xref: /netbsd-src/libexec/httpd/cgi-bozo.c (revision b7b7574d3bf8eeb51a1fa3977b59142ec6434a55)
1 /*	$NetBSD: cgi-bozo.c,v 1.25 2014/06/24 07:23:59 shm Exp $	*/
2 
3 /*	$eterna: cgi-bozo.c,v 1.40 2011/11/18 09:21:15 mrg Exp $	*/
4 
5 /*
6  * Copyright (c) 1997-2014 Matthew R. Green
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer and
16  *    dedication in the documentation and/or other materials provided
17  *    with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
20  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
21  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
22  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
23  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
24  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
25  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
26  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
27  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  */
32 
33 /* this code implements CGI/1.2 for bozohttpd */
34 
35 #ifndef NO_CGIBIN_SUPPORT
36 
37 #include <sys/param.h>
38 #include <sys/socket.h>
39 
40 #include <ctype.h>
41 #include <errno.h>
42 #include <paths.h>
43 #include <signal.h>
44 #include <stdlib.h>
45 #include <string.h>
46 #include <syslog.h>
47 #include <unistd.h>
48 
49 #include <netinet/in.h>
50 
51 #include "bozohttpd.h"
52 
53 #define CGIBIN_PREFIX		"cgi-bin/"
54 #define CGIBIN_PREFIX_LEN	(sizeof(CGIBIN_PREFIX)-1)
55 
56 #ifndef USE_ARG
57 #define USE_ARG(x)	/*LINTED*/(void)&(x)
58 #endif
59 
60 /*
61  * given the file name, return a CGI interpreter
62  */
63 static const char *
64 content_cgihandler(bozohttpd_t *httpd, bozo_httpreq_t *request,
65 		const char *file)
66 {
67 	bozo_content_map_t	*map;
68 
69 	USE_ARG(request);
70 	debug((httpd, DEBUG_FAT, "content_cgihandler: trying file %s", file));
71 	map = bozo_match_content_map(httpd, file, 0);
72 	if (map)
73 		return map->cgihandler;
74 	return NULL;
75 }
76 
77 static int
78 parse_header(bozohttpd_t *httpd, const char *str, ssize_t len, char **hdr_str,
79 		char **hdr_val)
80 {
81 	char	*name, *value;
82 
83 	/* if the string passed is zero-length bail out */
84 	if (*str == '\0')
85 		return -1;
86 
87 	value = bozostrdup(httpd, str);
88 
89 	/* locate the ':' separator in the header/value */
90 	name = bozostrnsep(&value, ":", &len);
91 
92 	if (NULL == name || -1 == len) {
93 		free(name);
94 		return -1;
95 	}
96 
97 	/* skip leading space/tab */
98 	while (*value == ' ' || *value == '\t')
99 		len--, value++;
100 
101 	*hdr_str = name;
102 	*hdr_val = value;
103 
104 	return 0;
105 }
106 
107 /*
108  * handle parsing a CGI header output, transposing a Status: header
109  * into the HTTP reply (ie, instead of "200 OK").
110  */
111 static void
112 finish_cgi_output(bozohttpd_t *httpd, bozo_httpreq_t *request, int in, int nph)
113 {
114 	char	buf[BOZO_WRSZ];
115 	char	*str;
116 	ssize_t	len;
117 	ssize_t rbytes;
118 	SIMPLEQ_HEAD(, bozoheaders)	headers;
119 	bozoheaders_t *hdr, *nhdr;
120 	int	write_header, nheaders = 0;
121 
122 	/* much of this code is like bozo_read_request()'s header loop. */
123 	SIMPLEQ_INIT(&headers);
124 	write_header = nph == 0;
125 	/* was read(2) here - XXX - agc */
126 	while (nph == 0 &&
127 		(str = bozodgetln(httpd, in, &len, bozo_read)) != NULL) {
128 		char	*hdr_name, *hdr_value;
129 
130 		if (parse_header(httpd, str, len, &hdr_name, &hdr_value))
131 			break;
132 
133 		/*
134 		 * The CGI 1.{1,2} spec both say that if the cgi program
135 		 * returns a `Status:' header field then the server MUST
136 		 * return it in the response.  If the cgi program does
137 		 * not return any `Status:' header then the server should
138 		 * respond with 200 OK.
