1 /*
2  * Copyright (c) 2020-2022 Tracey Emery <tracey@traceyemery.net>
3  * Copyright (c) 2013 David Gwynne <dlg@openbsd.org>
4  * Copyright (c) 2013 Florian Obser <florian@openbsd.org>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 #include "got_compat.h"
20 
21 #include <arpa/inet.h>
22 #include <sys/queue.h>
23 #include <sys/socket.h>
24 #include <sys/types.h>
25 #include <sys/uio.h>
26 
27 #include <errno.h>
28 #include <event.h>
29 #include <imsg.h>
30 #include <stdarg.h>
31 #include <stdlib.h>
32 #include <stdio.h>
33 #include <string.h>
34 #include <time.h>
35 #include <unistd.h>
36 
37 #include "got_error.h"
38 #include "got_reference.h"
39 
40 #include "proc.h"
41 #include "gotwebd.h"
42 #include "tmpl.h"
43 
44 size_t	 fcgi_parse_record(uint8_t *, size_t, struct request *);
45 void	 fcgi_parse_begin_request(uint8_t *, uint16_t, struct request *,
46 	    uint16_t);
47 void	 fcgi_parse_params(uint8_t *, uint16_t, struct request *, uint16_t);
48 int	 fcgi_send_response(struct request *, int, const void *, size_t);
49 
50 void	 dump_fcgi_record_header(const char *, struct fcgi_record_header *);
51 void	 dump_fcgi_begin_request_body(const char *,
52 	    struct fcgi_begin_request_body *);
53 void	 dump_fcgi_end_request_body(const char *,
54 	    struct fcgi_end_request_body *);
55 
56 extern int	 cgi_inflight;
57 extern volatile int client_cnt;
58 
59 void
60 fcgi_request(int fd, short events, void *arg)
61 {
62 	struct request *c = arg;
63 	ssize_t n;
64 	size_t parsed = 0;
65 
66 	n = read(fd, c->buf + c->buf_pos + c->buf_len,
67 	    FCGI_RECORD_SIZE - c->buf_pos-c->buf_len);
68 
69 	switch (n) {
70 	case -1:
71 		switch (errno) {
72 		case EINTR:
73 		case EAGAIN:
74 			return;
75 		default:
76 			goto fail;
77 		}
78 		break;
79 
80 	case 0:
81 		log_debug("closed connection");
82 		goto fail;
83 	default:
84 		break;
85 	}
86 
87 	c->buf_len += n;
88 
89 	/*
90 	 * Parse the records as they are received. Per the FastCGI
91 	 * specification, the server need only receive the FastCGI
92 	 * parameter records in full; it is free to begin execution
93 	 * at that point, which is what happens here.
94 	 */
95 	do {
96 		parsed = fcgi_parse_record(c->buf + c->buf_pos, c->buf_len, c);
97 		if (parsed != 0) {
98 			c->buf_pos += parsed;
99 			c->buf_len -= parsed;
100 		}
101 
102 		/* drop the parsed record */
103 		if (parsed != 0 && c->buf_len > 0) {
104 			bcopy(c->buf + c->buf_pos, c->buf, c->buf_len);
105 			c->buf_pos = 0;
106 		}
107 	} while (parsed > 0 && c->buf_len > 0);
108 
109 	return;
110 fail:
111 	fcgi_cleanup_request(c);
112 }
113 
114 size_t
115 fcgi_parse_record(uint8_t *buf, size_t n, struct request *c)
116 {
117 	struct fcgi_record_header *h;
118 
119 	if (n < sizeof(struct fcgi_record_header))
120 		 return 0;
121 
122 	h = (struct fcgi_record_header*) buf;
123 
124 	dump_fcgi_record("", h);
125 
126 	if (n < sizeof(struct fcgi_record_header) + ntohs(h->content_len)
127 	    + h->padding_len)
128 		 return 0;
129 
130 	if (h->version != 1)
131 		log_warn("wrong version");
132 
133 	switch (h->type) {
134 	case FCGI_BEGIN_REQUEST:
135 		fcgi_parse_begin_request(buf +
136 		    sizeof(struct fcgi_record_header),
137 		    ntohs(h->content_len), c, ntohs(h->id));
138 		break;
139 	case FCGI_PARAMS:
140 		fcgi_parse_params(buf + sizeof(struct fcgi_record_header),
141 		    ntohs(h->content_len), c, ntohs(h->id));
142 		break;
143 	case FCGI_STDIN:
