gotwebd/sockets.c

   1 /*
   2  * Copyright (c) 2016, 2019, 2020-2021 Tracey Emery <tracey@traceyemery.net>
   3  * Copyright (c) 2015 Mike Larkin <mlarkin@openbsd.org>
   4  * Copyright (c) 2013 David Gwynne <dlg@openbsd.org>
   5  * Copyright (c) 2013 Florian Obser <florian@openbsd.org>
   6  *
   7  * Permission to use, copy, modify, and distribute this software for any
   8  * purpose with or without fee is hereby granted, provided that the above
   9  * copyright notice and this permission notice appear in all copies.
  10  *
  11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18  */
  19
  20 #include "got_compat.h"
  21
  22 #include <sys/param.h>
  23 #include <sys/ioctl.h>
  24 #include <sys/queue.h>
  25 #include <sys/wait.h>
  26 #include <sys/uio.h>
  27 #include <sys/resource.h>
  28 #include <sys/socket.h>
  29 #include <sys/stat.h>
  30 #include <sys/time.h>
  31 #include <sys/types.h>
  32 #include <sys/mman.h>
  33 #include <sys/un.h>
  34
  35 #include <net/if.h>
  36 #include <netinet/in.h>
  37
  38 #include <errno.h>
  39 #include <event.h>
  40 #include <fcntl.h>
  41 #include <ifaddrs.h>
  42 #include <limits.h>
  43 #include <netdb.h>
  44 #include <poll.h>
  45 #include <pwd.h>
  46 #include <stddef.h>
  47 #include <stdio.h>
  48 #include <stdlib.h>
  49 #include <string.h>
  50 #include <unistd.h>
  51
  52 #include "got_error.h"
  53 #include "got_opentemp.h"
  54 #include "got_reference.h"
  55 #include "got_repository.h"
  56 #include "got_privsep.h"
  57
  58 #include "gotwebd.h"
  59 #include "tmpl.h"
  60
  61 #define SOCKS_BACKLOG 5
  62 #define MAXIMUM(a, b)   (((a) > (b)) ? (a) : (b))
  63
  64 volatile int client_cnt;
  65
  66 static struct timeval   timeout = { TIMEOUT_DEFAULT, 0 };
  67
  68 static void      sockets_sighdlr(int, short, void *);
  69 static void      sockets_shutdown(void);
  70 static void      sockets_launch(void);
  71 static void      sockets_purge(struct gotwebd *);
  72 static void      sockets_accept_paused(int, short, void *);
  73 static void      sockets_rlimit(int);
  74
  75 static void      sockets_dispatch_main(int, short, void *);
  76 static int       sockets_unix_socket_listen(struct gotwebd *, struct socket *);
  77 static int       sockets_create_socket(struct address *);
  78 static int       sockets_accept_reserve(int, struct sockaddr *, socklen_t *,
  79                     int, volatile int *);
  80
  81 static struct socket *sockets_conf_new_socket_unix(struct gotwebd *,
  82                     struct server *, int);
  83 static struct socket *sockets_conf_new_socket_fcgi(struct gotwebd *,
  84                     struct server *, int, struct address *);
  85
  86 int cgi_inflight = 0;
  87
  88 void
  89 sockets(struct gotwebd *env, int fd)
  90 {
  91         struct event     sighup, sigpipe, sigusr1, sigchld;
  92
  93         event_init();
  94
  95         sockets_rlimit(-1);
  96
  97         if (config_init(env) == -1)
  98                 fatal("failed to initialize configuration");
  99
 100         if ((env->iev_parent = malloc(sizeof(*env->iev_parent))) == NULL)
 101                 fatal("malloc");
 102         imsg_init(&env->iev_parent->ibuf, fd);
 103         env->iev_parent->handler = sockets_dispatch_main;
 104         env->iev_parent->data = env->iev_parent;
 105         event_set(&env->iev_parent->ev, fd, EV_READ, sockets_dispatch_main,
 106             env->iev_parent);
 107         event_add(&env->iev_parent->ev, NULL);
 108
 109         signal(SIGPIPE, SIG_IGN);
 110
 111         signal_set(&sighup, SIGCHLD, sockets_sighdlr, env);
 112         signal_add(&sighup, NULL);
 113         signal_set(&sigpipe, SIGCHLD, sockets_sighdlr, env);
 114         signal_add(&sigpipe, NULL);
 115         signal_set(&sigusr1, SIGCHLD, sockets_sighdlr, env);
 116         signal_add(&sigusr1, NULL);
 117         signal_set(&sigchld, SIGCHLD, sockets_sighdlr, env);
 118         signal_add(&sigchld, NULL);
 119
 120 #ifndef PROFILE
 121         if (pledge("stdio rpath inet recvfd proc exec sendfd unveil",
 122             NULL) == -1)
 123                 fatal("pledge");
