1 #include "first.h" 2 3 #include "base.h" 4 #include "stat_cache.h" 5 #include "http_kv.h" 6 #include "log.h" 7 #include "connections.h" 8 #include "joblist.h" 9 #include "response.h" 10 #include "http_chunk.h" 11 #include "http_header.h" 12 13 #include "plugin.h" 14 15 #include <sys/types.h> 16 #include "sys-mmap.h" 17 #include "sys-socket.h" 18 # include <sys/wait.h> 19 20 #include <unistd.h> 21 #include <errno.h> 22 #include <stdlib.h> 23 #include <string.h> 24 #include <fdevent.h> 25 26 #include <fcntl.h> 27 #include <signal.h> 28 29 static int pipe_cloexec(int pipefd[2]) { 30 #ifdef HAVE_PIPE2 31 if (0 == pipe2(pipefd, O_CLOEXEC)) return 0; 32 #endif 33 return 0 == pipe(pipefd) 34 #ifdef FD_CLOEXEC 35 && 0 == fcntl(pipefd[0], F_SETFD, FD_CLOEXEC) 36 && 0 == fcntl(pipefd[1], F_SETFD, FD_CLOEXEC) 37 #endif 38 ? 0 39 : -1; 40 } 41 42 typedef struct { 43 char *ptr; 44 size_t used; 45 size_t size; 46 size_t *offsets; 47 size_t osize; 48 size_t oused; 49 char **eptr; 50 size_t esize; 51 buffer *ld_preload; 52 buffer *ld_library_path; 53 #ifdef __CYGWIN__ 54 buffer *systemroot; 55 #endif 56 } env_accum; 57 58 typedef struct { 59 struct { pid_t pid; void *ctx; } *ptr; 60 size_t used; 61 size_t size; 62 } buffer_pid_t; 63 64 typedef struct { 65 array *cgi; 66 unsigned short execute_x_only; 67 unsigned short local_redir; 68 unsigned short xsendfile_allow; 69 unsigned short upgrade; 70 array *xsendfile_docroot; 71 } plugin_config; 72 73 typedef struct { 74 PLUGIN_DATA; 75 plugin_config **config_storage; 76 plugin_config conf; 77 buffer_pid_t cgi_pid; 78 env_accum env; 79 } plugin_data; 80 81 typedef struct { 82 pid_t pid; 83 int fd; 84 int fdtocgi; 85 fdnode *fdn; 86 fdnode *fdntocgi; 87 88 connection *remote_conn; /* dumb pointer */ 89 plugin_data *plugin_data; /* dumb pointer */ 90 91 buffer *response; 92 buffer *cgi_handler; /* dumb pointer */ 93 http_response_opts opts; 94 plugin_config conf; 95 } handler_ctx; 96 97 static handler_ctx * cgi_handler_ctx_init(void) { 98 handler_ctx *hctx = calloc(1, sizeof(*hctx)); 99 100 force_assert(hctx); 101 102 hctx->response = chunk_buffer_acquire(); 103 hctx->fd = -1; 104 hctx->fdtocgi = -1; 105 106 return hctx; 107 } 108 109 static void cgi_handler_ctx_free(handler_ctx *hctx) { 110 chunk_buffer_release(hctx->response); 111 free(hctx); 112 } 113 114 INIT_FUNC(mod_cgi_init) { 115 plugin_data *p; 116 const char *s; 117 118 p = calloc(1, sizeof(*p)); 119 120 force_assert(p); 121 122 /* for valgrind */ 123 s = getenv("LD_PRELOAD"); 124 if (s) p->env.ld_preload = buffer_init_string(s); 125 s = getenv("LD_LIBRARY_PATH"); 126 if (s) p->env.ld_library_path = buffer_init_string(s); 127 #ifdef __CYGWIN__ 128 /* CYGWIN needs SYSTEMROOT */ 129 s = getenv("SYSTEMROOT"); 130 if (s) p->env.systemroot = buffer_init_string(s); 131 #endif 132 133 return p; 134 } 135 136 137 FREE_FUNC(mod_cgi_free) { 138 plugin_data *p = p_d; 139 buffer_pid_t *r = &(p->cgi_pid); 140 141 UNUSED(srv); 142 143 if (p->config_storage) { 144 size_t i; 145 for (i = 0; i < srv->config_context->used; i++) { 146 plugin_config *s = p->config_storage[i]; 147 148 if (NULL == s) continue; 149 150 array_free(s->cgi); 151 array_free(s->xsendfile_docroot); 152 153 free(s); 154 } 155 free(p->config_storage); 156 } 157 158 159 if (r->ptr) free(r->ptr); 160 free(p->env.ptr); 161 free(p->env.offsets); 162 free(p->env.eptr); 163 buffer_free(p->env.ld_preload); 164 buffer_free(p->env.ld_library_path); 165 #ifdef __CYGWIN__ 166 buffer_free(p->env.systemroot); 167 #endif 168 free(p); 169 170 return HANDLER_GO_ON; 171 } 172 173 SETDEFAULTS_FUNC(mod_fastcgi_set_defaults) { 174 plugin_data *p = p_d; 175 size_t i = 0; 176 177 config_values_t cv[] = { 178 { "cgi.assign", NULL, T_CONFIG_ARRAY, T_CONFIG_SCOPE_CONNECTION }, /* 0 */ 179 { "cgi.execute-x-only", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION }, /* 1 */ 180 { "cgi.x-sendfile", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION }, /* 2 */ 181 { "cgi.x-sendfile-docroot", NULL, T_CONFIG_ARRAY, T_CONFIG_SCOPE_CONNECTION }, /* 3 */ 182 { "cgi.local-redir", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION }, /* 4 */ 183 { "cgi.upgrade", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION }, /* 5 */ 184 { NULL, NULL, T_CONFIG_UNSET, T_CONFIG_SCOPE_UNSET} 185 }; 186 187 if (!p) return HANDLER_ERROR; 188 189 p->config_storage = calloc(srv->config_context->used, sizeof(plugin_config *)); 190 force_assert(p->config_storage); 191 192 for (i = 0; i < srv->config_context->used; i++) { 193 data_config const* config = (data_config const*)srv->config_context->data[i]; 194 plugin_config *s; 195 196 s = calloc(1, sizeof(plugin_config)); 197 force_assert(s); 198 199 s->cgi = array_init(); 200 s->execute_x_only = 0; 201 s->local_redir = 0; 202 s->xsendfile_allow= 0; 203 s->xsendfile_docroot = array_init(); 204 s->upgrade = 0; 205 206 cv[0].destination = s->cgi; 207 cv[1].destination = &(s->execute_x_only); 208 cv[2].destination = &(s->xsendfile_allow); 209 cv[3].destination = s->xsendfile_docroot; 210 cv[4].destination = &(s->local_redir); 211 cv[5].destination = &(s->upgrade); 212 213 p->config_storage[i] = s; 214 215 if (0 != config_insert_values_global(srv, config->value, cv, i == 0 ? T_CONFIG_SCOPE_SERVER : T_CONFIG_SCOPE_CONNECTION)) { 216 return HANDLER_ERROR; 217 } 218 219 if (!array_is_kvstring(s->cgi)) { 220 log_error_write(srv, __FILE__, __LINE__, "s", 221 "unexpected value for cgi.assign; expected list of \"ext\" => \"exepath\""); 222 return HANDLER_ERROR; 223 } 224 225 if (s->xsendfile_docroot->used) { 226 size_t j; 227 for (j = 0; j < s->xsendfile_docroot->used; ++j) { 228 data_string *ds = (data_string *)s->xsendfile_docroot->data[j]; 229 if (ds->type != TYPE_STRING) { 230 log_error_write(srv, __FILE__, __LINE__, "s", 231 "unexpected type for key cgi.x-sendfile-docroot; expected: cgi.x-sendfile-docroot = ( \"/allowed/path\", ... )"); 232 return HANDLER_ERROR; 233 } 234 if (ds->value->ptr[0] != '/') { 235 log_error_write(srv, __FILE__, __LINE__, "SBs", 236 "cgi.x-sendfile-docroot paths must begin with '/'; invalid: \"", ds->value, "\""); 237 return HANDLER_ERROR; 238 } 239 buffer_path_simplify(ds->value, ds->value); 240 buffer_append_slash(ds->value); 241 } 242 } 243 } 244 245 return HANDLER_GO_ON; 246 } 247 248 249 static void cgi_pid_add(plugin_data *p, pid_t pid, void *ctx) { 250 buffer_pid_t *r = &(p->cgi_pid); 251 252 if (r->used == r->size) { 253 r->size += 16; 254 r->ptr = realloc(r->ptr, sizeof(*r->ptr) * r->size); 255 force_assert(r->ptr); 256 } 257 258 r->ptr[r->used].pid = pid; 259 r->ptr[r->used].ctx = ctx; 260 ++r->used; 261 } 262 263 static void cgi_pid_kill(plugin_data *p, pid_t pid) { 264 buffer_pid_t *r = &(p->cgi_pid); 265 for (size_t i = 0; i < r->used; ++i) { 266 if (r->ptr[i].pid == pid) { 267 r->ptr[i].ctx = NULL; 268 kill(pid, SIGTERM); 269 return; 270 } 271 } 272 } 273 274 static void cgi_pid_del(plugin_data *p, size_t i) { 275 buffer_pid_t *r = &(p->cgi_pid); 276 277 if (i != r->used - 1) { 278 r->ptr[i] = r->ptr[r->used - 1]; 279 } 280 r->used--; 281 } 282 283 284 static void cgi_connection_close_fdtocgi(server *srv, handler_ctx *hctx) { 285 /*(closes only hctx->fdtocgi)*/ 286 fdevent_fdnode_event_del(srv->ev, hctx->fdntocgi); 287 /*fdevent_unregister(srv->ev, hctx->fdtocgi);*//*(handled below)*/ 288 fdevent_sched_close(srv->ev, hctx->fdtocgi, 0); 289 hctx->fdntocgi = NULL; 290 hctx->fdtocgi = -1; 291 } 292 293 static void cgi_connection_close(server *srv, handler_ctx *hctx) { 294 plugin_data *p = hctx->plugin_data; 295 connection *con = hctx->remote_conn; 296 297 /* the connection to the browser went away, but we still have a connection 298 * to the CGI script 299 * 300 * close cgi-connection 301 */ 302 303 if (hctx->fd != -1) { 304 /* close connection to the cgi-script */ 305 fdevent_fdnode_event_del(srv->ev, hctx->fdn); 306 /*fdevent_unregister(srv->ev, hctx->fd);*//*(handled below)*/ 307 fdevent_sched_close(srv->ev, hctx->fd, 0); 308 hctx->fdn = NULL; 309 } 310 311 if (hctx->fdtocgi != -1) { 312 cgi_connection_close_fdtocgi(srv, hctx); /*(closes only hctx->fdtocgi)*/ 313 } 314 315 if (hctx->pid > 0) { 316 cgi_pid_kill(p, hctx->pid); 317 } 318 319 