xref: /lighttpd1.4/src/mod_cgi.c (revision d147673d)
1 #include "first.h"
2 
3 #include "server.h"
4 #include "stat_cache.h"
5 #include "keyvalue.h"
6 #include "log.h"
7 #include "connections.h"
8 #include "joblist.h"
9 #include "response.h"
10 #include "http_chunk.h"
11 #include "network_backends.h"
12 
13 #include "plugin.h"
14 
15 #include <sys/types.h>
16 #include "sys-mmap.h"
17 
18 #ifdef __WIN32
19 # include <winsock2.h>
20 #else
21 # include <sys/socket.h>
22 # include <sys/wait.h>
23 # include <netinet/in.h>
24 # include <arpa/inet.h>
25 #endif
26 
27 #include <unistd.h>
28 #include <errno.h>
29 #include <stdlib.h>
30 #include <string.h>
31 #include <fdevent.h>
32 #include <signal.h>
33 #include <ctype.h>
34 #include <assert.h>
35 
36 #include <stdio.h>
37 #include <fcntl.h>
38 
39 enum {EOL_UNSET, EOL_N, EOL_RN};
40 
41 typedef struct {
42 	char **ptr;
43 
44 	size_t size;
45 	size_t used;
46 } char_array;
47 
48 typedef struct {
49 	pid_t *ptr;
50 	size_t used;
51 	size_t size;
52 } buffer_pid_t;
53 
54 typedef struct {
55 	array *cgi;
56 	unsigned short execute_x_only;
57 	unsigned short xsendfile_allow;
58 	array *xsendfile_docroot;
59 } plugin_config;
60 
61 typedef struct {
62 	PLUGIN_DATA;
63 	buffer_pid_t cgi_pid;
64 
65 	buffer *tmp_buf;
66 	buffer *parse_response;
67 
68 	plugin_config **config_storage;
69 
70 	plugin_config conf;
71 } plugin_data;
72 
73 typedef struct {
74 	pid_t pid;
75 	int fd;
76 	int fdtocgi;
77 	int fde_ndx; /* index into the fd-event buffer */
78 	int fde_ndx_tocgi; /* index into the fd-event buffer */
79 
80 	connection *remote_conn;  /* dumb pointer */
81 	plugin_data *plugin_data; /* dumb pointer */
82 
83 	buffer *response;
84 	buffer *response_header;
85 } handler_ctx;
86 
87 static handler_ctx * cgi_handler_ctx_init(void) {
88 	handler_ctx *hctx = calloc(1, sizeof(*hctx));
89 
90 	force_assert(hctx);
91 
92 	hctx->response = buffer_init();
93 	hctx->response_header = buffer_init();
94 	hctx->fd = -1;
95 	hctx->fdtocgi = -1;
96 
97 	return hctx;
98 }
99 
100 static void cgi_handler_ctx_free(handler_ctx *hctx) {
101 	buffer_free(hctx->response);
102 	buffer_free(hctx->response_header);
103 
104 	free(hctx);
105 }
106 
107 enum {FDEVENT_HANDLED_UNSET, FDEVENT_HANDLED_FINISHED, FDEVENT_HANDLED_NOT_FINISHED, FDEVENT_HANDLED_ERROR};
108 
109 INIT_FUNC(mod_cgi_init) {
110 	plugin_data *p;
111 
112 	p = calloc(1, sizeof(*p));
113 
114 	force_assert(p);
115 
116 	p->tmp_buf = buffer_init();
117 	p->parse_response = buffer_init();
118 
119 	return p;
120 }
121 
122 
123 FREE_FUNC(mod_cgi_free) {
124 	plugin_data *p = p_d;
125 	buffer_pid_t *r = &(p->cgi_pid);
126 
127 	UNUSED(srv);
128 
129 	if (p->config_storage) {
130 		size_t i;
131 		for (i = 0; i < srv->config_context->used; i++) {
132 			plugin_config *s = p->config_storage[i];
133 
134 			if (NULL == s) continue;
135 
136 			array_free(s->cgi);
137 			array_free(s->xsendfile_docroot);
138 
139 			free(s);
140 		}
141 		free(p->config_storage);
142 	}
143 
144 
145 	if (r->ptr) free(r->ptr);
146 
147 	buffer_free(p->tmp_buf);
148 	buffer_free(p->parse_response);
149 
150 	free(p);
151 
152 	return HANDLER_GO_ON;
153 }
154 
155 SETDEFAULTS_FUNC(mod_fastcgi_set_defaults) {
156 	plugin_data *p = p_d;
157 	size_t i = 0;
158 
159 	config_values_t cv[] = {
160 		{ "cgi.assign",                  NULL, T_CONFIG_ARRAY, T_CONFIG_SCOPE_CONNECTION },       /* 0 */
161 		{ "cgi.execute-x-only",          NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION },     /* 1 */
162 		{ "cgi.x-sendfile",              NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION },     /* 2 */
163 		{ "cgi.x-sendfile-docroot",      NULL, T_CONFIG_ARRAY,   T_CONFIG_SCOPE_CONNECTION },     /* 3 */
164 		{ NULL,                          NULL, T_CONFIG_UNSET, T_CONFIG_SCOPE_UNSET}
165 	};
166 
167 	if (!p) return HANDLER_ERROR;
168 
169 	p->config_storage = calloc(1, srv->config_context->used * sizeof(plugin_config *));
170 	force_assert(p->config_storage);
171 
172 	for (i = 0; i < srv->config_context->used; i++) {
173 		data_config const* config = (data_config const*)srv->config_context->data[i];
174 		plugin_config *s;
175 
176 		s = calloc(1, sizeof(plugin_config));
177 		force_assert(s);
178 
179 		s->cgi    = array_init();
180 		s->execute_x_only = 0;
181 		s->xsendfile_allow= 0;
182 		s->xsendfile_docroot = array_init();
183 
184 		cv[0].destination = s->cgi;
185 		cv[1].destination = &(s->execute_x_only);
186 		cv[2].destination = &(s->xsendfile_allow);
187 		cv[3].destination = s->xsendfile_docroot;
188 
189 		p->config_storage[i] = s;
190 
191 		if (0 != config_insert_values_global(srv, config->value, cv, i == 0 ? T_CONFIG_SCOPE_SERVER : T_CONFIG_SCOPE_CONNECTION)) {
192 			return HANDLER_ERROR;
193 		}
194 
195 		if (s->xsendfile_docroot->used) {
196 			size_t j;
197 			for (j = 0; j < s->xsendfile_docroot->used; ++j) {
198 				data_string *ds = (data_string *)s->xsendfile_docroot->data[j];
199 				if (ds->type != TYPE_STRING) {
200 					log_error_write(srv, __FILE__, __LINE__, "s",
201 						"unexpected type for key cgi.x-sendfile-docroot; expected: cgi.x-sendfile-docroot = ( \"/allowed/path\", ... )");
202 					return HANDLER_ERROR;
203 				}
204 				if (ds->value->ptr[0] != '/') {
205 					log_error_write(srv, __FILE__, __LINE__, "SBs",
206 						"cgi.x-sendfile-docroot paths must begin with '/'; invalid: \"", ds->value, "\"");
207 					return HANDLER_ERROR;
208 				}
209 				buffer_path_simplify(ds->value, ds->value);
210 				buffer_append_slash(ds->value);
211 			}
212 		}
213 	}
214 
215 	return HANDLER_GO_ON;
216 }
217 
218 
219 static int cgi_pid_add(server *srv, plugin_data *p, pid_t pid) {
220 	int m = -1;
221 	size_t i;
222 	buffer_pid_t *r = &(p->cgi_pid);
223 
224 	UNUSED(srv);
225 
226 	for (i = 0; i < r->used; i++) {
227 		if (r->ptr[i] > m) m = r->ptr[i];
228 	}
229 
230 	if (r->size == 0) {
231 		r->size = 16;
232 		r->ptr = malloc(sizeof(*r->ptr) * r->size);
233 		force_assert(r->ptr);
234 	} else if (r->used == r->size) {
235 		r->size += 16;
236 		r->ptr = realloc(r->ptr, sizeof(*r->ptr) * r->size);
237 		force_assert(r->ptr);
238 	}
239 
240 	r->ptr[r->used++] = pid;
241 
242 	return m;
243 }
244 
245 static int cgi_pid_del(server *srv, plugin_data *p, pid_t pid) {
246 	size_t i;
247 	buffer_pid_t *r = &(p->cgi_pid);
248 
249 	UNUSED(srv);
250 
251 	for (i = 0; i < r->used; i++) {
252 		if (r->ptr[i] == pid) break;
253 	}
254 
255 	if (i != r->used) {
256 		/* found */
257 
258 		if (i != r->used - 1) {
259 			r->ptr[i] = r->ptr[r->used - 1];
260 		}
261 		r->used--;
262 	}
263 
264 	return 0;
265 }
266 
267 static int cgi_response_parse(server *srv, connection *con, plugin_data *p, buffer *in) {
268 	char *ns;
269 	const char *s;
270 	int line = 0;