139 		 * XXX The CGI 1.1 and 1.2 specification differ slightly on
140 		 * this in that v1.2 says that the script MUST NOT return a
141 		 * `Status:' header if it is returning a `Location:' header.
142 		 * For compatibility we are going with the CGI 1.1 behavior.
143 		 */
144 		if (strcasecmp(hdr_name, "status") == 0) {
145 			debug((httpd, DEBUG_OBESE,
146 				"bozo_process_cgi:  writing HTTP header "
147 				"from status %s ..", hdr_value));
148 			bozo_printf(httpd, "%s %s\r\n", request->hr_proto,
149 					hdr_value);
150 			bozo_flush(httpd, stdout);
151 			write_header = 0;
152 			free(hdr_name);
153 			break;
154 		}
155 
156 		hdr = bozomalloc(httpd, sizeof *hdr);
157 		hdr->h_header = hdr_name;
158 		hdr->h_value = hdr_value;
159 		SIMPLEQ_INSERT_TAIL(&headers, hdr, h_next);
160 		nheaders++;
161 	}
162 
163 	if (write_header) {
164 		debug((httpd, DEBUG_OBESE,
165 			"bozo_process_cgi:  writing HTTP header .."));
166 		bozo_printf(httpd,
167 			"%s 200 OK\r\n", request->hr_proto);
168 		bozo_flush(httpd, stdout);
169 	}
170 
171 	if (nheaders) {
172 		debug((httpd, DEBUG_OBESE,
173 			"bozo_process_cgi:  writing delayed HTTP headers .."));
174 		SIMPLEQ_FOREACH_SAFE(hdr, &headers, h_next, nhdr) {
175 			bozo_printf(httpd, "%s: %s\r\n", hdr->h_header,
176 					hdr->h_value);
177 			free(hdr->h_header);
178 			free(hdr);
179 		}
180 		bozo_printf(httpd, "\r\n");
181 		bozo_flush(httpd, stdout);
182 	}
183 
184 	/* XXX we should have some goo that times us out
185 	 */
186 	while ((rbytes = read(in, buf, sizeof buf)) > 0) {
187 		ssize_t wbytes;
188 		char *bp = buf;
189 
190 		while (rbytes) {
191 			wbytes = bozo_write(httpd, STDOUT_FILENO, buf,
192 						(size_t)rbytes);
193 			if (wbytes > 0) {
194 				rbytes -= wbytes;
195 				bp += wbytes;
196 			} else
197 				bozo_err(httpd, 1,
198 					"cgi output write failed: %s",
199 					strerror(errno));
200 		}
201 	}
202 }
203 
204 static void
205 append_index_html(bozohttpd_t *httpd, char **url)
206 {
207 	*url = bozorealloc(httpd, *url,
208 			strlen(*url) + strlen(httpd->index_html) + 1);
209 	strcat(*url, httpd->index_html);
210 	debug((httpd, DEBUG_NORMAL,
211 		"append_index_html: url adjusted to `%s'", *url));
212 }
213 
214 void
215 bozo_cgi_setbin(bozohttpd_t *httpd, const char *path)
216 {
217 	httpd->cgibin = strdup(path);
218 	debug((httpd, DEBUG_OBESE, "cgibin (cgi-bin directory) is %s",
219 		httpd->cgibin));
220 }
221 
222 /* help build up the environ pointer */
223 void
224 bozo_setenv(bozohttpd_t *httpd, const char *env, const char *val,
225 		char **envp)
226 {
227 	char *s1 = bozomalloc(httpd, strlen(env) + strlen(val) + 2);
228 
229 	strcpy(s1, env);
230 	strcat(s1, "=");
231 	strcat(s1, val);
232 	debug((httpd, DEBUG_OBESE, "bozo_setenv: %s", s1));
233 	*envp = s1;
234 }
235 
236 /*
237  * Checks if the request has asked for a cgi-bin.  Should only be called if
238  * cgibin is set.  If it starts CGIBIN_PREFIX or has a ncontent handler,
239  * process the cgi, otherwise just return.  Returns 0 if it did not handle
240  * the request.
