gotwebd/fcgi.c

   1 /*
   2  * Copyright (c) 2020-2022 Tracey Emery <tracey@traceyemery.net>
   3  * Copyright (c) 2013 David Gwynne <dlg@openbsd.org>
   4  * Copyright (c) 2013 Florian Obser <florian@openbsd.org>
   5  *
   6  * Permission to use, copy, modify, and distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include "got_compat.h"
  20
  21 #include <arpa/inet.h>
  22 #include <sys/queue.h>
  23 #include <sys/socket.h>
  24 #include <sys/types.h>
  25 #include <sys/uio.h>
  26
  27 #include <errno.h>
  28 #include <event.h>
  29 #include <imsg.h>
  30 #include <stdarg.h>
  31 #include <stdlib.h>
  32 #include <stdio.h>
  33 #include <string.h>
  34 #include <time.h>
  35 #include <unistd.h>
  36
  37 #include "got_error.h"
  38 #include "got_reference.h"
  39
  40 #include "proc.h"
  41 #include "gotwebd.h"
  42 #include "tmpl.h"
  43
  44 size_t   fcgi_parse_record(uint8_t *, size_t, struct request *);
  45 void     fcgi_parse_begin_request(uint8_t *, uint16_t, struct request *,
  46             uint16_t);
  47 void     fcgi_parse_params(uint8_t *, uint16_t, struct request *, uint16_t);
  48 int      fcgi_send_response(struct request *, int, const void *, size_t);
  49
  50 void     dump_fcgi_record_header(const char *, struct fcgi_record_header *);
  51 void     dump_fcgi_begin_request_body(const char *,
  52             struct fcgi_begin_request_body *);
  53 void     dump_fcgi_end_request_body(const char *,
  54             struct fcgi_end_request_body *);
  55
  56 extern int       cgi_inflight;
  57 extern volatile int client_cnt;
  58
  59 void
  60 fcgi_request(int fd, short events, void *arg)
  61 {
  62         struct request *c = arg;
  63         ssize_t n;
  64         size_t parsed = 0;
  65
  66         n = read(fd, c->buf + c->buf_pos + c->buf_len,
  67             FCGI_RECORD_SIZE - c->buf_pos-c->buf_len);
  68
  69         switch (n) {
  70         case -1:
  71                 switch (errno) {
  72                 case EINTR:
  73                 case EAGAIN:
  74                         return;
  75                 default:
  76                         goto fail;
  77                 }
  78                 break;
  79
  80         case 0:
  81                 log_debug("closed connection");
  82                 goto fail;
  83         default:
  84                 break;
  85         }
  86
  87         c->buf_len += n;
  88
  89         /*
  90          * Parse the records as they are received. Per the FastCGI
  91          * specification, the server need only receive the FastCGI
  92          * parameter records in full; it is free to begin execution
  93          * at that point, which is what happens here.
  94          */
  95         do {
  96                 parsed = fcgi_parse_record(c->buf + c->buf_pos, c->buf_len, c);
  97                 if (parsed != 0) {
  98                         c->buf_pos += parsed;
  99                         c->buf_len -= parsed;
 100                 }
 101
 102                 /* drop the parsed record */
 103                 if (parsed != 0 && c->buf_len > 0) {
 104                         bcopy(c->buf + c->buf_pos, c->buf, c->buf_len);
 105                         c->buf_pos = 0;
 106                 }
 107         } while (parsed > 0 && c->buf_len > 0);
 108
 109         return;
 110 fail:
 111         fcgi_cleanup_request(c);
 112 }
 113
 114 size_t
 115 fcgi_parse_record(uint8_t *buf, size_t n, struct request *c)
 116 {
 117         struct fcgi_record_header *h;
 118
 119         if (n < sizeof(struct fcgi_record_header))
 120                  return 0;
 121
 122         h = (struct fcgi_record_header*) buf;
 123
 124         dump_fcgi_record("", h);
 125
 126         if (n < sizeof(struct fcgi_record_header) + ntohs(h->content_len)
 127             + h->padding_len)
 128                  return 0;
 129
 130         if (h->version != 1)
 131                 log_warn("wrong version");
 132
 133         switch (h->type) {
 134         case FCGI_BEGIN_REQUEST:
 135                 fcgi_parse_begin_request(buf +
 136                     sizeof(struct fcgi_record_header),
 137                     ntohs(h->content_len), c, ntohs(h->id));
 138                 break;
 139         case FCGI_PARAMS:
 140                 fcgi_parse_params(buf + sizeof(struct fcgi_record_header),
 141                     ntohs(h->content_len), c, ntohs(h->id));
 142                 break;
 143         case FCGI_STDIN:
 144         case FCGI_ABORT_REQUEST:
 145                 if (c->sock->client_status != CLIENT_DISCONNECT &&
 146                     c->outbuf_len != 0) {
 147                         fcgi_send_response(c, FCGI_STDOUT, c->outbuf,
 148                             c->outbuf_len);
