer *src)
268 {
269 	unsigned char		 c, x[3];
270 
271 	fcgi->fcg_toread--;
272 	evbuffer_remove(src, &c, 1);
273 	if (c >> 7 == 0)
274 		return (c);
275 
276 	if (fcgi->fcg_toread < 3)
277 		return (-1);
278 
279 	fcgi->fcg_toread -= 3;
280 	evbuffer_remove(src, x, sizeof(x));
281 	return (((c & 0x7F) << 24) | (x[0] << 16) | (x[1] << 8) | x[2]);
282 }
283 
284 static int
285 fcgi_parse_params(struct fcgi *fcgi, struct evbuffer *src, struct client *clt)
286 {
287 	char			 pname[32];
288 	char			 server[HOST_NAME_MAX + 1];
289 	char			 path[PATH_MAX];
290 	int			 nlen, vlen;
291 
292 	while (fcgi->fcg_toread > 0) {
293 		if ((nlen = parse_len(fcgi, src)) < 0 ||
294 		    (vlen = parse_len(fcgi, src)) < 0)
295 			return (-1);
296 
297 		if (fcgi->fcg_toread < nlen + vlen)
298 			return (-1);
299 
300 		if ((size_t)nlen > sizeof(pname) - 1) {
301 			/* ignore this parameter */
302 			fcgi->fcg_toread -= nlen - vlen;
303 			evbuffer_drain(src, nlen + vlen);
304 			continue;
305 		}
306 
307 		fcgi->fcg_toread -= nlen;
308 		evbuffer_remove(src, &pname, nlen);
309 		pname[nlen] = '\0';
310 
311 		if (!strcmp(pname, "SERVER_NAME") &&
312 		    (size_t)vlen < sizeof(server)) {
313 			fcgi->fcg_toread -= vlen;
314 			evbuffer_remove(src, &server, vlen);
315 			server[vlen] = '\0';
316 
317 			free(clt->clt_server_name);
318 			if ((clt->clt_server_name = strdup(server)) == NULL)
319 				return (-1);
320 			log_debug("clt %d: server_name: %s", clt->clt_id,
321 			    clt->clt_server_name);
322 			continue;
323 		}
324 
325 		if (!strcmp(pname, "SCRIPT_NAME") &&
326 		    (size_t)vlen < sizeof(path)) {
327 			fcgi->fcg_toread -= vlen;
328 			evbuffer_remove(src, &path, vlen);
329 			path[vlen] = '\0';
330 
331 			free(clt->clt_script_name);
332 			clt->clt_script_name = NULL;
333 
334 			if (vlen > 0 && path[vlen - 1] != '/')
335 				asprintf(&clt->clt_script_name, "%s/", path);
336 			else
337 				clt->clt_script_name = strdup(path);
338 
339 			if (clt->clt_script_name == NULL)
340 				return (-1);
341 
342 			log_debug("clt %d: script_name: %s", clt->clt_id,
343 			    clt->clt_script_name);
344 			continue;
345 		}
346 
347 		if (!strcmp(pname, "PATH_INFO") &&
348 		    (size_t)vlen < sizeof(path)) {
349 			fcgi->fcg_toread -= vlen;
350 			evbuffer_remove(src, &path, vlen);
351 			path[vlen] = '\0';
352 
353 			free(clt->clt_path_info);
354 			clt->clt_path_info = NULL;
355 
356 			if (*path != '/')
357 				asprintf(&clt->clt_path_info, "/%s", path);
358 			else
359 				clt->clt_path_info = strdup(path);
360 
361 			if (clt->clt_path_info == NULL)
362 				return (-1);
363 
364 			log_debug("clt %d: path_info: %s", clt->clt_id,
365 			    clt->clt_path_info);
366 			continue;
367 		}
368 
369 		fcgi->fcg_toread -= vlen;