241  */
242 int
243 bozo_process_cgi(bozo_httpreq_t *request)
244 {
245 	bozohttpd_t *httpd = request->hr_httpd;
246 	char	buf[BOZO_WRSZ];
247 	char	date[40];
248 	bozoheaders_t *headp;
249 	const char *type, *clen, *info, *cgihandler;
250 	char	*query, *s, *t, *path, *env, *command, *file, *url;
251 	char	**envp, **curenvp, *argv[4];
252 	char	*uri;
253 	size_t	len;
254 	ssize_t rbytes;
255 	pid_t	pid;
256 	int	envpsize, ix, nph;
257 	int	sv[2];
258 
259 	if (!httpd->cgibin && !httpd->process_cgi)
260 		return 0;
261 
262 	if (request->hr_oldfile && strcmp(request->hr_oldfile, "/") != 0)
263 		uri = request->hr_oldfile;
264 	else
265 		uri = request->hr_file;
266 
267 	if (uri[0] == '/')
268 		file = bozostrdup(httpd, uri);
269 	else
270 		asprintf(&file, "/%s", uri);
271 	if (file == NULL)
272 		return 0;
273 
274 	if (request->hr_query && strlen(request->hr_query))
275 		query = bozostrdup(httpd, request->hr_query);
276 	else
277 		query = NULL;
278 
279 	asprintf(&url, "%s%s%s", file, query ? "?" : "", query ? query : "");
280 	if (url == NULL)
281 		goto out;
282 	debug((httpd, DEBUG_NORMAL, "bozo_process_cgi: url `%s'", url));
283 
284 	path = NULL;
285 	envp = NULL;
286 	cgihandler = NULL;
287 	command = NULL;
288 	info = NULL;
289 
290 	len = strlen(url);
291 
292 	if (bozo_auth_check(request, url + 1))
293 		goto out;
294 
295 	if (!httpd->cgibin ||
296 	    strncmp(url + 1, CGIBIN_PREFIX, CGIBIN_PREFIX_LEN) != 0) {
297 		cgihandler = content_cgihandler(httpd, request, file + 1);
298 		if (cgihandler == NULL) {
299 			debug((httpd, DEBUG_FAT,
300 				"bozo_process_cgi: no handler, returning"));
301 			goto out;
302 		}
303 		if (len == 0 || file[len - 1] == '/')
304 			append_index_html(httpd, &file);
305 		debug((httpd, DEBUG_NORMAL, "bozo_process_cgi: cgihandler `%s'",
306 		    cgihandler));
307 	} else if (len - 1 == CGIBIN_PREFIX_LEN)	/* url is "/cgi-bin/" */
308 		append_index_html(httpd, &file);
309 
310 	ix = 0;
311 	if (cgihandler) {
312 		command = file + 1;
313 		path = bozostrdup(httpd, cgihandler);
314 		argv[ix++] = path;
315 			/* argv[] = [ path, command, query, NULL ] */
316 	} else {
317 		command = file + CGIBIN_PREFIX_LEN + 1;
318 		if ((s = strchr(command, '/')) != NULL) {
319 			info = bozostrdup(httpd, s);
320 			*s = '\0';
321 		}
322 		path = bozomalloc(httpd,
323 				strlen(httpd->cgibin) + 1 + strlen(command) + 1);
324 		strcpy(path, httpd->cgibin);
325 		strcat(path, "/");
326 		strcat(path, command);
327 			/* argv[] = [ command, query, NULL ] */
328 	}
329 	argv[ix++] = command;
330 	argv[ix++] = query;
331 	argv[ix++] = NULL;
332 
333 	nph = strncmp(command, "nph-", 4) == 0;
334 
335 	type = request->hr_content_type;
336 	clen = request->hr_content_length;
337 
338 	envpsize = 13 + request->hr_nheaders +
339 	    (info && *info ? 1 : 0) +
340 	    (query && *query ? 1 : 0) +
341 	    (type && *type ? 1 : 0) +
342 	    (clen && *clen ? 1 : 0) +
343 	    (request->hr_remotehost && *request->hr_remotehost ? 1 : 0) +
