src/mod_cgi.c

   1 #include "first.h"
   2
   3 #include "server.h"
   4 #include "stat_cache.h"
   5 #include "keyvalue.h"
   6 #include "log.h"
   7 #include "connections.h"
   8 #include "joblist.h"
   9 #include "response.h"
  10 #include "http_chunk.h"
  11
  12 #include "plugin.h"
  13
  14 #include <sys/types.h>
  15 #include "sys-mmap.h"
  16
  17 #ifdef __WIN32
  18 # include <winsock2.h>
  19 #else
  20 # include <sys/socket.h>
  21 # include <sys/wait.h>
  22 # include <netinet/in.h>
  23 # include <arpa/inet.h>
  24 #endif
  25
  26 #include <unistd.h>
  27 #include <errno.h>
  28 #include <stdlib.h>
  29 #include <string.h>
  30 #include <fdevent.h>
  31 #include <signal.h>
  32 #include <ctype.h>
  33 #include <assert.h>
  34
  35 #include <stdio.h>
  36 #include <fcntl.h>
  37
  38 static int pipe_cloexec(int pipefd[2]) {
  39   #ifdef HAVE_PIPE2
  40     if (0 == pipe2(pipefd, O_CLOEXEC)) return 0;
  41   #endif
  42     return 0 == pipe(pipefd)
  43        #ifdef FD_CLOEXEC
  44         && 0 == fcntl(pipefd[0], F_SETFD, FD_CLOEXEC)
  45         && 0 == fcntl(pipefd[1], F_SETFD, FD_CLOEXEC)
  46        #endif
  47       ?  0
  48       : -1;
  49 }
  50
  51 enum {EOL_UNSET, EOL_N, EOL_RN};
  52
  53 typedef struct {
  54         char **ptr;
  55
  56         size_t size;
  57         size_t used;
  58 } char_array;
  59
  60 typedef struct {
  61         pid_t *ptr;
  62         size_t used;
  63         size_t size;
  64 } buffer_pid_t;
  65
  66 typedef struct {
  67         array *cgi;
  68         unsigned short execute_x_only;
  69         unsigned short xsendfile_allow;
  70         array *xsendfile_docroot;
  71 } plugin_config;
  72
  73 typedef struct {
  74         PLUGIN_DATA;
  75         buffer_pid_t cgi_pid;
  76
  77         buffer *parse_response;
  78
  79         plugin_config **config_storage;
  80
  81         plugin_config conf;
  82 } plugin_data;
  83
  84 typedef struct {
  85         pid_t pid;
  86         int fd;
  87         int fdtocgi;
  88         int fde_ndx; /* index into the fd-event buffer */
  89         int fde_ndx_tocgi; /* index into the fd-event buffer */
  90
  91         connection *remote_conn;  /* dumb pointer */
  92         plugin_data *plugin_data; /* dumb pointer */
  93
  94         buffer *response;
  95         buffer *response_header;
  96         buffer *cgi_handler;      /* dumb pointer */
  97         plugin_config conf;
  98 } handler_ctx;
  99
 100 static handler_ctx * cgi_handler_ctx_init(void) {
 101         handler_ctx *hctx = calloc(1, sizeof(*hctx));
 102
 103         force_assert(hctx);
 104
 105         hctx->response = buffer_init();
 106         hctx->response_header = buffer_init();
 107         hctx->fd = -1;
 108         hctx->fdtocgi = -1;
 109
 110         return hctx;
 111 }
 112
 113 static void cgi_handler_ctx_free(handler_ctx *hctx) {
 114         buffer_free(hctx->response);
 115         buffer_free(hctx->response_header);
 116
 117         free(hctx);
 118 }
 119
 120 enum {FDEVENT_HANDLED_UNSET, FDEVENT_HANDLED_FINISHED, FDEVENT_HANDLED_NOT_FINISHED, FDEVENT_HANDLED_COMEBACK, FDEVENT_HANDLED_ERROR};
 121
 122 INIT_FUNC(mod_cgi_init) {
 123         plugin_data *p;
 124
 125         p = calloc(1, sizeof(*p));
 126
 127         force_assert(p);
 128
 129         p->parse_response = buffer_init();
 130
 131         return p;
 132 }
 133
 134
 135 FREE_FUNC(mod_cgi_free) {
 136         plugin_data *p = p_d;
 137         buffer_pid_t *r = &(p->cgi_pid);
 138
 139         UNUSED(srv);
 140
 141         if (p->config_storage) {
 142                 size_t i;
 143                 for (i = 0; i < srv->config_context->used; i++) {
 144                         plugin_config *s = p->config_storage[i];
 145
 146                         if (NULL == s) continue;
 147
 148                         array_free(s->cgi);
 149                         array_free(s->xsendfile_docroot);
 150
 151                         free(s);
 152                 }
 153                 free(p->config_storage);
 154         }
 155
 156
 157         if (r->ptr) free(r->ptr);
 158
 159         buffer_free(p->parse_response);
 160
 161         free(p);
 162
 163         return HANDLER_GO_ON;
 164 }
 165
 166 SETDEFAULTS_FUNC(mod_fastcgi_set_defaults) {
 167         plugin_data *p = p_d;
 168         size_t i = 0;
 169
 170         config_values_t cv[] = {
 171                 { "cgi.assign",                  NULL, T_CONFIG_ARRAY, T_CONFIG_SCOPE_CONNECTION },       /* 0 */
 172                 { "cgi.execute-x-only",          NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION },     /* 1 */
 173                 { "cgi.x-sendfile",              NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION },     /* 2 */
 174                 { "cgi.x-sendfile-docroot",      NULL, T_CONFIG_ARRAY,   T_CONFIG_SCOPE_CONNECTION },     /* 3 */
 175                 { NULL,                          NULL, T_CONFIG_UNSET, T_CONFIG_SCOPE_UNSET}
 176         };
 177
 178         if (!p) return HANDLER_ERROR;
 179
 180         p->config_storage = calloc(1, srv->config_context->used * sizeof(plugin_config *));
 181         force_assert(p->config_storage);
 182
 183         for (i = 0; i < srv->config_context->used; i++) {
 184                 data_config const* config = (data_config const*)srv->config_context->data[i];
 185                 plugin_config *s;
 186
 187                 s = calloc(1, sizeof(plugin_config));
 188                 force_assert(s);
 189
 190                 s->cgi    = array_init();
 191                 s->execute_x_only = 0;
 192                 s->xsendfile_allow= 0;
 193                 s->xsendfile_docroot = array_init();
 194
 195                 cv[0].destination = s->cgi;
 196                 cv[1].destination = &(s->execute_x_only);
 197                 cv[2].destination = &(s->xsendfile_allow);
 198                 cv[3].destination = s->xsendfile_docroot;
 199
 200                 p->config_storage[i] = s;
 201
 202                 if (0 != config_insert_values_global(srv, config->value, cv, i == 0 ? T_CONFIG_SCOPE_SERVER : T_CONFIG_SCOPE_CONNECTION)) {
 203                         return HANDLER_ERROR;
 204                 }
 205
 206                 if (s->xsendfile_docroot->used) {
 207                         size_t j;
 208                         for (j = 0; j < s->xsendfile_docroot->used; ++j) {
 209                                 data_string *ds = (data_string *)s->xsendfile_docroot->data[j];
 210                                 if (ds->type != TYPE_STRING) {
 211                                         log_error_write(srv, __FILE__, __LINE__, "s",
 212                                                 "unexpected type for key cgi.x-sendfile-docroot; expected: cgi.x-sendfile-docroot = ( \"/allowed/path\", ... )");
 213                                         return HANDLER_ERROR;
 214                                 }
 215                                 if (ds->value->ptr[0] != '/') {
 216                                         log_error_write(srv, __FILE__, __LINE__, "SBs",
 217                                                 "cgi.x-sendfile-docroot paths must begin with '/'; invalid: \"", ds->value, "\"");
 218                                         return HANDLER_ERROR;
 219                                 }
 220                                 buffer_path_simplify(ds->value, ds->value);
 221                                 buffer_append_slash(ds->value);
 222                         }
 223                 }
 224         }
 225
 226         return HANDLER_GO_ON;
 227 }
 228
 229
 230 static int cgi_pid_add(server *srv, plugin_data *p, pid_t pid) {
 231         int m = -1;
 232         size_t i;
 233         buffer_pid_t *r = &(p->cgi_pid);
 234
 235         UNUSED(srv);
 236
 237         for (i = 0; i < r->used; i++) {
 238                 if (r->ptr[i] > m) m = r->ptr[i];
 239         }
 240
 241         if (r->size == 0) {
 242                 r->size = 16;
 243                 r->ptr = malloc(sizeof(*r->ptr) * r->size);
 244                 force_assert(r->ptr);
 245         } else if (r->used == r->size) {
 246                 r->size += 16;
 247                 r->ptr = realloc(r->ptr, sizeof(*r->ptr) * r->size);
 248                 force_assert(r->ptr);
 249         }
 250
 251         r->ptr[r->used++] = pid;
 252
 253         return m;
 254 }
 255
 256 static int cgi_pid_del(server *srv, plugin_data *p, pid_t pid) {
 257         size_t i;
 258         buffer_pid_t *r = &(p->cgi_pid);
 259
 260         UNUSED(srv);
 261
 262         for (i = 0; i < r->used; i++) {
 263                 if (r->ptr[i] == pid) break;
 264         }
 265
 266         if (i != r->used) {
 267                 /* found */
 268
 269                 if (i != r->used - 1) {
 270                         r->ptr[i] = r->ptr[r->used - 1];