370 		evbuffer_drain(src, vlen);
371 	}
372 
373 	return (0);
374 }
375 
376 void
377 fcgi_read(struct bufferevent *bev, void *d)
378 {
379 	struct fcgi		*fcgi = d;
380 	struct galileo		*env = fcgi->fcg_env;
381 	struct evbuffer		*src = EVBUFFER_INPUT(bev);
382 	struct fcgi_header	 hdr;
383 	struct fcgi_begin_req	 breq;
384 	struct client		*clt, q;
385 	int			 role;
386 
387 	memset(&q, 0, sizeof(q));
388 
389 	for (;;) {
390 		if (EVBUFFER_LENGTH(src) < (size_t)fcgi->fcg_toread)
391 			return;
392 
393 		if (fcgi->fcg_want == FCGI_RECORD_HEADER) {
394 			fcgi->fcg_want = FCGI_RECORD_BODY;
395 			bufferevent_read(bev, &hdr, sizeof(hdr));
396 
397 #ifdef DEBUG
398 			log_warnx("header: v=%d t=%d id=%d len=%d p=%d",
399 			    hdr.version, hdr.type,
400 			    CAT(hdr.req_id0, hdr.req_id1),
401 			    CAT(hdr.content_len0, hdr.content_len1),
402 			    hdr.padding);
403 #endif
404 
405 			if (hdr.version != FCGI_VERSION_1) {
406 				log_warnx("unknown fastcgi version: %d",
407 				    hdr.version);
408 				fcgi_error(bev, EV_READ, d);
409 				return;
410 			}
411 
412 			fcgi->fcg_toread = CAT(hdr.content_len0,
413 			    hdr.content_len1);
414 			if (fcgi->fcg_toread < 0) {
415 				log_warnx("invalid record length: %d",
416 				    fcgi->fcg_toread);
417 				fcgi_error(bev, EV_READ, d);
418 				return;
419 			}
420 
421 			fcgi->fcg_padding = hdr.padding;
422 			if (fcgi->fcg_padding < 0) {
423 				log_warnx("invalid padding: %d",
424 				    fcgi->fcg_padding);
425 				fcgi_error(bev, EV_READ, d);
426 				return;
427 			}
428 
429 			fcgi->fcg_type = hdr.type;
430 			fcgi->fcg_rec_id = CAT(hdr.req_id0, hdr.req_id1);
431 			continue;
432 		}
433 
434 		q.clt_id = fcgi->fcg_rec_id;
435 		clt = SPLAY_FIND(client_tree, &fcgi->fcg_clients, &q);
436 
437 		switch (fcgi->fcg_type) {
438 		case FCGI_BEGIN_REQUEST:
439 			if (sizeof(breq) != fcgi->fcg_toread) {
440 				log_warnx("unexpected size for "
441 				    "FCGI_BEGIN_REQUEST");
442 				fcgi_error(bev, EV_READ, d);
443 				return;
444 			}
445 
446 			evbuffer_remove(src, &breq, sizeof(breq));
447 
448 			role = CAT(breq.role0, breq.role1);
449 			if (role != FCGI_RESPONDER) {
450 				log_warnx("unknown fastcgi role: %d",
451 				    role);
452 				if (fcgi_send_end_req(fcgi, fcgi->fcg_rec_id,
453 				    1, FCGI_UNKNOWN_ROLE) == -1) {
454 					fcgi_error(bev, EV_READ, d);
455 					return;
456 				}
457 				break;
458 			}
459 
460 			if (!fcgi->fcg_keep_conn) {
461 				log_warnx("trying to reuse the fastcgi "
462 				    "socket without marking it as so.");
463 				fcgi_error(bev, EV_READ, d);
464 				return;
465 			}
466 			fcgi->fcg_keep_conn = breq.flags & FCGI_KEEP_CONN;
467 
468 			if (clt != NULL) {
469 				log_warnx("ignoring attemp to re-use an "
470 				    "active request id (%d)",