344 	    (request->hr_remoteaddr && *request->hr_remoteaddr ? 1 : 0) +
345 	    bozo_auth_cgi_count(request) +
346 	    (request->hr_serverport && *request->hr_serverport ? 1 : 0);
347 
348 	debug((httpd, DEBUG_FAT,
349 		"bozo_process_cgi: path `%s', cmd `%s', info `%s', "
350 		"query `%s', nph `%d', envpsize `%d'",
351 		path, command, strornull(info),
352 		strornull(query), nph, envpsize));
353 
354 	envp = bozomalloc(httpd, sizeof(*envp) * envpsize);
355 	for (ix = 0; ix < envpsize; ix++)
356 		envp[ix] = NULL;
357 	curenvp = envp;
358 
359 	SIMPLEQ_FOREACH(headp, &request->hr_headers, h_next) {
360 		const char *s2;
361 		env = bozomalloc(httpd, 6 + strlen(headp->h_header) + 1 +
362 		    strlen(headp->h_value));
363 
364 		t = env;
365 		strcpy(t, "HTTP_");
366 		t += strlen(t);
367 		for (s2 = headp->h_header; *s2; t++, s2++)
368 			if (islower((u_int)*s2))
369 				*t = toupper((u_int)*s2);
370 			else if (*s2 == '-')
371 				*t = '_';
372 			else
373 				*t = *s2;
374 		*t = '\0';
375 		debug((httpd, DEBUG_OBESE, "setting header %s as %s = %s",
376 		    headp->h_header, env, headp->h_value));
377 		bozo_setenv(httpd, env, headp->h_value, curenvp++);
378 		free(env);
379 	}
380 
381 #ifndef _PATH_DEFPATH
382 #define _PATH_DEFPATH "/usr/bin:/bin"
383 #endif
384 
385 	bozo_setenv(httpd, "PATH", _PATH_DEFPATH, curenvp++);
386 	bozo_setenv(httpd, "IFS", " \t\n", curenvp++);
387 	bozo_setenv(httpd, "SERVER_NAME", BOZOHOST(httpd,request), curenvp++);
388 	bozo_setenv(httpd, "GATEWAY_INTERFACE", "CGI/1.1", curenvp++);
389 	bozo_setenv(httpd, "SERVER_PROTOCOL", request->hr_proto, curenvp++);
390 	bozo_setenv(httpd, "REQUEST_METHOD", request->hr_methodstr, curenvp++);
391 	bozo_setenv(httpd, "SCRIPT_NAME", file, curenvp++);
392 	bozo_setenv(httpd, "SCRIPT_FILENAME", file + 1, curenvp++);
393 	bozo_setenv(httpd, "SERVER_SOFTWARE", httpd->server_software,
394 			curenvp++);
395 	bozo_setenv(httpd, "REQUEST_URI", uri, curenvp++);
396 	bozo_setenv(httpd, "DATE_GMT", bozo_http_date(date, sizeof(date)),
397 			curenvp++);
398 	if (query && *query)
399 		bozo_setenv(httpd, "QUERY_STRING", query, curenvp++);
400 	if (info && *info)
401 		bozo_setenv(httpd, "PATH_INFO", info, curenvp++);
402 	if (type && *type)
403 		bozo_setenv(httpd, "CONTENT_TYPE", type, curenvp++);
404 	if (clen && *clen)
405 		bozo_setenv(httpd, "CONTENT_LENGTH", clen, curenvp++);
406 	if (request->hr_serverport && *request->hr_serverport)
407 		bozo_setenv(httpd, "SERVER_PORT", request->hr_serverport,
408 				curenvp++);
409 	if (request->hr_remotehost && *request->hr_remotehost)
410 		bozo_setenv(httpd, "REMOTE_HOST", request->hr_remotehost,
411 				curenvp++);
412 	if (request->hr_remoteaddr && *request->hr_remoteaddr)
413 		bozo_setenv(httpd, "REMOTE_ADDR", request->hr_remoteaddr,
414 				curenvp++);
415 	/*
416 	 * XXX Apache does this when invoking content handlers, and PHP
417 	 * XXX 5.3 requires it as a "security" measure.