144 	case FCGI_ABORT_REQUEST:
145 		if (c->sock->client_status != CLIENT_DISCONNECT &&
146 		    c->outbuf_len != 0) {
147 			fcgi_send_response(c, FCGI_STDOUT, c->outbuf,
148 			    c->outbuf_len);
149 		}
150 
151 		fcgi_create_end_record(c);
152 		fcgi_cleanup_request(c);
153 		return 0;
154 	default:
155 		log_warn("unimplemented type %d", h->type);
156 		break;
157 	}
158 
159 	return (sizeof(struct fcgi_record_header) + ntohs(h->content_len)
160 	    + h->padding_len);
161 }
162 
163 void
164 fcgi_parse_begin_request(uint8_t *buf, uint16_t n,
165     struct request *c, uint16_t id)
166 {
167 	/* XXX -- FCGI_CANT_MPX_CONN */
168 	if (c->request_started) {
169 		log_warn("unexpected FCGI_BEGIN_REQUEST, ignoring");
170 		return;
171 	}
172 
173 	if (n != sizeof(struct fcgi_begin_request_body)) {
174 		log_warn("wrong size %d != %lu", n,
175 		    sizeof(struct fcgi_begin_request_body));
176 		return;
177 	}
178 
179 	c->request_started = 1;
180 	c->id = id;
181 }
182 
183 void
184 fcgi_parse_params(uint8_t *buf, uint16_t n, struct request *c, uint16_t id)
185 {
186 	uint32_t name_len, val_len;
187 	uint8_t *sd, *val;
188 
189 	if (!c->request_started) {
190 		log_warn("FCGI_PARAMS without FCGI_BEGIN_REQUEST, ignoring");
191 		return;
192 	}
193 
194 	if (c->id != id) {
195 		log_warn("unexpected id, ignoring");
196 		return;
197 	}
198 
199 	if (n == 0) {
200 		gotweb_process_request(c);
201 		return;
202 	}
203 
204 	while (n > 0) {
205 		if (buf[0] >> 7 == 0) {
206 			name_len = buf[0];
207 			n--;
208 			buf++;
209 		} else {
210 			if (n > 3) {
211 				name_len = ((buf[0] & 0x7f) << 24) +
212 				    (buf[1] << 16) + (buf[2] << 8) + buf[3];
213 				n -= 4;
214 				buf += 4;
215 			} else
216 				return;
217 		}
218 
219 		if (n == 0)
220 			return;
221 
222 		if (buf[0] >> 7 == 0) {
223 			val_len = buf[0];
224 			n--;
225 			buf++;
226 		} else {
227 			if (n > 3) {
228 				val_len = ((buf[0] & 0x7f) << 24) +
229 					(buf[1] << 16) + (buf[2] << 8) +
230 					buf[3];
231 				n -= 4;
232 				buf += 4;
233 			} else
234 				return;
235 		}
236 
237 		if (n < name_len + val_len)
238 			return;
239 
240 		val = buf + name_len;
241 
242 		if (c->querystring[0] == '\0' &&
243 		    val_len < MAX_QUERYSTRING &&
244 		    name_len == 12 &&
245 		    strncmp(buf, "QUERY_STRING", 12) == 0) {
246 			memcpy(c->querystring, val, val_len);
247 			c->querystring[val_len] = '\0';
248 		}
249 
250 		if (c->http_host[0] == '\0' &&
251 		    val_len < GOTWEBD_MAXTEXT &&
252 		    name_len == 9 &&
253 		    strncmp(buf, "HTTP_HOST", 9) == 0) {
254 			memcpy(c->http_host, val, val_len);
255 			c->http_host[val_len] = '\0';
256 
257 			/*
258 			 * lazily get subdomain
259 			 * will only get domain if no subdomain exists
260 			 * this can still work if gotweb server name is the same
261 			 */
262 			sd = strchr(c->http_host, '.');
263 			if (sd)
264 				*sd = '\0';
265 		}
266 
267 		if (c->document_uri[0] == '\0' &&
268 		    val_len < MAX_DOCUMENT_URI &&
269 		    name_len == 12 &&
270 		    strncmp(buf, "DOCUMENT_URI", 12) == 0) {
271 			memcpy(c->document_uri, val, val_len);
272 			c->document_uri[val_len] = '\0';
273 		}
274 
275 		if (c->server_name[0] == '\0' &&
276 		    val_len < MAX_SERVER_NAME &&
277 		    name_len == 11 &&
278 		    strncmp(buf, "SERVER_NAME", 11) == 0) {
279 			memcpy(c->server_name, val, val_len);
280 			c->server_name[val_len] = '\0';
281 		}
282 