 271                 }
 272                 r->used--;
 273         }
 274
 275         return 0;
 276 }
 277
 278 static int cgi_response_parse(server *srv, connection *con, plugin_data *p, buffer *in) {
 279         char *ns;
 280         const char *s;
 281         int line = 0;
 282
 283         UNUSED(srv);
 284
 285         buffer_copy_buffer(p->parse_response, in);
 286
 287         for (s = p->parse_response->ptr;
 288              NULL != (ns = strchr(s, '\n'));
 289              s = ns + 1, line++) {
 290                 const char *key, *value;
 291                 int key_len;
 292                 data_string *ds;
 293
 294                 /* strip the \n */
 295                 ns[0] = '\0';
 296
 297                 if (ns > s && ns[-1] == '\r') ns[-1] = '\0';
 298
 299                 if (line == 0 &&
 300                     0 == strncmp(s, "HTTP/1.", 7)) {
 301                         /* non-parsed header ... we parse them anyway */
 302
 303                         if ((s[7] == '1' ||
 304                              s[7] == '0') &&
 305                             s[8] == ' ') {
 306                                 int status;
 307                                 /* after the space should be a status code for us */
 308
 309                                 status = strtol(s+9, NULL, 10);
 310
 311                                 if (status >= 100 &&
 312                                     status < 1000) {
 313                                         /* we expected 3 digits and didn't got them */
 314                                         con->parsed_response |= HTTP_STATUS;
 315                                         con->http_status = status;
 316                                 }
 317                         }
 318                 } else {
 319                         /* parse the headers */
 320                         key = s;
 321                         if (NULL == (value = strchr(s, ':'))) {
 322                                 /* we expect: "<key>: <value>\r\n" */
 323                                 continue;
 324                         }
 325
 326                         key_len = value - key;
 327                         value += 1;
 328
 329                         /* skip LWS */
 330                         while (*value == ' ' || *value == '\t') value++;
 331
 332                         if (NULL == (ds = (data_string *)array_get_unused_element(con->response.headers, TYPE_STRING))) {
 333                                 ds = data_response_init();
 334                         }
 335                         buffer_copy_string_len(ds->key, key, key_len);
 336                         buffer_copy_string(ds->value, value);
 337
 338                         array_insert_unique(con->response.headers, (data_unset *)ds);
 339
 340                         switch(key_len) {
 341                         case 4:
 342                                 if (0 == strncasecmp(key, "Date", key_len)) {
 343                                         con->parsed_response |= HTTP_DATE;
 344                                 }
 345                                 break;
 346                         case 6:
 347                                 if (0 == strncasecmp(key, "Status", key_len)) {
 348                                         int status = strtol(value, NULL, 10);
 349                                         if (status >= 100 && status < 1000) {
 350                                                 con->http_status = status;
 351                                                 con->parsed_response |= HTTP_STATUS;
 352                                         } else {
 353                                                 con->http_status = 502;
 354                                         }
 355                                 }
 356                                 break;
 357                         case 8:
 358                                 if (0 == strncasecmp(key, "Location", key_len)) {
 359                                         con->parsed_response |= HTTP_LOCATION;
 360                                 }
 361                                 break;
 362                         case 10:
 363                                 if (0 == strncasecmp(key, "Connection", key_len)) {
 364                                         con->response.keep_alive = (0 == strcasecmp(value, "Keep-Alive")) ? 1 : 0;
 365                                         con->parsed_response |= HTTP_CONNECTION;
 366                                 }
 367                                 break;
 368                         case 14:
 369                                 if (0 == strncasecmp(key, "Content-Length", key_len)) {
 370                                         con->response.content_length = strtoul(value, NULL, 10);
 371                                         con->parsed_response |= HTTP_CONTENT_LENGTH;
 372                                 }
 373                                 break;
 374                         default:
 375                                 break;
 376                         }
 377                 }
 378         }
 379
 380         /* CGI/1.1 rev 03 - 7.2.1.2 */
 381         if ((con->parsed_response & HTTP_LOCATION) &&
 382             !(con->parsed_response & HTTP_STATUS)) {
 383                 con->http_status = 302;
 384         }
 385
 386         return 0;
 387 }
 388
 389
 390 static int cgi_demux_response(server *srv, handler_ctx *hctx) {
 391         plugin_data *p    = hctx->plugin_data;
 392         connection  *con  = hctx->remote_conn;
 393
 394         while(1) {
 395                 int n;
 396                 int toread;
 397
 398 #if defined(__WIN32)
 399                 buffer_string_prepare_copy(hctx->response, 4 * 1024);
 400 #else
 401                 if (ioctl(hctx->fd, FIONREAD, &toread) || toread <= 4*1024) {
 402                         buffer_string_prepare_copy(hctx->response, 4 * 1024);
 403                 } else {
 404                         if (toread > MAX_READ_LIMIT) toread = MAX_READ_LIMIT;
 405                         buffer_string_prepare_copy(hctx->response, toread);
 406                 }
 407 #endif
 408
 409                 if (-1 == (n = read(hctx->fd, hctx->response->ptr, hctx->response->size - 1))) {
 410                         if (errno == EAGAIN || errno == EINTR) {
 411                                 /* would block, wait for signal */
 412                                 fdevent_event_add(srv->ev, &(hctx->fde_ndx), hctx->fd, FDEVENT_IN);
 413                                 return FDEVENT_HANDLED_NOT_FINISHED;
 414                         }
 415                         /* error */
 416                         log_error_write(srv, __FILE__, __LINE__, "sdd", strerror(errno), con->fd, hctx->fd);
 417                         return FDEVENT_HANDLED_ERROR;
 418                 }
 419
 420                 if (n == 0) {
 421                         /* read finished */
 422                         return FDEVENT_HANDLED_FINISHED;
 423                 }
 424
 425                 buffer_commit(hctx->response, n);
 426
 427                 /* split header from body */
 428
 429                 if (con->file_started == 0) {
 430                         int is_header = 0;
 431                         int is_header_end = 0;
 432                         size_t last_eol = 0;
 433                         size_t i, header_len;
 434
 435                         buffer_append_string_buffer(hctx->response_header, hctx->response);
 436
 437                         /**
 438                          * we have to handle a few cases:
 439                          *
 440                          * nph:
 441                          *
 442                          *   HTTP/1.0 200 Ok\n
 443                          *   Header: Value\n
 444                          *   \n
 445                          *
 446                          * CGI:
 447                          *   Header: Value\n
 448                          *   Status: 200\n
 449                          *   \n
 450                          *
 451                          * and different mixes of \n and \r\n combinations
 452                          *
 453                          * Some users also forget about CGI and just send a response and hope
 454                          * we handle it. No headers, no header-content seperator
 455                          *
 456                          */
 457
 458                         /* nph (non-parsed headers) */
 459                         if (0 == strncmp(hctx->response_header->ptr, "HTTP/1.", 7)) is_header = 1;
 460
 461                         header_len = buffer_string_length(hctx->response_header);
 462                         for (i = 0; !is_header_end && i < header_len; i++) {
