xref: /lighttpd1.4/src/mod_cgi.c (revision 331ac4f1)
1 #include "first.h"
2 
3 #include "server.h"
4 #include "stat_cache.h"
5 #include "keyvalue.h"
6 #include "log.h"
7 #include "connections.h"
8 #include "joblist.h"
9 #include "response.h"
10 #include "http_chunk.h"
11 
12 #include "plugin.h"
13 
14 #include <sys/types.h>
15 #include "sys-mmap.h"
16 
17 #ifdef __WIN32
18 # include <winsock2.h>
19 #else
20 # include <sys/socket.h>
21 # include <sys/wait.h>
22 # include <netinet/in.h>
23 # include <arpa/inet.h>
24 #endif
25 
26 #include <unistd.h>
27 #include <errno.h>
28 #include <stdlib.h>
29 #include <string.h>
30 #include <fdevent.h>
31 #include <signal.h>
32 #include <ctype.h>
33 #include <assert.h>
34 
35 #include <stdio.h>
36 #include <fcntl.h>
37 
38 #if defined(O_CLOEXEC) && (!defined(__FreeBSD__) || defined(SOCK_CLOEXEC)) \
39  && !(defined(__APPLE__) && defined(__MACH__))
40 #define pipe_cloexec(pipefd) pipe2((pipefd), O_CLOEXEC)
41 #elif defined FD_CLOEXEC
42 #define pipe_cloexec(pipefd) \
43   (   0 == pipe(pipefd) \
44    && 0 == fcntl(pipefd[0], F_SETFD, FD_CLOEXEC) \
45    && 0 == fcntl(pipefd[1], F_SETFD, FD_CLOEXEC) \
46     ? 0 \
47     : -1)
48 #else
49 #define pipe_cloexec(pipefd) pipe(pipefd)
50 #endif
51 
52 enum {EOL_UNSET, EOL_N, EOL_RN};
53 
54 typedef struct {
55 	char **ptr;
56 
57 	size_t size;
58 	size_t used;
59 } char_array;
60 
61 typedef struct {
62 	pid_t *ptr;
63 	size_t used;
64 	size_t size;
65 } buffer_pid_t;
66 
67 typedef struct {
68 	array *cgi;
69 	unsigned short execute_x_only;
70 	unsigned short xsendfile_allow;
71 	array *xsendfile_docroot;
72 } plugin_config;
73 
74 typedef struct {
75 	PLUGIN_DATA;
76 	buffer_pid_t cgi_pid;
77 
78 	buffer *parse_response;
79 
80 	plugin_config **config_storage;
81 
82 	plugin_config conf;
83 } plugin_data;
84 
85 typedef struct {
86 	pid_t pid;
87 	int fd;
88 	int fdtocgi;
89 	int fde_ndx; /* index into the fd-event buffer */
90 	int fde_ndx_tocgi; /* index into the fd-event buffer */
91 
92 	connection *remote_conn;  /* dumb pointer */
93 	plugin_data *plugin_data; /* dumb pointer */
94 
95 	buffer *response;
96 	buffer *response_header;
97 	plugin_config conf;
98 } handler_ctx;
99 
100 static handler_ctx * cgi_handler_ctx_init(void) {
101 	handler_ctx *hctx = calloc(1, sizeof(*hctx));
102 
103 	force_assert(hctx);
104 
105 	hctx->response = buffer_init();
106 	hctx->response_header = buffer_init();
107 	hctx->fd = -1;
108 	hctx->fdtocgi = -1;
109 
110 	return hctx;
111 }
112 
113 static void cgi_handler_ctx_free(handler_ctx *hctx) {
114 	buffer_free(hctx->response);
115 	buffer_free(hctx->response_header);
116 
117 	free(hctx);
118 }
119 
120 enum {FDEVENT_HANDLED_UNSET, FDEVENT_HANDLED_FINISHED, FDEVENT_HANDLED_NOT_FINISHED, FDEVENT_HANDLED_COMEBACK, FDEVENT_HANDLED_ERROR};
121 
122 INIT_FUNC(mod_cgi_init) {
123 	plugin_data *p;
124 
125 	p = calloc(1, sizeof(*p));
126 
127 	force_assert(p);
128 
129 	p->parse_response = buffer_init();
130 
131 	return p;
132 }
133 
134 
135 FREE_FUNC(mod_cgi_free) {
136 	plugin_data *p = p_d;
137 	buffer_pid_t *r = &(p->cgi_pid);
138 
139 	UNUSED(srv);
140 
141 	if (p->config_storage) {
142 		size_t i;
143 		for (i = 0; i < srv->config_context->used; i++) {
144 			plugin_config *s = p->config_storage[i];
145 
146 			if (NULL == s) continue;
147 
148 			array_free(s->cgi);
149 			array_free(s->xsendfile_docroot);
150 
151 			free(s);
152 		}
153 		free(p->config_storage);
154 	}
155 
156 
157 	if (r->ptr) free(r->ptr);
158 
159 	buffer_free(p->parse_response);
160 
161 	free(p);
162 
163 	return HANDLER_GO_ON;
164 }
165 
166 SETDEFAULTS_FUNC(mod_fastcgi_set_defaults) {
167 	plugin_data *p = p_d;
168 	size_t i = 0;
169 
170 	config_values_t cv[] = {
171 		{ "cgi.assign",                  NULL, T_CONFIG_ARRAY, T_CONFIG_SCOPE_CONNECTION },       /* 0 */
172 		{ "cgi.execute-x-only",          NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION },     /* 1 */
173 		{ "cgi.x-sendfile",              NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION },     /* 2 */
174 		{ "cgi.x-sendfile-docroot",      NULL, T_CONFIG_ARRAY,   T_CONFIG_SCOPE_CONNECTION },     /* 3 */
175 		{ NULL,                          NULL, T_CONFIG_UNSET, T_CONFIG_SCOPE_UNSET}
176 	};
177 
178 	if (!p) return HANDLER_ERROR;
179 
180 	p->config_storage = calloc(1, srv->config_context->used * sizeof(plugin_config *));
181 	force_assert(p->config_storage);
182 
183 	for (i = 0; i < srv->config_context->used; i++) {
184 		data_config const* config = (data_config const*)srv->config_context->data[i];
185 		plugin_config *s;
186 
187 		s = calloc(1, sizeof(plugin_config));
188 		force_assert(s);
189 
190 		s->cgi    = array_init();
191 		s->execute_x_only = 0;
192 		s->xsendfile_allow= 0;
193 		s->xsendfile_docroot = array_init();
194 
195 		cv[0].destination = s->cgi;
196 		cv[1].destination = &(s->execute_x_only);
197 		cv[2].destination = &(s->xsendfile_allow);
198 		cv[3].destination = s->xsendfile_docroot;
199 
200 		p->config_storage[i] = s;
201 
202 		if (0 != config_insert_values_global(srv, config->value, cv, i == 0 ? T_CONFIG_SCOPE_SERVER : T_CONFIG_SCOPE_CONNECTION)) {
203 			return HANDLER_ERROR;
204 		}
205 
206 		if (s->xsendfile_docroot->used) {
207 			size_t j;
208 			for (j = 0; j < s->xsendfile_docroot->used; ++j) {
209 				data_string *ds = (data_string *)s->xsendfile_docroot->data[j];
210 				if (ds->type != TYPE_STRING) {
211 					log_error_write(srv, __FILE__, __LINE__, "s",
212 						"unexpected type for key cgi.x-sendfile-docroot; expected: cgi.x-sendfile-docroot = ( \"/allowed/path\", ... )");
213 					return HANDLER_ERROR;
214 				}
215 				if (ds->value->ptr[0] != '/') {
216 					log_error_write(srv, __FILE__, __LINE__, "SBs",
217 						"cgi.x-sendfile-docroot paths must begin with '/'; invalid: \"", ds->value, "\"");
218 					return HANDLER_ERROR;
219 				}
220 				buffer_path_simplify(ds->value, ds->value);
221 				buffer_append_slash(ds->value);
