1 /*
2  * Copyright (c) 2020-2022 Tracey Emery <tracey@traceyemery.net>
3  * Copyright (c) 2013 David Gwynne <dlg@openbsd.org>
4  * Copyright (c) 2013 Florian Obser <florian@openbsd.org>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 #include <arpa/inet.h>
20 #include <sys/queue.h>
21 #include <sys/socket.h>
22 #include <sys/types.h>
23 #include <sys/uio.h>
24 
25 #include <errno.h>
26 #include <event.h>
27 #include <imsg.h>
28 #include <stdarg.h>
29 #include <stdlib.h>
30 #include <stdio.h>
31 #include <string.h>
32 #include <time.h>
33 #include <unistd.h>
34 
35 #include "got_error.h"
36 #include "got_reference.h"
37 
38 #include "proc.h"
39 #include "gotwebd.h"
40 #include "tmpl.h"
41 
42 size_t	 fcgi_parse_record(uint8_t *, size_t, struct request *);
43 void	 fcgi_parse_begin_request(uint8_t *, uint16_t, struct request *,
44 	    uint16_t);
45 void	 fcgi_parse_params(uint8_t *, uint16_t, struct request *, uint16_t);
46 int	 fcgi_send_response(struct request *, int, const void *, size_t);
47 
48 void	 dump_fcgi_record_header(const char *, struct fcgi_record_header *);
49 void	 dump_fcgi_begin_request_body(const char *,
50 	    struct fcgi_begin_request_body *);
51 void	 dump_fcgi_end_request_body(const char *,
52 	    struct fcgi_end_request_body *);
53 
54 extern int	 cgi_inflight;
55 extern volatile int client_cnt;
56 
57 void
58 fcgi_request(int fd, short events, void *arg)
59 {
60 	struct request *c = arg;
61 	ssize_t n;
62 	size_t parsed = 0;
63 
64 	n = read(fd, c->buf + c->buf_pos + c->buf_len,
65 	    FCGI_RECORD_SIZE - c->buf_pos-c->buf_len);
66 
67 	switch (n) {
68 	case -1:
69 		switch (errno) {
70 		case EINTR:
71 		case EAGAIN:
72 			return;
73 		default:
74 			goto fail;
75 		}
76 		break;
77 
78 	case 0:
79 		log_debug("closed connection");
80 		goto fail;
81 	default:
82 		break;
83 	}
84 
85 	c->buf_len += n;
86 
87 	/*
88 	 * Parse the records as they are received. Per the FastCGI
89 	 * specification, the server need only receive the FastCGI
90 	 * parameter records in full; it is free to begin execution
91 	 * at that point, which is what happens here.
92 	 */
93 	do {
94 		parsed = fcgi_parse_record(c->buf + c->buf_pos, c->buf_len, c);
95 		if (parsed != 0) {
96 			c->buf_pos += parsed;
97 			c->buf_len -= parsed;
98 		}
99 
100 		/* drop the parsed record */
101 		if (parsed != 0 && c->buf_len > 0) {
102 			bcopy(c->buf + c->buf_pos, c->buf, c->buf_len);
103 			c->buf_pos = 0;
104 		}
105 	} while (parsed > 0 && c->buf_len > 0);
106 
107 	return;
108 fail:
109 	fcgi_cleanup_request(c);
110 }
111 
112 size_t
113 fcgi_parse_record(uint8_t *buf, size_t n, struct request *c)
114 {
115 	struct fcgi_record_header *h;
116 
117 	if (n < sizeof(struct fcgi_record_header))
118 		 return 0;
119 
120 	h = (struct fcgi_record_header*) buf;
121 
122 	dump_fcgi_record("", h);
123 
124 	if (n < sizeof(struct fcgi_record_header) + ntohs(h->content_len)
125 	    + h->padding_len)
126 		 return 0;
127 
128 	if (h->version != 1)
129 		log_warn("wrong version");
130 