 463                                 char c = hctx->response_header->ptr[i];
 464
 465                                 switch (c) {
 466                                 case ':':
 467                                         /* we found a colon
 468                                          *
 469                                          * looks like we have a normal header
 470                                          */
 471                                         is_header = 1;
 472                                         break;
 473                                 case '\n':
 474                                         /* EOL */
 475                                         if (is_header == 0) {
 476                                                 /* we got a EOL but we don't seem to got a HTTP header */
 477
 478                                                 is_header_end = 1;
 479
 480                                                 break;
 481                                         }
 482
 483                                         /**
 484                                          * check if we saw a \n(\r)?\n sequence
 485                                          */
 486                                         if (last_eol > 0 &&
 487                                             ((i - last_eol == 1) ||
 488                                              (i - last_eol == 2 && hctx->response_header->ptr[i - 1] == '\r'))) {
 489                                                 is_header_end = 1;
 490                                                 break;
 491                                         }
 492
 493                                         last_eol = i;
 494
 495                                         break;
 496                                 }
 497                         }
 498
 499                         if (is_header_end) {
 500                                 if (!is_header) {
 501                                         /* no header, but a body */
 502                                         if (0 != http_chunk_append_buffer(srv, con, hctx->response_header)) {
 503                                                 return FDEVENT_HANDLED_ERROR;
 504                                         }
 505                                 } else {
 506                                         const char *bstart;
 507                                         size_t blen;
 508
 509                                         /* the body starts after the EOL */
 510                                         bstart = hctx->response_header->ptr + i;
 511                                         blen = header_len - i;
 512
 513                                         /**
 514                                          * i still points to the char after the terminating EOL EOL
 515                                          *
 516                                          * put it on the last \n again
 517                                          */
 518                                         i--;
 519
 520                                         /* string the last \r?\n */
 521                                         if (i > 0 && (hctx->response_header->ptr[i - 1] == '\r')) {
 522                                                 i--;
 523                                         }
 524
 525                                         buffer_string_set_length(hctx->response_header, i);
 526
 527                                         /* parse the response header */
 528                                         cgi_response_parse(srv, con, p, hctx->response_header);
 529
 530                                         if (con->http_status >= 300 && con->http_status < 400) {
 531                                                 /*(con->parsed_response & HTTP_LOCATION)*/
 532                                                 size_t ulen = buffer_string_length(con->uri.path);
 533                                                 data_string *ds;
 534                                                 if (NULL != (ds = (data_string *) array_get_element(con->response.headers, "Location"))
 535                                                     && ds->value->ptr[0] == '/'
 536                                                     && (0 != strncmp(ds->value->ptr, con->uri.path->ptr, ulen)
 537                                                         || (ds->value->ptr[ulen] != '\0' && ds->value->ptr[ulen] != '/' && ds->value->ptr[ulen] != '?'))
 538                                                     && NULL == array_get_element(con->response.headers, "Set-Cookie")) {
 539                                                         if (++con->loops_per_request > 5) {
 540                                                                 log_error_write(srv, __FILE__, __LINE__, "sb", "too many internal loops while processing request:", con->request.orig_uri);
 541                                                                 con->http_status = 500; /* Internal Server Error */
 542                                                                 con->mode = DIRECT;
 543                                                                 return FDEVENT_HANDLED_FINISHED;
 544                                                         }
 545
 546                                                         buffer_copy_buffer(con->request.uri, ds->value);
 547
 548                                                         if (con->request.content_length) {
 549                                                                 if (con->request.content_length != con->request_content_queue->bytes_in) {
 550                                                                         con->keep_alive = 0;
 551                                                                 }
 552                                                                 con->request.content_length = 0;
 553                                                                 chunkqueue_reset(con->request_content_queue);
 554                                                         }
 555
 556                                                         if (con->http_status != 307 && con->http_status != 308) {
 557                                                                 /* Note: request body (if any) sent to initial dynamic handler
 558                                                                  * and is not available to the internal redirect */
 559                                                                 con->request.http_method = HTTP_METHOD_GET;
 560                                                         }
 561
 562                                                         connection_response_reset(srv, con); /*(includes con->http_status = 0)*/
 563
 564                                                         con->mode = DIRECT;
 565                                                         return FDEVENT_HANDLED_COMEBACK;
 566                                                 }
 567                                         }
 568
 569                                         if (hctx->conf.xsendfile_allow) {
 570                                                 data_string *ds;
 571                                                 if (NULL != (ds = (data_string *) array_get_element(con->response.headers, "X-Sendfile"))) {
 572                                                         http_response_xsendfile(srv, con, ds->value, hctx->conf.xsendfile_docroot);
 573                                                         return FDEVENT_HANDLED_FINISHED;
 574                                                 }
 575                                         }
 576
 577                                         if (blen > 0) {
 578                                                 if (0 != http_chunk_append_mem(srv, con, bstart, blen)) {
 579                                                         return FDEVENT_HANDLED_ERROR;
 580                                                 }
 581                                         }
 582                                 }
 583
 584                                 con->file_started = 1;
 585                         } else {
 586                                 /*(reuse MAX_HTTP_REQUEST_HEADER as max size for response headers from backends)*/
 587                                 if (header_len > MAX_HTTP_REQUEST_HEADER) {
 588                                         log_error_write(srv, __FILE__, __LINE__, "sb", "response headers too large for", con->uri.path);
 589                                         con->http_status = 502; /* Bad Gateway */
 590                                         con->mode = DIRECT;
 591                                         return FDEVENT_HANDLED_FINISHED;
 592                                 }
 593                         }
 594                 } else {