con->plugin_ctx[p->id] = NULL; 320 321 cgi_handler_ctx_free(hctx); 322 323 /* finish response (if not already con->file_started, con->file_finished) */ 324 if (con->mode == p->id) { 325 http_response_backend_done(srv, con); 326 } 327 } 328 329 static handler_t cgi_connection_close_callback(server *srv, connection *con, void *p_d) { 330 plugin_data *p = p_d; 331 handler_ctx *hctx = con->plugin_ctx[p->id]; 332 if (hctx) cgi_connection_close(srv, hctx); 333 334 return HANDLER_GO_ON; 335 } 336 337 338 static int cgi_write_request(server *srv, handler_ctx *hctx, int fd); 339 340 341 static handler_t cgi_handle_fdevent_send (server *srv, void *ctx, int revents) { 342 handler_ctx *hctx = ctx; 343 connection *con = hctx->remote_conn; 344 345 /*(joblist only actually necessary here in mod_cgi fdevent send if returning HANDLER_ERROR)*/ 346 joblist_append(srv, con); 347 348 if (revents & FDEVENT_OUT) { 349 if (0 != cgi_write_request(srv, hctx, hctx->fdtocgi)) { 350 cgi_connection_close(srv, hctx); 351 return HANDLER_ERROR; 352 } 353 /* more request body to be sent to CGI */ 354 } 355 356 if (revents & FDEVENT_HUP) { 357 /* skip sending remaining data to CGI */ 358 if (con->request.content_length) { 359 chunkqueue *cq = con->request_content_queue; 360 chunkqueue_mark_written(cq, chunkqueue_length(cq)); 361 if (cq->bytes_in != (off_t)con->request.content_length) { 362 con->keep_alive = 0; 363 } 364 } 365 366 cgi_connection_close_fdtocgi(srv, hctx); /*(closes only hctx->fdtocgi)*/ 367 } else if (revents & FDEVENT_ERR) { 368 /* kill all connections to the cgi process */ 369 #if 1 370 log_error_write(srv, __FILE__, __LINE__, "s", "cgi-FDEVENT_ERR"); 371 #endif 372 cgi_connection_close(srv, hctx); 373 return HANDLER_ERROR; 374 } 375 376 return HANDLER_FINISHED; 377 } 378 379 380 static handler_t cgi_response_headers(server *srv, connection *con, struct http_response_opts_t *opts) { 381 /* response headers just completed */ 382 handler_ctx *hctx = (handler_ctx *)opts->pdata; 383 384 if (con->response.htags & HTTP_HEADER_UPGRADE) { 385 if (hctx->conf.upgrade && con->http_status == 101) { 386 /* 101 Switching Protocols; transition to transparent proxy */ 387 http_response_upgrade_read_body_unknown(srv, con); 388 } 389 else { 390 con->response.htags &= ~HTTP_HEADER_UPGRADE; 391 #if 0 392 /* preserve prior questionable behavior; likely broken behavior 393 * anyway if backend thinks connection is being upgraded but client 394 * does not receive Connection: upgrade */ 395 http_header_response_unset(con, HTTP_HEADER_UPGRADE, 396 CONST_STR_LEN("Upgrade")); 397 #endif 398 } 399 } 400 401 if (hctx->conf.upgrade && !(con->response.htags & HTTP_HEADER_UPGRADE)) { 402 chunkqueue *cq = con->request_content_queue; 403 hctx->conf.upgrade = 0; 404 if (cq->bytes_out == (off_t)con->request.content_length) { 405 cgi_connection_close_fdtocgi(srv, hctx); /*(closes hctx->fdtocgi)*/ 406 } 407 } 408 409 return HANDLER_GO_ON; 410 } 411 412 413 static int cgi_recv_response(server *srv, handler_ctx *hctx) { 414 switch (http_response_read(srv, hctx->remote_conn, &hctx->opts, 415 hctx->response, hctx->fdn)) { 416 default: 417 return HANDLER_GO_ON; 418 case HANDLER_ERROR: 419 http_response_backend_error(srv, hctx->remote_conn); 420 /* fall through */ 421 case HANDLER_FINISHED: 422 cgi_connection_close(srv, hctx); 423 return HANDLER_FINISHED; 424 case HANDLER_COMEBACK: 425 /* hctx->conf.local_redir */ 426 buffer_clear(hctx->response); 427 connection_response_reset(srv, hctx->remote_conn); /*(includes con->http_status = 0)*/ 428 plugins_call_connection_reset(srv, hctx->remote_conn); 429 /*cgi_connection_close(srv, hctx);*//*(already cleaned up and hctx is now invalid)*/ 430 return HANDLER_COMEBACK; 431 } 432 } 433 434 435 static handler_t cgi_handle_fdevent(server *srv, void *ctx, int revents) { 436 handler_ctx *hctx = ctx; 437 connection *con = hctx->remote_conn; 438 439 joblist_append(srv, con); 440 441 if (revents & FDEVENT_IN) { 442 handler_t rc = cgi_recv_response(srv, hctx);/*(might invalidate hctx)*/ 443 if (rc != HANDLER_GO_ON) return rc; /*(unless HANDLER_GO_ON)*/ 444 } 