 124 #endif
 125
 126         event_dispatch();
 127         sockets_shutdown();
 128 }
 129
 130 void
 131 sockets_parse_sockets(struct gotwebd *env)
 132 {
 133         struct server *srv;
 134         struct address *a;
 135         struct socket *new_sock = NULL;
 136         int sock_id = 1;
 137
 138         TAILQ_FOREACH(srv, &env->servers, entry) {
 139                 if (srv->unix_socket) {
 140                         new_sock = sockets_conf_new_socket_unix(env, srv,
 141                             sock_id);
 142                         if (new_sock) {
 143                                 sock_id++;
 144                                 TAILQ_INSERT_TAIL(&env->sockets, new_sock,
 145                                     entry);
 146                         }
 147                 }
 148
 149                 if (srv->fcgi_socket) {
 150                         if (TAILQ_EMPTY(&srv->al)) {
 151                                 fatalx("%s: server %s has no IP addresses to "
 152                                     "listen for FCGI connections", __func__,
 153                                     srv->name);
 154                         }
 155                         TAILQ_FOREACH(a, &srv->al, entry) {
 156                                 if (a->ss.ss_family != AF_INET &&
 157                                     a->ss.ss_family != AF_INET6)
 158                                         continue;
 159                                 new_sock = sockets_conf_new_socket_fcgi(env,
 160                                     srv, sock_id, a);
 161                                 if (new_sock) {
 162                                         sock_id++;
 163                                         TAILQ_INSERT_TAIL(&env->sockets,
 164                                             new_sock, entry);
 165                                 }
 166                         }
 167                 }
 168         }
 169 }
 170
 171 static struct socket *
 172 sockets_conf_new_socket_unix(struct gotwebd *env, struct server *srv, int id)
 173 {
 174         struct socket *sock;
 175         int n;
 176
 177         if ((sock = calloc(1, sizeof(*sock))) == NULL)
 178                 fatalx("%s: calloc", __func__);
 179
 180         sock->conf.id = id;
 181         sock->fd = -1;
 182         sock->conf.af_type = AF_UNIX;
 183
 184         if (strlcpy(sock->conf.unix_socket_name,
 185             srv->unix_socket_name,
 186             sizeof(sock->conf.unix_socket_name)) >=
 187             sizeof(sock->conf.unix_socket_name)) {
 188                 free(sock);
 189                 fatalx("%s: strlcpy", __func__);
 190         }
 191
 192         n = snprintf(sock->conf.name, GOTWEBD_MAXTEXT, "%s_parent",
 193             srv->name);
 194         if (n < 0 || (size_t)n >= GOTWEBD_MAXTEXT) {
 195                 free(sock);
 196                 fatalx("%s: snprintf", __func__);
 197         }
 198
 199         if (strlcpy(sock->conf.srv_name, srv->name,
 200             sizeof(sock->conf.srv_name)) >= sizeof(sock->conf.srv_name)) {
 201                 free(sock);
 202                 fatalx("%s: strlcpy", __func__);
 203         }
 204
 205         return sock;
 206 }
 207
 208 static struct socket *
 209 sockets_conf_new_socket_fcgi(struct gotwebd *env, struct server *srv, int id,
 210     struct address *a)
 211 {
 212         struct socket *sock;
 213         struct address *acp;
 214         int n;
 215
 216         if ((sock = calloc(1, sizeof(*sock))) == NULL)
 217                 fatalx("%s: calloc", __func__);
 218
 219         sock->conf.id = id;
 220         sock->fd = -1;
 221         sock->conf.af_type = a->ss.ss_family;
 222
 223         sock->conf.fcgi_socket_port = a->port;
 224
 225         n = snprintf(sock->conf.name, GOTWEBD_MAXTEXT, "%s_parent",
 226             srv->name);
 227         if (n < 0 || (size_t)n >= GOTWEBD_MAXTEXT) {
 228                 free(sock);
 229                 fatalx("%s: snprintf", __func__);
 230         }
 231
 232         if (strlcpy(sock->conf.srv_name, srv->name,
 233             sizeof(sock->conf.srv_name)) >= sizeof(sock->conf.srv_name)) {