283 		if (name_len == 5 &&
284 		    strncmp(buf, "HTTPS", 5) == 0)
285 			c->https = 1;
286 
287 		buf += name_len + val_len;
288 		n -= name_len - val_len;
289 	}
290 }
291 
292 void
293 fcgi_timeout(int fd, short events, void *arg)
294 {
295 	fcgi_cleanup_request((struct request*) arg);
296 }
297 
298 int
299 fcgi_puts(struct template *tp, const char *str)
300 {
301 	if (str == NULL)
302 		return 0;
303 	return fcgi_gen_binary_response(tp->tp_arg, str, strlen(str));
304 }
305 
306 int
307 fcgi_putc(struct template *tp, int ch)
308 {
309 	uint8_t c = ch;
310 	return fcgi_gen_binary_response(tp->tp_arg, &c, 1);
311 }
312 
313 int
314 fcgi_vprintf(struct request *c, const char *fmt, va_list ap)
315 {
316 	char *str;
317 	int r;
318 
319 	r = vasprintf(&str, fmt, ap);
320 	if (r == -1) {
321 		log_warn("%s: asprintf", __func__);
322 		return -1;
323 	}
324 
325 	r = fcgi_gen_binary_response(c, str, r);
326 	free(str);
327 	return r;
328 }
329 
330 int
331 fcgi_printf(struct request *c, const char *fmt, ...)
332 {
333 	va_list ap;
334 	int r;
335 
336 	va_start(ap, fmt);
337 	r = fcgi_vprintf(c, fmt, ap);
338 	va_end(ap);
339 
340 	return r;
341 }
342 
343 int
344 fcgi_gen_binary_response(struct request *c, const uint8_t *data, int len)
345 {
346 	int r;
347 
348 	if (c->sock->client_status == CLIENT_DISCONNECT)
349 		return -1;
350 
351 	if (data == NULL || len == 0)
352 		return 0;
353 
354 	/*
355 	 * special case: send big replies -like blobs- directly
356 	 * without copying.
357 	 */
358 	if (len > sizeof(c->outbuf)) {
359 		if (c->outbuf_len > 0) {
360 			fcgi_send_response(c, FCGI_STDOUT,
361 			    c->outbuf, c->outbuf_len);
362 			c->outbuf_len = 0;
363 		}
364 		return fcgi_send_response(c, FCGI_STDOUT, data, len);
365 	}
366 
367 	if (len < sizeof(c->outbuf) - c->outbuf_len) {
368 		memcpy(c->outbuf + c->outbuf_len, data, len);
369 		c->outbuf_len += len;
370 		return 0;
371 	}
372 
373 	r = fcgi_send_response(c, FCGI_STDOUT, c->outbuf, c->outbuf_len);
374 	if (r == -1)
375 		return -1;
376 
377 	memcpy(c->outbuf, data, len);
378 	c->outbuf_len = len;
379 	return 0;
380 }
381 
382 static int
383 send_response(struct request *c, int type, const uint8_t *data,
384     size_t len)
385 {
386 	static const uint8_t padding[FCGI_PADDING_SIZE];
387 	struct fcgi_record_header header;
388 	struct iovec iov[3];
389 	struct timespec ts;
390 	ssize_t nw;
391 	size_t padded_len, tot;
392 	int i, err = 0, th = 2000;
393 
394 	ts.tv_sec = 0;
395 	ts.tv_nsec = 50;
396 
397 	memset(&header, 0, sizeof(header));
398 	header.version = 1;
399 	header.type = type;
400 	header.id = htons(c->id);
401 	header.content_len = htons(len);
402 
403 	/* The FastCGI spec suggests to align the output buffer */
404 	tot = sizeof(header) + len;
405 	padded_len = FCGI_ALIGN(tot);
406 	if (padded_len > tot) {
407 		header.padding_len = padded_len - tot;
408 		tot += header.padding_len;
409 	}
410 
411 	iov[0].iov_base = &header;
412 	iov[0].iov_len = sizeof(header);
413 
414 	iov[1].iov_base = (void *)data;
415 	iov[1].iov_len = len;
416 
417 	iov[2].iov_base = (void *)padding;
418 	iov[2].iov_len = header.padding_len;
419 
420 	dump_fcgi_record("resp ", &header);
421 
422 	/*
423 	 * XXX: add some simple write heuristics here
424 	 * On slower VMs, spotty connections, etc., we don't want to go right to
425 	 * disconnect. Let's at least try to write the data a few times before
426 	 * giving up.