 595                         if (0 != http_chunk_append_buffer(srv, con, hctx->response)) {
 596                                 return FDEVENT_HANDLED_ERROR;
 597                         }
 598                         if ((con->conf.stream_response_body & FDEVENT_STREAM_RESPONSE_BUFMIN)
 599                             && chunkqueue_length(con->write_queue) > 65536 - 4096) {
 600                                 if (!con->is_writable) {
 601                                         /*(defer removal of FDEVENT_IN interest since
 602                                          * connection_state_machine() might be able to send data
 603                                          * immediately, unless !con->is_writable, where
 604                                          * connection_state_machine() might not loop back to call
 605                                          * mod_cgi_handle_subrequest())*/
 606                                         fdevent_event_clr(srv->ev, &(hctx->fde_ndx), hctx->fd, FDEVENT_IN);
 607                                 }
 608                                 break;
 609                         }
 610                 }
 611
 612 #if 0
 613                 log_error_write(srv, __FILE__, __LINE__, "ddss", con->fd, hctx->fd, connection_get_state(con->state), b->ptr);
 614 #endif
 615         }
 616
 617         return FDEVENT_HANDLED_NOT_FINISHED;
 618 }
 619
 620 static void cgi_connection_close_fdtocgi(server *srv, handler_ctx *hctx) {
 621         /*(closes only hctx->fdtocgi)*/
 622         fdevent_event_del(srv->ev, &(hctx->fde_ndx_tocgi), hctx->fdtocgi);
 623         fdevent_unregister(srv->ev, hctx->fdtocgi);
 624         fdevent_sched_close(srv->ev, hctx->fdtocgi, 0);
 625         hctx->fdtocgi = -1;
 626 }
 627
 628 static void cgi_connection_close(server *srv, handler_ctx *hctx) {
 629         int status;
 630         pid_t pid;
 631         plugin_data *p = hctx->plugin_data;
 632         connection *con = hctx->remote_conn;
 633
 634 #ifndef __WIN32
 635
 636         /* the connection to the browser went away, but we still have a connection
 637          * to the CGI script
 638          *
 639          * close cgi-connection
 640          */
 641
 642         if (hctx->fd != -1) {
 643                 /* close connection to the cgi-script */
 644                 fdevent_event_del(srv->ev, &(hctx->fde_ndx), hctx->fd);
 645                 fdevent_unregister(srv->ev, hctx->fd);
 646                 fdevent_sched_close(srv->ev, hctx->fd, 0);
 647         }
 648
 649         if (hctx->fdtocgi != -1) {
 650                 cgi_connection_close_fdtocgi(srv, hctx); /*(closes only hctx->fdtocgi)*/
 651         }
 652
 653         pid = hctx->pid;
 654
 655         con->plugin_ctx[p->id] = NULL;
 656
 657         cgi_handler_ctx_free(hctx);
 658
 659         /* if waitpid hasn't been called by response.c yet, do it here */
 660         if (pid) {
 661                 /* check if the CGI-script is already gone */
 662                 switch(waitpid(pid, &status, WNOHANG)) {
 663                 case 0:
 664                         /* not finished yet */
 665 #if 0
 666                         log_error_write(srv, __FILE__, __LINE__, "sd", "(debug) child isn't done yet, pid:", pid);
 667 #endif
 668                         break;
 669                 case -1:
 670                         /* */
 671                         if (errno == EINTR) break;
 672
 673                         /*
 674                          * errno == ECHILD happens if _subrequest catches the process-status before
 675                          * we have read the response of the cgi process
 676                          *
 677                          * -> catch status
 678                          * -> WAIT_FOR_EVENT
 679                          * -> read response
 680                          * -> we get here with waitpid == ECHILD
 681                          *
 682                          */
 683                         if (errno != ECHILD) {
 684                                 log_error_write(srv, __FILE__, __LINE__, "ss", "waitpid failed: ", strerror(errno));
 685                         }
 686                         /* anyway: don't wait for it anymore */
 687                         pid = 0;
 688                         break;
 689                 default:
 690                         if (WIFEXITED(status)) {
 691 #if 0
 692                                 log_error_write(srv, __FILE__, __LINE__, "sd", "(debug) cgi exited fine, pid:", pid);
 693 #endif
 694                         } else {
 695                                 log_error_write(srv, __FILE__, __LINE__, "sd", "cgi died, pid:", pid);
 696                         }
 697
 698                         pid = 0;
 699                         break;
 700                 }
 701
 702                 if (pid) {
 703                         kill(pid, SIGTERM);
 704
 705                         /* cgi-script is still alive, queue the PID for removal */
 706                         cgi_pid_add(srv, p, pid);
 707                 }
 708         }
 709 #endif
 710
 711         /* finish response (if not already con->file_started, con->file_finished) */
 712         if (con->mode == p->id) {
 713                 http_response_backend_done(srv, con);
 714         }
 715 }
 716
 717 static handler_t cgi_connection_close_callback(server *srv, connection *con, void *p_d) {
 718         plugin_data *p = p_d;
 719         handler_ctx *hctx = con->plugin_ctx[p->id];
 720         if (hctx) cgi_connection_close(srv, hctx);
 721
 722         return HANDLER_GO_ON;
 723 }
 724
 725
 726 static int cgi_write_request(server *srv, handler_ctx *hctx, int fd);
 727
 728
 729 static handler_t cgi_handle_fdevent_send (server *srv, void *ctx, int revents) {
 730         handler_ctx *hctx = ctx;
 731         connection  *con  = hctx->remote_conn;
 732
 733         /*(joblist only actually necessary here in mod_cgi fdevent send if returning HANDLER_ERROR)*/
 734         joblist_append(srv, con);
 735
 736         if (revents & FDEVENT_OUT) {
 737                 if (0 != cgi_write_request(srv, hctx, hctx->fdtocgi)) {
 738                         cgi_connection_close(srv, hctx);
 739                         return HANDLER_ERROR;
 740                 }
 741                 /* more request body to be sent to CGI */
 742         }
 743
 744         if (revents & FDEVENT_HUP) {
 745                 /* skip sending remaining data to CGI */
 746                 if (con->request.content_length) {
 747                         chunkqueue *cq = con->request_content_queue;
 748                         chunkqueue_mark_written(cq, chunkqueue_length(cq));
 749                         if (cq->bytes_in != (off_t)con->request.content_length) {
 750                                 con->keep_alive = 0;
 751                         }
 752                 }
 753
 754                 cgi_connection_close_fdtocgi(srv, hctx); /*(closes only hctx->fdtocgi)*/
 755         } else if (revents & FDEVENT_ERR) {
 756                 /* kill all connections to the cgi process */
 757 #if 1
 758                 log_error_write(srv, __FILE__, __LINE__, "s", "cgi-FDEVENT_ERR");
 759 #endif
 760                 cgi_connection_close(srv, hctx);
 761                 return HANDLER_ERROR;
 762         }
 763
 764         return HANDLER_FINISHED;
 765 }
 766
 767
 768 static int cgi_recv_response(server *srv, handler_ctx *hctx) {
 769                 switch (cgi_demux_response(srv, hctx)) {
 770                 case FDEVENT_HANDLED_NOT_FINISHED:
 771                         break;
 772                 case FDEVENT_HANDLED_FINISHED:
 773                         /* we are done */
 774
 775 #if 0
 776                         log_error_write(srv, __FILE__, __LINE__, "ddss", con->fd, hctx->fd, connection_get_state(con->state), "finished");
 777 #endif
 778                         cgi_connection_close(srv, hctx);
 779
 780                         /* if we get a IN|HUP and have read everything don't exec the close twice */
 781                         return HANDLER_FINISHED;
 782                 case FDEVENT_HANDLED_COMEBACK:
 783                         cgi_connection_close(srv, hctx);
 784                         return HANDLER_COMEBACK;
 785                 case FDEVENT_HANDLED_ERROR:
 786                         log_error_write(srv, __FILE__, __LINE__, "s", "demuxer failed: ");
 787
 788                         cgi_connection_close(srv, hctx);
 789                         return HANDLER_FINISHED;
 790                 }
 791
 792                 return HANDLER_GO_ON;
 793 }
 794
 795
 796 static handler_t cgi_handle_fdevent(server *srv, void *ctx, int revents) {
 797         handler_ctx *hctx = ctx;
 798         connection  *con  = hctx->remote_conn;
 799
 800         joblist_append(srv, con);