 234                 free(sock);
 235                 fatalx("%s: strlcpy", __func__);
 236         }
 237
 238         acp = &sock->conf.addr;
 239
 240         memcpy(&acp->ss, &a->ss, sizeof(acp->ss));
 241         acp->slen = a->slen;
 242         acp->ai_family = a->ai_family;
 243         acp->ai_socktype = a->ai_socktype;
 244         acp->ai_protocol = a->ai_protocol;
 245         acp->port = a->port;
 246         if (*a->ifname != '\0') {
 247                 if (strlcpy(acp->ifname, a->ifname,
 248                     sizeof(acp->ifname)) >= sizeof(acp->ifname)) {
 249                         fatalx("%s: interface name truncated",
 250                             __func__);
 251                 }
 252         }
 253
 254         return (sock);
 255 }
 256
 257 static void
 258 sockets_launch(void)
 259 {
 260         struct socket *sock;
 261         struct server *srv;
 262         const struct got_error *error;
 263
 264         TAILQ_FOREACH(sock, &gotwebd_env->sockets, entry) {
 265                 log_debug("%s: configuring socket %d (%d)", __func__,
 266                     sock->conf.id, sock->fd);
 267
 268                 event_set(&sock->ev, sock->fd, EV_READ | EV_PERSIST,
 269                     sockets_socket_accept, sock);
 270
 271                 if (event_add(&sock->ev, NULL))
 272                         fatalx("event add sock");
 273
 274                 evtimer_set(&sock->pause, sockets_accept_paused, sock);
 275
 276                 log_debug("%s: running socket listener %d", __func__,
 277                     sock->conf.id);
 278         }
 279
 280         TAILQ_FOREACH(srv, &gotwebd_env->servers, entry) {
 281                 if (unveil(srv->repos_path, "r") == -1)
 282                         fatal("unveil %s", srv->repos_path);
 283         }
 284
 285         error = got_privsep_unveil_exec_helpers();
 286         if (error)
 287                 fatal("%s", error->msg);
 288
 289         if (unveil(NULL, NULL) == -1)
 290                 fatal("unveil");
 291 }
 292
 293 static void
 294 sockets_purge(struct gotwebd *env)
 295 {
 296         struct socket *sock, *tsock;
 297
 298         /* shutdown and remove sockets */
 299         TAILQ_FOREACH_SAFE(sock, &env->sockets, entry, tsock) {
 300                 if (event_initialized(&sock->ev))
 301                         event_del(&sock->ev);
 302                 if (evtimer_initialized(&sock->evt))
 303                         evtimer_del(&sock->evt);
 304                 if (evtimer_initialized(&sock->pause))
 305                         evtimer_del(&sock->pause);
 306                 if (sock->fd != -1)
 307                         close(sock->fd);
 308                 TAILQ_REMOVE(&env->sockets, sock, entry);
 309         }
 310 }
 311
 312 static void
 313 sockets_dispatch_main(int fd, short event, void *arg)
 314 {
 315         struct imsgev           *iev = arg;
 316         struct imsgbuf          *ibuf;
 317         struct imsg              imsg;
 318         struct gotwebd          *env = gotwebd_env;
 319         ssize_t                  n;
 320         int                      shut = 0;
 321
 322         ibuf = &iev->ibuf;
 323
 324         if (event & EV_READ) {
 325                 if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
 326                         fatal("imsg_read error");
 327                 if (n == 0)     /* Connection closed */
 328                         shut = 1;
 329         }
 330         if (event & EV_WRITE) {
 331                 if ((n = msgbuf_write(&ibuf->w)) == -1 && errno != EAGAIN)
 332                         fatal("msgbuf_write");
 333                 if (n == 0)     /* Connection closed */
 334                         shut = 1;
 335         }
 336
 337         for (;;) {
 338                 if ((n = imsg_get(ibuf, &imsg)) == -1)
 339                         fatal("imsg_get");
 340                 if (n == 0)     /* No more messages. */
 341                         break;
 342
 343                 switch (imsg.hdr.type) {
 344                 case IMSG_CFG_SRV:
 345                         config_getserver(env, &imsg);
 346                         break;
 347                 case IMSG_CFG_SOCK:
 348                         config_getsock(env, &imsg);
 349                         break;
 350                 case IMSG_CFG_FD:
 351                         config_getfd(env, &imsg);
 352                         break;
 353                 case IMSG_CFG_DONE:
 354                         config_getcfg(env, &imsg);
 355                         break;
 356                 case IMSG_CTL_START:
 357                         sockets_launch();
 358                         break;
 359                 default:
 360                         fatalx("%s: unknown imsg type %d", __func__,
 361                             imsg.hdr.type);
 362                 }
 363
 364                 imsg_free(&imsg);
 365         }
 366
 367         if (!shut)
 368                 imsg_event_add(iev);
 369         else {
 370                 /* This pipe is dead.  Remove its event handler */
 371                 event_del(&iev->ev);
 372                 event_loopexit(NULL);
 373         }
 374 }
 375
 376 static void
 377 sockets_sighdlr(int sig, short event, void *arg)
 378 {
 379         switch (sig) {
 380         case SIGHUP:
 381                 log_info("%s: ignoring SIGHUP", __func__);
 382                 break;
 383         case SIGPIPE:
 384                 log_info("%s: ignoring SIGPIPE", __func__);
 385                 break;
 386         case SIGUSR1:
 387                 log_info("%s: ignoring SIGUSR1", __func__);
 388                 break;
 389         case SIGCHLD:
 390                 break;
 391         default:
 392                 log_info("SIGNAL: %d", sig);
 393                 fatalx("unexpected signal");
 394         }
 395 }
 396
 397 static void
 398 sockets_shutdown(void)
 399 {
 400         struct server *srv, *tsrv;
 401         struct socket *sock, *tsock;
 402
 403         sockets_purge(gotwebd_env);
 404
 405         /* clean sockets */
 406         TAILQ_FOREACH_SAFE(sock, &gotwebd_env->sockets, entry, tsock) {
 407                 TAILQ_REMOVE(&gotwebd_env->sockets, sock, entry);
 408                 close(sock->fd);
 409                 free(sock);
 410         }
 411
 412         /* clean servers */
 413         TAILQ_FOREACH_SAFE(srv, &gotwebd_env->servers, entry, tsrv)
 414                 free(srv);
 415
 416         free(gotwebd_env);
 417 }
 418
 419 int
 420 sockets_privinit(struct gotwebd *env, struct socket *sock)
 421 {
 422         if (sock->conf.af_type == AF_UNIX) {
 423                 log_debug("%s: initializing unix socket %s", __func__,
 424                     sock->conf.unix_socket_name);
 425                 sock->fd = sockets_unix_socket_listen(env, sock);
 426                 if (sock->fd == -1) {
 427                         log_warnx("%s: create unix socket failed", __func__);
 428                         return -1;
 429                 }
 430         }
 431
 432         if (sock->conf.af_type == AF_INET || sock->conf.af_type == AF_INET6) {
 433                 log_debug("%s: initializing %s FCGI socket on port %d for %s",
 434                     __func__, sock->conf.af_type == AF_INET ? "inet" : "inet6",
 435                     sock->conf.fcgi_socket_port, sock->conf.name);
 436                 sock->fd = sockets_create_socket(&sock->conf.addr);
 437                 if (sock->fd == -1) {
 438                         log_warnx("%s: create FCGI socket failed", __func__);
 439                         return -1;
 440                 }
 441         }
 442
 443         return 0;
 444 }
 445
 446 static int
 447 sockets_unix_socket_listen(struct gotwebd *env, struct socket *sock)
 448 {
 449         struct sockaddr_un sun;
 450         struct socket *tsock;
 451         int u_fd = -1;
 452         mode_t old_umask, mode;
 453
 454         TAILQ_FOREACH(tsock, &env->sockets, entry) {
 455                 if (strcmp(tsock->conf.unix_socket_name,
 456                     sock->conf.unix_socket_name) == 0 &&
 457                     tsock->fd != -1)
 458                         return (tsock->fd);
 459         }