 149                 }
 150
 151                 fcgi_create_end_record(c);
 152                 fcgi_cleanup_request(c);
 153                 return 0;
 154         default:
 155                 log_warn("unimplemented type %d", h->type);
 156                 break;
 157         }
 158
 159         return (sizeof(struct fcgi_record_header) + ntohs(h->content_len)
 160             + h->padding_len);
 161 }
 162
 163 void
 164 fcgi_parse_begin_request(uint8_t *buf, uint16_t n,
 165     struct request *c, uint16_t id)
 166 {
 167         /* XXX -- FCGI_CANT_MPX_CONN */
 168         if (c->request_started) {
 169                 log_warn("unexpected FCGI_BEGIN_REQUEST, ignoring");
 170                 return;
 171         }
 172
 173         if (n != sizeof(struct fcgi_begin_request_body)) {
 174                 log_warn("wrong size %d != %lu", n,
 175                     sizeof(struct fcgi_begin_request_body));
 176                 return;
 177         }
 178
 179         c->request_started = 1;
 180         c->id = id;
 181 }
 182
 183 void
 184 fcgi_parse_params(uint8_t *buf, uint16_t n, struct request *c, uint16_t id)
 185 {
 186         uint32_t name_len, val_len;
 187         uint8_t *sd, *val;
 188
 189         if (!c->request_started) {
 190                 log_warn("FCGI_PARAMS without FCGI_BEGIN_REQUEST, ignoring");
 191                 return;
 192         }
 193
 194         if (c->id != id) {
 195                 log_warn("unexpected id, ignoring");
 196                 return;
 197         }
 198
 199         if (n == 0) {
 200                 gotweb_process_request(c);
 201                 return;
 202         }
 203
 204         while (n > 0) {
 205                 if (buf[0] >> 7 == 0) {
 206                         name_len = buf[0];
 207                         n--;
 208                         buf++;
 209                 } else {
 210                         if (n > 3) {
 211                                 name_len = ((buf[0] & 0x7f) << 24) +
 212                                     (buf[1] << 16) + (buf[2] << 8) + buf[3];
 213                                 n -= 4;
 214                                 buf += 4;
 215                         } else
 216                                 return;
 217                 }
 218
 219                 if (n == 0)
 220                         return;
 221
 222                 if (buf[0] >> 7 == 0) {
 223                         val_len = buf[0];
 224                         n--;
 225                         buf++;
 226                 } else {
 227                         if (n > 3) {
 228                                 val_len = ((buf[0] & 0x7f) << 24) +
 229                                         (buf[1] << 16) + (buf[2] << 8) +
 230                                         buf[3];
 231                                 n -= 4;
 232                                 buf += 4;
 233                         } else
 234                                 return;
 235                 }
 236
 237                 if (n < name_len + val_len)
 238                         return;
 239
 240                 val = buf + name_len;
 241
 242                 if (c->querystring[0] == '\0' &&
 243                     val_len < MAX_QUERYSTRING &&
 244                     name_len == 12 &&
 245                     strncmp(buf, "QUERY_STRING", 12) == 0) {
 246                         memcpy(c->querystring, val, val_len);
 247                         c->querystring[val_len] = '\0';
 248                 }
 249
 250                 if (c->http_host[0] == '\0' &&
 251                     val_len < GOTWEBD_MAXTEXT &&
 252                     name_len == 9 &&
 253                     strncmp(buf, "HTTP_HOST", 9) == 0) {
 254                         memcpy(c->http_host, val, val_len);
 255                         c->http_host[val_len] = '\0';
 256
 257                         /*
 258                          * lazily get subdomain
 259                          * will only get domain if no subdomain exists
 260                          * this can still work if gotweb server name is the same
 261                          */
 262                         sd = strchr(c->http_host, '.');
 263                         if (sd)
 264                                 *sd = '\0';
 265                 }
 266
 267                 if (c->document_uri[0] == '\0' &&
 268                     val_len < MAX_DOCUMENT_URI &&
 269                     name_len == 12 &&
 270                     strncmp(buf, "DOCUMENT_URI", 12) == 0) {
 271                         memcpy(c->document_uri, val, val_len);
 272                         c->document_uri[val_len] = '\0';
 273                 }
 274