271 
272 	UNUSED(srv);
273 
274 	buffer_copy_buffer(p->parse_response, in);
275 
276 	for (s = p->parse_response->ptr;
277 	     NULL != (ns = strchr(s, '\n'));
278 	     s = ns + 1, line++) {
279 		const char *key, *value;
280 		int key_len;
281 		data_string *ds;
282 
283 		/* strip the \n */
284 		ns[0] = '\0';
285 
286 		if (ns > s && ns[-1] == '\r') ns[-1] = '\0';
287 
288 		if (line == 0 &&
289 		    0 == strncmp(s, "HTTP/1.", 7)) {
290 			/* non-parsed header ... we parse them anyway */
291 
292 			if ((s[7] == '1' ||
293 			     s[7] == '0') &&
294 			    s[8] == ' ') {
295 				int status;
296 				/* after the space should be a status code for us */
297 
298 				status = strtol(s+9, NULL, 10);
299 
300 				if (status >= 100 &&
301 				    status < 1000) {
302 					/* we expected 3 digits and didn't got them */
303 					con->parsed_response |= HTTP_STATUS;
304 					con->http_status = status;
305 				}
306 			}
307 		} else {
308 			/* parse the headers */
309 			key = s;
310 			if (NULL == (value = strchr(s, ':'))) {
311 				/* we expect: "<key>: <value>\r\n" */
312 				continue;
313 			}
314 
315 			key_len = value - key;
316 			value += 1;
317 
318 			/* skip LWS */
319 			while (*value == ' ' || *value == '\t') value++;
320 
321 			if (NULL == (ds = (data_string *)array_get_unused_element(con->response.headers, TYPE_STRING))) {
322 				ds = data_response_init();
323 			}
324 			buffer_copy_string_len(ds->key, key, key_len);
325 			buffer_copy_string(ds->value, value);
326 
327 			array_insert_unique(con->response.headers, (data_unset *)ds);
328 
329 			switch(key_len) {
330 			case 4:
331 				if (0 == strncasecmp(key, "Date", key_len)) {
332 					con->parsed_response |= HTTP_DATE;
333 				}
334 				break;
335 			case 6:
336 				if (0 == strncasecmp(key, "Status", key_len)) {
337 					int status = strtol(value, NULL, 10);
338 					if (status >= 100 && status < 1000) {
339 						con->http_status = status;
340 						con->parsed_response |= HTTP_STATUS;
341 					} else {
342 						con->http_status = 502;
343 					}
344 				}
345 				break;
346 			case 8:
347 				if (0 == strncasecmp(key, "Location", key_len)) {
348 					con->parsed_response |= HTTP_LOCATION;
349 				}
350 				break;
351 			case 10:
352 				if (0 == strncasecmp(key, "Connection", key_len)) {
353 					con->response.keep_alive = (0 == strcasecmp(value, "Keep-Alive")) ? 1 : 0;
354 					con->parsed_response |= HTTP_CONNECTION;
355 				}
356 				break;
357 			case 14:
358 				if (0 == strncasecmp(key, "Content-Length", key_len)) {
359 					con->response.content_length = strtoul(value, NULL, 10);
360 					con->parsed_response |= HTTP_CONTENT_LENGTH;
361 				}
362 				break;
363 			default:
364 				break;
365 			}
366 		}
367 	}
368 
369 	/* CGI/1.1 rev 03 - 7.2.1.2 */
370 	if ((con->parsed_response & HTTP_LOCATION) &&
371 	    !(con->parsed_response & HTTP_STATUS)) {
372 		con->http_status = 302;
373 	}
374 
375 	return 0;
376 }
377 
378 
379 static int cgi_demux_response(server *srv, handler_ctx *hctx) {
380 	plugin_data *p    = hctx->plugin_data;
381 	connection  *con  = hctx->remote_conn;
382 
383 	while(1) {
384 		int n;
385 		int toread;
386 
387 #if defined(__WIN32)
388 		buffer_string_prepare_copy(hctx->response, 4 * 1024);
389 #else
390 		if (ioctl(con->fd, FIONREAD, &toread) || toread == 0 || toread <= 4*1024) {
391 			buffer_string_prepare_copy(hctx->response, 4 * 1024);
392 		} else {
393 			if (toread > MAX_READ_LIMIT) toread = MAX_READ_LIMIT;
394 			buffer_string_prepare_copy(hctx->response, toread);
395 		}
396 #endif
397 
398 		if (-1 == (n = read(hctx->fd, hctx->response->ptr, hctx->response->size - 1))) {
399 			if (errno == EAGAIN || errno == EINTR) {
400 				/* would block, wait for signal */
401 				fdevent_event_add(srv->ev, &(hctx->fde_ndx), hctx->fd, FDEVENT_IN);
402 				return FDEVENT_HANDLED_NOT_FINISHED;
403 			}
404 			/* error */
405 			log_error_write(srv, __FILE__, __LINE__, "sdd", strerror(errno), con->fd, hctx->fd);
406 			return FDEVENT_HANDLED_ERROR;
407 		}
408 
409 		if (n == 0) {
410 			/* read finished */
411 			return FDEVENT_HANDLED_FINISHED;
412 		}
413 
414 		buffer_commit(hctx->response, n);
415 
416 		/* split header from body */
417 
418 		if (con->file_started == 0) {
419 			int is_header = 0;
420 			int is_header_end = 0;
421 			size_t last_eol = 0;
422 			size_t i, header_len;
423 
424 			buffer_append_string_buffer(hctx->response_header, hctx->response);
425 
426 			/**
427 			 * we have to handle a few cases:
428 			 *
429 			 * nph:
430 			 *
431 			 *   HTTP/1.0 200 Ok\n
432 			 *   Header: Value\n
433 			 *   \n
434 			 *
435 			 * CGI:
436 			 *   Header: Value\n
437 			 *   Status: 200\n
438 			 *   \n
439 			 *
440 			 * and different mixes of \n and \r\n combinations
441 			 *
442 			 * Some users also forget about CGI and just send a response and hope
443 			 * we handle it. No headers, no header-content seperator
444 			 *
445 			 */
446 
447 			/* nph (non-parsed headers) */
448 			if (0 == strncmp(hctx->response_header->ptr, "HTTP/1.", 7)) is_header = 1;
449 
450 			header_len = buffer_string_length(hctx->response_header);
451 			for (i = 0; !is_header_end && i < header_len; i++) {
452 				char c = hctx->response_header->ptr[i];
453 
454 				switch (c) {
455 				case ':':
456 					/* we found a colon
457 					 *
458 					 * looks like we have a normal header
459 					 */
460 					is_header = 1;
461 					break;
462 				case '\n':
463 					/* EOL */
464 					if (is_header == 0) {
465 						/* we got a EOL but we don't seem to got a HTTP header */
466 
467 						is_header_end = 1;
468 
469 						break;
470 					}
471 
472 					/**
473 					 * check if we saw a \n(\r)?\n sequence
474 					 */
475 					if (last_eol > 0 &&
476 					    ((i - last_eol == 1) ||
477 					     (i - last_eol == 2 && hctx->response_header->ptr[i - 1] == '\r'))) {
478 						is_header_end = 1;
479 						break;
480 					}
481 
482 					last_eol = i;
483 
484 					break;
485 				}
486 			}
487 
488 			if (is_header_end) {
489 				if (!is_header) {
490 					/* no header, but a body */
491 					if (0 != http_chunk_append_buffer(srv, con, hctx->response_header)) {
492 						return FDEVENT_HANDLED_ERROR;
493 					}
494 				} else {
495 					const char *bstart;
496 					size_t blen;
497 
498 					/* the body starts after the EOL */
499 					bstart = hctx->response_header->ptr + i;
500 					blen = header_len - i;
501 
502 					/**
503 					 * i still points to the char after the terminating EOL EOL
504 					 *
505 					 * put it on the last \n again
506 					 */
507 					i--;
508 
509 					/* string the last \r?\n */
510 					if (i > 0 && (hctx->response_header->ptr[i - 1] == '\r')) {
511 						i--;
512 					}
513 
514 					buffer_string_set_length(hctx->response_header, i);