445 446 /* perhaps this issue is already handled */ 447 if (revents & (FDEVENT_HUP|FDEVENT_RDHUP)) { 448 if (con->file_started) { 449 /* drain any remaining data from kernel pipe buffers 450 * even if (con->conf.stream_response_body 451 * & FDEVENT_STREAM_RESPONSE_BUFMIN) 452 * since event loop will spin on fd FDEVENT_HUP event 453 * until unregistered. */ 454 handler_t rc; 455 const unsigned short flags = con->conf.stream_response_body; 456 con->conf.stream_response_body &= ~FDEVENT_STREAM_RESPONSE_BUFMIN; 457 con->conf.stream_response_body |= FDEVENT_STREAM_RESPONSE_POLLRDHUP; 458 do { 459 rc = cgi_recv_response(srv,hctx);/*(might invalidate hctx)*/ 460 } while (rc == HANDLER_GO_ON); /*(unless HANDLER_GO_ON)*/ 461 con->conf.stream_response_body = flags; 462 return rc; /* HANDLER_FINISHED or HANDLER_COMEBACK or HANDLER_ERROR */ 463 } else if (!buffer_string_is_empty(hctx->response)) { 464 /* unfinished header package which is a body in reality */ 465 con->file_started = 1; 466 if (0 != http_chunk_append_buffer(srv, con, hctx->response)) { 467 cgi_connection_close(srv, hctx); 468 return HANDLER_ERROR; 469 } 470 if (0 == con->http_status) con->http_status = 200; /* OK */ 471 } 472 cgi_connection_close(srv, hctx); 473 } else if (revents & FDEVENT_ERR) { 474 /* kill all connections to the cgi process */ 475 cgi_connection_close(srv, hctx); 476 return HANDLER_ERROR; 477 } 478 479 return HANDLER_FINISHED; 480 } 481 482 483 static int cgi_env_add(void *venv, const char *key, size_t key_len, const char *val, size_t val_len) { 484 env_accum *env = venv; 485 char *dst; 486 487 if (!key || !val) return -1; 488 489 if (env->size - env->used < key_len + val_len + 2) { 490 if (0 == env->size) env->size = 4096; 491 do { env->size *= 2; } while (env->size - env->used < key_len + val_len + 2); 492 env->ptr = realloc(env->ptr, env->size); 493 force_assert(env->ptr); 494 } 495 496 dst = env->ptr + env->used; 497 memcpy(dst, key, key_len); 498 dst[key_len] = '='; 499 memcpy(dst + key_len + 1, val, val_len); 500 dst[key_len + 1 + val_len] = '\0'; 501 502 if (env->osize == env->oused) { 503 env->osize += 16; 504 env->offsets = realloc(env->offsets, env->osize * sizeof(*env->offsets)); 505 force_assert(env->offsets); 506 } 507 env->offsets[env->oused++] = env->used; 508 env->used += key_len + val_len + 2; 509 510 return 0; 511 } 512 513 /*(improved from network_write_mmap.c)*/ 514 static off_t mmap_align_offset(off_t start) { 515 static off_t pagemask = 0; 516 if (0 == pagemask) { 517 long pagesize = sysconf(_SC_PAGESIZE); 518 if (-1 == pagesize) pagesize = 4096; 519 pagemask = ~((off_t)pagesize - 1); /* pagesize always power-of-2 */ 520 } 521 return (start & pagemask); 522 } 523 524 /* returns: 0: continue, -1: fatal error, -2: connection reset */ 525 /* similar to network_write_file_chunk_mmap, but doesn't use send on windows (because we're on pipes), 526 * also mmaps and sends complete chunk instead of only small parts - the files 527 * are supposed to be temp files with reasonable chunk sizes. 528 * 529 * Also always use mmap; the files are "trusted", as we created them. 530 */ 531 static ssize_t cgi_write_file_chunk_mmap(server *srv, connection *con, int fd, chunkqueue *cq) { 532 chunk* const c = cq->first; 533 off_t offset, toSend, file_end; 534 ssize_t r; 535 size_t mmap_offset, mmap_avail; 536 char *data = NULL; 537 538 force_assert(NULL != c); 539 force_assert(FILE_CHUNK == c->type); 540 force_assert(c->offset >= 0 && c->offset <= c->file.length); 541 542 offset = c->file.start + c->offset; 543 toSend = c->file.length - c->offset; 544 file_end = c->file.start + c->file.length; /* offset to file end in this chunk */ 545 546 if (0 == toSend) { 547 chunkqueue_remove_finished_chunks(cq); 548 return 0; 549 } 550 551 /*(simplified from chunk.c:chunkqueue_open_file_chunk())*/ 552 UNUSED(con); 553 if (-1 == c->file.fd) { 554 if (-1 == (c->file.fd = fdevent_open_cloexec(c->mem->ptr, con->conf.follow_symlink, O_RDONLY, 0))) { 555 log_error_write(srv, __FILE__, __LINE__, "ssb", "open failed:", strerror(errno), c->mem); 556 return -1; 557 } 558 } 559 560 /* (re)mmap the buffer if range is not covered completely */ 561 if (MAP_FAILED == c->file.mmap.start 562 || offset < c->file.mmap.offset 563 || file_end > (off_t)(c->file.mmap.offset + c->file.mmap.length)) { 564 565 if (MAP_FAILED != c->file.mmap.start) { 566 munmap(c->file.mmap.start, c->file.mmap.length); 567 c->file.mmap.start = MAP_FAILED; 568 } 569 570 c->file.mmap.offset = mmap_align_offset(offset); 571 c->file.mmap.length = file_end - c->file.mmap.offset; 572 573 if (MAP_FAILED == (c->file.mmap.start = mmap(NULL, c->file.mmap.length, PROT_READ, MAP_PRIVATE, c->file.fd, c->file.mmap.offset))) { 574 if (toSend > 65536) toSend = 65536; 575 data = malloc(toSend); 576 force_assert(data); 577 if (-1 == lseek(c->file.fd, offset, SEEK_SET) 578 || 0 >= (toSend = read(c->file.fd, data, toSend))) { 579 if (-1 == toSend) { 580 log_error_write(srv, __FILE__, __LINE__, "ssbdo", "lseek/read failed:", 581 strerror(errno), c->mem, c->file.fd, offset); 582 } else { /*(0 == toSend)*/ 583 log_error_write(srv, __FILE__, __LINE__, "sbdo", "unexpected EOF (input truncated?):", 584 c->mem, c->file.fd, offset); 585 } 586 free(data); 587 return -1; 588 } 589 } 590 } 591 592 if (MAP_FAILED != c->file.mmap.start) { 593 force_assert(offset >= c->file.mmap.offset); 594 mmap_offset = offset - c->file.mmap.offset; 595 force_assert(c->file.mmap.length > mmap_offset); 596 mmap_avail = c->file.mmap.length - mmap_offset; 597 force_assert(toSend <= (off_t) mmap_avail); 598 599 data = c->file.mmap.start + mmap_offset; 600 } 601 602 r = write(fd, data, toSend); 603 604 if (MAP_FAILED == c->file.mmap.start) free(data); 605 606 if (r < 0) { 607 switch (errno) { 608 case EAGAIN: 609 case EINTR: 610 return 0; 611 case EPIPE: 612 case ECONNRESET: 613 return -2; 614 default: 615 log_error_write(srv, __FILE__, __LINE__, "ssd", 616 "write failed:", strerror(errno), fd); 617 return -1; 618 } 619 } 620 621 chunkqueue_mark_written(cq, r); 622 return r; 623 } 624 625 static int cgi_write_request(server *srv, handler_ctx *hctx, int fd) { 626 connection *con = hctx->remote_conn; 627 chunkqueue *cq = con->request_content_queue; 628 chunk *c; 629 630 /* old comment: windows doesn't support select() on pipes - wouldn't be easy to fix for all platforms. 631 * solution: if this is still a problem on windows, then substitute 632 * socketpair() for pipe() and closesocket() for close() on windows. 633 */ 634 635 for (c = cq->first; c; c = cq->first) { 636 ssize_t r = -1; 637 638 switch(c->type) { 639 case FILE_CHUNK: 640 r = cgi_write_file_chunk_mmap(srv, con, fd, cq); 641 break; 642 643 case MEM_CHUNK: 644 if ((r = write(fd, c->mem->ptr + c->offset, buffer_string_length(c->mem) - c->offset)) < 0) { 645 switch(errno) { 646 case EAGAIN: 647 case EINTR: 648 /* ignore and try again */ 649 r = 0; 650 break; 651 case EPIPE: 652 case ECONNRESET: 653 /* connection closed */ 654 r = -2; 655 break; 656 default: 657 /* fatal error */ 658 log_error_write(srv, __FILE__, __LINE__, "ss", "write failed due to: ", strerror(errno)); 659 r = -1; 660 break; 661 } 662 } else if (r > 0) { 663 chunkqueue_mark_written(cq, r); 664 } 665 break; 666 } 667 668 if (0 == r) break; /*(might block)*/ 669 670 switch (r) { 671 case -1: 672 /* fatal error */ 673 return -1; 674 case -2: 675 /* connection reset */ 676 log_error_write(srv, __FILE__, __LINE__, "s", "failed to send post data to cgi, connection closed by CGI"); 677 /* skip all remaining data */ 678 chunkqueue_mark_written(cq, chunkqueue_length(cq)); 679 break; 680 default: 681 break; 682 } 683 } 684 685 if (cq->bytes_out == (off_t)con->request.content_length && !hctx->conf.upgrade) { 686 /* sent all request body input */ 687 /* close connection to the cgi-script */ 688 if (-1 == hctx->fdtocgi) { /*(received request body sent in initial send to pipe buffer)*/ 689 --srv->cur_fds; 690 if (close(fd)) { 691 log_error_write(srv, __FILE__, __LINE__, "sds", "cgi stdin close failed ", fd, strerror(errno)); 692 } 693 } else { 694 cgi_connection_close_fdtocgi(srv, hctx); /*(closes only hctx->fdtocgi)*/ 695 } 696 } else { 697 off_t cqlen = cq->bytes_in - cq->bytes_out; 698 if (cq->bytes_in != con->request.content_length && cqlen < 65536 - 16384) { 699 /*(con->conf.stream_request_body & FDEVENT_STREAM_REQUEST)*/ 700 if (!