 460
 461         /* TA: FIXME:  this needs upstreaming. */
 462         int socket_flags = SOCK_STREAM | SOCK_NONBLOCK;
 463 #ifdef SOCK_CLOEXEC
 464         socket_flags |= SOCK_CLOEXEC;
 465 #endif
 466         u_fd = socket(AF_UNIX, socket_flags, 0);
 467         if (u_fd == -1) {
 468                 log_warn("%s: socket", __func__);
 469                 return -1;
 470         }
 471
 472         sun.sun_family = AF_UNIX;
 473         if (strlcpy(sun.sun_path, sock->conf.unix_socket_name,
 474             sizeof(sun.sun_path)) >= sizeof(sun.sun_path)) {
 475                 log_warn("%s: %s name too long", __func__,
 476                     sock->conf.unix_socket_name);
 477                 close(u_fd);
 478                 return -1;
 479         }
 480
 481         if (unlink(sock->conf.unix_socket_name) == -1) {
 482                 if (errno != ENOENT) {
 483                         log_warn("%s: unlink %s", __func__,
 484                             sock->conf.unix_socket_name);
 485                         close(u_fd);
 486                         return -1;
 487                 }
 488         }
 489
 490         old_umask = umask(S_IXUSR|S_IXGRP|S_IWOTH|S_IROTH|S_IXOTH);
 491         mode = S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP;
 492
 493         if (bind(u_fd, (struct sockaddr *)&sun, sizeof(sun)) == -1) {
 494                 log_warn("%s: bind: %s", __func__, sock->conf.unix_socket_name);
 495                 close(u_fd);
 496                 (void)umask(old_umask);
 497                 return -1;
 498         }
 499
 500         (void)umask(old_umask);
 501
 502         if (chmod(sock->conf.unix_socket_name, mode) == -1) {
 503                 log_warn("%s: chmod", __func__);
 504                 close(u_fd);
 505                 (void)unlink(sock->conf.unix_socket_name);
 506                 return -1;
 507         }
 508
 509         if (chown(sock->conf.unix_socket_name, env->pw->pw_uid,
 510             env->pw->pw_gid) == -1) {
 511                 log_warn("%s: chown", __func__);
 512                 close(u_fd);
 513                 (void)unlink(sock->conf.unix_socket_name);
 514                 return -1;
 515         }
 516
 517         if (listen(u_fd, SOCKS_BACKLOG) == -1) {
 518                 log_warn("%s: listen", __func__);
 519                 return -1;
 520         }
 521
 522         return u_fd;
 523 }
 524
 525 static int
 526 sockets_create_socket(struct address *a)
 527 {
 528         int fd = -1, o_val = 1, flags;
 529
 530         fd = socket(a->ai_family, a->ai_socktype, a->ai_protocol);
 531         if (fd == -1)
 532                 return -1;
 533
 534         log_debug("%s: opened socket (%d) for %s", __func__,
 535             fd, a->ifname);
 536
 537         if (setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &o_val,
 538             sizeof(int)) == -1) {
 539                 log_warn("%s: setsockopt error", __func__);
 540                 close(fd);
 541                 return -1;
 542         }
 543
 544         /* non-blocking */
 545         flags = fcntl(fd, F_GETFL);
 546         flags |= O_NONBLOCK;
 547         if (fcntl(fd, F_SETFL, flags) == -1) {
 548                 log_info("%s: could not enable non-blocking I/O", __func__);
 549                 close(fd);
 550                 return -1;
 551         }
 552
 553         if (bind(fd, (struct sockaddr *)&a->ss, a->slen) == -1) {
 554                 close(fd);
 555                 log_info("%s: can't bind to port %d", __func__, a->port);
 556                 return -1;
 557         }
 558
 559         if (listen(fd, SOMAXCONN) == -1) {
 560                 log_warn("%s, unable to listen on socket", __func__);
 561                 close(fd);
 562                 return -1;
 563         }
 564
 565         return (fd);
 566 }
 567
 568 static int
 569 sockets_accept_reserve(int sockfd, struct sockaddr *addr, socklen_t *addrlen,
 570     int reserve, volatile int *counter)
 571 {
 572         int ret;
 573
 574         if (getdtablecount() + reserve +
 575             ((*counter + 1) * FD_NEEDED) >= getdtablesize()) {