222 			}
223 		}
224 	}
225 
226 	return HANDLER_GO_ON;
227 }
228 
229 
230 static int cgi_pid_add(server *srv, plugin_data *p, pid_t pid) {
231 	int m = -1;
232 	size_t i;
233 	buffer_pid_t *r = &(p->cgi_pid);
234 
235 	UNUSED(srv);
236 
237 	for (i = 0; i < r->used; i++) {
238 		if (r->ptr[i] > m) m = r->ptr[i];
239 	}
240 
241 	if (r->size == 0) {
242 		r->size = 16;
243 		r->ptr = malloc(sizeof(*r->ptr) * r->size);
244 		force_assert(r->ptr);
245 	} else if (r->used == r->size) {
246 		r->size += 16;
247 		r->ptr = realloc(r->ptr, sizeof(*r->ptr) * r->size);
248 		force_assert(r->ptr);
249 	}
250 
251 	r->ptr[r->used++] = pid;
252 
253 	return m;
254 }
255 
256 static int cgi_pid_del(server *srv, plugin_data *p, pid_t pid) {
257 	size_t i;
258 	buffer_pid_t *r = &(p->cgi_pid);
259 
260 	UNUSED(srv);
261 
262 	for (i = 0; i < r->used; i++) {
263 		if (r->ptr[i] == pid) break;
264 	}
265 
266 	if (i != r->used) {
267 		/* found */
268 
269 		if (i != r->used - 1) {
270 			r->ptr[i] = r->ptr[r->used - 1];
271 		}
272 		r->used--;
273 	}
274 
275 	return 0;
276 }
277 
278 static int cgi_response_parse(server *srv, connection *con, plugin_data *p, buffer *in) {
279 	char *ns;
280 	const char *s;
281 	int line = 0;
282 
283 	UNUSED(srv);
284 
285 	buffer_copy_buffer(p->parse_response, in);
286 
287 	for (s = p->parse_response->ptr;
288 	     NULL != (ns = strchr(s, '\n'));
289 	     s = ns + 1, line++) {
290 		const char *key, *value;
291 		int key_len;
292 		data_string *ds;
293 
294 		/* strip the \n */
295 		ns[0] = '\0';
296 
297 		if (ns > s && ns[-1] == '\r') ns[-1] = '\0';
298 
299 		if (line == 0 &&
300 		    0 == strncmp(s, "HTTP/1.", 7)) {
301 			/* non-parsed header ... we parse them anyway */
302 
303 			if ((s[7] == '1' ||
304 			     s[7] == '0') &&
305 			    s[8] == ' ') {
306 				int status;
307 				/* after the space should be a status code for us */
308 
309 				status = strtol(s+9, NULL, 10);
310 
311 				if (status >= 100 &&
312 				    status < 1000) {
313 					/* we expected 3 digits and didn't got them */
314 					con->parsed_response |= HTTP_STATUS;
315 					con->http_status = status;
316 				}
317 			}
318 		} else {
319 			/* parse the headers */
320 			key = s;
321 			if (NULL == (value = strchr(s, ':'))) {
322 				/* we expect: "<key>: <value>\r\n" */
323 				continue;
324 			}
325 
326 			key_len = value - key;
327 			value += 1;
328 
329 			/* skip LWS */
330 			while (*value == ' ' || *value == '\t') value++;
331 
332 			if (NULL == (ds = (data_string *)array_get_unused_element(con->response.headers, TYPE_STRING))) {
333 				ds = data_response_init();
334 			}
335 			buffer_copy_string_len(ds->key, key, key_len);
336 			buffer_copy_string(ds->value, value);
337 
338 			array_insert_unique(con->response.headers, (data_unset *)ds);
339 
340 			switch(key_len) {
341 			case 4:
342 				if (0 == strncasecmp(key, "Date", key_len)) {
343 					con->parsed_response |= HTTP_DATE;
344 				}
345 				break;
346 			case 6:
347 				if (0 == strncasecmp(key, "Status", key_len)) {
348 					int status = strtol(value, NULL, 10);
349 					if (status >= 100 && status < 1000) {
350 						con->http_status = status;
351 						con->parsed_response |= HTTP_STATUS;
352 					} else {
353 						con->http_status = 502;
354 					}
355 				}
356 				break;
357 			case 8:
358 				if (0 == strncasecmp(key, "Location", key_len)) {
359 					con->parsed_response |= HTTP_LOCATION;
360 				}
361 				break;
362 			case 10:
363 				if (0 == strncasecmp(key, "Connection", key_len)) {
364 					con->response.keep_alive = (0 == strcasecmp(value, "Keep-Alive")) ? 1 : 0;
365 					con->parsed_response |= HTTP_CONNECTION;
366 				}
367 				break;
368 			case 14:
369 				if (0 == strncasecmp(key, "Content-Length", key_len)) {
370 					con->response.content_length = strtoul(value, NULL, 10);
371 					con->parsed_response |= HTTP_CONTENT_LENGTH;
372 				}
373 				break;
374 			default:
375 				break;
376 			}
377 		}
378 	}
379 
380 	/* CGI/1.1 rev 03 - 7.2.1.2 */
381 	if ((con->parsed_response & HTTP_LOCATION) &&
382 	    !(con->parsed_response & HTTP_STATUS)) {
383 		con->http_status = 302;
384 	}
385 
386 	return 0;
387 }
388 
389 
390 static int cgi_demux_response(server *srv, handler_ctx *hctx) {
391 	plugin_data *p    = hctx->plugin_data;
392 	connection  *con  = hctx->remote_conn;
393 
394 	while(1) {
395 		int n;
396 		int toread;
397 
398 #if defined(__WIN32)
399 		buffer_string_prepare_copy(hctx->response, 4 * 1024);
400 #else
401 		if (ioctl(con->fd, FIONREAD, &toread) || toread <= 4*1024) {
402 			buffer_string_prepare_copy(hctx->response, 4 * 1024);
403 		} else {
404 			if (toread > MAX_READ_LIMIT) toread = MAX_READ_LIMIT;
405 			buffer_string_prepare_copy(hctx->response, toread);
406 		}
407 #endif
408 
409 		if (-1 == (n = read(hctx->fd, hctx->response->ptr, hctx->response->size - 1))) {
410 			if (errno == EAGAIN || errno == EINTR) {
411 				/* would block, wait for signal */
412 				fdevent_event_add(srv->ev, &(hctx->fde_ndx), hctx->fd, FDEVENT_IN);
413 				return FDEVENT_HANDLED_NOT_FINISHED;
414 			}
415 			/* error */
416 			log_error_write(srv, __FILE__, __LINE__, "sdd", strerror(errno), con->fd, hctx->fd);
417 			return FDEVENT_HANDLED_ERROR;
418 		}
419 
420 		if (n == 0) {
421 			/* read finished */
422 			return FDEVENT_HANDLED_FINISHED;
423 		}
424 
425 		buffer_commit(hctx->response, n);
426 
427 		/* split header from body */
428 
429 		if (con->file_started == 0) {
430 			int is_header = 0;
431 			int is_header_end = 0;
432 			size_t last_eol = 0;
433 			size_t i, header_len;
434 
435 			buffer_append_string_buffer(hctx->response_header, hctx->response);
436 
437 			/**
438 			 * we have to handle a few cases:
439 			 *
440 			 * nph:
441 			 *
442 			 *   HTTP/1.0 200 Ok\n
443 			 *   Header: Value\n
444 			 *   \n
445 			 *
446 			 * CGI:
447 			 *   Header: Value\n
448 			 *   Status: 200\n
449 			 *   \n
450 			 *