 801
 802         if (revents & FDEVENT_IN) {
 803                 handler_t rc = cgi_recv_response(srv, hctx);/*(might invalidate hctx)*/
 804                 if (rc != HANDLER_GO_ON) return rc;         /*(unless HANDLER_GO_ON)*/
 805         }
 806
 807         /* perhaps this issue is already handled */
 808         if (revents & FDEVENT_HUP) {
 809                 if (con->file_started) {
 810                         /* drain any remaining data from kernel pipe buffers
 811                          * even if (con->conf.stream_response_body
 812                          *          & FDEVENT_STREAM_RESPONSE_BUFMIN)
 813                          * since event loop will spin on fd FDEVENT_HUP event
 814                          * until unregistered. */
 815                         handler_t rc;
 816                         do {
 817                                 rc = cgi_recv_response(srv,hctx);/*(might invalidate hctx)*/
 818                         } while (rc == HANDLER_GO_ON);           /*(unless HANDLER_GO_ON)*/
 819                         return rc; /* HANDLER_FINISHED or HANDLER_COMEBACK or HANDLER_ERROR */
 820                 } else if (!buffer_string_is_empty(hctx->response_header)) {
 821                         /* unfinished header package which is a body in reality */
 822                         con->file_started = 1;
 823                         if (0 != http_chunk_append_buffer(srv, con, hctx->response_header)) {
 824                                 cgi_connection_close(srv, hctx);
 825                                 return HANDLER_ERROR;
 826                         }
 827                 } else {
 828 # if 0
 829                         log_error_write(srv, __FILE__, __LINE__, "sddd", "got HUP from cgi", con->fd, hctx->fd, revents);
 830 # endif
 831                 }
 832                 cgi_connection_close(srv, hctx);
 833         } else if (revents & FDEVENT_ERR) {
 834                 /* kill all connections to the cgi process */
 835                 cgi_connection_close(srv, hctx);
 836 #if 1
 837                 log_error_write(srv, __FILE__, __LINE__, "s", "cgi-FDEVENT_ERR");
 838 #endif
 839                 return HANDLER_ERROR;
 840         }
 841
 842         return HANDLER_FINISHED;
 843 }
 844
 845
 846 static int cgi_env_add(void *venv, const char *key, size_t key_len, const char *val, size_t val_len) {
 847         char_array *env = venv;
 848         char *dst;
 849
 850         if (!key || !val) return -1;
 851
 852         dst = malloc(key_len + val_len + 2);
 853         force_assert(dst);
 854         memcpy(dst, key, key_len);
 855         dst[key_len] = '=';
 856         memcpy(dst + key_len + 1, val, val_len);
 857         dst[key_len + 1 + val_len] = '\0';
 858
 859         if (env->size == 0) {
 860                 env->size = 16;
 861                 env->ptr = malloc(env->size * sizeof(*env->ptr));
 862                 force_assert(env->ptr);
 863         } else if (env->size == env->used) {
 864                 env->size += 16;
 865                 env->ptr = realloc(env->ptr, env->size * sizeof(*env->ptr));
 866                 force_assert(env->ptr);
 867         }
 868
 869         env->ptr[env->used++] = dst;
 870
 871         return 0;
 872 }
 873
 874 /*(improved from network_write_mmap.c)*/
 875 static off_t mmap_align_offset(off_t start) {
 876     static off_t pagemask = 0;
 877     if (0 == pagemask) {
 878         long pagesize = sysconf(_SC_PAGESIZE);
 879         if (-1 == pagesize) pagesize = 4096;
 880         pagemask = ~((off_t)pagesize - 1); /* pagesize always power-of-2 */
 881     }
 882     return (start & pagemask);
 883 }
 884
 885 /* returns: 0: continue, -1: fatal error, -2: connection reset */
 886 /* similar to network_write_file_chunk_mmap, but doesn't use send on windows (because we're on pipes),
 887  * also mmaps and sends complete chunk instead of only small parts - the files
 888  * are supposed to be temp files with reasonable chunk sizes.
 889  *
 890  * Also always use mmap; the files are "trusted", as we created them.
 891  */
 892 static ssize_t cgi_write_file_chunk_mmap(server *srv, connection *con, int fd, chunkqueue *cq) {
 893         chunk* const c = cq->first;
 894         off_t offset, toSend, file_end;
 895         ssize_t r;
 896         size_t mmap_offset, mmap_avail;
 897         char *data;
 898
 899         force_assert(NULL != c);
 900         force_assert(FILE_CHUNK == c->type);
 901         force_assert(c->offset >= 0 && c->offset <= c->file.length);
 902
 903         offset = c->file.start + c->offset;
 904         toSend = c->file.length - c->offset;
 905         file_end = c->file.start + c->file.length; /* offset to file end in this chunk */
 906
 907         if (0 == toSend) {
 908                 chunkqueue_remove_finished_chunks(cq);
 909                 return 0;
 910         }
 911
 912         /*(simplified from network_write_no_mmap.c:network_open_file_chunk())*/
 913         UNUSED(con);
 914         if (-1 == c->file.fd) {
 915                 if (-1 == (c->file.fd = fdevent_open_cloexec(c->file.name->ptr, O_RDONLY, 0))) {
 916                         log_error_write(srv, __FILE__, __LINE__, "ssb", "open failed:", strerror(errno), c->file.name);
 917                         return -1;
 918                 }
 919         }
 920
 921         /* (re)mmap the buffer if range is not covered completely */
 922         if (MAP_FAILED == c->file.mmap.start
 923                 || offset < c->file.mmap.offset
 924                 || file_end > (off_t)(c->file.mmap.offset + c->file.mmap.length)) {
 925
 926                 if (MAP_FAILED != c->file.mmap.start) {
 927                         munmap(c->file.mmap.start, c->file.mmap.length);
 928                         c->file.mmap.start = MAP_FAILED;
 929                 }
 930
 931                 c->file.mmap.offset = mmap_align_offset(offset);
 932                 c->file.mmap.length = file_end - c->file.mmap.offset;
 933
 934                 if (MAP_FAILED == (c->file.mmap.start = mmap(NULL, c->file.mmap.length, PROT_READ, MAP_PRIVATE, c->file.fd, c->file.mmap.offset))) {
 935                         if (toSend > 65536) toSend = 65536;
 936                         data = malloc(toSend);
 937                         force_assert(data);
 938                         if (-1 == lseek(c->file.fd, offset, SEEK_SET)
 939                             || 0 >= (toSend = read(c->file.fd, data, toSend))) {
 940                                 if (-1 == toSend) {
 941                                         log_error_write(srv, __FILE__, __LINE__, "ssbdo", "lseek/read failed:",
 942                                                 strerror(errno), c->file.name, c->file.fd, offset);
 943                                 } else { /*(0 == toSend)*/
 944                                         log_error_write(srv, __FILE__, __LINE__, "sbdo", "unexpected EOF (input truncated?):",
 945                                                 c->file.name, c->file.fd, offset);
 946                                 }
 947                                 free(data);
 948                                 return -1;
 949                         }
 950                 }
 951         }
 952
 953         if (MAP_FAILED != c->file.mmap.start) {
 954                 force_assert(offset >= c->file.mmap.offset);
 955                 mmap_offset = offset - c->file.mmap.offset;
 956                 force_assert(c->file.mmap.length > mmap_offset);
 957                 mmap_avail = c->file.mmap.length - mmap_offset;
 958                 force_assert(toSend <= (off_t) mmap_avail);
 959
 960                 data = c->file.mmap.start + mmap_offset;
 961         }
 962
 963         r = write(fd, data, toSend);
 964
 965         if (MAP_FAILED == c->file.mmap.start) free(data);
 966
 967         if (r < 0) {
 968                 switch (errno) {
 969                 case EAGAIN:
 970                 case EINTR:
 971                         return 0;
 972                 case EPIPE:
 973                 case ECONNRESET:
 974                         return -2;
 975                 default:
 976                         log_error_write(srv, __FILE__, __LINE__, "ssd",
 977                                 "write failed:", strerror(errno), fd);
 978                         return -1;
 979                 }
 980         }
 981
 982         if (r >= 0) {
 983                 chunkqueue_mark_written(cq, r);
 984         }
 985
 986         return r;
 987 }
 988
 989 static int cgi_write_request(server *srv, handler_ctx *hctx, int fd) {
 990         connection *con = hctx->remote_conn;
 991         chunkqueue *cq = con->request_content_queue;
 992         chunk *c;
 993
 994         /* old comment: windows doesn't support select() on pipes - wouldn't be easy to fix for all platforms.
