1 /*
2  * Copyright (c) 2021 Omar Polo <op@omarpolo.com>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include "gmid.h"
18 
19 #include <err.h>
20 #include <errno.h>
21 
22 #include <event.h>
23 #include <fcntl.h>
24 #include <libgen.h>
25 #include <limits.h>
26 #include <signal.h>
27 #include <stdarg.h>
28 #include <string.h>
29 
30 static void	handle_imsg_cgi_req(struct imsgbuf*, struct imsg*, size_t);
31 static void	handle_imsg_quit(struct imsgbuf*, struct imsg*, size_t);
32 static void	handle_dispatch_imsg(int, short, void*);
33 
34 static imsg_handlerfn *handlers[] = {
35 	[IMSG_CGI_REQ] = handle_imsg_cgi_req,
36 	[IMSG_QUIT] = handle_imsg_quit,
37 };
38 
39 static inline void
40 safe_setenv(const char *name, const char *val)
41 {
42 	if (val == NULL)
43 		val = "";
44 	setenv(name, val, 1);
45 }
46 
47 static char *
48 xasprintf(const char *fmt, ...)
49 {
50 	va_list ap;
51 	char *s;
52 
53 	va_start(ap, fmt);
54 	if (vasprintf(&s, fmt, ap) == -1)
55 		s = NULL;
56 	va_end(ap);
57 
58 	return s;
59 }
60 
61 static void
62 do_exec(const char *ex, const char *spath, char *query)
63 {
64 	char **argv, buf[PATH_MAX], *sname, *t;
65 	size_t i, n;
66 
67 	/* restore the default handlers */
68 	signal(SIGPIPE, SIG_DFL);
69 	signal(SIGCHLD, SIG_DFL);
70 	signal(SIGHUP,  SIG_DFL);
71 	signal(SIGINT,  SIG_DFL);
72 	signal(SIGTERM, SIG_DFL);
73 
74 	strlcpy(buf, spath, sizeof(buf));
75 	sname = basename(buf);
76 
77 	if (query == NULL || strchr(query, '=') != NULL) {
78 		if ((argv = calloc(2, sizeof(char*))) == NULL)
79 			err(1, "calloc");
80 		argv[0] = sname;
81 		execvp(ex, argv);
82 		warn("execvp: %s", argv[0]);
83 		return;
84 	}
85 
86 	n = 1;
87 	for (t = query ;; t++, n++) {
88 		if ((t = strchr(t, '+')) == NULL)
89 			break;
90 	}
91 
92 	if ((argv = calloc(n+2, sizeof(char*))) == NULL)
93 		err(1, "calloc");
94 
95 	argv[0] = sname;
96 	for (i = 0; i < n; ++i) {
97 		t = strchr(query, '+');
98 		if (t != NULL)
99 			*t = '\0';
100 		argv[i+1] = pct_decode_str(query);
101 		query = t+1;
102 	}
103 
104 	execvp(ex, argv);
105 	warn("execvp: %s", argv[0]);
106 }
107 
108 static inline void
109 setenv_time(const char *var, time_t t)
110 {
111 	char timebuf[21];
112 	struct tm tminfo;
113 
114 	if (t == -1)
115 		return;
116 
117 	strftime(timebuf, sizeof(timebuf), "%FT%TZ",
118 	    gmtime_r(&t, &tminfo));
119 	setenv(var, timebuf, 1);
120 }
121 
122 /* fd or -1 on error */
123 static int
124 launch_cgi(struct iri *iri, struct cgireq *req, struct vhost *vhost,
125     struct location *loc)
126 {
127 	int p[2];		/* read end, write end */
128 
129 	if (pipe(p) == -1)
130 		return -1;
131 
132 	switch (fork()) {
133 	case -1:
134 		return -1;
135 
136 	case 0: {		/* child */
137 		char *ex, *pwd;
138 		char iribuf[GEMINI_URL_LEN];
139 		char path[PATH_MAX];
140 		struct envlist *e;
141 
142 		close(p[0]);
143 		if (dup2(p[1], 1) == -1)
144 			goto childerr;
145 
146 		ex = xasprintf("%s/%s", loc->dir, req->spath);
147 
148 		serialize_iri(iri, iribuf, sizeof(iribuf));
149 
150 		safe_setenv("GATEWAY_INTERFACE", "CGI/1.1");
151 		safe_setenv("GEMINI_DOCUMENT_ROOT", loc->dir);
152 		safe_setenv("GEMINI_SCRIPT_FILENAME",
153 		    xasprintf("%s/%s", loc->dir, req->spath));
154 		safe_setenv("GEMINI_URL", iribuf);
155 
156 		strlcpy(path, "/", sizeof(path));
157 		strlcat(path, req->spath, sizeof(path));
158 		safe_setenv("GEMINI_URL_PATH", path);
159 
160 		if (*req->relpath != '\0') {
161 			strlcpy(path, "/", sizeof(path));
162 			strlcat(path, req->relpath, sizeof(path));
163 			safe_setenv("PATH_INFO", path);
164 
165 			strlcpy(path, loc->dir, sizeof(path));
166 			strlcat(path, "/", sizeof(path));
167 			strlcat(path, req->relpath, sizeof(path));
168 			safe_setenv("PATH_TRANSLATED", path);
169 		}
170 
171 		safe_setenv("QUERY_STRING", iri->query);
172 		safe_setenv("REMOTE_ADDR", req->addr);
173 		safe_setenv("REMOTE_HOST", req->addr);
174 		safe_setenv("REQUEST_METHOD", "");
175 
176 		strlcpy(path, "/", sizeof(path));
177 		strlcat(path, req->spath, sizeof(path));