427 	 */
428 	while (tot > 0) {
429 		nw = writev(c->fd, iov, nitems(iov));
430 		if (nw == 0) {
431 			c->sock->client_status = CLIENT_DISCONNECT;
432 			break;
433 		}
434 		if (nw == -1) {
435 			err++;
436 			if (errno == EAGAIN && err < th) {
437 				nanosleep(&ts, NULL);
438 				continue;
439 			}
440 			log_warn("%s: write failure", __func__);
441 			c->sock->client_status = CLIENT_DISCONNECT;
442 			return -1;
443 		}
444 
445 		if (nw != tot)
446 			log_debug("%s: partial write: %zu vs %zu", __func__,
447 			    nw, tot);
448 
449 		tot -= nw;
450 		for (i = 0; i < nitems(iov); ++i) {
451 			if (nw < iov[i].iov_len) {
452 				iov[i].iov_base += nw;
453 				iov[i].iov_len -= nw;
454 				break;
455 			}
456 			nw -= iov[i].iov_len;
457 			iov[i].iov_len = 0;
458 		}
459 	}
460 
461 	return 0;
462 }
463 
464 int
465 fcgi_send_response(struct request *c, int type, const void *data,
466     size_t len)
467 {
468 	if (c->sock->client_status == CLIENT_DISCONNECT)
469 		return -1;
470 
471 	while (len > FCGI_CONTENT_SIZE) {
472 		if (send_response(c, type, data, len) == -1)
473 			return -1;
474 
475 		data += FCGI_CONTENT_SIZE;
476 		len -= FCGI_CONTENT_SIZE;
477 	}
478 
479 	if (len == 0)
480 		return 0;
481 
482 	return send_response(c, type, data, len);
483 }
484 
485 void
486 fcgi_create_end_record(struct request *c)
487 {
488 	struct fcgi_end_request_body end_request;
489 
490 	memset(&end_request, 0, sizeof(end_request));
491 	end_request.app_status = htonl(0); /* script status */
492 	end_request.protocol_status = FCGI_REQUEST_COMPLETE;
493 
494 	fcgi_send_response(c, FCGI_END_REQUEST, &end_request,
495 	    sizeof(end_request));
496 }
497 
498 void
499 fcgi_cleanup_request(struct request *c)
500 {
501 	cgi_inflight--;
502 	client_cnt--;
503 
504 	evtimer_del(&c->tmo);
505 	if (event_initialized(&c->ev))
506 		event_del(&c->ev);
507 
508 	close(c->fd);
509 	template_free(c->tp);
510 	if (c->t != NULL)
511 		gotweb_free_transport(c->t);
512 	free(c);
513 }
514 
515 void
516 dump_fcgi_record(const char *p, struct fcgi_record_header *h)
517 {
518 	dump_fcgi_record_header(p, h);
519 
520 	if (h->type == FCGI_BEGIN_REQUEST)
521 		dump_fcgi_begin_request_body(p,
522 		    (struct fcgi_begin_request_body *)(h + 1));
523 	else if (h->type == FCGI_END_REQUEST)
524 		dump_fcgi_end_request_body(p,
525 		    (struct fcgi_end_request_body *)(h + 1));
526 }
527 
528 void
529 dump_fcgi_record_header(const char* p, struct fcgi_record_header *h)
530 {
531 	log_debug("%sversion:         %d", p, h->version);
532 	log_debug("%stype:            %d", p, h->type);
533 	log_debug("%srequestId:       %d", p, ntohs(h->id));
534 	log_debug("%scontentLength:   %d", p, ntohs(h->content_len));
535 	log_debug("%spaddingLength:   %d", p, h->padding_len);
536 	log_debug("%sreserved:        %d", p, h->reserved);
537 }
538 
539 void
540 dump_fcgi_begin_request_body(const char *p, struct fcgi_begin_request_body *b)
541 {
542 	log_debug("%srole             %d", p, ntohs(b->role));
543 	log_debug("%sflags            %d", p, b->flags);
544 }
545 
546 void
547 dump_fcgi_end_request_body(const char *p, struct fcgi_end_request_body *b)
548 {
549 	log_debug("%sappStatus:       %d", p, ntohl(b->app_status));
550 	log_debug("%sprotocolStatus:  %d", p, b->protocol_status);
551 }