 995          * solution: if this is still a problem on windows, then substitute
 996          * socketpair() for pipe() and closesocket() for close() on windows.
 997          */
 998
 999         for (c = cq->first; c; c = cq->first) {
1000                 ssize_t r = -1;
1001
1002                 switch(c->type) {
1003                 case FILE_CHUNK:
1004                         r = cgi_write_file_chunk_mmap(srv, con, fd, cq);
1005                         break;
1006
1007                 case MEM_CHUNK:
1008                         if ((r = write(fd, c->mem->ptr + c->offset, buffer_string_length(c->mem) - c->offset)) < 0) {
1009                                 switch(errno) {
1010                                 case EAGAIN:
1011                                 case EINTR:
1012                                         /* ignore and try again */
1013                                         r = 0;
1014                                         break;
1015                                 case EPIPE:
1016                                 case ECONNRESET:
1017                                         /* connection closed */
1018                                         r = -2;
1019                                         break;
1020                                 default:
1021                                         /* fatal error */
1022                                         log_error_write(srv, __FILE__, __LINE__, "ss", "write failed due to: ", strerror(errno));
1023                                         r = -1;
1024                                         break;
1025                                 }
1026                         } else if (r > 0) {
1027                                 chunkqueue_mark_written(cq, r);
1028                         }
1029                         break;
1030                 }
1031
1032                 if (0 == r) break; /*(might block)*/
1033
1034                 switch (r) {
1035                 case -1:
1036                         /* fatal error */
1037                         return -1;
1038                 case -2:
1039                         /* connection reset */
1040                         log_error_write(srv, __FILE__, __LINE__, "s", "failed to send post data to cgi, connection closed by CGI");
1041                         /* skip all remaining data */
1042                         chunkqueue_mark_written(cq, chunkqueue_length(cq));
1043                         break;
1044                 default:
1045                         break;
1046                 }
1047         }
1048
1049         if (cq->bytes_out == (off_t)con->request.content_length) {
1050                 /* sent all request body input */
1051                 /* close connection to the cgi-script */
1052                 if (-1 == hctx->fdtocgi) { /*(received request body sent in initial send to pipe buffer)*/
1053                         --srv->cur_fds;
1054                         if (close(fd)) {
1055                                 log_error_write(srv, __FILE__, __LINE__, "sds", "cgi stdin close failed ", fd, strerror(errno));
1056                         }
1057                 } else {
1058                         cgi_connection_close_fdtocgi(srv, hctx); /*(closes only hctx->fdtocgi)*/
1059                 }
1060         } else {
1061                 off_t cqlen = cq->bytes_in - cq->bytes_out;
1062                 if (cq->bytes_in != con->request.content_length && cqlen < 65536 - 16384) {
1063                         /*(con->conf.stream_request_body & FDEVENT_STREAM_REQUEST)*/
1064                         if (!(con->conf.stream_request_body & FDEVENT_STREAM_REQUEST_POLLIN)) {
1065                                 con->conf.stream_request_body |= FDEVENT_STREAM_REQUEST_POLLIN;
1066                                 con->is_readable = 1; /* trigger optimistic read from client */
1067                         }
1068                 }
1069                 if (-1 == hctx->fdtocgi) { /*(not registered yet)*/
1070                         hctx->fdtocgi = fd;
1071                         hctx->fde_ndx_tocgi = -1;
1072                         fdevent_register(srv->ev, hctx->fdtocgi, cgi_handle_fdevent_send, hctx);
1073                 }
1074                 if (0 == cqlen) { /*(chunkqueue_is_empty(cq))*/
1075                         if ((fdevent_event_get_interest(srv->ev, hctx->fdtocgi) & FDEVENT_OUT)) {
1076                                 fdevent_event_set(srv->ev, &(hctx->fde_ndx_tocgi), hctx->fdtocgi, 0);
1077                         }
1078                 } else {
1079                         /* more request body remains to be sent to CGI so register for fdevents */
1080                         fdevent_event_set(srv->ev, &(hctx->fde_ndx_tocgi), hctx->fdtocgi, FDEVENT_OUT);
1081                 }
1082         }
1083
1084         return 0;
1085 }
1086
1087 static int cgi_create_env(server *srv, connection *con, plugin_data *p, handler_ctx *hctx, buffer *cgi_handler) {
1088         pid_t pid;
1089
1090         int to_cgi_fds[2];
1091         int from_cgi_fds[2];
1092         struct stat st;
1093         UNUSED(p);
1094
1095 #ifndef __WIN32
1096
1097         if (!buffer_string_is_empty(cgi_handler)) {
1098                 /* stat the exec file */
1099                 if (-1 == (stat(cgi_handler->ptr, &st))) {
1100                         log_error_write(srv, __FILE__, __LINE__, "sbss",
1101                                         "stat for cgi-handler", cgi_handler,
1102                                         "failed:", strerror(errno));
1103                         return -1;
1104                 }
1105         }
1106
1107         if (pipe_cloexec(to_cgi_fds)) {
1108                 log_error_write(srv, __FILE__, __LINE__, "ss", "pipe failed:", strerror(errno));
1109                 return -1;
1110         }
1111
1112         if (pipe_cloexec(from_cgi_fds)) {
1113                 close(to_cgi_fds[0]);
1114                 close(to_cgi_fds[1]);
1115                 log_error_write(srv, __FILE__, __LINE__, "ss", "pipe failed:", strerror(errno));
1116                 return -1;
1117         }
1118
1119         /* fork, execve */
1120         switch (pid = fork()) {
1121         case 0: {
1122                 /* child */
1123                 char **args;
1124                 int argc;
1125                 int i = 0;
1126                 char_array env;
1127                 char *c;
1128                 const char *s;
1129                 http_cgi_opts opts = { 0, 0, NULL, NULL };
1130
1131                 /* move stdout to from_cgi_fd[1] */
1132                 dup2(from_cgi_fds[1], STDOUT_FILENO);
1133               #ifndef FD_CLOEXEC
1134                 close(from_cgi_fds[1]);
1135                 /* not needed */
1136                 close(from_cgi_fds[0]);
1137               #endif
1138
1139                 /* move the stdin to to_cgi_fd[0] */
1140                 dup2(to_cgi_fds[0], STDIN_FILENO);
1141               #ifndef FD_CLOEXEC
1142                 close(to_cgi_fds[0]);
1143                 /* not needed */
1144                 close(to_cgi_fds[1]);
1145               #endif
1146
1147                 /* create environment */
1148                 env.ptr = NULL;
1149                 env.size = 0;
1150                 env.used = 0;
1151
1152                 http_cgi_headers(srv, con, &opts, cgi_env_add, &env);
1153
1154                 /* for valgrind */
1155                 if (NULL != (s = getenv("LD_PRELOAD"))) {
1156                         cgi_env_add(&env, CONST_STR_LEN("LD_PRELOAD"), s, strlen(s));
1157                 }
1158
1159                 if (NULL != (s = getenv("LD_LIBRARY_PATH"))) {
1160                         cgi_env_add(&env, CONST_STR_LEN("LD_LIBRARY_PATH"), s, strlen(s));
1161                 }
1162 #ifdef __CYGWIN__
1163                 /* CYGWIN needs SYSTEMROOT */
1164                 if (NULL != (s = getenv("SYSTEMROOT"))) {