(con->conf.stream_request_body & FDEVENT_STREAM_REQUEST_POLLIN)) { 701 con->conf.stream_request_body |= FDEVENT_STREAM_REQUEST_POLLIN; 702 con->is_readable = 1; /* trigger optimistic read from client */ 703 } 704 } 705 if (-1 == hctx->fdtocgi) { /*(not registered yet)*/ 706 hctx->fdtocgi = fd; 707 hctx->fdntocgi = fdevent_register(srv->ev, hctx->fdtocgi, cgi_handle_fdevent_send, hctx); 708 } 709 if (0 == cqlen) { /*(chunkqueue_is_empty(cq))*/ 710 if ((fdevent_fdnode_interest(hctx->fdntocgi) & FDEVENT_OUT)) { 711 fdevent_fdnode_event_set(srv->ev, hctx->fdntocgi, 0); 712 } 713 } else { 714 /* more request body remains to be sent to CGI so register for fdevents */ 715 fdevent_fdnode_event_set(srv->ev, hctx->fdntocgi, FDEVENT_OUT); 716 } 717 } 718 719 return 0; 720 } 721 722 static struct stat * cgi_stat(server *srv, connection *con, buffer *path) { 723 /* CGI might be executable even if it is not readable */ 724 stat_cache_entry *sce; 725 return (HANDLER_ERROR != stat_cache_get_entry(srv, con, path, &sce)) 726 ? &sce->st 727 : NULL; 728 } 729 730 static int cgi_create_env(server *srv, connection *con, plugin_data *p, handler_ctx *hctx, buffer *cgi_handler) { 731 char *args[3]; 732 int to_cgi_fds[2]; 733 int from_cgi_fds[2]; 734 int dfd = -1; 735 UNUSED(p); 736 737 if (!buffer_string_is_empty(cgi_handler)) { 738 if (NULL == cgi_stat(srv, con, cgi_handler)) { 739 log_error_write(srv, __FILE__, __LINE__, "sbss", 740 "stat for cgi-handler", cgi_handler, 741 "failed:", strerror(errno)); 742 return -1; 743 } 744 } 745 746 if (pipe_cloexec(to_cgi_fds)) { 747 log_error_write(srv, __FILE__, __LINE__, "ss", "pipe failed:", strerror(errno)); 748 return -1; 749 } 750 if (pipe_cloexec(from_cgi_fds)) { 751 close(to_cgi_fds[0]); 752 close(to_cgi_fds[1]); 753 log_error_write(srv, __FILE__, __LINE__, "ss", "pipe failed:", strerror(errno)); 754 return -1; 755 } 756 fdevent_setfd_cloexec(to_cgi_fds[1]); 757 fdevent_setfd_cloexec(from_cgi_fds[0]); 758 759 { 760 size_t i = 0; 761 http_cgi_opts opts = { 0, 0, NULL, NULL }; 762 env_accum *env = &p->env; 763 env->used = 0; 764 env->oused = 0; 765 766 /* create environment */ 767 768 http_cgi_headers(srv, con, &opts, cgi_env_add, env); 769 770 /* for valgrind */ 771 if (p->env.ld_preload) { 772 cgi_env_add(env, CONST_STR_LEN("LD_PRELOAD"), CONST_BUF_LEN(p->env.ld_preload)); 773 } 774 if (p->env.ld_library_path) { 775 cgi_env_add(env, CONST_STR_LEN("LD_LIBRARY_PATH"), CONST_BUF_LEN(p->env.ld_library_path)); 776 } 777 #ifdef __CYGWIN__ 778 /* CYGWIN needs SYSTEMROOT */ 779 if (p->env.systemroot) { 780 cgi_env_add(env, CONST_STR_LEN("SYSTEMROOT"), CONST_BUF_LEN(p->env.systemroot)); 781 } 782 #endif 783 784 if (env->esize <= env->oused) { 785 env->esize = (env->oused + 1 + 0xf) & ~(0xfuL); 786 env->eptr = realloc(env->eptr, env->esize * sizeof(*env->eptr)); 787 force_assert(env->eptr); 788 } 789 for (i = 0; i < env->oused; ++i) { 790 env->eptr[i] = env->ptr + env->offsets[i]; 791 } 792 env->eptr[env->oused] = NULL; 793 794 /* set up args */ 795 i = 0; 796 797 if (!buffer_string_is_empty(cgi_handler)) { 798 args[i++] = cgi_handler->ptr; 799 } 800 args[i++] = con->physical.path->ptr; 801 args[i ] = NULL; 802 } 803 804 dfd = fdevent_open_dirname(con->physical.path->ptr, con->conf.follow_symlink); 805 if (-1 == dfd) { 806 log_error_write(srv, __FILE__, __LINE__, "ssb", "open dirname failed:", strerror(errno), con->physical.path); 807 } 808 809 hctx->pid = (dfd >= 0) ? fdevent_fork_execve(args[0], args, p->env.eptr, to_cgi_fds[0], from_cgi_fds[1], -1, dfd) : -1; 810 811 if (-1 == hctx->pid) { 812 /* log error with errno prior to calling close() (might change errno) */ 813 log_error_write(srv, __FILE__, __LINE__, "ss", "fork failed:", strerror(errno)); 814 if (-1 != dfd) close(dfd); 815 close(from_cgi_fds[0]); 816 close(from_cgi_fds[1]); 817 close(to_cgi_fds[0]); 818 close(to_cgi_fds[1]); 819 return -1; 820 } else { 821 if (-1 != dfd) close(dfd); 822 close(from_cgi_fds[1]); 823 close(to_cgi_fds[0]); 824 825 hctx->fd = from_cgi_fds[0]; 826 827 ++srv->cur_fds; 828 829 cgi_pid_add(p, hctx->pid, hctx); 830 831 if (0 == con->request.content_length) { 832 close(to_cgi_fds[1]); 833 } else { 834 /* there is content to send */ 835 if (-1 == fdevent_fcntl_set_nb(srv->ev, to_cgi_fds[1])) { 836 log_error_write(srv, __FILE__, __LINE__, "ss", "fcntl failed: ", strerror(errno)); 837 close(to_cgi_fds[1]); 838 cgi_connection_close(srv, hctx); 839 return -1; 840 } 841 842 if (0 != cgi_write_request(srv, hctx, to_cgi_fds[1])) { 843 close(to_cgi_fds[1]); 844 cgi_connection_close(srv, hctx); 845 return -1; 846 } 847 848 ++srv->cur_fds; 849 } 850 851 hctx->fdn = fdevent_register(srv->ev, hctx->fd, cgi_handle_fdevent, hctx); 852 if (-1 == fdevent_fcntl_set_nb(srv->ev, hctx->fd)) { 853 log_error_write(srv, __FILE__, __LINE__, "ss", "fcntl failed: ", strerror(errno)); 854 cgi_connection_close(srv, hctx); 855 return -1; 856 } 857 fdevent_fdnode_event_set(srv->ev, hctx->fdn, FDEVENT_IN | FDEVENT_RDHUP); 858 859 return 0; 860 } 861 } 862 863 #define PATCH(x) \ 864 p->conf.x = s->x; 865 static int mod_cgi_patch_connection(server *srv, connection *con, plugin_data *p) { 866 size_t i, j; 867 plugin_config *s = p->config_storage[0]; 868 869 PATCH(cgi); 870 PATCH(execute_x_only); 871 PATCH(local_redir); 872 PATCH(upgrade); 873 PATCH(xsendfile_allow); 874 PATCH(xsendfile_docroot); 875 876 /* skip the first, the global context */ 877 for (i = 1; i < srv->config_context->used; i++) { 878 data_config *dc = (data_config *)srv->config_context->data[i]; 879 s = p->config_storage[i]; 880 881 /* condition didn't match */ 882 if (!config_check_cond(srv, con, dc)) continue; 883 884 /* merge config */ 885 for (j = 0; j < dc->value->used; j++) { 886 data_unset *du = dc->value->data[j]; 887 888 if (buffer_is_equal_string(du->key, CONST_STR_LEN("cgi.assign"))) { 889 PATCH(cgi); 890 } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("cgi.execute-x-only"))) { 891 PATCH(execute_x_only); 892 } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("cgi.local-redir"))) { 893 PATCH(local_redir); 894 } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("cgi.upgrade"))) { 895 PATCH(upgrade); 896 } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("cgi.x-sendfile"))) { 897 PATCH(xsendfile_allow); 898 } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("cgi.x-sendfile-docroot"))) { 899 PATCH(xsendfile_docroot); 900 } 901 } 902 } 903 904 return 0; 905 } 906 #undef PATCH 907 908 URIHANDLER_FUNC(cgi_is_handled) { 909 plugin_data *p = p_d; 910 struct stat *st; 911 data_string *ds; 912 913 if (con->mode != DIRECT) return HANDLER_GO_ON; 914 if (buffer_is_empty(con->physical.path)) return HANDLER_GO_ON; 915 916 mod_cgi_patch_connection(srv, con, p); 917 918 ds = (data_string *)array_match_key_suffix(p->conf.cgi, con->physical.path); 919 if (NULL == ds) return HANDLER_GO_ON; 920 921 st = cgi_stat(srv, con, con->physical.path); 922 if (NULL == st) return HANDLER_GO_ON; 923 924 if (!S_ISREG(st->st_mode)) return HANDLER_GO_ON; 925 if (p->conf.execute_x_only == 1 && (st->st_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0) return HANDLER_GO_ON; 926 927 { 928 handler_ctx *hctx = cgi_handler_ctx_init(); 929 hctx->remote_conn = con; 930 hctx->plugin_data = p; 931 hctx->cgi_handler = ds->value; 932 memcpy(&hctx->conf, &p->conf, sizeof(plugin_config)); 933 hctx->conf.upgrade = 934 hctx->conf.upgrade 935 && con->request.http_version == HTTP_VERSION_1_1 936 && NULL != http_header_request_get(con, HTTP_HEADER_UPGRADE, CONST_STR_LEN("Upgrade")); 937 hctx->opts.fdfmt = S_IFIFO; 938 hctx->opts.backend = BACKEND_CGI; 939 hctx->opts.authorizer = 0; 940 hctx->opts.local_redir = hctx->conf.local_redir; 941 hctx->opts.xsendfile_allow = hctx->conf.xsendfile_allow; 942 hctx->opts.xsendfile_docroot = hctx->conf.xsendfile_docroot; 943 hctx->opts.pdata = hctx; 944 hctx->opts.headers = cgi_response_headers; 945 con->plugin_ctx[p->id] = hctx; 946 con->mode = p->id; 947 } 948 949 return HANDLER_GO_ON; 950 } 951 952 /* 953 * - HANDLER_GO_ON : not our job 954 * - HANDLER_FINISHED: got response 955 * - HANDLER_WAIT_FOR_EVENT: waiting for response 956 */ 957 SUBREQUEST_FUNC(mod_cgi_handle_subrequest) { 958 plugin_data *p = p_d; 959 handler_ctx *hctx = con->plugin_ctx[p->id]; 960 chunkqueue *cq = con->request_content_queue; 961 962 if (con->mode != p->id) return HANDLER_GO_ON; 963 if (NULL == hctx) return HANDLER_GO_ON; 964 965 if ((con->conf.stream_response_body & FDEVENT_STREAM_RESPONSE_BUFMIN) 966 && con->file_started) { 967 if (chunkqueue_length(con->write_queue) > 65536 - 4096) { 968 fdevent_fdnode_event_clr(srv->ev,hctx->fdn,FDEVENT_IN); 969 } else if (!(fdevent_fdnode_interest(hctx->fdn) & FDEVENT_IN)) { 970 /* optimistic read from backend */ 971 handler_t rc = cgi_recv_response(srv, hctx); /*(might invalidate hctx)*/ 972 if (rc != HANDLER_GO_ON) return rc; /*(unless HANDLER_GO_ON)*/ 973 fdevent_fdnode_event_add(srv->ev, hctx->fdn, FDEVENT_IN); 974 } 975 } 976 977 if (cq->bytes_in != (off_t)con->request.content_length) { 978 /*(64k - 4k to attempt to avoid temporary files 979 * in conjunction with FDEVENT_STREAM_REQUEST_BUFMIN)*/ 980 if (cq->bytes_in - cq->bytes_out > 65536 - 4096 981 && (con->conf.stream_request_body & FDEVENT_STREAM_REQUEST_BUFMIN)){ 982 con->conf.stream_request_body &= ~FDEVENT_STREAM_REQUEST_POLLIN; 983 if (-1 != hctx->fd) return HANDLER_WAIT_FOR_EVENT; 984 } else { 985 handler_t r = connection_handle_read_post_state(srv, con); 986 if (!chunkqueue_is_empty(cq)) { 987 if (fdevent_fdnode_interest(hctx->fdntocgi) & FDEVENT_OUT) { 988 return (r == HANDLER_GO_ON) ? HANDLER_WAIT_FOR_EVENT : r; 989 } 990 } 991 if (r != HANDLER_GO_ON) return r; 992 993 /* CGI environment requires that Content-Length be set. 994 * Send 411 Length Required if Content-Length missing. 995 * (occurs here if client sends Transfer-Encoding: chunked 996 * and module is flagged to stream request body to backend) */ 997 if (-1 == con->request.content_length) { 998 return connection_handle_read_post_error(srv, con, 411); 999 } 1000 } 1001 } 1002 1003 if (-1 == hctx->fd) { 1004 if (cgi_create_env(srv, con, p, hctx, hctx->cgi_handler)) { 1005 con->http_status = 500; 1006 con->mode = DIRECT; 1007 1008 return HANDLER_FINISHED; 1009 } 1010 } else if (!chunkqueue_is_empty(con->request_content_queue)) { 1011 if (0 != cgi_write_request(srv, hctx, hctx->fdtocgi)) { 1012 cgi_connection_close(srv, hctx); 1013 return HANDLER_ERROR; 1014 } 1015 } 1016 1017 /* if not done, wait for CGI to close stdout, so we read EOF on pipe */ 1018 return HANDLER_WAIT_FOR_EVENT; 1019 } 1020 1021 1022 static handler_t cgi_waitpid_cb(server *srv, void *p_d, pid_t pid, int status) { 1023 plugin_data *p = (plugin_data *)p_d; 1024 for (size_t i = 0; i < p->cgi_pid.used; ++i) { 1025 handler_ctx *hctx; 1026 if (pid != p->cgi_pid.ptr[i].pid) continue; 1027 1028 hctx = (handler_ctx *)p->cgi_pid.ptr[i].ctx; 1029 if (hctx) hctx->pid = -1; 1030 cgi_pid_del(p, i); 1031 1032 if (WIFEXITED(status)) { 1033 /* (skip logging (non-zero) CGI exit; might be very noisy) */ 1034 } 1035 else if (WIFSIGNALED(status)) { 1036 /* ignore SIGTERM if sent by cgi_connection_close() (NULL == hctx)*/ 1037 if (WTERMSIG(status) != SIGTERM || NULL != hctx) { 1038 log_error_write(srv, __FILE__, __LINE__, "sdsd", "CGI pid", pid, 1039 "died with signal", WTERMSIG(status)); 1040 } 1041 } 1042 else { 1043 log_error_write(srv, __FILE__, __LINE__, "sds", 1044 "CGI pid", pid, "ended unexpectedly"); 1045 } 1046 1047 return HANDLER_FINISHED; 1048 } 1049 1050 return HANDLER_GO_ON; 1051 } 1052 1053 1054 int mod_cgi_plugin_init(plugin *p); 1055 int mod_cgi_plugin_init(plugin *p) { 1056 p->version = LIGHTTPD_VERSION_ID; 1057 p->name = buffer_init_string("cgi"); 1058 1059 p->connection_reset = cgi_connection_close_callback; 1060 p->handle_subrequest_start = cgi_is_handled; 1061 p->handle_subrequest = mod_cgi_handle_subrequest; 1062 p->handle_waitpid = cgi_waitpid_cb; 1063 p->init = mod_cgi_init; 1064 p->cleanup = mod_cgi_free; 1065 p->set_defaults = mod_fastcgi_set_defaults; 1066 1067 p->data = NULL; 1068 1069 return 0; 1070 } 1071