451 			 * and different mixes of \n and \r\n combinations
452 			 *
453 			 * Some users also forget about CGI and just send a response and hope
454 			 * we handle it. No headers, no header-content seperator
455 			 *
456 			 */
457 
458 			/* nph (non-parsed headers) */
459 			if (0 == strncmp(hctx->response_header->ptr, "HTTP/1.", 7)) is_header = 1;
460 
461 			header_len = buffer_string_length(hctx->response_header);
462 			for (i = 0; !is_header_end && i < header_len; i++) {
463 				char c = hctx->response_header->ptr[i];
464 
465 				switch (c) {
466 				case ':':
467 					/* we found a colon
468 					 *
469 					 * looks like we have a normal header
470 					 */
471 					is_header = 1;
472 					break;
473 				case '\n':
474 					/* EOL */
475 					if (is_header == 0) {
476 						/* we got a EOL but we don't seem to got a HTTP header */
477 
478 						is_header_end = 1;
479 
480 						break;
481 					}
482 
483 					/**
484 					 * check if we saw a \n(\r)?\n sequence
485 					 */
486 					if (last_eol > 0 &&
487 					    ((i - last_eol == 1) ||
488 					     (i - last_eol == 2 && hctx->response_header->ptr[i - 1] == '\r'))) {
489 						is_header_end = 1;
490 						break;
491 					}
492 
493 					last_eol = i;
494 
495 					break;
496 				}
497 			}
498 
499 			if (is_header_end) {
500 				if (!is_header) {
501 					/* no header, but a body */
502 					if (0 != http_chunk_append_buffer(srv, con, hctx->response_header)) {
503 						return FDEVENT_HANDLED_ERROR;
504 					}
505 				} else {
506 					const char *bstart;
507 					size_t blen;
508 
509 					/* the body starts after the EOL */
510 					bstart = hctx->response_header->ptr + i;
511 					blen = header_len - i;
512 
513 					/**
514 					 * i still points to the char after the terminating EOL EOL
515 					 *
516 					 * put it on the last \n again
517 					 */
518 					i--;
519 
520 					/* string the last \r?\n */
521 					if (i > 0 && (hctx->response_header->ptr[i - 1] == '\r')) {
522 						i--;
523 					}
524 
525 					buffer_string_set_length(hctx->response_header, i);
526 
527 					/* parse the response header */
528 					cgi_response_parse(srv, con, p, hctx->response_header);
529 
530 					if (con->http_status >= 300 && con->http_status < 400) {
531 						/*(con->parsed_response & HTTP_LOCATION)*/
532 						data_string *ds;
533 						if (NULL != (ds = (data_string *) array_get_element(con->response.headers, "Location"))
534 						    && ds->value->ptr[0] == '/') {
535 							if (++con->loops_per_request > 5) {
536 								log_error_write(srv, __FILE__, __LINE__, "sb", "too many internal loops while processing request:", con->request.orig_uri);
537 								con->http_status = 500; /* Internal Server Error */
538 								con->mode = DIRECT;
539 								return FDEVENT_HANDLED_FINISHED;
540 							}
541 
542 							buffer_copy_buffer(con->request.uri, ds->value);
543 
544 							if (con->request.content_length) {
545 								if ((off_t)con->request.content_length != chunkqueue_length(con->request_content_queue)) {
546 									con->keep_alive = 0;
547 								}
548 								con->request.content_length = 0;
549 								chunkqueue_reset(con->request_content_queue);
550 							}
551 
552 							if (con->http_status != 307 && con->http_status != 308) {
553 								/* Note: request body (if any) sent to initial dynamic handler
554 								 * and is not available to the internal redirect */
555 								con->request.http_method = HTTP_METHOD_GET;
556 							}
557 
558 							connection_response_reset(srv, con); /*(includes con->http_status = 0)*/
559 
560 							con->mode = DIRECT;
561 							return FDEVENT_HANDLED_COMEBACK;
562 						}
563 					}
564 
565 					if (hctx->conf.xsendfile_allow) {
566 						data_string *ds;
567 						if (NULL != (ds = (data_string *) array_get_element(con->response.headers, "X-Sendfile"))) {
568 							http_response_xsendfile(srv, con, ds->value, hctx->conf.xsendfile_docroot);
569 							return FDEVENT_HANDLED_FINISHED;
570 						}
571 					}
572 
573 					if (blen > 0) {
574 						if (0 != http_chunk_append_mem(srv, con, bstart, blen)) {
575 							return FDEVENT_HANDLED_ERROR;
576 						}
577 					}
578 				}
579 
580 				con->file_started = 1;
581 			} else {
582 				/*(reuse MAX_HTTP_REQUEST_HEADER as max size for response headers from backends)*/
583 				if (header_len > MAX_HTTP_REQUEST_HEADER) {
584 					log_error_write(srv, __FILE__, __LINE__, "sb", "response headers too large for", con->uri.path);
585 					con->http_status = 502; /* Bad Gateway */
586 					con->mode = DIRECT;
587 					return FDEVENT_HANDLED_FINISHED;
588 				}
589 			}
590 		} else {
591 			if (0 != http_chunk_append_buffer(srv, con, hctx->response)) {
592 				return FDEVENT_HANDLED_ERROR;
593 			}
594 			if ((con->conf.stream_response_body & FDEVENT_STREAM_RESPONSE_BUFMIN)
595 			    && chunkqueue_length(con->write_queue) > 65536 - 4096) {
596 				if (!con->is_writable) {
597 					/*(defer removal of FDEVENT_IN interest since
598 					 * connection_state_machine() might be able to send data
599 					 * immediately, unless !con->is_writable, where
600 					 * connection_state_machine() might not loop back to call
601 					 * mod_cgi_handle_subrequest())*/
602 					fdevent_event_clr(srv->ev, &(hctx->fde_ndx), hctx->fd, FDEVENT_IN);
603 				}
604 				break;
605 			}
606 		}
607 
608 #if 0
609 		log_error_write(srv, __FILE__, __LINE__, "ddss", con->fd, hctx->fd, connection_get_state(con->state), b->ptr);
610 #endif
611 	}
612 
613 	return FDEVENT_HANDLED_NOT_FINISHED;
614 }
615 
616 static void cgi_connection_close_fdtocgi(server *srv, handler_ctx *hctx) {
617 	/*(closes only hctx->fdtocgi)*/
618 	fdevent_event_del(srv->ev, &(hctx->fde_ndx_tocgi), hctx->fdtocgi);
619 	fdevent_unregister(srv->ev, hctx->fdtocgi);
620 	fdevent_sched_close(srv->ev, hctx->fdtocgi, 0);
621 	hctx->fdtocgi = -1;
622 }
623 
624 static void cgi_connection_close(server *srv, handler_ctx *hctx) {
625 	int status;
626 	pid_t pid;