131 	switch (h->type) {
132 	case FCGI_BEGIN_REQUEST:
133 		fcgi_parse_begin_request(buf +
134 		    sizeof(struct fcgi_record_header),
135 		    ntohs(h->content_len), c, ntohs(h->id));
136 		break;
137 	case FCGI_PARAMS:
138 		fcgi_parse_params(buf + sizeof(struct fcgi_record_header),
139 		    ntohs(h->content_len), c, ntohs(h->id));
140 		break;
141 	case FCGI_STDIN:
142 	case FCGI_ABORT_REQUEST:
143 		fcgi_create_end_record(c);
144 		fcgi_cleanup_request(c);
145 		return 0;
146 	default:
147 		log_warn("unimplemented type %d", h->type);
148 		break;
149 	}
150 
151 	return (sizeof(struct fcgi_record_header) + ntohs(h->content_len)
152 	    + h->padding_len);
153 }
154 
155 void
156 fcgi_parse_begin_request(uint8_t *buf, uint16_t n,
157     struct request *c, uint16_t id)
158 {
159 	/* XXX -- FCGI_CANT_MPX_CONN */
160 	if (c->request_started) {
161 		log_warn("unexpected FCGI_BEGIN_REQUEST, ignoring");
162 		return;
163 	}
164 
165 	if (n != sizeof(struct fcgi_begin_request_body)) {
166 		log_warn("wrong size %d != %lu", n,
167 		    sizeof(struct fcgi_begin_request_body));
168 		return;
169 	}
170 
171 	c->request_started = 1;
172 	c->id = id;
173 }
174 
175 void
176 fcgi_parse_params(uint8_t *buf, uint16_t n, struct request *c, uint16_t id)
177 {
178 	uint32_t name_len, val_len;
179 	uint8_t *val;
180 
181 	if (!c->request_started) {
182 		log_warn("FCGI_PARAMS without FCGI_BEGIN_REQUEST, ignoring");
183 		return;
184 	}
185 
186 	if (c->id != id) {
187 		log_warn("unexpected id, ignoring");
188 		return;
189 	}
190 
191 	if (n == 0) {
192 		gotweb_process_request(c);
193 		template_flush(c->tp);
194 		return;
195 	}
196 
197 	while (n > 0) {
198 		if (buf[0] >> 7 == 0) {
199 			name_len = buf[0];
200 			n--;
201 			buf++;
202 		} else {
203 			if (n > 3) {
204 				name_len = ((buf[0] & 0x7f) << 24) +
205 				    (buf[1] << 16) + (buf[2] << 8) + buf[3];
206 				n -= 4;
207 				buf += 4;
208 			} else
209 				return;
210 		}
211 
212 		if (n == 0)
213 			return;
214 
215 		if (buf[0] >> 7 == 0) {
216 			val_len = buf[0];
217 			n--;
218 			buf++;
219 		} else {
220 			if (n > 3) {
221 				val_len = ((buf[0] & 0x7f) << 24) +
222 					(buf[1] << 16) + (buf[2] << 8) +
223 					buf[3];
224 				n -= 4;
225 				buf += 4;
226 			} else
227 				return;
228 		}
229 
230 		if (n < name_len + val_len)
231 			return;
232 
233 		val = buf + name_len;
234 
235 		if (c->querystring[0] == '\0' &&
236 		    val_len < MAX_QUERYSTRING &&
237 		    name_len == 12 &&
238 		    strncmp(buf, "QUERY_STRING", 12) == 0) {
239 			memcpy(c->querystring, val, val_len);
240 			c->querystring[val_len] = '\0';
241 		}
242 
243 		if (c->document_uri[0] == '\0' &&
244 		    val_len < MAX_DOCUMENT_URI &&
245 		    name_len == 12 &&
246 		    strncmp(buf, "DOCUMENT_URI", 12) == 0) {
247 			memcpy(c->document_uri, val, val_len);
248 			c->document_uri[val_len] = '\0';
249 		}
250 
251 		if (c->server_name[0] == '\0' &&
252 		    val_len < MAX_SERVER_NAME &&
253 		    name_len == 11 &&
254 		    strncmp(buf, "SERVER_NAME", 11) == 0) {