1165                         cgi_env_add(&env, CONST_STR_LEN("SYSTEMROOT"), s, strlen(s));
1166                 }
1167 #endif
1168
1169                 if (env.size == env.used) {
1170                         env.size += 16;
1171                         env.ptr = realloc(env.ptr, env.size * sizeof(*env.ptr));
1172                 }
1173
1174                 env.ptr[env.used] = NULL;
1175
1176                 /* set up args */
1177                 argc = 3;
1178                 args = malloc(sizeof(*args) * argc);
1179                 force_assert(args);
1180                 i = 0;
1181
1182                 if (!buffer_string_is_empty(cgi_handler)) {
1183                         args[i++] = cgi_handler->ptr;
1184                 }
1185                 args[i++] = con->physical.path->ptr;
1186                 args[i  ] = NULL;
1187
1188                 /* search for the last / */
1189                 if (NULL != (c = strrchr(con->physical.path->ptr, '/'))) {
1190                         /* handle special case of file in root directory */
1191                         const char* physdir = (c == con->physical.path->ptr) ? "/" : con->physical.path->ptr;
1192
1193                         /* temporarily shorten con->physical.path to directory without terminating '/' */
1194                         *c = '\0';
1195                         /* change to the physical directory */
1196                         if (-1 == chdir(physdir)) {
1197                                 log_error_write(srv, __FILE__, __LINE__, "ssb", "chdir failed:", strerror(errno), con->physical.path);
1198                         }
1199                         *c = '/';
1200                 }
1201
1202                 /* we don't need the client socket */
1203                 for (i = 3; i < 256; i++) {
1204                         if (i != srv->errorlog_fd) close(i);
1205                 }
1206
1207                 /* exec the cgi */
1208                 execve(args[0], args, env.ptr);
1209
1210                 /* most log files may have been closed/redirected by this point,
1211                  * though stderr might still point to lighttpd.breakage.log */
1212                 perror(args[0]);
1213                 _exit(1);
1214         }
1215         case -1:
1216                 /* error */
1217                 log_error_write(srv, __FILE__, __LINE__, "ss", "fork failed:", strerror(errno));
1218                 close(from_cgi_fds[0]);
1219                 close(from_cgi_fds[1]);
1220                 close(to_cgi_fds[0]);
1221                 close(to_cgi_fds[1]);
1222                 return -1;
1223         default: {
1224                 /* parent process */
1225
1226                 close(from_cgi_fds[1]);
1227                 close(to_cgi_fds[0]);
1228
1229                 /* register PID and wait for them asynchronously */
1230
1231                 hctx->pid = pid;
1232                 hctx->fd = from_cgi_fds[0];
1233                 hctx->fde_ndx = -1;
1234
1235                 ++srv->cur_fds;
1236
1237                 if (0 == con->request.content_length) {
1238                         close(to_cgi_fds[1]);
1239                 } else {
1240                         /* there is content to send */
1241                         if (-1 == fdevent_fcntl_set_nb(srv->ev, to_cgi_fds[1])) {
1242                                 log_error_write(srv, __FILE__, __LINE__, "ss", "fcntl failed: ", strerror(errno));
1243                                 close(to_cgi_fds[1]);
1244                                 cgi_connection_close(srv, hctx);
1245                                 return -1;
1246                         }
1247
1248                         if (0 != cgi_write_request(srv, hctx, to_cgi_fds[1])) {
1249                                 close(to_cgi_fds[1]);
1250                                 cgi_connection_close(srv, hctx);
1251                                 return -1;
1252                         }
1253
1254                         ++srv->cur_fds;
1255                 }
1256
1257                 fdevent_register(srv->ev, hctx->fd, cgi_handle_fdevent, hctx);
1258                 if (-1 == fdevent_fcntl_set_nb(srv->ev, hctx->fd)) {
1259                         log_error_write(srv, __FILE__, __LINE__, "ss", "fcntl failed: ", strerror(errno));
1260                         cgi_connection_close(srv, hctx);
1261                         return -1;
1262                 }
1263                 fdevent_event_set(srv->ev, &(hctx->fde_ndx), hctx->fd, FDEVENT_IN);
1264
1265                 break;
1266         }
1267         }
1268
1269         return 0;
1270 #else
1271         return -1;
1272 #endif
1273 }
1274
1275 static buffer * cgi_get_handler(array *a, buffer *fn) {
1276         size_t k, s_len = buffer_string_length(fn);
1277         for (k = 0; k < a->used; ++k) {
1278                 data_string *ds = (data_string *)a->data[k];
1279                 size_t ct_len = buffer_string_length(ds->key);
1280
1281                 if (buffer_is_empty(ds->key)) continue;
1282                 if (s_len < ct_len) continue;
1283
1284                 if (0 == strncmp(fn->ptr + s_len - ct_len, ds->key->ptr, ct_len)) {
1285                         return ds->value;
1286                 }
1287         }
1288
1289         return NULL;
1290 }
1291
1292 #define PATCH(x) \
1293         p->conf.x = s->x;
1294 static int mod_cgi_patch_connection(server *srv, connection *con, plugin_data *p) {
1295         size_t i, j;
1296         plugin_config *s = p->config_storage[0];
1297
1298         PATCH(cgi);
1299         PATCH(execute_x_only);
1300         PATCH(xsendfile_allow);
1301         PATCH(xsendfile_docroot);
1302
1303         /* skip the first, the global context */
1304         for (i = 1; i < srv->config_context->used; i++) {
1305                 data_config *dc = (data_config *)srv->config_context->data[i];
1306                 s = p->config_storage[i];
1307
1308                 /* condition didn't match */
1309                 if (!config_check_cond(srv, con, dc)) continue;
1310
1311                 /* merge config */
1312                 for (j = 0; j < dc->value->used; j++) {
1313                         data_unset *du = dc->value->data[j];
1314
1315                         if (buffer_is_equal_string(du->key, CONST_STR_LEN("cgi.assign"))) {
1316                                 PATCH(cgi);
1317                         } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("cgi.execute-x-only"))) {
1318                                 PATCH(execute_x_only);
1319                         } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("cgi.x-sendfile"))) {
1320                                 PATCH(xsendfile_allow);
1321                         } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("cgi.x-sendfile-docroot"))) {
1322                                 PATCH(xsendfile_docroot);
1323                         }
1324                 }
1325         }
1326
1327         return 0;
1328 }
1329 #undef PATCH
1330
1331 URIHANDLER_FUNC(cgi_is_handled) {
1332         plugin_data *p = p_d;
1333         buffer *fn = con->physical.path;
1334         stat_cache_entry *sce = NULL;
1335         struct stat stbuf;
1336         struct stat *st;
1337         buffer *cgi_handler;
1338
1339         if (con->mode != DIRECT) return HANDLER_GO_ON;
1340
1341         if (buffer_is_empty(fn)) return HANDLER_GO_ON;
1342
1343         mod_cgi_patch_connection(srv, con, p);
1344
1345         if (HANDLER_ERROR != stat_cache_get_entry(srv, con, con->physical.path, &sce)) {
1346                 st = &sce->st;
1347         } else {
1348                 /* CGI might be executable even if it is not readable
1349                  * (stat_cache_get_entry() currently checks file is readable)*/
1350                 if (0 != stat(con->physical.path->ptr, &stbuf)) return HANDLER_GO_ON;
1351                 st = &stbuf;
1352         }
1353