418 	 */
419 	if (cgihandler)
420 		bozo_setenv(httpd, "REDIRECT_STATUS", "200", curenvp++);
421 	bozo_auth_cgi_setenv(request, &curenvp);
422 
423 	free(file);
424 	free(url);
425 
426 	debug((httpd, DEBUG_FAT, "bozo_process_cgi: going exec %s, %s %s %s",
427 	    path, argv[0], strornull(argv[1]), strornull(argv[2])));
428 
429 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, sv) == -1)
430 		bozo_err(httpd, 1, "child socketpair failed: %s",
431 				strerror(errno));
432 
433 	/*
434 	 * We create 2 procs: one to become the CGI, one read from
435 	 * the CGI and output to the network, and this parent will
436 	 * continue reading from the network and writing to the
437 	 * CGI procsss.
438 	 */
439 	switch (fork()) {
440 	case -1: /* eep, failure */
441 		bozo_err(httpd, 1, "child fork failed: %s", strerror(errno));
442 		/*NOTREACHED*/
443 	case 0:
444 		close(sv[0]);
445 		dup2(sv[1], STDIN_FILENO);
446 		dup2(sv[1], STDOUT_FILENO);
447 		close(2);
448 		close(sv[1]);
449 		closelog();
450 		bozo_daemon_closefds(httpd);
451 
452 		if (-1 == execve(path, argv, envp))
453 			bozo_err(httpd, 1, "child exec failed: %s: %s",
454 			      path, strerror(errno));
455 		/* NOT REACHED */
456 		bozo_err(httpd, 1, "child execve returned?!");
457 	}
458 
459 	close(sv[1]);
460 
461 	/* parent: read from stdin (bozo_read()) write to sv[0] */
462 	/* child: read from sv[0] (bozo_write()) write to stdout */
463 	pid = fork();
464 	if (pid == -1)
465 		bozo_err(httpd, 1, "io child fork failed: %s", strerror(errno));
466 	else if (pid == 0) {
467 		/* child reader/writer */
468 		close(STDIN_FILENO);
469 		finish_cgi_output(httpd, request, sv[0], nph);
470 		/* if we're done output, our parent is useless... */
471 		kill(getppid(), SIGKILL);
472 		debug((httpd, DEBUG_FAT, "done processing cgi output"));
473 		_exit(0);
474 	}
475 	close(STDOUT_FILENO);
476 
477 	/* XXX we should have some goo that times us out
478 	 */
479 	while ((rbytes = bozo_read(httpd, STDIN_FILENO, buf, sizeof buf)) > 0) {
480 		ssize_t wbytes;
481 		char *bp = buf;
482 
483 		while (rbytes) {
484 			wbytes = write(sv[0], buf, (size_t)rbytes);
485 			if (wbytes > 0) {
486 				rbytes -= wbytes;
487 				bp += wbytes;
488 			} else
489 				bozo_err(httpd, 1, "write failed: %s",
490 					strerror(errno));
491 		}
492 	}
493 	debug((httpd, DEBUG_FAT, "done processing cgi input"));
494 	exit(0);
495 
496  out:
497 	free(query);
498 	free(file);
499 	free(url);
500 	return 0;
501 }
502 
503 #ifndef NO_DYNAMIC_CONTENT
504 /* cgi maps are simple ".postfix /path/to/prog" */
505 void
506 bozo_add_content_map_cgi(bozohttpd_t *httpd, const char *arg, const char *cgihandler)
507 {
508 	bozo_content_map_t *map;
509 
510 	debug((httpd, DEBUG_NORMAL, "bozo_add_content_map_cgi: name %s cgi %s",
511 		arg, cgihandler));
512 
513 	httpd->process_cgi = 1;
514 
515 	map = bozo_get_content_map(httpd, arg);
516 	map->name = arg;
517 	map->namelen = strlen(map->name);
518 	map->type = map->encoding = map->encoding11 = NULL;
519 	map->cgihandler = cgihandler;
520 }
521 #endif /* NO_DYNAMIC_CONTENT */
522 
523 #endif /* NO_CGIBIN_SUPPORT */
524