471 				    fcgi->fcg_rec_id);
472 				break;
473 			}
474 
475 			if ((clt = calloc(1, sizeof(*clt))) == NULL) {
476 				log_warnx("calloc");
477 				break;
478 			}
479 
480 			clt->clt_id = fcgi->fcg_rec_id;
481 			clt->clt_fd = -1;
482 			clt->clt_fcgi = fcgi;
483 			SPLAY_INSERT(client_tree, &fcgi->fcg_clients, clt);
484 			break;
485 		case FCGI_PARAMS:
486 			if (clt == NULL) {
487 				log_warnx("got FCGI_PARAMS for inactive id "
488 				    "(%d)", fcgi->fcg_rec_id);
489 				evbuffer_drain(src, fcgi->fcg_toread);
490 				break;
491 			}
492 			if (fcgi->fcg_toread == 0) {
493 				evbuffer_drain(src, fcgi->fcg_toread);
494 				proxy_start_request(env, clt);
495 				break;
496 			}
497 			if (fcgi_parse_params(fcgi, src, clt) == -1) {
498 				log_warnx("fcgi_parse_params failed");
499 				fcgi_error(bev, EV_READ, d);
500 				return;
501 			}
502 			break;
503 		case FCGI_STDIN:
504 			/* ignore */
505 			evbuffer_drain(src, fcgi->fcg_toread);
506 			break;
507 		case FCGI_ABORT_REQUEST:
508 			if (clt == NULL) {
509 				log_warnx("got FCGI_ABORT_REQUEST for inactive"
510 				    " id (%d)", fcgi->fcg_rec_id);
511 				evbuffer_drain(src, fcgi->fcg_toread);
512 				break;
513 			}
514 			if (fcgi_end_request(clt, 1) == -1) {
515 				/* calls fcgi_error on failure */
516 				return;
517 			}
518 			break;
519 		default:
520 			log_warnx("unknown fastcgi record type %d",
521 			    fcgi->fcg_type);
522 			evbuffer_drain(src, fcgi->fcg_toread);
523 			break;
524 		}
525 
526 		/* Prepare for the next record. */
527 		evbuffer_drain(src, fcgi->fcg_padding);
528 		fcgi->fcg_want = FCGI_RECORD_HEADER;
529 		fcgi->fcg_toread = sizeof(struct fcgi_header);
530 	}
531 }
532 
533 void
534 fcgi_write(struct bufferevent *bev, void *d)
535 {
536 	struct fcgi		*fcgi = d;
537 	struct evbuffer		*out = EVBUFFER_OUTPUT(bev);
538 
539 	if (fcgi->fcg_done && EVBUFFER_LENGTH(out) == 0)
540 		fcgi_error(bev, EVBUFFER_EOF, fcgi);
541 }
542 
543 void
544 fcgi_error(struct bufferevent *bev, short event, void *d)
545 {
546 	struct fcgi		*fcgi = d;
547 	struct galileo		*env = fcgi->fcg_env;
548 	struct client		*clt;
549 
550 	log_debug("fcgi failure, shutting down connection (ev: %x)",
551 	    event);
552 	fcgi_inflight_dec(__func__);
553 
554 	while ((clt = SPLAY_MIN(client_tree, &fcgi->fcg_clients)) != NULL) {
555 		SPLAY_REMOVE(client_tree, &fcgi->fcg_clients, clt);
556 		proxy_client_free(clt);
557 	}
558 
559 	close(fcgi->fcg_s);
560 	bufferevent_free(fcgi->fcg_bev);
561 	SPLAY_REMOVE(fcgi_tree, &env->sc_fcgi_socks, fcgi);
562 	free(fcgi);
563 
564 	return;
565 }
566 
567 int
568 clt_flush(struct client *clt)
569 {
570 	struct fcgi		*fcgi = clt->clt_fcgi;
571 	struct bufferevent	*bev = fcgi->fcg_bev;
572 	struct fcgi_header	 hdr;
573 