 576                 log_debug("inflight fds exceeded");
 577                 errno = EMFILE;
 578                 return -1;
 579         }
 580 /* TA:  This needs fixing upstream. */
 581 #ifdef __APPLE__
 582         ret = accept(sockfd, addr, addrlen);
 583 #else
 584         ret = accept4(sockfd, addr, addrlen, SOCK_NONBLOCK | SOCK_CLOEXEC);
 585 #endif
 586
 587         if (ret > -1) {
 588                 (*counter)++;
 589                 log_debug("inflight incremented, now %d", *counter);
 590         }
 591
 592         return ret;
 593 }
 594
 595 static void
 596 sockets_accept_paused(int fd, short events, void *arg)
 597 {
 598         struct socket *sock = (struct socket *)arg;
 599
 600         event_add(&sock->ev, NULL);
 601 }
 602
 603 void
 604 sockets_socket_accept(int fd, short event, void *arg)
 605 {
 606         struct socket *sock = (struct socket *)arg;
 607         struct sockaddr_storage ss;
 608         struct timeval backoff;
 609         struct request *c = NULL;
 610         socklen_t len;
 611         int s;
 612
 613         backoff.tv_sec = 1;
 614         backoff.tv_usec = 0;
 615
 616         event_add(&sock->ev, NULL);
 617         if (event & EV_TIMEOUT)
 618                 return;
 619
 620         len = sizeof(ss);
 621
 622         s = sockets_accept_reserve(fd, (struct sockaddr *)&ss, &len,
 623             FD_RESERVE, &cgi_inflight);
 624
 625         if (s == -1) {
 626                 switch (errno) {
 627                 case EINTR:
 628                 case EWOULDBLOCK:
 629                 case ECONNABORTED:
 630                         return;
 631                 case EMFILE:
 632                 case ENFILE:
 633                         event_del(&sock->ev);
 634                         evtimer_add(&sock->pause, &backoff);
 635                         return;
 636                 default:
 637                         log_warn("%s: accept", __func__);
 638                 }
 639         }
 640
 641         if (client_cnt > GOTWEBD_MAXCLIENTS)
 642                 goto err;
 643
 644         c = calloc(1, sizeof(struct request));
 645         if (c == NULL) {
 646                 log_warn("%s", __func__);
 647                 close(s);
 648                 cgi_inflight--;
 649                 return;
 650         }
 651
 652         c->tp = template(c, &fcgi_write, c->outbuf, sizeof(c->outbuf));
 653         if (c->tp == NULL) {
 654                 log_warn("%s", __func__);
 655                 close(s);
 656                 cgi_inflight--;
 657                 free(c);
 658                 return;
 659         }
 660
 661         c->fd = s;
 662         c->sock = sock;
 663         memcpy(c->priv_fd, sock->priv_fd, sizeof(c->priv_fd));
 664         c->buf_pos = 0;
 665         c->buf_len = 0;
 666         c->request_started = 0;
 667         c->sock->client_status = CLIENT_CONNECT;
 668
 669         event_set(&c->ev, s, EV_READ|EV_PERSIST, fcgi_request, c);
 670         event_add(&c->ev, NULL);
 671
 672         evtimer_set(&c->tmo, fcgi_timeout, c);
 673         evtimer_add(&c->tmo, &timeout);
 674
 675         client_cnt++;
 676
 677         return;
 678 err:
 679         cgi_inflight--;
 680         close(s);
 681         if (c != NULL)
 682                 free(c);
 683 }
 684
 685 static void
 686 sockets_rlimit(int maxfd)
 687 {
 688         struct rlimit rl;
 689
 690         if (getrlimit(RLIMIT_NOFILE, &rl) == -1)
 691                 fatal("%s: failed to get resource limit", __func__);
 692         log_debug("%s: max open files %llu", __func__,
 693             (unsigned long long)rl.rlim_max);
 694
 695         /*
 696          * Allow the maximum number of open file descriptors for this
 697          * login class (which should be the class "daemon" by default).
 698          */
 699         if (maxfd == -1)
 700                 rl.rlim_cur = rl.rlim_max;
 701         else
 702                 rl.rlim_cur = MAXIMUM(rl.rlim_max, (rlim_t)maxfd);
 703         if (setrlimit(RLIMIT_NOFILE, &rl) == -1)
 704                 fatal("%s: failed to set resource limit", __func__);
 705 }