515 
516 					/* parse the response header */
517 					cgi_response_parse(srv, con, p, hctx->response_header);
518 
519 					if (p->conf.xsendfile_allow) {
520 						data_string *ds;
521 						if (NULL != (ds = (data_string *) array_get_element(con->response.headers, "X-Sendfile"))) {
522 							http_response_xsendfile(srv, con, ds->value, p->conf.xsendfile_docroot);
523 							return FDEVENT_HANDLED_FINISHED;
524 						}
525 					}
526 
527 					if (blen > 0) {
528 						if (0 != http_chunk_append_mem(srv, con, bstart, blen)) {
529 							return FDEVENT_HANDLED_ERROR;
530 						}
531 					}
532 				}
533 
534 				con->file_started = 1;
535 			} else {
536 				/*(reuse MAX_HTTP_REQUEST_HEADER as max size for response headers from backends)*/
537 				if (header_len > MAX_HTTP_REQUEST_HEADER) {
538 					log_error_write(srv, __FILE__, __LINE__, "sb", "response headers too large for", con->uri.path);
539 					con->http_status = 502; /* Bad Gateway */
540 					con->mode = DIRECT;
541 					return FDEVENT_HANDLED_FINISHED;
542 				}
543 			}
544 		} else {
545 			if (0 != http_chunk_append_buffer(srv, con, hctx->response)) {
546 				return FDEVENT_HANDLED_ERROR;
547 			}
548 			if ((con->conf.stream_response_body & FDEVENT_STREAM_RESPONSE_BUFMIN)
549 			    && chunkqueue_length(con->write_queue) > 65536 - 4096) {
550 				if (!con->is_writable) {
551 					/*(defer removal of FDEVENT_IN interest since
552 					 * connection_state_machine() might be able to send data
553 					 * immediately, unless !con->is_writable, where
554 					 * connection_state_machine() might not loop back to call
555 					 * mod_cgi_handle_subrequest())*/
556 					fdevent_event_clr(srv->ev, &(hctx->fde_ndx), hctx->fd, FDEVENT_IN);
557 				}
558 				break;
559 			}
560 		}
561 
562 #if 0
563 		log_error_write(srv, __FILE__, __LINE__, "ddss", con->fd, hctx->fd, connection_get_state(con->state), b->ptr);
564 #endif
565 	}
566 
567 	return FDEVENT_HANDLED_NOT_FINISHED;
568 }
569 
570 static void cgi_connection_close_fdtocgi(server *srv, handler_ctx *hctx) {
571 	/*(closes only hctx->fdtocgi)*/
572 	fdevent_event_del(srv->ev, &(hctx->fde_ndx_tocgi), hctx->fdtocgi);
573 	fdevent_unregister(srv->ev, hctx->fdtocgi);
574 
575 	if (close(hctx->fdtocgi)) {
576 		log_error_write(srv, __FILE__, __LINE__, "sds", "cgi stdin close failed ", hctx->fdtocgi, strerror(errno));
577 	}
578 	hctx->fdtocgi = -1;
579 }
580 
581 static void cgi_connection_close(server *srv, handler_ctx *hctx) {
582 	int status;
583 	pid_t pid;
584 	plugin_data *p = hctx->plugin_data;
585 	connection *con = hctx->remote_conn;
586 
587 #ifndef __WIN32
588 
589 	/* the connection to the browser went away, but we still have a connection
590 	 * to the CGI script
591 	 *
592 	 * close cgi-connection
593 	 */
594 
595 	if (hctx->fd != -1) {
596 		/* close connection to the cgi-script */
597 		fdevent_event_del(srv->ev, &(hctx->fde_ndx), hctx->fd);
598 		fdevent_unregister(srv->ev, hctx->fd);
599 
600 		if (close(hctx->fd)) {
601 			log_error_write(srv, __FILE__, __LINE__, "sds", "cgi close failed ", hctx->fd, strerror(errno));
602 		}
603 	}
604 
605 	if (hctx->fdtocgi != -1) {
606 		cgi_connection_close_fdtocgi(srv, hctx); /*(closes only hctx->fdtocgi)*/
607 	}
608 
609 	pid = hctx->pid;
610 
611 	con->plugin_ctx[p->id] = NULL;
612 
613 	cgi_handler_ctx_free(hctx);
614 
615 	/* if waitpid hasn't been called by response.c yet, do it here */
616 	if (pid) {
617 		/* check if the CGI-script is already gone */
618 		switch(waitpid(pid, &status, WNOHANG)) {
619 		case 0:
620 			/* not finished yet */
621 #if 0
622 			log_error_write(srv, __FILE__, __LINE__, "sd", "(debug) child isn't done yet, pid:", pid);
623 #endif
624 			break;
625 		case -1:
626 			/* */
627 			if (errno == EINTR) break;
628 
629 			/*
630 			 * errno == ECHILD happens if _subrequest catches the process-status before
631 			 * we have read the response of the cgi process
632 			 *
633 			 * -> catch status
634 			 * -> WAIT_FOR_EVENT
635 			 * -> read response
636 			 * -> we get here with waitpid == ECHILD
637 			 *
638 			 */
639 			if (errno != ECHILD) {
640 				log_error_write(srv, __FILE__, __LINE__, "ss", "waitpid failed: ", strerror(errno));
641 			}
642 			/* anyway: don't wait for it anymore */
643 			pid = 0;
644 			break;
645 		default:
646 			if (WIFEXITED(status)) {
647 #if 0
648 				log_error_write(srv, __FILE__, __LINE__, "sd", "(debug) cgi exited fine, pid:", pid);
649 #endif
650 			} else {
651 				log_error_write(srv, __FILE__, __LINE__, "sd", "cgi died, pid:", pid);
652 			}
653 
654 			pid = 0;
655 			break;
656 		}
657 
658 		if (pid) {
659 			kill(pid, SIGTERM);
660 
661 			/* cgi-script is still alive, queue the PID for removal */
662 			cgi_pid_add(srv, p, pid);
663 		}
664 	}
665 #endif
666 
667 	/* finish response (if not already con->file_started, con->file_finished) */
668 	if (con->mode == p->id) {
669 		http_response_backend_done(srv, con);
670 	}
671 }
672 
673 static handler_t cgi_connection_close_callback(server *srv, connection *con, void *p_d) {
674 	plugin_data *p = p_d;
675 	handler_ctx *hctx = con->plugin_ctx[p->id];
676 	if (hctx) cgi_connection_close(srv, hctx);
677 
678 	return HANDLER_GO_ON;
679 }
680 
681 
682 static int cgi_write_request(server *srv, handler_ctx *hctx, int fd);
683 
684 
685 static handler_t cgi_handle_fdevent_send (server *srv, void *ctx, int revents) {
686 	handler_ctx *hctx = ctx;
687 	connection  *con  = hctx->remote_conn;
688 
689 	/*(joblist only actually necessary here in mod_cgi fdevent send if returning HANDLER_ERROR)*/
690 	joblist_append(srv, con);
691 
692 	if (revents & FDEVENT_OUT) {
693 		if (0 != cgi_write_request(srv, hctx, hctx->fdtocgi)) {
694 			cgi_connection_close(srv, hctx);
695 			return HANDLER_ERROR;
696 		}
697 		/* more request body to be sent to CGI */
698 	}
699 
700 	if (revents & FDEVENT_HUP) {
701 		/* skip sending remaining data to CGI */
702 		if (con->request.content_length) {
703 			chunkqueue *cq = con->request_content_queue;
704 			chunkqueue_mark_written(cq, chunkqueue_length(cq));
705 			if (cq->bytes_in != (off_t)con->request.content_length) {
706 				con->keep_alive = 0;
707 			}
708 		}
709 
710 		cgi_connection_close_fdtocgi(srv, hctx); /*(closes only hctx->fdtocgi)*/
711 	} else if (revents & FDEVENT_ERR) {
712 		/* kill all connections to the cgi process */
713 #if 1
714 		log_error_write(srv, __FILE__, __LINE__, "s", "cgi-FDEVENT_ERR");
715 #endif
716 		cgi_connection_close(srv, hctx);
717 		return HANDLER_ERROR;
718 	}
719 
720 	return HANDLER_FINISHED;
721 }
722 
723 
724 static int cgi_recv_response(server *srv, handler_ctx *hctx) {
725 		switch (cgi_demux_response(srv, hctx)) {
726 		case FDEVENT_HANDLED_NOT_FINISHED:
727 			break;