178 		safe_setenv("SCRIPT_NAME", path);
179 
180 		safe_setenv("SERVER_NAME", iri->host);
181 
182 		snprintf(path, sizeof(path), "%d", conf.port);
183 		safe_setenv("SERVER_PORT", path);
184 
185 		safe_setenv("SERVER_PROTOCOL", "GEMINI");
186 		safe_setenv("SERVER_SOFTWARE", "gmid/1.6");
187 
188 		if (*req->subject != '\0')
189 			safe_setenv("AUTH_TYPE", "Certificate");
190 		else
191 			safe_setenv("AUTH_TYPE", "");
192 
193 		safe_setenv("REMOTE_USER", req->subject);
194 		safe_setenv("TLS_CLIENT_ISSUER", req->issuer);
195 		safe_setenv("TLS_CLIENT_HASH", req->hash);
196 		safe_setenv("TLS_VERSION", req->version);
197 		safe_setenv("TLS_CIPHER", req->cipher);
198 
199 		snprintf(path, sizeof(path), "%d", req->cipher_strength);
200 		safe_setenv("TLS_CIPHER_STRENGTH", path);
201 
202 		setenv_time("TLS_CLIENT_NOT_AFTER", req->notafter);
203 		setenv_time("TLS_CLIENT_NOT_BEFORE", req->notbefore);
204 
205 		TAILQ_FOREACH(e, &vhost->env, envs) {
206 			safe_setenv(e->name, e->value);
207 		}
208 
209 		strlcpy(path, ex, sizeof(path));
210 
211 		pwd = dirname(path);
212 		if (chdir(pwd)) {
213 			warn("chdir");
214 			goto childerr;
215 		}
216 
217 		do_exec(ex, req->spath, iri->query);
218 		goto childerr;
219 	}
220 
221 	default:
222 		close(p[1]);
223 		mark_nonblock(p[0]);
224 		return p[0];
225 	}
226 
227 childerr:
228 	dprintf(p[1], "%d internal server error\r\n", TEMP_FAILURE);
229 	_exit(1);
230 }
231 
232 static struct vhost *
233 host_nth(size_t n)
234 {
235 	struct vhost *h;
236 
237 	TAILQ_FOREACH(h, &hosts, vhosts) {
238 		if (n == 0)
239 			return h;
240 		n--;
241 	}
242 
243 	return NULL;
244 }
245 
246 static struct location *
247 loc_nth(struct vhost *vhost, size_t n)
248 {
249 	struct location *loc;
250 
251 	TAILQ_FOREACH(loc, &vhost->locations, locations) {
252 		if (n == 0)
253 			return loc;
254 		n--;
255 	}
256 
257 	return NULL;
258 }
259 
260 static void
261 handle_imsg_cgi_req(struct imsgbuf *ibuf, struct imsg *imsg, size_t datalen)
262 {
263 	struct vhost	*h;
264 	struct location	*l;
265 	struct cgireq	 req;
266 	struct iri	 iri;
267 	int		 fd;
268 
269 	if (datalen != sizeof(req))
270 		abort();
271 
272 	memcpy(&req, imsg->data, datalen);
273 
274 	iri.schema = req.iri_schema_off + req.buf;
275 	iri.host = req.iri_host_off + req.buf;
276 	iri.port = req.iri_port_off + req.buf;
277 	iri.path = req.iri_path_off + req.buf;
278 	iri.query = req.iri_query_off + req.buf;
279 	iri.fragment = req.iri_fragment_off + req.buf;
280 
281 	/* patch the query, otherwise do_exec will always pass "" as
282 	 * first argument to the script. */
283 	if (*iri.query == '\0')
284 		iri.query = NULL;
285 
286 	if ((h = host_nth(req.host_off)) == NULL)
287 		abort();
288 
289 	if ((l = loc_nth(h, req.host_off)) == NULL)
290 		abort();
291 
292 	fd = launch_cgi(&iri, &req, h, l);
293 	imsg_compose(ibuf, IMSG_CGI_RES, imsg->hdr.peerid, 0, fd, NULL, 0);
294 	imsg_flush(ibuf);
295 }
296 
297 static void
298 handle_imsg_quit(struct imsgbuf *ibuf, struct imsg *imsg, size_t datalen)
299 {
300 	int i;
301 
302 	(void)ibuf;
303 	(void)imsg;
304 	(void)datalen;
305 
306 	for (i = 0; i < conf.prefork; ++i) {
307 		imsg_compose(&servibuf[i], IMSG_QUIT, 0, 0, -1, NULL, 0);
308 		imsg_flush(&exibuf);
309 		close(servibuf[i].fd);
310 	}
311 
312 	event_loopbreak();
313 }
314 
315 static void
316 handle_dispatch_imsg(int fd, short ev, void *d)
317 {
318 	struct imsgbuf *ibuf = d;
319 	dispatch_imsg(ibuf, handlers, sizeof(handlers));
320 }
321 
322 int
323 executor_main(struct imsgbuf *ibuf)
324 {
325 	struct event	 evs[PROC_MAX], imsgev;
326 	int		 i;
327 
328 	event_init();
329 
330 	if (ibuf != NULL) {
331 		event_set(&imsgev, ibuf->fd, EV_READ | EV_PERSIST,
332 		    handle_dispatch_imsg, ibuf);
333 		event_add(&imsgev, NULL);
334 	}
335 
336 	for (i = 0; i < conf.prefork; ++i) {
337 		event_set(&evs[i], servibuf[i].fd, EV_READ | EV_PERSIST,
338 		    handle_dispatch_imsg, &servibuf[i]);
339 		event_add(&evs[i], NULL);
340 	}
341 
342 	sandbox_executor_process();
343 
344 	event_dispatch();
345 
346 	return 1;
347 }