627 	plugin_data *p = hctx->plugin_data;
628 	connection *con = hctx->remote_conn;
629 
630 #ifndef __WIN32
631 
632 	/* the connection to the browser went away, but we still have a connection
633 	 * to the CGI script
634 	 *
635 	 * close cgi-connection
636 	 */
637 
638 	if (hctx->fd != -1) {
639 		/* close connection to the cgi-script */
640 		fdevent_event_del(srv->ev, &(hctx->fde_ndx), hctx->fd);
641 		fdevent_unregister(srv->ev, hctx->fd);
642 		fdevent_sched_close(srv->ev, hctx->fd, 0);
643 	}
644 
645 	if (hctx->fdtocgi != -1) {
646 		cgi_connection_close_fdtocgi(srv, hctx); /*(closes only hctx->fdtocgi)*/
647 	}
648 
649 	pid = hctx->pid;
650 
651 	con->plugin_ctx[p->id] = NULL;
652 
653 	cgi_handler_ctx_free(hctx);
654 
655 	/* if waitpid hasn't been called by response.c yet, do it here */
656 	if (pid) {
657 		/* check if the CGI-script is already gone */
658 		switch(waitpid(pid, &status, WNOHANG)) {
659 		case 0:
660 			/* not finished yet */
661 #if 0
662 			log_error_write(srv, __FILE__, __LINE__, "sd", "(debug) child isn't done yet, pid:", pid);
663 #endif
664 			break;
665 		case -1:
666 			/* */
667 			if (errno == EINTR) break;
668 
669 			/*
670 			 * errno == ECHILD happens if _subrequest catches the process-status before
671 			 * we have read the response of the cgi process
672 			 *
673 			 * -> catch status
674 			 * -> WAIT_FOR_EVENT
675 			 * -> read response
676 			 * -> we get here with waitpid == ECHILD
677 			 *
678 			 */
679 			if (errno != ECHILD) {
680 				log_error_write(srv, __FILE__, __LINE__, "ss", "waitpid failed: ", strerror(errno));
681 			}
682 			/* anyway: don't wait for it anymore */
683 			pid = 0;
684 			break;
685 		default:
686 			if (WIFEXITED(status)) {
687 #if 0
688 				log_error_write(srv, __FILE__, __LINE__, "sd", "(debug) cgi exited fine, pid:", pid);
689 #endif
690 			} else {
691 				log_error_write(srv, __FILE__, __LINE__, "sd", "cgi died, pid:", pid);
692 			}
693 
694 			pid = 0;
695 			break;
696 		}
697 
698 		if (pid) {
699 			kill(pid, SIGTERM);
700 
701 			/* cgi-script is still alive, queue the PID for removal */
702 			cgi_pid_add(srv, p, pid);
703 		}
704 	}
705 #endif
706 
707 	/* finish response (if not already con->file_started, con->file_finished) */
708 	if (con->mode == p->id) {
709 		http_response_backend_done(srv, con);
710 	}
711 }
712 
713 static handler_t cgi_connection_close_callback(server *srv, connection *con, void *p_d) {
714 	plugin_data *p = p_d;
715 	handler_ctx *hctx = con->plugin_ctx[p->id];
716 	if (hctx) cgi_connection_close(srv, hctx);
717 
718 	return HANDLER_GO_ON;
719 }
720 
721 
722 static int cgi_write_request(server *srv, handler_ctx *hctx, int fd);
723 
724 
725 static handler_t cgi_handle_fdevent_send (server *srv, void *ctx, int revents) {
726 	handler_ctx *hctx = ctx;
727 	connection  *con  = hctx->remote_conn;
728 
729 	/*(joblist only actually necessary here in mod_cgi fdevent send if returning HANDLER_ERROR)*/
730 	joblist_append(srv, con);
731 
732 	if (revents & FDEVENT_OUT) {
733 		if (0 != cgi_write_request(srv, hctx, hctx->fdtocgi)) {
734 			cgi_connection_close(srv, hctx);
735 			return HANDLER_ERROR;
736 		}
737 		/* more request body to be sent to CGI */
738 	}
739 
740 	if (revents & FDEVENT_HUP) {
741 		/* skip sending remaining data to CGI */
742 		if (con->request.content_length) {
743 			chunkqueue *cq = con->request_content_queue;
744 			chunkqueue_mark_written(cq, chunkqueue_length(cq));
745 			if (cq->bytes_in != (off_t)con->request.content_length) {
746 				con->keep_alive = 0;
747 			}
748 		}
749 
750 		cgi_connection_close_fdtocgi(srv, hctx); /*(closes only hctx->fdtocgi)*/
751 	} else if (revents & FDEVENT_ERR) {
752 		/* kill all connections to the cgi process */
753 #if 1
754 		log_error_write(srv, __FILE__, __LINE__, "s", "cgi-FDEVENT_ERR");
755 #endif
756 		cgi_connection_close(srv, hctx);
757 		return HANDLER_ERROR;
758 	}
759 
760 	return HANDLER_FINISHED;
761 }
762 
763 
764 static int cgi_recv_response(server *srv, handler_ctx *hctx) {
765 		switch (cgi_demux_response(srv, hctx)) {
766 		case FDEVENT_HANDLED_NOT_FINISHED:
767 			break;
768 		case FDEVENT_HANDLED_FINISHED:
769 			/* we are done */
770 
771 #if 0
772 			log_error_write(srv, __FILE__, __LINE__, "ddss", con->fd, hctx->fd, connection_get_state(con->state), "finished");
773 #endif
774 			cgi_connection_close(srv, hctx);
775 
776 			/* if we get a IN|HUP and have read everything don't exec the close twice */
777 			return HANDLER_FINISHED;
778 		case FDEVENT_HANDLED_COMEBACK:
779 			cgi_connection_close(srv, hctx);
780 			return HANDLER_COMEBACK;
781 		case FDEVENT_HANDLED_ERROR:
782 			log_error_write(srv, __FILE__, __LINE__, "s", "demuxer failed: ");
783 
784 			cgi_connection_close(srv, hctx);
785 			return HANDLER_FINISHED;
786 		}
787 
788 		return HANDLER_GO_ON;
789 }
790 
791 
792 static handler_t cgi_handle_fdevent(server *srv, void *ctx, int revents) {
793 	handler_ctx *hctx = ctx;
794 	connection  *con  = hctx->remote_conn;
795 
796 	joblist_append(srv, con);
797 
798 	if (revents & FDEVENT_IN) {
799 		handler_t rc = cgi_recv_response(srv, hctx);/*(might invalidate hctx)*/
800 		if (rc != HANDLER_GO_ON) return rc;         /*(unless HANDLER_GO_ON)*/
801 	}
802 
803 	/* perhaps this issue is already handled */
804 	if (revents & FDEVENT_HUP) {
805 		if (con->file_started) {
806 			/* drain any remaining data from kernel pipe buffers
807 			 * even if (con->conf.stream_response_body
808 			 *          & FDEVENT_STREAM_RESPONSE_BUFMIN)
809 			 * since event loop will spin on fd FDEVENT_HUP event
810 			 * until unregistered. */
811 			handler_t rc;
812 			do {
813 				rc = cgi_recv_response(srv,hctx);/*(might invalidate hctx)*/
814 			} while (rc == HANDLER_GO_ON);           /*(unless HANDLER_GO_ON)*/
815 			return rc; /* HANDLER_FINISHED or HANDLER_COMEBACK or HANDLER_ERROR */
816 		} else if (!buffer_string_is_empty(hctx->response_header)) {