728 		case FDEVENT_HANDLED_FINISHED:
729 			/* we are done */
730 
731 #if 0
732 			log_error_write(srv, __FILE__, __LINE__, "ddss", con->fd, hctx->fd, connection_get_state(con->state), "finished");
733 #endif
734 			cgi_connection_close(srv, hctx);
735 
736 			/* if we get a IN|HUP and have read everything don't exec the close twice */
737 			return HANDLER_FINISHED;
738 		case FDEVENT_HANDLED_ERROR:
739 			log_error_write(srv, __FILE__, __LINE__, "s", "demuxer failed: ");
740 
741 			cgi_connection_close(srv, hctx);
742 			return HANDLER_FINISHED;
743 		}
744 
745 		return HANDLER_GO_ON;
746 }
747 
748 
749 static handler_t cgi_handle_fdevent(server *srv, void *ctx, int revents) {
750 	handler_ctx *hctx = ctx;
751 	connection  *con  = hctx->remote_conn;
752 
753 	joblist_append(srv, con);
754 
755 	if (revents & FDEVENT_IN) {
756 		handler_t rc = cgi_recv_response(srv, hctx);/*(might invalidate hctx)*/
757 		if (rc != HANDLER_GO_ON) return rc;         /*(unless HANDLER_GO_ON)*/
758 	}
759 
760 	/* perhaps this issue is already handled */
761 	if (revents & FDEVENT_HUP) {
762 		if (con->file_started) {
763 			/* drain any remaining data from kernel pipe buffers
764 			 * even if (con->conf.stream_response_body
765 			 *          & FDEVENT_STREAM_RESPONSE_BUFMIN)
766 			 * since event loop will spin on fd FDEVENT_HUP event
767 			 * until unregistered. */
768 			handler_t rc;
769 			do {
770 				rc = cgi_recv_response(srv,hctx);/*(might invalidate hctx)*/
771 			} while (rc == HANDLER_GO_ON);           /*(unless HANDLER_GO_ON)*/
772 			return rc; /* HANDLER_FINISHED or HANDLER_ERROR */
773 		} else if (!buffer_string_is_empty(hctx->response_header)) {
774 			/* unfinished header package which is a body in reality */
775 			con->file_started = 1;
776 			if (0 != http_chunk_append_buffer(srv, con, hctx->response_header)) {
777 				cgi_connection_close(srv, hctx);
778 				return HANDLER_ERROR;
779 			}
780 		} else {
781 # if 0
782 			log_error_write(srv, __FILE__, __LINE__, "sddd", "got HUP from cgi", con->fd, hctx->fd, revents);
783 # endif
784 		}
785 		cgi_connection_close(srv, hctx);
786 	} else if (revents & FDEVENT_ERR) {
787 		/* kill all connections to the cgi process */
788 		cgi_connection_close(srv, hctx);
789 #if 1
790 		log_error_write(srv, __FILE__, __LINE__, "s", "cgi-FDEVENT_ERR");
791 #endif
792 		return HANDLER_ERROR;
793 	}
794 
795 	return HANDLER_FINISHED;
796 }
797 
798 
799 static int cgi_env_add(char_array *env, const char *key, size_t key_len, const char *val, size_t val_len) {
800 	char *dst;
801 
802 	if (!key || !val) return -1;
803 
804 	dst = malloc(key_len + val_len + 2);
805 	force_assert(dst);
806 	memcpy(dst, key, key_len);
807 	dst[key_len] = '=';
808 	memcpy(dst + key_len + 1, val, val_len);
809 	dst[key_len + 1 + val_len] = '\0';
810 
811 	if (env->size == 0) {
812 		env->size = 16;
813 		env->ptr = malloc(env->size * sizeof(*env->ptr));
814 		force_assert(env->ptr);
815 	} else if (env->size == env->used) {
816 		env->size += 16;
817 		env->ptr = realloc(env->ptr, env->size * sizeof(*env->ptr));
818 		force_assert(env->ptr);
819 	}
820 
821 	env->ptr[env->used++] = dst;
822 
823 	return 0;
824 }
825 
826 /* returns: 0: continue, -1: fatal error, -2: connection reset */
827 /* similar to network_write_file_chunk_mmap, but doesn't use send on windows (because we're on pipes),
828  * also mmaps and sends complete chunk instead of only small parts - the files
829  * are supposed to be temp files with reasonable chunk sizes.
830  *
831  * Also always use mmap; the files are "trusted", as we created them.
832  */
833 static ssize_t cgi_write_file_chunk_mmap(server *srv, connection *con, int fd, chunkqueue *cq) {
834 	chunk* const c = cq->first;
835 	off_t offset, toSend, file_end;
836 	ssize_t r;
837 	size_t mmap_offset, mmap_avail;
838 	char *data;
839 
840 	force_assert(NULL != c);
841 	force_assert(FILE_CHUNK == c->type);
842 	force_assert(c->offset >= 0 && c->offset <= c->file.length);
843 
844 	offset = c->file.start + c->offset;
845 	toSend = c->file.length - c->offset;
846 	file_end = c->file.start + c->file.length; /* offset to file end in this chunk */
847 
848 	if (0 == toSend) {
849 		chunkqueue_remove_finished_chunks(cq);
850 		return 0;
851 	}
852 
853 	if (0 != network_open_file_chunk(srv, con, cq)) return -1;
854 
855 	/* (re)mmap the buffer if range is not covered completely */
856 	if (MAP_FAILED == c->file.mmap.start
857 		|| offset < c->file.mmap.offset
858 		|| file_end > (off_t)(c->file.mmap.offset + c->file.mmap.length)) {
859 
860 		if (MAP_FAILED != c->file.mmap.start) {
861 			munmap(c->file.mmap.start, c->file.mmap.length);
862 			c->file.mmap.start = MAP_FAILED;
863 		}
864 
865 		c->file.mmap.offset = mmap_align_offset(offset);
866 		c->file.mmap.length = file_end - c->file.mmap.offset;
867 
868 		if (MAP_FAILED == (c->file.mmap.start = mmap(NULL, c->file.mmap.length, PROT_READ, MAP_PRIVATE, c->file.fd, c->file.mmap.offset))) {
869 			if (toSend > 65536) toSend = 65536;
870 			data = malloc(toSend);
871 			force_assert(data);
872 			if (-1 == lseek(c->file.fd, offset, SEEK_SET)
873 			    || 0 >= (toSend = read(c->file.fd, data, toSend))) {
874 				if (-1 == toSend) {
875 					log_error_write(srv, __FILE__, __LINE__, "ssbdo", "lseek/read failed:",
876 						strerror(errno), c->file.name, c->file.fd, offset);
877 				} else { /*(0 == toSend)*/
878 					log_error_write(srv, __FILE__, __LINE__, "sbdo", "unexpected EOF (input truncated?):",
879 						c->file.name, c->file.fd, offset);
880 				}
881 				free(data);
882 				return -1;
883 			}
884 		}
885 	}
886 
887 	if (MAP_FAILED != c->file.mmap.start) {
888 		force_assert(offset >= c->file.mmap.offset);
889 		mmap_offset = offset - c->file.mmap.offset;
890 		force_assert(c->file.mmap.length > mmap_offset);
891 		mmap_avail = c->file.mmap.length - mmap_offset;
892 		force_assert(toSend <= (off_t) mmap_avail);
893 
894 		data = c->file.mmap.start + mmap_offset;
895 	}
896 
897 	r = write(fd, data, toSend);
898 
899 	if (MAP_FAILED == c->file.mmap.start) free(data);
900 
901 	if (r < 0) {
902 		switch (errno) {
903 		case EAGAIN:
904 		case EINTR:
905 			return 0;
906 		case EPIPE:
907 		case ECONNRESET:
908 			return -2;
909 		default:
910 			log_error_write(srv, __FILE__, __LINE__, "ssd",
911 				"write failed:", strerror(errno), fd);
912 			return -1;
913 		}
914 	}
915 
916 	if (r >= 0) {
917 		chunkqueue_mark_written(cq, r);
918 	}
919 
920 	return r;
921 }
922 
923 static int cgi_write_request(server *srv, handler_ctx *hctx, int fd) {
924 	connection *con = hctx->remote_conn;
925 	chunkqueue *cq = con->request_content_queue;
926 	chunk *c;
927 
928 	/* old comment: windows doesn't support select() on pipes - wouldn't be easy to fix for all platforms.