 275                 if (c->server_name[0] == '\0' &&
 276                     val_len < MAX_SERVER_NAME &&
 277                     name_len == 11 &&
 278                     strncmp(buf, "SERVER_NAME", 11) == 0) {
 279                         memcpy(c->server_name, val, val_len);
 280                         c->server_name[val_len] = '\0';
 281                 }
 282
 283                 if (name_len == 5 &&
 284                     strncmp(buf, "HTTPS", 5) == 0)
 285                         c->https = 1;
 286
 287                 buf += name_len + val_len;
 288                 n -= name_len - val_len;
 289         }
 290 }
 291
 292 void
 293 fcgi_timeout(int fd, short events, void *arg)
 294 {
 295         fcgi_cleanup_request((struct request*) arg);
 296 }
 297
 298 int
 299 fcgi_puts(struct template *tp, const char *str)
 300 {
 301         if (str == NULL)
 302                 return 0;
 303         return fcgi_gen_binary_response(tp->tp_arg, str, strlen(str));
 304 }
 305
 306 int
 307 fcgi_putc(struct template *tp, int ch)
 308 {
 309         uint8_t c = ch;
 310         return fcgi_gen_binary_response(tp->tp_arg, &c, 1);
 311 }
 312
 313 int
 314 fcgi_vprintf(struct request *c, const char *fmt, va_list ap)
 315 {
 316         char *str;
 317         int r;
 318
 319         r = vasprintf(&str, fmt, ap);
 320         if (r == -1) {
 321                 log_warn("%s: asprintf", __func__);
 322                 return -1;
 323         }
 324
 325         r = fcgi_gen_binary_response(c, str, r);
 326         free(str);
 327         return r;
 328 }
 329
 330 int
 331 fcgi_printf(struct request *c, const char *fmt, ...)
 332 {
 333         va_list ap;
 334         int r;
 335
 336         va_start(ap, fmt);
 337         r = fcgi_vprintf(c, fmt, ap);
 338         va_end(ap);
 339
 340         return r;
 341 }
 342
 343 int
 344 fcgi_gen_binary_response(struct request *c, const uint8_t *data, int len)
 345 {
 346         int r;
 347
 348         if (c->sock->client_status == CLIENT_DISCONNECT)
 349                 return -1;
 350
 351         if (data == NULL || len == 0)
 352                 return 0;
 353
 354         /*
 355          * special case: send big replies -like blobs- directly
 356          * without copying.
 357          */
 358         if (len > sizeof(c->outbuf)) {
 359                 if (c->outbuf_len > 0) {
 360                         fcgi_send_response(c, FCGI_STDOUT,
 361                             c->outbuf, c->outbuf_len);
 362                         c->outbuf_len = 0;
 363                 }
 364                 return fcgi_send_response(c, FCGI_STDOUT, data, len);
 365         }
 366
 367         if (len < sizeof(c->outbuf) - c->outbuf_len) {
 368                 memcpy(c->outbuf + c->outbuf_len, data, len);
 369                 c->outbuf_len += len;
 370                 return 0;
 371         }
 372
 373         r = fcgi_send_response(c, FCGI_STDOUT, c->outbuf, c->outbuf_len);
 374         if (r == -1)
 375                 return -1;
 376
 377         memcpy(c->outbuf, data, len);
 378         c->outbuf_len = len;
 379         return 0;
 380 }
 381
 382 static int
 383 send_response(struct request *c, int type, const uint8_t *data,
 384     size_t len)
 385 {
 386         static const uint8_t padding[FCGI_PADDING_SIZE];
 387         struct fcgi_record_header header;
 388         struct iovec iov[3];
 389         struct timespec ts;
 390         ssize_t nw;
 391         size_t padded_len, tot;
 392         int i, err = 0, th = 2000;
 393
 394         ts.tv_sec = 0;
 395         ts.tv_nsec = 50;
 396
 397         memset(&header, 0, sizeof(header));
 398         header.version = 1;
 399         header.type = type;
 400         header.id = htons(c->id);
 401         header.content_len = htons(len);
 402
 403         /* The FastCGI spec suggests to align the output buffer */
 404         tot = sizeof(header) + len;
 405         padded_len = FCGI_ALIGN(tot);
 406         if (padded_len > tot) {
 407                 header.padding_len = padded_len - tot;
 408                 tot += header.padding_len;
 409         }
 410
 411         iov[0].iov_base = &header;
 412         iov[0].iov_len = sizeof(header);
 413
 414         iov[1].iov_base = (void *)data;
 415         iov[1].iov_len = len;
 416
 417         iov[2].iov_base = (void *)padding;
 418         iov[2].iov_len = header.padding_len;
 419
 420         dump_fcgi_record("resp ", &header);
 421
 422         /*
 423          * XXX: add some simple write heuristics here
 424          * On slower VMs, spotty connections, etc., we don't want to go right to
 425          * disconnect. Let's at least try to write the data a few times before
 426          * giving up.