1354         if (!S_ISREG(st->st_mode)) return HANDLER_GO_ON;
1355         if (p->conf.execute_x_only == 1 && (st->st_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0) return HANDLER_GO_ON;
1356
1357         if (NULL != (cgi_handler = cgi_get_handler(p->conf.cgi, fn))) {
1358                 handler_ctx *hctx = cgi_handler_ctx_init();
1359                 hctx->remote_conn = con;
1360                 hctx->plugin_data = p;
1361                 hctx->cgi_handler = cgi_handler;
1362                 memcpy(&hctx->conf, &p->conf, sizeof(plugin_config));
1363                 con->plugin_ctx[p->id] = hctx;
1364                 con->mode = p->id;
1365         }
1366
1367         return HANDLER_GO_ON;
1368 }
1369
1370 TRIGGER_FUNC(cgi_trigger) {
1371         plugin_data *p = p_d;
1372         size_t ndx;
1373         /* the trigger handle only cares about lonely PID which we have to wait for */
1374 #ifndef __WIN32
1375
1376         for (ndx = 0; ndx < p->cgi_pid.used; ndx++) {
1377                 int status;
1378
1379                 switch(waitpid(p->cgi_pid.ptr[ndx], &status, WNOHANG)) {
1380                 case 0:
1381                         /* not finished yet */
1382 #if 0
1383                         log_error_write(srv, __FILE__, __LINE__, "sd", "(debug) child isn't done yet, pid:", p->cgi_pid.ptr[ndx]);
1384 #endif
1385                         break;
1386                 case -1:
1387                         if (errno == ECHILD) {
1388                                 /* someone else called waitpid... remove the pid to stop looping the error each time */
1389                                 log_error_write(srv, __FILE__, __LINE__, "s", "cgi child vanished, probably someone else called waitpid");
1390
1391                                 cgi_pid_del(srv, p, p->cgi_pid.ptr[ndx]);
1392                                 ndx--;
1393                                 continue;
1394                         }
1395
1396                         log_error_write(srv, __FILE__, __LINE__, "ss", "waitpid failed: ", strerror(errno));
1397
1398                         return HANDLER_ERROR;
1399                 default:
1400
1401                         if (WIFEXITED(status)) {
1402 #if 0
1403                                 log_error_write(srv, __FILE__, __LINE__, "sd", "(debug) cgi exited fine, pid:", p->cgi_pid.ptr[ndx]);
1404 #endif
1405                         } else if (WIFSIGNALED(status)) {
1406                                 /* FIXME: what if we killed the CGI script with a kill(..., SIGTERM) ?
1407                                  */
1408                                 if (WTERMSIG(status) != SIGTERM) {
1409                                         log_error_write(srv, __FILE__, __LINE__, "sd", "cleaning up CGI: process died with signal", WTERMSIG(status));
1410                                 }
1411                         } else {
1412                                 log_error_write(srv, __FILE__, __LINE__, "s", "cleaning up CGI: ended unexpectedly");
1413                         }
1414
1415                         cgi_pid_del(srv, p, p->cgi_pid.ptr[ndx]);
1416                         /* del modified the buffer structure
1417                          * and copies the last entry to the current one
1418                          * -> recheck the current index
1419                          */
1420                         ndx--;
1421                 }
1422         }
1423 #endif
1424         return HANDLER_GO_ON;
1425 }
1426
1427 /*
1428  * - HANDLER_GO_ON : not our job
1429  * - HANDLER_FINISHED: got response
1430  * - HANDLER_WAIT_FOR_EVENT: waiting for response
1431  */
1432 SUBREQUEST_FUNC(mod_cgi_handle_subrequest) {
1433         plugin_data *p = p_d;
1434         handler_ctx *hctx = con->plugin_ctx[p->id];
1435         chunkqueue *cq = con->request_content_queue;
1436
1437         if (con->mode != p->id) return HANDLER_GO_ON;
1438         if (NULL == hctx) return HANDLER_GO_ON;
1439
1440         if ((con->conf.stream_response_body & FDEVENT_STREAM_RESPONSE_BUFMIN)
1441             && con->file_started) {
1442                 if (chunkqueue_length(con->write_queue) > 65536 - 4096) {
1443                         fdevent_event_clr(srv->ev, &(hctx->fde_ndx), hctx->fd, FDEVENT_IN);
1444                 } else if (!(fdevent_event_get_interest(srv->ev, hctx->fd) & FDEVENT_IN)) {
1445                         /* optimistic read from backend, which might re-enable FDEVENT_IN */
1446                         handler_t rc = cgi_recv_response(srv, hctx); /*(might invalidate hctx)*/
1447                         if (rc != HANDLER_GO_ON) return rc;          /*(unless HANDLER_GO_ON)*/
1448                 }
1449         }
1450
1451         if (cq->bytes_in != (off_t)con->request.content_length) {
1452                 /*(64k - 4k to attempt to avoid temporary files
1453                  * in conjunction with FDEVENT_STREAM_REQUEST_BUFMIN)*/
1454                 if (cq->bytes_in - cq->bytes_out > 65536 - 4096
1455                     && (con->conf.stream_request_body & FDEVENT_STREAM_REQUEST_BUFMIN)){
1456                         con->conf.stream_request_body &= ~FDEVENT_STREAM_REQUEST_POLLIN;
1457                         if (-1 != hctx->fd) return HANDLER_WAIT_FOR_EVENT;
1458                 } else {
1459                         handler_t r = connection_handle_read_post_state(srv, con);
1460                         if (!chunkqueue_is_empty(cq)) {
1461                                 if (fdevent_event_get_interest(srv->ev, hctx->fdtocgi) & FDEVENT_OUT) {
1462                                         return (r == HANDLER_GO_ON) ? HANDLER_WAIT_FOR_EVENT : r;
1463                                 }
1464                         }
1465                         if (r != HANDLER_GO_ON) return r;
1466
1467                         /* CGI environment requires that Content-Length be set.
1468                          * Send 411 Length Required if Content-Length missing.
1469                          * (occurs here if client sends Transfer-Encoding: chunked
1470                          *  and module is flagged to stream request body to backend) */
1471                         if (-1 == con->request.content_length) {
1472                                 return connection_handle_read_post_error(srv, con, 411);
1473                         }
1474                 }
1475         }
1476
1477         if (-1 == hctx->fd) {
1478                 if (cgi_create_env(srv, con, p, hctx, hctx->cgi_handler)) {
1479                         con->http_status = 500;
1480                         con->mode = DIRECT;
1481
1482                         return HANDLER_FINISHED;
1483                 }
1484 #if 0
1485         log_error_write(srv, __FILE__, __LINE__, "sdd", "subrequest, pid =", hctx, hctx->pid);
1486 #endif
1487         } else if (!chunkqueue_is_empty(con->request_content_queue)) {
1488                 if (0 != cgi_write_request(srv, hctx, hctx->fdtocgi)) {
1489                         cgi_connection_close(srv, hctx);
1490                         return HANDLER_ERROR;
1491                 }
1492         }
1493
1494         /* if not done, wait for CGI to close stdout, so we read EOF on pipe */
1495         return HANDLER_WAIT_FOR_EVENT;
1496 }
1497
1498
1499 int mod_cgi_plugin_init(plugin *p);
1500 int mod_cgi_plugin_init(plugin *p) {
1501         p->version     = LIGHTTPD_VERSION_ID;
1502         p->name        = buffer_init_string("cgi");
1503
1504         p->connection_reset = cgi_connection_close_callback;
1505         p->handle_subrequest_start = cgi_is_handled;
1506         p->handle_subrequest = mod_cgi_handle_subrequest;
1507         p->handle_trigger = cgi_trigger;
1508         p->init           = mod_cgi_init;
1509         p->cleanup        = mod_cgi_free;
1510         p->set_defaults   = mod_fastcgi_set_defaults;
1511
1512         p->data        = NULL;
1513
1514         return 0;
1515 }