817 			/* unfinished header package which is a body in reality */
818 			con->file_started = 1;
819 			if (0 != http_chunk_append_buffer(srv, con, hctx->response_header)) {
820 				cgi_connection_close(srv, hctx);
821 				return HANDLER_ERROR;
822 			}
823 		} else {
824 # if 0
825 			log_error_write(srv, __FILE__, __LINE__, "sddd", "got HUP from cgi", con->fd, hctx->fd, revents);
826 # endif
827 		}
828 		cgi_connection_close(srv, hctx);
829 	} else if (revents & FDEVENT_ERR) {
830 		/* kill all connections to the cgi process */
831 		cgi_connection_close(srv, hctx);
832 #if 1
833 		log_error_write(srv, __FILE__, __LINE__, "s", "cgi-FDEVENT_ERR");
834 #endif
835 		return HANDLER_ERROR;
836 	}
837 
838 	return HANDLER_FINISHED;
839 }
840 
841 
842 static int cgi_env_add(void *venv, const char *key, size_t key_len, const char *val, size_t val_len) {
843 	char_array *env = venv;
844 	char *dst;
845 
846 	if (!key || !val) return -1;
847 
848 	dst = malloc(key_len + val_len + 2);
849 	force_assert(dst);
850 	memcpy(dst, key, key_len);
851 	dst[key_len] = '=';
852 	memcpy(dst + key_len + 1, val, val_len);
853 	dst[key_len + 1 + val_len] = '\0';
854 
855 	if (env->size == 0) {
856 		env->size = 16;
857 		env->ptr = malloc(env->size * sizeof(*env->ptr));
858 		force_assert(env->ptr);
859 	} else if (env->size == env->used) {
860 		env->size += 16;
861 		env->ptr = realloc(env->ptr, env->size * sizeof(*env->ptr));
862 		force_assert(env->ptr);
863 	}
864 
865 	env->ptr[env->used++] = dst;
866 
867 	return 0;
868 }
869 
870 /*(improved from network_write_mmap.c)*/
871 static off_t mmap_align_offset(off_t start) {
872     static off_t pagemask = 0;
873     if (0 == pagemask) {
874         long pagesize = sysconf(_SC_PAGESIZE);
875         if (-1 == pagesize) pagesize = 4096;
876         pagemask = ~((off_t)pagesize - 1); /* pagesize always power-of-2 */
877     }
878     return (start & pagemask);
879 }
880 
881 /* returns: 0: continue, -1: fatal error, -2: connection reset */
882 /* similar to network_write_file_chunk_mmap, but doesn't use send on windows (because we're on pipes),
883  * also mmaps and sends complete chunk instead of only small parts - the files
884  * are supposed to be temp files with reasonable chunk sizes.
885  *
886  * Also always use mmap; the files are "trusted", as we created them.
887  */
888 static ssize_t cgi_write_file_chunk_mmap(server *srv, connection *con, int fd, chunkqueue *cq) {
889 	chunk* const c = cq->first;
890 	off_t offset, toSend, file_end;
891 	ssize_t r;
892 	size_t mmap_offset, mmap_avail;
893 	char *data;
894 
895 	force_assert(NULL != c);
896 	force_assert(FILE_CHUNK == c->type);
897 	force_assert(c->offset >= 0 && c->offset <= c->file.length);
898 
899 	offset = c->file.start + c->offset;
900 	toSend = c->file.length - c->offset;
901 	file_end = c->file.start + c->file.length; /* offset to file end in this chunk */
902 
903 	if (0 == toSend) {
904 		chunkqueue_remove_finished_chunks(cq);
905 		return 0;
906 	}
907 
908 	/*(simplified from network_write_no_mmap.c:network_open_file_chunk())*/
909 	UNUSED(con);
910 	if (-1 == c->file.fd) {
911 		if (-1 == (c->file.fd = fdevent_open_cloexec(c->file.name->ptr, O_RDONLY, 0))) {
912 			log_error_write(srv, __FILE__, __LINE__, "ssb", "open failed:", strerror(errno), c->file.name);
913 			return -1;
914 		}
915 	}
916 
917 	/* (re)mmap the buffer if range is not covered completely */
918 	if (MAP_FAILED == c->file.mmap.start
919 		|| offset < c->file.mmap.offset
920 		|| file_end > (off_t)(c->file.mmap.offset + c->file.mmap.length)) {
921 
922 		if (MAP_FAILED != c->file.mmap.start) {
923 			munmap(c->file.mmap.start, c->file.mmap.length);
924 			c->file.mmap.start = MAP_FAILED;
925 		}
926 
927 		c->file.mmap.offset = mmap_align_offset(offset);
928 		c->file.mmap.length = file_end - c->file.mmap.offset;
929 
930 		if (MAP_FAILED == (c->file.mmap.start = mmap(NULL, c->file.mmap.length, PROT_READ, MAP_PRIVATE, c->file.fd, c->file.mmap.offset))) {
931 			if (toSend > 65536) toSend = 65536;
932 			data = malloc(toSend);
933 			force_assert(data);
934 			if (-1 == lseek(c->file.fd, offset, SEEK_SET)
935 			    || 0 >= (toSend = read(c->file.fd, data, toSend))) {
936 				if (-1 == toSend) {
937 					log_error_write(srv, __FILE__, __LINE__, "ssbdo", "lseek/read failed:",
938 						strerror(errno), c->file.name, c->file.fd, offset);
939 				} else { /*(0 == toSend)*/
940 					log_error_write(srv, __FILE__, __LINE__, "sbdo", "unexpected EOF (input truncated?):",
941 						c->file.name, c->file.fd, offset);
942 				}
943 				free(data);
944 				return -1;
945 			}
946 		}
947 	}
948 
949 	if (MAP_FAILED != c->file.mmap.start) {
950 		force_assert(offset >= c->file.mmap.offset);
951 		mmap_offset = offset - c->file.mmap.offset;
952 		force_assert(c->file.mmap.length > mmap_offset);
953 		mmap_avail = c->file.mmap.length - mmap_offset;
954 		force_assert(toSend <= (off_t) mmap_avail);
955 
956 		data = c->file.mmap.start + mmap_offset;
957 	}
958 
959 	r = write(fd, data, toSend);
960 
961 	if (MAP_FAILED == c->file.mmap.start) free(data);
962 
963 	if (r < 0) {
964 		switch (errno) {
965 		case EAGAIN:
966 		case EINTR:
967 			return 0;
968 		case EPIPE:
969 		case ECONNRESET:
970 			return -2;
971 		default:
972 			log_error_write(srv, __FILE__, __LINE__, "ssd",
973 				"write failed:", strerror(errno), fd);
974 			return -1;
975 		}
976 	}
977 
978 	if (r >= 0) {
979 		chunkqueue_mark_written(cq, r);
980 	}
981 
982 	return r;
983 }
984 
985 static int cgi_write_request(server *srv, handler_ctx *hctx, int fd) {
986 	connection *con = hctx->remote_conn;
987 	chunkqueue *cq = con->request_content_queue;
988 	chunk *c;
989 
990 	/* old comment: windows doesn't support select() on pipes - wouldn't be easy to fix for all platforms.
991 	 * solution: if this is still a problem on windows, then substitute
992 	 * socketpair() for pipe() and closesocket() for close() on windows.