 427          */
 428         while (tot > 0) {
 429                 nw = writev(c->fd, iov, nitems(iov));
 430                 if (nw == 0) {
 431                         c->sock->client_status = CLIENT_DISCONNECT;
 432                         break;
 433                 }
 434                 if (nw == -1) {
 435                         err++;
 436                         if (errno == EAGAIN && err < th) {
 437                                 nanosleep(&ts, NULL);
 438                                 continue;
 439                         }
 440                         log_warn("%s: write failure", __func__);
 441                         c->sock->client_status = CLIENT_DISCONNECT;
 442                         return -1;
 443                 }
 444
 445                 if (nw != tot)
 446                         log_debug("%s: partial write: %zu vs %zu", __func__,
 447                             nw, tot);
 448
 449                 tot -= nw;
 450                 for (i = 0; i < nitems(iov); ++i) {
 451                         if (nw < iov[i].iov_len) {
 452                                 iov[i].iov_base += nw;
 453                                 iov[i].iov_len -= nw;
 454                                 break;
 455                         }
 456                         nw -= iov[i].iov_len;
 457                         iov[i].iov_len = 0;
 458                 }
 459         }
 460
 461         return 0;
 462 }
 463
 464 int
 465 fcgi_send_response(struct request *c, int type, const void *data,
 466     size_t len)
 467 {
 468         if (c->sock->client_status == CLIENT_DISCONNECT)
 469                 return -1;
 470
 471         while (len > FCGI_CONTENT_SIZE) {
 472                 if (send_response(c, type, data, len) == -1)
 473                         return -1;
 474
 475                 data += FCGI_CONTENT_SIZE;
 476                 len -= FCGI_CONTENT_SIZE;
 477         }
 478
 479         if (len == 0)
 480                 return 0;
 481
 482         return send_response(c, type, data, len);
 483 }
 484
 485 void
 486 fcgi_create_end_record(struct request *c)
 487 {
 488         struct fcgi_end_request_body end_request;
 489
 490         memset(&end_request, 0, sizeof(end_request));
 491         end_request.app_status = htonl(0); /* script status */
 492         end_request.protocol_status = FCGI_REQUEST_COMPLETE;
 493
 494         fcgi_send_response(c, FCGI_END_REQUEST, &end_request,
 495             sizeof(end_request));
 496 }
 497
 498 void
 499 fcgi_cleanup_request(struct request *c)
 500 {
 501         cgi_inflight--;
 502         client_cnt--;
 503
 504         evtimer_del(&c->tmo);
 505         if (event_initialized(&c->ev))
 506                 event_del(&c->ev);
 507
 508         close(c->fd);
 509         template_free(c->tp);
 510         if (c->t != NULL)
 511                 gotweb_free_transport(c->t);
 512         free(c);
 513 }
 514
 515 void
 516 dump_fcgi_record(const char *p, struct fcgi_record_header *h)
 517 {
 518         dump_fcgi_record_header(p, h);
 519
 520         if (h->type == FCGI_BEGIN_REQUEST)
 521                 dump_fcgi_begin_request_body(p,
 522                     (struct fcgi_begin_request_body *)(h + 1));
 523         else if (h->type == FCGI_END_REQUEST)
 524                 dump_fcgi_end_request_body(p,
 525                     (struct fcgi_end_request_body *)(h + 1));
 526 }
 527
 528 void
 529 dump_fcgi_record_header(const char* p, struct fcgi_record_header *h)
 530 {
 531         log_debug("%sversion:         %d", p, h->version);
 532         log_debug("%stype:            %d", p, h->type);
 533         log_debug("%srequestId:       %d", p, ntohs(h->id));
 534         log_debug("%scontentLength:   %d", p, ntohs(h->content_len));
 535         log_debug("%spaddingLength:   %d", p, h->padding_len);
 536         log_debug("%sreserved:        %d", p, h->reserved);
 537 }
 538
 539 void
 540 dump_fcgi_begin_request_body(const char *p, struct fcgi_begin_request_body *b)
 541 {
 542         log_debug("%srole             %d", p, ntohs(b->role));
 543         log_debug("%sflags            %d", p, b->flags);
 544 }
 545
 546 void
 547 dump_fcgi_end_request_body(const char *p, struct fcgi_end_request_body *b)
 548 {
 549         log_debug("%sappStatus:       %d", p, ntohl(b->app_status));
 550         log_debug("%sprotocolStatus:  %d", p, b->protocol_status);
 551 }