929 	 * solution: if this is still a problem on windows, then substitute
930 	 * socketpair() for pipe() and closesocket() for close() on windows.
931 	 */
932 
933 	for (c = cq->first; c; c = cq->first) {
934 		ssize_t r = -1;
935 
936 		switch(c->type) {
937 		case FILE_CHUNK:
938 			r = cgi_write_file_chunk_mmap(srv, con, fd, cq);
939 			break;
940 
941 		case MEM_CHUNK:
942 			if ((r = write(fd, c->mem->ptr + c->offset, buffer_string_length(c->mem) - c->offset)) < 0) {
943 				switch(errno) {
944 				case EAGAIN:
945 				case EINTR:
946 					/* ignore and try again */
947 					r = 0;
948 					break;
949 				case EPIPE:
950 				case ECONNRESET:
951 					/* connection closed */
952 					r = -2;
953 					break;
954 				default:
955 					/* fatal error */
956 					log_error_write(srv, __FILE__, __LINE__, "ss", "write failed due to: ", strerror(errno));
957 					r = -1;
958 					break;
959 				}
960 			} else if (r > 0) {
961 				chunkqueue_mark_written(cq, r);
962 			}
963 			break;
964 		}
965 
966 		if (0 == r) break; /*(might block)*/
967 
968 		switch (r) {
969 		case -1:
970 			/* fatal error */
971 			return -1;
972 		case -2:
973 			/* connection reset */
974 			log_error_write(srv, __FILE__, __LINE__, "s", "failed to send post data to cgi, connection closed by CGI");
975 			/* skip all remaining data */
976 			chunkqueue_mark_written(cq, chunkqueue_length(cq));
977 			break;
978 		default:
979 			break;
980 		}
981 	}
982 
983 	if (cq->bytes_out == (off_t)con->request.content_length) {
984 		/* sent all request body input */
985 		/* close connection to the cgi-script */
986 		if (-1 == hctx->fdtocgi) { /*(received request body sent in initial send to pipe buffer)*/
987 			if (close(fd)) {
988 				log_error_write(srv, __FILE__, __LINE__, "sds", "cgi stdin close failed ", fd, strerror(errno));
989 			}
990 		} else {
991 			cgi_connection_close_fdtocgi(srv, hctx); /*(closes only hctx->fdtocgi)*/
992 		}
993 	} else {
994 		off_t cqlen = cq->bytes_in - cq->bytes_out;
995 		if (cq->bytes_in < (off_t)con->request.content_length && cqlen < 65536 - 16384) {
996 			/*(con->conf.stream_request_body & FDEVENT_STREAM_REQUEST)*/
997 			if (!(con->conf.stream_request_body & FDEVENT_STREAM_REQUEST_POLLIN)) {
998 				con->conf.stream_request_body |= FDEVENT_STREAM_REQUEST_POLLIN;
999 				con->is_readable = 1; /* trigger optimistic read from client */
1000 			}
1001 		}
1002 		if (-1 == hctx->fdtocgi) { /*(not registered yet)*/
1003 			hctx->fdtocgi = fd;
1004 			hctx->fde_ndx_tocgi = -1;
1005 			fdevent_register(srv->ev, hctx->fdtocgi, cgi_handle_fdevent_send, hctx);
1006 		}
1007 		if (0 == cqlen) { /*(chunkqueue_is_empty(cq))*/
1008 			if ((fdevent_event_get_interest(srv->ev, hctx->fdtocgi) & FDEVENT_OUT)) {
1009 				fdevent_event_set(srv->ev, &(hctx->fde_ndx_tocgi), hctx->fdtocgi, 0);
1010 			}
1011 		} else {
1012 			/* more request body remains to be sent to CGI so register for fdevents */
1013 			fdevent_event_set(srv->ev, &(hctx->fde_ndx_tocgi), hctx->fdtocgi, FDEVENT_OUT);
1014 		}
1015 	}
1016 
1017 	return 0;
1018 }
1019 
1020 static int cgi_create_env(server *srv, connection *con, plugin_data *p, handler_ctx *hctx, buffer *cgi_handler) {
1021 	pid_t pid;
1022 
1023 #ifdef HAVE_IPV6
1024 	char b2[INET6_ADDRSTRLEN + 1];
1025 #endif
1026 
1027 	int to_cgi_fds[2];
1028 	int from_cgi_fds[2];
1029 	struct stat st;
1030 
1031 #ifndef __WIN32
1032 
1033 	if (!buffer_string_is_empty(cgi_handler)) {
1034 		/* stat the exec file */
1035 		if (-1 == (stat(cgi_handler->ptr, &st))) {
1036 			log_error_write(srv, __FILE__, __LINE__, "sbss",
1037 					"stat for cgi-handler", cgi_handler,
1038 					"failed:", strerror(errno));
1039 			return -1;
1040 		}
1041 	}
1042 
1043 	if (pipe(to_cgi_fds)) {
1044 		log_error_write(srv, __FILE__, __LINE__, "ss", "pipe failed:", strerror(errno));
1045 		return -1;
1046 	}
1047 
1048 	if (pipe(from_cgi_fds)) {
1049 		close(to_cgi_fds[0]);
1050 		close(to_cgi_fds[1]);
1051 		log_error_write(srv, __FILE__, __LINE__, "ss", "pipe failed:", strerror(errno));
1052 		return -1;
1053 	}
1054 
1055 	/* fork, execve */
1056 	switch (pid = fork()) {
1057 	case 0: {
1058 		/* child */
1059 		char **args;
1060 		int argc;
1061 		int i = 0;
1062 		char buf[LI_ITOSTRING_LENGTH];
1063 		size_t n;
1064 		char_array env;
1065 		char *c;
1066 		const char *s;
1067 		server_socket *srv_sock = con->srv_socket;
1068 
1069 		/* move stdout to from_cgi_fd[1] */
1070 		close(STDOUT_FILENO);
1071 		dup2(from_cgi_fds[1], STDOUT_FILENO);
1072 		close(from_cgi_fds[1]);
1073 		/* not needed */
1074 		close(from_cgi_fds[0]);
1075 
1076 		/* move the stdin to to_cgi_fd[0] */
1077 		close(STDIN_FILENO);
1078 		dup2(to_cgi_fds[0], STDIN_FILENO);
1079 		close(to_cgi_fds[0]);
1080 		/* not needed */
1081 		close(to_cgi_fds[1]);
1082 
1083 		/* create environment */
1084 		env.ptr = NULL;
1085 		env.size = 0;
1086 		env.used = 0;
1087 
1088 		cgi_env_add(&env, CONST_STR_LEN("SERVER_SOFTWARE"), CONST_BUF_LEN(con->conf.server_tag));
1089 
1090 		if (!buffer_string_is_empty(con->server_name)) {
1091 			size_t len = buffer_string_length(con->server_name);
1092 
1093 			if (con->server_name->ptr[0] == '[') {
1094 				const char *colon = strstr(con->server_name->ptr, "]:");
1095 				if (colon) len = (colon + 1) - con->server_name->ptr;
1096 			} else {
1097 				const char *colon = strchr(con->server_name->ptr, ':');
1098 				if (colon) len = colon - con->server_name->ptr;
1099 			}
1100 
1101 			cgi_env_add(&env, CONST_STR_LEN("SERVER_NAME"), con->server_name->ptr, len);
1102 		} else {
1103 #ifdef HAVE_IPV6
1104 			s = inet_ntop(
1105 				srv_sock->addr.plain.sa_family,
1106 				srv_sock->addr.plain.sa_family == AF_INET6 ?