993 	 */
994 
995 	for (c = cq->first; c; c = cq->first) {
996 		ssize_t r = -1;
997 
998 		switch(c->type) {
999 		case FILE_CHUNK:
1000 			r = cgi_write_file_chunk_mmap(srv, con, fd, cq);
1001 			break;
1002 
1003 		case MEM_CHUNK:
1004 			if ((r = write(fd, c->mem->ptr + c->offset, buffer_string_length(c->mem) - c->offset)) < 0) {
1005 				switch(errno) {
1006 				case EAGAIN:
1007 				case EINTR:
1008 					/* ignore and try again */
1009 					r = 0;
1010 					break;
1011 				case EPIPE:
1012 				case ECONNRESET:
1013 					/* connection closed */
1014 					r = -2;
1015 					break;
1016 				default:
1017 					/* fatal error */
1018 					log_error_write(srv, __FILE__, __LINE__, "ss", "write failed due to: ", strerror(errno));
1019 					r = -1;
1020 					break;
1021 				}
1022 			} else if (r > 0) {
1023 				chunkqueue_mark_written(cq, r);
1024 			}
1025 			break;
1026 		}
1027 
1028 		if (0 == r) break; /*(might block)*/
1029 
1030 		switch (r) {
1031 		case -1:
1032 			/* fatal error */
1033 			return -1;
1034 		case -2:
1035 			/* connection reset */
1036 			log_error_write(srv, __FILE__, __LINE__, "s", "failed to send post data to cgi, connection closed by CGI");
1037 			/* skip all remaining data */
1038 			chunkqueue_mark_written(cq, chunkqueue_length(cq));
1039 			break;
1040 		default:
1041 			break;
1042 		}
1043 	}
1044 
1045 	if (cq->bytes_out == (off_t)con->request.content_length) {
1046 		/* sent all request body input */
1047 		/* close connection to the cgi-script */
1048 		if (-1 == hctx->fdtocgi) { /*(received request body sent in initial send to pipe buffer)*/
1049 			--srv->cur_fds;
1050 			if (close(fd)) {
1051 				log_error_write(srv, __FILE__, __LINE__, "sds", "cgi stdin close failed ", fd, strerror(errno));
1052 			}
1053 		} else {
1054 			cgi_connection_close_fdtocgi(srv, hctx); /*(closes only hctx->fdtocgi)*/
1055 		}
1056 	} else {
1057 		off_t cqlen = cq->bytes_in - cq->bytes_out;
1058 		if (cq->bytes_in < (off_t)con->request.content_length && cqlen < 65536 - 16384) {
1059 			/*(con->conf.stream_request_body & FDEVENT_STREAM_REQUEST)*/
1060 			if (!(con->conf.stream_request_body & FDEVENT_STREAM_REQUEST_POLLIN)) {
1061 				con->conf.stream_request_body |= FDEVENT_STREAM_REQUEST_POLLIN;
1062 				con->is_readable = 1; /* trigger optimistic read from client */
1063 			}
1064 		}
1065 		if (-1 == hctx->fdtocgi) { /*(not registered yet)*/
1066 			hctx->fdtocgi = fd;
1067 			hctx->fde_ndx_tocgi = -1;
1068 			fdevent_register(srv->ev, hctx->fdtocgi, cgi_handle_fdevent_send, hctx);
1069 		}
1070 		if (0 == cqlen) { /*(chunkqueue_is_empty(cq))*/
1071 			if ((fdevent_event_get_interest(srv->ev, hctx->fdtocgi) & FDEVENT_OUT)) {
1072 				fdevent_event_set(srv->ev, &(hctx->fde_ndx_tocgi), hctx->fdtocgi, 0);
1073 			}
1074 		} else {
1075 			/* more request body remains to be sent to CGI so register for fdevents */
1076 			fdevent_event_set(srv->ev, &(hctx->fde_ndx_tocgi), hctx->fdtocgi, FDEVENT_OUT);
1077 		}
1078 	}
1079 
1080 	return 0;
1081 }
1082 
1083 static int cgi_create_env(server *srv, connection *con, plugin_data *p, handler_ctx *hctx, buffer *cgi_handler) {
1084 	pid_t pid;
1085 
1086 	int to_cgi_fds[2];
1087 	int from_cgi_fds[2];
1088 	struct stat st;
1089 	UNUSED(p);
1090 
1091 #ifndef __WIN32
1092 
1093 	if (!buffer_string_is_empty(cgi_handler)) {
1094 		/* stat the exec file */
1095 		if (-1 == (stat(cgi_handler->ptr, &st))) {
1096 			log_error_write(srv, __FILE__, __LINE__, "sbss",
1097 					"stat for cgi-handler", cgi_handler,
1098 					"failed:", strerror(errno));
1099 			return -1;
1100 		}
1101 	}
1102 
1103 	if (pipe_cloexec(to_cgi_fds)) {
1104 		log_error_write(srv, __FILE__, __LINE__, "ss", "pipe failed:", strerror(errno));
1105 		return -1;
1106 	}
1107 
1108 	if (pipe_cloexec(from_cgi_fds)) {
1109 		close(to_cgi_fds[0]);
1110 		close(to_cgi_fds[1]);
1111 		log_error_write(srv, __FILE__, __LINE__, "ss", "pipe failed:", strerror(errno));
1112 		return -1;
1113 	}
1114 
1115 	/* fork, execve */
1116 	switch (pid = fork()) {
1117 	case 0: {
1118 		/* child */
1119 		char **args;
1120 		int argc;
1121 		int i = 0;
1122 		char_array env;
1123 		char *c;
1124 		const char *s;
1125 		http_cgi_opts opts = { 0, 0, NULL, NULL };
1126 
1127 		/* move stdout to from_cgi_fd[1] */
1128 		dup2(from_cgi_fds[1], STDOUT_FILENO);
1129 	      #ifndef FD_CLOEXEC
1130 		close(from_cgi_fds[1]);
1131 		/* not needed */
1132 		close(from_cgi_fds[0]);
1133 	      #endif
1134 
1135 		/* move the stdin to to_cgi_fd[0] */
1136 		dup2(to_cgi_fds[0], STDIN_FILENO);
1137 	      #ifndef FD_CLOEXEC
1138 		close(to_cgi_fds[0]);
1139 		/* not needed */
1140 		close(to_cgi_fds[1]);
1141 	      #endif
1142 
1143 		/* create environment */
1144 		env.ptr = NULL;
1145 		env.size = 0;
1146 		env.used = 0;
1147 
1148 		http_cgi_headers(srv, con, &opts, cgi_env_add, &env);
1149 
1150 		/* for valgrind */
1151 		if (NULL != (s = getenv("LD_PRELOAD"))) {
1152 			cgi_env_add(&env, CONST_STR_LEN("LD_PRELOAD"), s, strlen(s));
1153 		}
1154 
1155 		if (NULL != (s = getenv("LD_LIBRARY_PATH"))) {
1156 			cgi_env_add(&env, CONST_STR_LEN("LD_LIBRARY_PATH"), s, strlen(s));
1157 		}
1158 #ifdef __CYGWIN__
1159 		/* CYGWIN needs SYSTEMROOT */
1160 		if (NULL != (s = getenv("SYSTEMROOT"))) {
1161 			cgi_env_add(&env, CONST_STR_LEN("SYSTEMROOT"), s, strlen(s));
1162 		}
1163 #endif
1164 
1165 		if (env.size == env.used) {
1166 			env.size += 16;
1167 			env.ptr = realloc(env.ptr, env.size * sizeof(*env.ptr));
1168 		}
1169 
1170 		env.ptr[env.used] = NULL;
1171 
1172 		/* set up args */
1173 		argc = 3;
1174 		args = malloc(sizeof(*args) * argc);
1175 		force_assert(args);
1176 		i = 0;
1177 
1178 		if (!buffer_string_is_empty(cgi_handler)) {
1179 			args[i++] = cgi_handler->ptr;
1180 		}
1181 		args[i++] = con->physical.path->ptr;
1182 		args[i  ] = NULL;
1183 
1184 		/* search for the last / */
1185 		if (NULL != (c = strrchr(con->physical.path->ptr, '/'))) {
1186 			/* handle special case of file in root directory */
1187 			const char* physdir = (c == con->physical.path->ptr) ? "/" : con->physical.path->ptr;
1188 
1189 			/* temporarily shorten con->physical.path to directory without terminating '/' */
1190 			*c = '\0';
1191 			/* change to the physical directory */
1192 			if (-1 == chdir(physdir)) {
1193 				log_error_write(srv, __FILE__, __LINE__, "ssb", "chdir failed:", strerror(errno), con->physical.path);
1194 			}
1195 			*c = '/';
1196 		}
1197 