574 	if (clt->clt_buflen == 0)
575 		return (0);
576 
577 	memset(&hdr, 0, sizeof(hdr));
578 	hdr.version = FCGI_VERSION_1;
579 	hdr.type = FCGI_STDOUT;
580 	hdr.req_id0 = (clt->clt_id & 0xFF);
581 	hdr.req_id1 = (clt->clt_id >> 8);
582 	hdr.content_len0 = (clt->clt_buflen & 0xFF);
583 	hdr.content_len1 = (clt->clt_buflen >> 8);
584 
585 	if (bufferevent_write(bev, &hdr, sizeof(hdr)) == -1 ||
586 	    bufferevent_write(bev, clt->clt_buf, clt->clt_buflen) == -1) {
587 		fcgi_error(bev, EV_WRITE, fcgi);
588 		return (-1);
589 	}
590 
591 	clt->clt_buflen = 0;
592 
593 	return (0);
594 }
595 
596 int
597 clt_write(struct client *clt, const uint8_t *buf, size_t len)
598 {
599 	size_t			 left, copy;
600 
601 	while (len > 0) {
602 		left = sizeof(clt->clt_buf) - clt->clt_buflen;
603 		if (left == 0) {
604 			if (clt_flush(clt) == -1)
605 				return (-1);
606 			left = sizeof(clt->clt_buf);
607 		}
608 
609 		copy = MIN(left, len);
610 
611 		memcpy(&clt->clt_buf[clt->clt_buflen], buf, copy);
612 		clt->clt_buflen += copy;
613 		buf += copy;
614 		len -= copy;
615 	}
616 
617 	return (0);
618 }
619 
620 int
621 clt_putc(struct client *clt, char ch)
622 {
623 	return (clt_write(clt, &ch, 1));
624 }
625 
626 int
627 clt_puts(struct client *clt, const char *str)
628 {
629 	return (clt_write(clt, str, strlen(str)));
630 }
631 
632 int
633 clt_write_bufferevent(struct client *clt, struct bufferevent *bev)
634 {
635 	struct evbuffer		*src = EVBUFFER_INPUT(bev);
636 	size_t			 len, left, copy;
637 
638 	len = EVBUFFER_LENGTH(src);
639 	while (len > 0) {
640 		left = sizeof(clt->clt_buf) - clt->clt_buflen;
641 		if (left == 0) {
642 			if (clt_flush(clt) == -1)
643 				return (-1);
644 			left = sizeof(clt->clt_buf);
645 		}
646 
647 		copy = bufferevent_read(bev, &clt->clt_buf[clt->clt_buflen],
648 		    MIN(left, len));
649 		clt->clt_buflen += copy;
650 
651 		len = EVBUFFER_LENGTH(src);
652 	}
653 
654 	return (0);
655 }
656 
657 int
658 clt_printf(struct client *clt, const char *fmt, ...)
659 {
660 	struct fcgi		*fcgi = clt->clt_fcgi;
661 	struct bufferevent	*bev = fcgi->fcg_bev;
662 	char			*str;
663 	va_list			 ap;
664 	int			 r;
665 
666 	va_start(ap, fmt);
667 	r = vasprintf(&str, fmt, ap);
668 	va_end(ap);
669 	if (r == -1) {
670 		fcgi_error(bev, EV_WRITE, fcgi);
671 		return (-1);
672 	}
673 
674 	r = clt_write(clt, str, r);
675 	free(str);
676 	return (r);
677 }
678 
679 int
680 fcgi_cmp(struct fcgi *a, struct fcgi *b)
681 {
682 	return ((int)a->fcg_id - b->fcg_id);
683 }
684 
685 int
686 fcgi_client_cmp(struct client *a, struct client *b)
687 {
688 	return ((int)a->clt_id - b->clt_id);
689 }
690 
691 SPLAY_GENERATE(fcgi_tree, fcgi, fcg_nodes, fcgi_cmp);
692 SPLAY_GENERATE(client_tree, client, clt_nodes, fcgi_client_cmp);
693