1107 				(const void *) &(srv_sock->addr.ipv6.sin6_addr) :
1108 				(const void *) &(srv_sock->addr.ipv4.sin_addr),
1109 				b2, sizeof(b2)-1);
1110 #else
1111 			s = inet_ntoa(srv_sock->addr.ipv4.sin_addr);
1112 #endif
1113 			force_assert(s);
1114 			cgi_env_add(&env, CONST_STR_LEN("SERVER_NAME"), s, strlen(s));
1115 		}
1116 		cgi_env_add(&env, CONST_STR_LEN("GATEWAY_INTERFACE"), CONST_STR_LEN("CGI/1.1"));
1117 
1118 		s = get_http_version_name(con->request.http_version);
1119 		force_assert(s);
1120 		cgi_env_add(&env, CONST_STR_LEN("SERVER_PROTOCOL"), s, strlen(s));
1121 
1122 		li_utostrn(buf, sizeof(buf),
1123 #ifdef HAVE_IPV6
1124 			ntohs(srv_sock->addr.plain.sa_family == AF_INET6 ? srv_sock->addr.ipv6.sin6_port : srv_sock->addr.ipv4.sin_port)
1125 #else
1126 			ntohs(srv_sock->addr.ipv4.sin_port)
1127 #endif
1128 			);
1129 		cgi_env_add(&env, CONST_STR_LEN("SERVER_PORT"), buf, strlen(buf));
1130 
1131 		switch (srv_sock->addr.plain.sa_family) {
1132 #ifdef HAVE_IPV6
1133 		case AF_INET6:
1134 			s = inet_ntop(
1135 				srv_sock->addr.plain.sa_family,
1136 				(const void *) &(srv_sock->addr.ipv6.sin6_addr),
1137 				b2, sizeof(b2)-1);
1138 			break;
1139 		case AF_INET:
1140 			s = inet_ntop(
1141 				srv_sock->addr.plain.sa_family,
1142 				(const void *) &(srv_sock->addr.ipv4.sin_addr),
1143 				b2, sizeof(b2)-1);
1144 			break;
1145 #else
1146 		case AF_INET:
1147 			s = inet_ntoa(srv_sock->addr.ipv4.sin_addr);
1148 			break;
1149 #endif
1150 		default:
1151 			s = "";
1152 			break;
1153 		}
1154 		force_assert(s);
1155 		cgi_env_add(&env, CONST_STR_LEN("SERVER_ADDR"), s, strlen(s));
1156 
1157 		s = get_http_method_name(con->request.http_method);
1158 		force_assert(s);
1159 		cgi_env_add(&env, CONST_STR_LEN("REQUEST_METHOD"), s, strlen(s));
1160 
1161 		if (!buffer_string_is_empty(con->request.pathinfo)) {
1162 			cgi_env_add(&env, CONST_STR_LEN("PATH_INFO"), CONST_BUF_LEN(con->request.pathinfo));
1163 		}
1164 		if (!buffer_string_is_empty(con->uri.query)) {
1165 			cgi_env_add(&env, CONST_STR_LEN("QUERY_STRING"), CONST_BUF_LEN(con->uri.query));
1166 		} else {
1167 			cgi_env_add(&env, CONST_STR_LEN("QUERY_STRING"), CONST_STR_LEN(""));
1168 		}
1169 		if (con->error_handler_saved_status >= 0) {
1170 			cgi_env_add(&env, CONST_STR_LEN("REQUEST_URI"), CONST_BUF_LEN(con->request.uri));
1171 		} else {
1172 			cgi_env_add(&env, CONST_STR_LEN("REQUEST_URI"), CONST_BUF_LEN(con->request.orig_uri));
1173 		}
1174 		/* set REDIRECT_STATUS for php compiled with --force-redirect
1175 		 * (if REDIRECT_STATUS has not already been set by error handler) */
1176 		if (0 == con->error_handler_saved_status) {
1177 			cgi_env_add(&env, CONST_STR_LEN("REDIRECT_STATUS"), CONST_STR_LEN("200"));
1178 		}
1179 
1180 
1181 		switch (con->dst_addr.plain.sa_family) {
1182 #ifdef HAVE_IPV6
1183 		case AF_INET6:
1184 			s = inet_ntop(
1185 				con->dst_addr.plain.sa_family,
1186 				(const void *) &(con->dst_addr.ipv6.sin6_addr),
1187 				b2, sizeof(b2)-1);
1188 			break;
1189 		case AF_INET:
1190 			s = inet_ntop(
1191 				con->dst_addr.plain.sa_family,
1192 				(const void *) &(con->dst_addr.ipv4.sin_addr),
1193 				b2, sizeof(b2)-1);
1194 			break;
1195 #else
1196 		case AF_INET:
1197 			s = inet_ntoa(con->dst_addr.ipv4.sin_addr);
1198 			break;
1199 #endif
1200 		default:
1201 			s = "";
1202 			break;
1203 		}
1204 		force_assert(s);
1205 		cgi_env_add(&env, CONST_STR_LEN("REMOTE_ADDR"), s, strlen(s));
1206 
1207 		li_utostrn(buf, sizeof(buf),
1208 #ifdef HAVE_IPV6
1209 			ntohs(con->dst_addr.plain.sa_family == AF_INET6 ? con->dst_addr.ipv6.sin6_port : con->dst_addr.ipv4.sin_port)
1210 #else
1211 			ntohs(con->dst_addr.ipv4.sin_port)
1212 #endif
1213 			);
1214 		cgi_env_add(&env, CONST_STR_LEN("REMOTE_PORT"), buf, strlen(buf));
1215 
1216 		if (buffer_is_equal_caseless_string(con->uri.scheme, CONST_STR_LEN("https"))) {
1217 			cgi_env_add(&env, CONST_STR_LEN("HTTPS"), CONST_STR_LEN("on"));
1218 		}
1219 
1220 		li_itostrn(buf, sizeof(buf), con->request.content_length);
1221 		cgi_env_add(&env, CONST_STR_LEN("CONTENT_LENGTH"), buf, strlen(buf));
1222 		cgi_env_add(&env, CONST_STR_LEN("SCRIPT_FILENAME"), CONST_BUF_LEN(con->physical.path));
1223 		cgi_env_add(&env, CONST_STR_LEN("SCRIPT_NAME"), CONST_BUF_LEN(con->uri.path));
1224 		cgi_env_add(&env, CONST_STR_LEN("DOCUMENT_ROOT"), CONST_BUF_LEN(con->physical.basedir));
1225 
1226 		/* for valgrind */
1227 		if (NULL != (s = getenv("LD_PRELOAD"))) {
1228 			cgi_env_add(&env, CONST_STR_LEN("LD_PRELOAD"), s, strlen(s));
1229 		}
1230 
1231 		if (NULL != (s = getenv("LD_LIBRARY_PATH"))) {
1232 			cgi_env_add(&env, CONST_STR_LEN("LD_LIBRARY_PATH"), s, strlen(s));
1233 		}
1234 #ifdef __CYGWIN__
1235 		/* CYGWIN needs SYSTEMROOT */
1236 		if (NULL != (s = getenv("SYSTEMROOT"))) {
1237 			cgi_env_add(&env, CONST_STR_LEN("SYSTEMROOT"), s, strlen(s));
1238 		}
1239 #endif
1240 
1241 		for (n = 0; n < con->request.headers->used; n++) {
1242 			data_string *ds;
1243 
1244 			ds = (data_string *)con->request.headers->data[n];
1245 
1246 			if (!buffer_is_empty(ds->value) && !buffer_is_empty(ds->key)) {
1247 				buffer_copy_string_encoded_cgi_varnames(p->tmp_buf, CONST_BUF_LEN(ds->key), 1);
1248 
1249 				cgi_env_add(&env, CONST_BUF_LEN(p->tmp_buf), CONST_BUF_LEN(ds->value));
1250 			}
1251 		}
1252 
1253 		for (n = 0; n < con->environment->used; n++) {
1254 			data_string *ds;
1255 
1256 			ds = (data_string *)con->environment->data[n];
1257 
1258 			if (!buffer_is_empty(ds->value) && !buffer_is_empty(ds->key)) {