1198 		/* we don't need the client socket */
1199 		for (i = 3; i < 256; i++) {
1200 			if (i != srv->errorlog_fd) close(i);
1201 		}
1202 
1203 		/* exec the cgi */
1204 		execve(args[0], args, env.ptr);
1205 
1206 		/* most log files may have been closed/redirected by this point,
1207 		 * though stderr might still point to lighttpd.breakage.log */
1208 		perror(args[0]);
1209 		_exit(1);
1210 	}
1211 	case -1:
1212 		/* error */
1213 		log_error_write(srv, __FILE__, __LINE__, "ss", "fork failed:", strerror(errno));
1214 		close(from_cgi_fds[0]);
1215 		close(from_cgi_fds[1]);
1216 		close(to_cgi_fds[0]);
1217 		close(to_cgi_fds[1]);
1218 		return -1;
1219 	default: {
1220 		/* parent process */
1221 
1222 		close(from_cgi_fds[1]);
1223 		close(to_cgi_fds[0]);
1224 
1225 		/* register PID and wait for them asynchronously */
1226 
1227 		hctx->pid = pid;
1228 		hctx->fd = from_cgi_fds[0];
1229 		hctx->fde_ndx = -1;
1230 
1231 		++srv->cur_fds;
1232 
1233 		if (0 == con->request.content_length) {
1234 			close(to_cgi_fds[1]);
1235 		} else {
1236 			/* there is content to send */
1237 			if (-1 == fdevent_fcntl_set_nb(srv->ev, to_cgi_fds[1])) {
1238 				log_error_write(srv, __FILE__, __LINE__, "ss", "fcntl failed: ", strerror(errno));
1239 				close(to_cgi_fds[1]);
1240 				cgi_connection_close(srv, hctx);
1241 				return -1;
1242 			}
1243 
1244 			if (0 != cgi_write_request(srv, hctx, to_cgi_fds[1])) {
1245 				close(to_cgi_fds[1]);
1246 				cgi_connection_close(srv, hctx);
1247 				return -1;
1248 			}
1249 
1250 			++srv->cur_fds;
1251 		}
1252 
1253 		fdevent_register(srv->ev, hctx->fd, cgi_handle_fdevent, hctx);
1254 		if (-1 == fdevent_fcntl_set_nb(srv->ev, hctx->fd)) {
1255 			log_error_write(srv, __FILE__, __LINE__, "ss", "fcntl failed: ", strerror(errno));
1256 			cgi_connection_close(srv, hctx);
1257 			return -1;
1258 		}
1259 		fdevent_event_set(srv->ev, &(hctx->fde_ndx), hctx->fd, FDEVENT_IN);
1260 
1261 		break;
1262 	}
1263 	}
1264 
1265 	return 0;
1266 #else
1267 	return -1;
1268 #endif
1269 }
1270 
1271 static buffer * cgi_get_handler(array *a, buffer *fn) {
1272 	size_t k, s_len = buffer_string_length(fn);
1273 	for (k = 0; k < a->used; ++k) {
1274 		data_string *ds = (data_string *)a->data[k];
1275 		size_t ct_len = buffer_string_length(ds->key);
1276 
1277 		if (buffer_is_empty(ds->key)) continue;
1278 		if (s_len < ct_len) continue;
1279 
1280 		if (0 == strncmp(fn->ptr + s_len - ct_len, ds->key->ptr, ct_len)) {
1281 			return ds->value;
1282 		}
1283 	}
1284 
1285 	return NULL;
1286 }
1287 
1288 #define PATCH(x) \
1289 	p->conf.x = s->x;
1290 static int mod_cgi_patch_connection(server *srv, connection *con, plugin_data *p) {
1291 	size_t i, j;
1292 	plugin_config *s = p->config_storage[0];
1293 
1294 	PATCH(cgi);
1295 	PATCH(execute_x_only);
1296 	PATCH(xsendfile_allow);
1297 	PATCH(xsendfile_docroot);
1298 
1299 	/* skip the first, the global context */
1300 	for (i = 1; i < srv->config_context->used; i++) {
1301 		data_config *dc = (data_config *)srv->config_context->data[i];
1302 		s = p->config_storage[i];
1303 
1304 		/* condition didn't match */
1305 		if (!config_check_cond(srv, con, dc)) continue;
1306 
1307 		/* merge config */
1308 		for (j = 0; j < dc->value->used; j++) {
1309 			data_unset *du = dc->value->data[j];
1310 
1311 			if (buffer_is_equal_string(du->key, CONST_STR_LEN("cgi.assign"))) {
1312 				PATCH(cgi);
1313 			} else if (buffer_is_equal_string(du->key, CONST_STR_LEN("cgi.execute-x-only"))) {
1314 				PATCH(execute_x_only);
1315 			} else if (buffer_is_equal_string(du->key, CONST_STR_LEN("cgi.x-sendfile"))) {
1316 				PATCH(xsendfile_allow);
1317 			} else if (buffer_is_equal_string(du->key, CONST_STR_LEN("cgi.x-sendfile-docroot"))) {
1318 				PATCH(xsendfile_docroot);
1319 			}
1320 		}
1321 	}
1322 
1323 	return 0;
1324 }
1325 #undef PATCH
1326 
1327 URIHANDLER_FUNC(cgi_is_handled) {
1328 	plugin_data *p = p_d;
1329 	buffer *fn = con->physical.path;
1330 	stat_cache_entry *sce = NULL;
1331 	struct stat stbuf;
1332 	struct stat *st;
1333 
1334 	if (con->mode != DIRECT) return HANDLER_GO_ON;
1335 
1336 	if (buffer_is_empty(fn)) return HANDLER_GO_ON;
1337 
1338 	mod_cgi_patch_connection(srv, con, p);
1339 
1340 	if (HANDLER_ERROR != stat_cache_get_entry(srv, con, con->physical.path, &sce)) {
1341 		st = &sce->st;
1342 	} else {
1343 		/* CGI might be executable even if it is not readable
1344 		 * (stat_cache_get_entry() currently checks file is readable)*/
1345 		if (0 != stat(con->physical.path->ptr, &stbuf)) return HANDLER_GO_ON;
1346 		st = &stbuf;
1347 	}
1348 
1349 	if (!S_ISREG(st->st_mode)) return HANDLER_GO_ON;
1350 	if (p->conf.execute_x_only == 1 && (st->st_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0) return HANDLER_GO_ON;
1351 
1352 	if (NULL != cgi_get_handler(p->conf.cgi, fn)) {
1353 		handler_ctx *hctx = cgi_handler_ctx_init();
1354 		hctx->remote_conn = con;
1355 		hctx->plugin_data = p;
1356 		memcpy(&hctx->conf, &p->conf, sizeof(plugin_config));
1357 		con->plugin_ctx[p->id] = hctx;
1358 		con->mode = p->id;
1359 	}
1360 
1361 	return HANDLER_GO_ON;
1362 }
1363 
1364 TRIGGER_FUNC(cgi_trigger) {
1365 	plugin_data *p = p_d;
1366 	size_t ndx;
1367 	/* the trigger handle only cares about lonely PID which we have to wait for */
1368 #ifndef __WIN32
1369 
1370 	for (ndx = 0; ndx < p->cgi_pid.used; ndx++) {
1371 		int status;
1372 
1373 		switch(waitpid(p->cgi_pid.ptr[ndx], &status, WNOHANG)) {
1374 		case 0:
1375 			/* not finished yet */
1376 #if 0
1377 			log_error_write(srv, __FILE__, __LINE__, "sd", "(debug) child isn't done yet, pid:", p->cgi_pid.ptr[ndx]);
1378 #endif
1379 			break;
1380 		case -1:
1381 			if (errno == ECHILD) {
1382 				/* someone else called waitpid... remove the pid to stop looping the error each time */
1383 				log_error_write(srv, __FILE__, __LINE__, "s", "cgi child vanished, probably someone else called waitpid");
1384 
1385 				cgi_pid_del(srv, p, p->cgi_pid.ptr[ndx]);
1386 				ndx--;
1387 				continue;
1388 			}
1389 
1390 			log_error_write(srv, __FILE__, __LINE__, "ss", "waitpid failed: ", strerror(errno));
1391 
1392 			return HANDLER_ERROR;
1393 		default:
1394 
1395 			if (WIFEXITED(status)) {
1396 #if 0
1397 				log_error_write(srv, __FILE__, __LINE__, "sd", "(debug) cgi exited fine, pid:", p->cgi_pid.ptr[ndx]);
1398 #endif
1399 			} else if (WIFSIGNALED(status)) {
1400 				/* FIXME: what if we killed the CGI script with a kill(..., SIGTERM) ?
1401 				 */
1402 				if (WTERMSIG(status) != SIGTERM) {
1403 					log_error_write(srv, __FILE__, __LINE__, "sd", "cleaning up CGI: process died with signal", WTERMSIG(status));
1404 				}
1405 			} else {
1406 				log_error_write(srv, __FILE__, __LINE__, "s", "cleaning up CGI: ended unexpectedly");
1407 			}
1408 
1409 			cgi_pid_del(srv, p, p->cgi_pid.ptr[ndx]);
1410 			/* del modified the buffer structure
1411 			 * and copies the last entry to the current one
1412 			 * -> recheck the current index
1413 			 */
1414 			ndx--;
1415 		}
1416 	}
1417 #endif
1418 	return HANDLER_GO_ON;
1419 }
1420 
1421 /*
1422  * - HANDLER_GO_ON : not our job
1423  * - HANDLER_FINISHED: got response
1424  * - HANDLER_WAIT_FOR_EVENT: waiting for response
1425  */
1426 SUBREQUEST_FUNC(mod_cgi_handle_subrequest) {
1427 	plugin_data *p = p_d;
1428 	handler_ctx *hctx = con->plugin_ctx[p->id];
1429 	chunkqueue *cq = con->request_content_queue;
1430 
1431 	if (con->mode != p->id) return HANDLER_GO_ON;
1432 	if (NULL == hctx) return HANDLER_GO_ON;
1433 
1434 	if ((con->conf.stream_response_body & FDEVENT_STREAM_RESPONSE_BUFMIN)
1435 	    && con->file_started) {
1436 		if (chunkqueue_length(con->write_queue) > 65536 - 4096) {
1437 			fdevent_event_clr(srv->ev, &(hctx->fde_ndx), hctx->fd, FDEVENT_IN);
1438 		} else if (!(fdevent_event_get_interest(srv->ev, hctx->fd) & FDEVENT_IN)) {
1439 			/* optimistic read from backend, which might re-enable FDEVENT_IN */
1440 			handler_t rc = cgi_recv_response(srv, hctx); /*(might invalidate hctx)*/
1441 			if (rc != HANDLER_GO_ON) return rc;          /*(unless HANDLER_GO_ON)*/
1442 		}
1443 	}
1444 
1445 	if (cq->bytes_in != (off_t)con->request.content_length) {
1446 		/*(64k - 4k to attempt to avoid temporary files
1447 		 * in conjunction with FDEVENT_STREAM_REQUEST_BUFMIN)*/
1448 		if (cq->bytes_in - cq->bytes_out > 65536 - 4096
1449 		    && (con->conf.stream_request_body & FDEVENT_STREAM_REQUEST_BUFMIN)){
1450 			con->conf.stream_request_body &= ~FDEVENT_STREAM_REQUEST_POLLIN;
1451 			if (-1 != hctx->fd) return HANDLER_WAIT_FOR_EVENT;
1452 		} else {
1453 			handler_t r = connection_handle_read_post_state(srv, con);
1454 			if (!chunkqueue_is_empty(cq)) {
1455 				if (fdevent_event_get_interest(srv->ev, hctx->fdtocgi) & FDEVENT_OUT) {
1456 					return (r == HANDLER_GO_ON) ? HANDLER_WAIT_FOR_EVENT : r;
1457 				}
1458 			}
1459 			if (r != HANDLER_GO_ON) return r;
1460 		}
1461 	}
1462 
1463 	if (-1 == hctx->fd) {
1464 		buffer *handler = cgi_get_handler(hctx->conf.cgi, con->physical.path);
1465 		if (!handler) return HANDLER_GO_ON; /*(should not happen; checked in cgi_is_handled())*/
1466 		if (cgi_create_env(srv, con, p, hctx, handler)) {
1467 			con->http_status = 500;
1468 			con->mode = DIRECT;
1469 
1470 			return HANDLER_FINISHED;
1471 		}
1472 #if 0
1473 	log_error_write(srv, __FILE__, __LINE__, "sdd", "subrequest, pid =", hctx, hctx->pid);
1474 #endif
1475 	} else if (!chunkqueue_is_empty(con->request_content_queue)) {
1476 		if (0 != cgi_write_request(srv, hctx, hctx->fdtocgi)) {
1477 			cgi_connection_close(srv, hctx);
1478 			return HANDLER_ERROR;
1479 		}
1480 	}
1481 
1482 	/* if not done, wait for CGI to close stdout, so we read EOF on pipe */
1483 	return HANDLER_WAIT_FOR_EVENT;
1484 }
1485 
1486 
1487 int mod_cgi_plugin_init(plugin *p);
1488 int mod_cgi_plugin_init(plugin *p) {
1489 	p->version     = LIGHTTPD_VERSION_ID;
1490 	p->name        = buffer_init_string("cgi");
1491 
1492 	p->connection_reset = cgi_connection_close_callback;
1493 	p->handle_subrequest_start = cgi_is_handled;
1494 	p->handle_subrequest = mod_cgi_handle_subrequest;
1495 	p->handle_trigger = cgi_trigger;
1496 	p->init           = mod_cgi_init;
1497 	p->cleanup        = mod_cgi_free;
1498 	p->set_defaults   = mod_fastcgi_set_defaults;
1499 
1500 	p->data        = NULL;
1501 
1502 	return 0;
1503 }
1504