1259 				buffer_copy_string_encoded_cgi_varnames(p->tmp_buf, CONST_BUF_LEN(ds->key), 0);
1260 
1261 				cgi_env_add(&env, CONST_BUF_LEN(p->tmp_buf), CONST_BUF_LEN(ds->value));
1262 			}
1263 		}
1264 
1265 		if (env.size == env.used) {
1266 			env.size += 16;
1267 			env.ptr = realloc(env.ptr, env.size * sizeof(*env.ptr));
1268 		}
1269 
1270 		env.ptr[env.used] = NULL;
1271 
1272 		/* set up args */
1273 		argc = 3;
1274 		args = malloc(sizeof(*args) * argc);
1275 		force_assert(args);
1276 		i = 0;
1277 
1278 		if (!buffer_string_is_empty(cgi_handler)) {
1279 			args[i++] = cgi_handler->ptr;
1280 		}
1281 		args[i++] = con->physical.path->ptr;
1282 		args[i  ] = NULL;
1283 
1284 		/* search for the last / */
1285 		if (NULL != (c = strrchr(con->physical.path->ptr, '/'))) {
1286 			/* handle special case of file in root directory */
1287 			const char* physdir = (c == con->physical.path->ptr) ? "/" : con->physical.path->ptr;
1288 
1289 			/* temporarily shorten con->physical.path to directory without terminating '/' */
1290 			*c = '\0';
1291 			/* change to the physical directory */
1292 			if (-1 == chdir(physdir)) {
1293 				log_error_write(srv, __FILE__, __LINE__, "ssb", "chdir failed:", strerror(errno), con->physical.path);
1294 			}
1295 			*c = '/';
1296 		}
1297 
1298 		/* we don't need the client socket */
1299 		for (i = 3; i < 256; i++) {
1300 			if (i != srv->errorlog_fd) close(i);
1301 		}
1302 
1303 		/* exec the cgi */
1304 		execve(args[0], args, env.ptr);
1305 
1306 		/* most log files may have been closed/redirected by this point,
1307 		 * though stderr might still point to lighttpd.breakage.log */
1308 		perror(args[0]);
1309 		_exit(1);
1310 	}
1311 	case -1:
1312 		/* error */
1313 		log_error_write(srv, __FILE__, __LINE__, "ss", "fork failed:", strerror(errno));
1314 		close(from_cgi_fds[0]);
1315 		close(from_cgi_fds[1]);
1316 		close(to_cgi_fds[0]);
1317 		close(to_cgi_fds[1]);
1318 		return -1;
1319 	default: {
1320 		/* parent process */
1321 
1322 		close(from_cgi_fds[1]);
1323 		close(to_cgi_fds[0]);
1324 
1325 		/* register PID and wait for them asynchronously */
1326 
1327 		hctx->pid = pid;
1328 		hctx->fd = from_cgi_fds[0];
1329 		hctx->fde_ndx = -1;
1330 
1331 		if (0 == con->request.content_length) {
1332 			close(to_cgi_fds[1]);
1333 		} else {
1334 			/* there is content to send */
1335 			if (-1 == fdevent_fcntl_set(srv->ev, to_cgi_fds[1])) {
1336 				log_error_write(srv, __FILE__, __LINE__, "ss", "fcntl failed: ", strerror(errno));
1337 				close(to_cgi_fds[1]);
1338 				cgi_connection_close(srv, hctx);
1339 				return -1;
1340 			}
1341 
1342 			if (0 != cgi_write_request(srv, hctx, to_cgi_fds[1])) {
1343 				close(to_cgi_fds[1]);
1344 				cgi_connection_close(srv, hctx);
1345 				return -1;
1346 			}
1347 		}
1348 
1349 		fdevent_register(srv->ev, hctx->fd, cgi_handle_fdevent, hctx);
1350 		fdevent_event_set(srv->ev, &(hctx->fde_ndx), hctx->fd, FDEVENT_IN);
1351 
1352 		if (-1 == fdevent_fcntl_set(srv->ev, hctx->fd)) {
1353 			log_error_write(srv, __FILE__, __LINE__, "ss", "fcntl failed: ", strerror(errno));
1354 			cgi_connection_close(srv, hctx);
1355 			return -1;
1356 		}
1357 
1358 		break;
1359 	}
1360 	}
1361 
1362 	return 0;
1363 #else
1364 	return -1;
1365 #endif
1366 }
1367 
1368 static buffer * cgi_get_handler(array *a, buffer *fn) {
1369 	size_t k, s_len = buffer_string_length(fn);
1370 	for (k = 0; k < a->used; ++k) {
1371 		data_string *ds = (data_string *)a->data[k];
1372 		size_t ct_len = buffer_string_length(ds->key);
1373 
1374 		if (buffer_is_empty(ds->key)) continue;
1375 		if (s_len < ct_len) continue;
1376 
1377 		if (0 == strncmp(fn->ptr + s_len - ct_len, ds->key->ptr, ct_len)) {
1378 			return ds->value;
1379 		}
1380 	}
1381 
1382 	return NULL;
1383 }
1384 
1385 #define PATCH(x) \
1386 	p->conf.x = s->x;
1387 static int mod_cgi_patch_connection(server *srv, connection *con, plugin_data *p) {
1388 	size_t i, j;
1389 	plugin_config *s = p->config_storage[0];
1390 
1391 	PATCH(cgi);
1392 	PATCH(execute_x_only);
1393 	PATCH(xsendfile_allow);
1394 	PATCH(xsendfile_docroot);
1395 
1396 	/* skip the first, the global context */
1397 	for (i = 1; i < srv->config_context->used; i++) {
1398 		data_config *dc = (data_config *)srv->config_context->data[i];
1399 		s = p->config_storage[i];
1400 
1401 		/* condition didn't match */
1402 		if (!config_check_cond(srv, con, dc)) continue;
1403 
1404 		/* merge config */
1405 		for (j = 0; j < dc->value->used; j++) {
1406 			data_unset *du = dc->value->data[j];
1407 
1408 			if (buffer_is_equal_string(du->key, CONST_STR_LEN("cgi.assign"))) {
1409 				PATCH(cgi);
1410 			} else if (buffer_is_equal_string(du->key, CONST_STR_LEN("cgi.execute-x-only"))) {
1411 				PATCH(execute_x_only);
1412 			} else if (buffer_is_equal_string(du->key, CONST_STR_LEN("cgi.x-sendfile"))) {
1413 				PATCH(xsendfile_allow);
1414 			} else if (buffer_is_equal_string(du->key, CONST_STR_LEN("cgi.x-sendfile-docroot"))) {
1415 				PATCH(xsendfile_docroot);
1416 			}
1417 		}
1418 	}
1419 
1420 	return 0;
1421 }
1422 #undef PATCH
1423 
1424 URIHANDLER_FUNC(cgi_is_handled) {
1425 	plugin_data *p = p_d;
1426 	buffer *fn = con->physical.path;
1427 	stat_cache_entry *sce = NULL;
1428 
1429 	if (con->mode != DIRECT) return HANDLER_GO_ON;
1430 
1431 	if (buffer_is_empty(fn)) return HANDLER_GO_ON;
1432 
1433 	mod_cgi_patch_connection(srv, con, p);
1434 
1435 	if (HANDLER_ERROR == stat_cache_get_entry(srv, con, con->physical.path, &sce)) return HANDLER_GO_ON;
1436 	if (!S_ISREG(sce->st.st_mode)) return HANDLER_GO_ON;
1437 	if (p->conf.execute_x_only == 1 && (sce->st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0) return HANDLER_GO_ON;
1438 
1439 	if (NULL != cgi_get_handler(p->conf.cgi, fn)) {
1440 		handler_ctx *hctx = cgi_handler_ctx_init();
1441 		hctx->remote_conn = con;
1442 		hctx->plugin_data = p;
1443 		con->plugin_ctx[p->id] = hctx;
1444 		con->mode = p->id;
1445 	}
1446 
1447 	return HANDLER_GO_ON;
1448 }
1449 
1450 TRIGGER_FUNC(cgi_trigger) {
1451 	plugin_data *p = p_d;
1452 	size_t ndx;
1453 	/* the trigger handle only cares about lonely PID which we have to wait for */
1454 #ifndef __WIN32
1455 
1456 	for (ndx = 0; ndx < p->cgi_pid.used; ndx++) {
1457 		int status;
1458 
1459 		switch(waitpid(p->cgi_pid.ptr[ndx], &status, WNOHANG)) {
1460 		case 0:
1461 			/* not finished yet */
1462 #if 0
1463 			log_error_write(srv, __FILE__, __LINE__, "sd", "(debug) child isn't done yet, pid:", p->cgi_pid.ptr[ndx]);
1464 #endif
1465 			break;
1466 		case -1:
1467 			if (errno == ECHILD) {
1468 				/* someone else called waitpid... remove the pid to stop looping the error each time */
1469 				log_error_write(srv, __FILE__, __LINE__, "s", "cgi child vanished, probably someone else called waitpid");
1470 
1471 				cgi_pid_del(srv, p, p->cgi_pid.ptr[ndx]);
1472 				ndx--;
1473 				continue;
1474 			}
1475 
1476 			log_error_write(srv, __FILE__, __LINE__, "ss", "waitpid failed: ", strerror(errno));
1477 
1478 			return HANDLER_ERROR;
1479 		default:
1480 
1481 			if (WIFEXITED(status)) {
1482 #if 0
1483 				log_error_write(srv, __FILE__, __LINE__, "sd", "(debug) cgi exited fine, pid:", p->cgi_pid.ptr[ndx]);
1484 #endif
1485 			} else if (WIFSIGNALED(status)) {
1486 				/* FIXME: what if we killed the CGI script with a kill(..., SIGTERM) ?
1487 				 */
1488 				if (WTERMSIG(status) != SIGTERM) {
1489 					log_error_write(srv, __FILE__, __LINE__, "sd", "cleaning up CGI: process died with signal", WTERMSIG(status));
1490 				}
1491 			} else {
1492 				log_error_write(srv, __FILE__, __LINE__, "s", "cleaning up CGI: ended unexpectedly");
1493 			}
1494 
1495 			cgi_pid_del(srv, p, p->cgi_pid.ptr[ndx]);
1496 			/* del modified the buffer structure
1497 			 * and copies the last entry to the current one
1498 			 * -> recheck the current index
1499 			 */
1500 			ndx--;
1501 		}
1502 	}
1503 #endif
1504 	return HANDLER_GO_ON;
1505 }
1506 
1507 /*
1508  * - HANDLER_GO_ON : not our job
1509  * - HANDLER_FINISHED: got response
1510  * - HANDLER_WAIT_FOR_EVENT: waiting for response
1511  */
1512 SUBREQUEST_FUNC(mod_cgi_handle_subrequest) {
1513 	plugin_data *p = p_d;
1514 	handler_ctx *hctx = con->plugin_ctx[p->id];
1515 	chunkqueue *cq = con->request_content_queue;
1516 
1517 	if (con->mode != p->id) return HANDLER_GO_ON;
1518 	if (NULL == hctx) return HANDLER_GO_ON;
1519 
1520 	if ((con->conf.stream_response_body & FDEVENT_STREAM_RESPONSE_BUFMIN)
1521 	    && con->file_started) {
1522 		if (chunkqueue_length(con->write_queue) > 65536 - 4096) {
1523 			fdevent_event_clr(srv->ev, &(hctx->fde_ndx), hctx->fd, FDEVENT_IN);
1524 		} else if (!(fdevent_event_get_interest(srv->ev, hctx->fd) & FDEVENT_IN)) {
1525 			/* optimistic read from backend, which might re-enable FDEVENT_IN */
1526 			handler_t rc = cgi_recv_response(srv, hctx); /*(might invalidate hctx)*/
1527 			if (rc != HANDLER_GO_ON) return rc;          /*(unless HANDLER_GO_ON)*/
1528 		}
1529 	}
1530 
1531 	if (cq->bytes_in != (off_t)con->request.content_length) {
1532 		/*(64k - 4k to attempt to avoid temporary files
1533 		 * in conjunction with FDEVENT_STREAM_REQUEST_BUFMIN)*/
1534 		if (cq->bytes_in - cq->bytes_out > 65536 - 4096
1535 		    && (con->conf.stream_request_body & FDEVENT_STREAM_REQUEST_BUFMIN)){
1536 			con->conf.stream_request_body &= ~FDEVENT_STREAM_REQUEST_POLLIN;
1537 			if (-1 != hctx->fd) return HANDLER_WAIT_FOR_EVENT;
1538 		} else {
1539 			handler_t r = connection_handle_read_post_state(srv, con);
1540 			if (!chunkqueue_is_empty(cq)) {
1541 				if (fdevent_event_get_interest(srv->ev, hctx->fdtocgi) & FDEVENT_OUT) {
1542 					return (r == HANDLER_GO_ON) ? HANDLER_WAIT_FOR_EVENT : r;
1543 				}
1544 			}
1545 			if (r != HANDLER_GO_ON) return r;
1546 		}
1547 	}
1548 
1549 	if (-1 == hctx->fd) {
1550 		buffer *handler = cgi_get_handler(p->conf.cgi, con->physical.path);
1551 		if (!handler) return HANDLER_GO_ON; /*(should not happen; checked in cgi_is_handled())*/
1552 		if (cgi_create_env(srv, con, p, hctx, handler)) {
1553 			con->http_status = 500;
1554 			con->mode = DIRECT;
1555 
1556 			return HANDLER_FINISHED;
1557 		}
1558 #if 0
1559 	log_error_write(srv, __FILE__, __LINE__, "sdd", "subrequest, pid =", hctx, hctx->pid);
1560 #endif
1561 	} else if (!chunkqueue_is_empty(con->request_content_queue)) {
1562 		if (0 != cgi_write_request(srv, hctx, hctx->fdtocgi)) {
1563 			cgi_connection_close(srv, hctx);
1564 			return HANDLER_ERROR;
1565 		}
1566 	}
1567 
1568 	/* if not done, wait for CGI to close stdout, so we read EOF on pipe */
1569 	return HANDLER_WAIT_FOR_EVENT;
1570 }
1571 
1572 
1573 int mod_cgi_plugin_init(plugin *p);
1574 int mod_cgi_plugin_init(plugin *p) {
1575 	p->version     = LIGHTTPD_VERSION_ID;
1576 	p->name        = buffer_init_string("cgi");
1577 
1578 	p->connection_reset = cgi_connection_close_callback;
1579 	p->handle_subrequest_start = cgi_is_handled;
1580 	p->handle_subrequest = mod_cgi_handle_subrequest;
1581 	p->handle_trigger = cgi_trigger;
1582 	p->init           = mod_cgi_init;
1583 	p->cleanup        = mod_cgi_free;
1584 	p->set_defaults   = mod_fastcgi_set_defaults;
1585 
1586 	p->data        = NULL;
1587 
1588 	return 0;
1589 }
1590