255 			memcpy(c->server_name, val, val_len);
256 			c->server_name[val_len] = '\0';
257 		}
258 
259 		if (name_len == 5 &&
260 		    strncmp(buf, "HTTPS", 5) == 0)
261 			c->https = 1;
262 
263 		buf += name_len + val_len;
264 		n -= name_len - val_len;
265 	}
266 }
267 
268 void
269 fcgi_timeout(int fd, short events, void *arg)
270 {
271 	fcgi_cleanup_request((struct request*) arg);
272 }
273 
274 static int
275 send_response(struct request *c, int type, const uint8_t *data,
276     size_t len)
277 {
278 	static const uint8_t padding[FCGI_PADDING_SIZE];
279 	struct fcgi_record_header header;
280 	struct iovec iov[3];
281 	struct timespec ts;
282 	ssize_t nw;
283 	size_t padded_len, tot;
284 	int i, err = 0, th = 2000;
285 
286 	ts.tv_sec = 0;
287 	ts.tv_nsec = 50;
288 
289 	memset(&header, 0, sizeof(header));
290 	header.version = 1;
291 	header.type = type;
292 	header.id = htons(c->id);
293 	header.content_len = htons(len);
294 
295 	/* The FastCGI spec suggests to align the output buffer */
296 	tot = sizeof(header) + len;
297 	padded_len = FCGI_ALIGN(tot);
298 	if (padded_len > tot) {
299 		header.padding_len = padded_len - tot;
300 		tot += header.padding_len;
301 	}
302 
303 	iov[0].iov_base = &header;
304 	iov[0].iov_len = sizeof(header);
305 
306 	iov[1].iov_base = (void *)data;
307 	iov[1].iov_len = len;
308 
309 	iov[2].iov_base = (void *)padding;
310 	iov[2].iov_len = header.padding_len;
311 
312 	dump_fcgi_record("resp ", &header);
313 
314 	/*
315 	 * XXX: add some simple write heuristics here
316 	 * On slower VMs, spotty connections, etc., we don't want to go right to
317 	 * disconnect. Let's at least try to write the data a few times before
318 	 * giving up.
319 	 */
320 	while (tot > 0) {
321 		nw = writev(c->fd, iov, nitems(iov));
322 		if (nw == 0) {
323 			c->sock->client_status = CLIENT_DISCONNECT;
324 			break;
325 		}
326 		if (nw == -1) {
327 			err++;
328 			if (errno == EAGAIN && err < th) {
329 				nanosleep(&ts, NULL);
330 				continue;
331 			}
332 			log_debug("%s: write failure: %s", __func__,
333 			    strerror(errno));
334 			c->sock->client_status = CLIENT_DISCONNECT;
335 			return -1;
336 		}
337 
338 		if (nw != tot)
339 			log_debug("%s: partial write: %zu vs %zu", __func__,
340 			    nw, tot);
341 
342 		tot -= nw;
343 		for (i = 0; i < nitems(iov); ++i) {
344 			if (nw < iov[i].iov_len) {
345 				iov[i].iov_base += nw;
346 				iov[i].iov_len -= nw;
347 				break;
348 			}
349 			nw -= iov[i].iov_len;
350 			iov[i].iov_len = 0;
351 		}
352 	}
353 
354 	return 0;
355 }
356 
357 int
358 fcgi_send_response(struct request *c, int type, const void *data,
359     size_t len)
360 {
361 	if (c->sock->client_status == CLIENT_DISCONNECT)
362 		return -1;
363 
364 	while (len > FCGI_CONTENT_SIZE) {
365 		if (send_response(c, type, data, len) == -1)
366 			return -1;
367 
368 		data += FCGI_CONTENT_SIZE;
369 		len -= FCGI_CONTENT_SIZE;
370 	}
371 
372 	if (len == 0)
373 		return 0;
374 
375 	return send_response(c, type, data, len);
376 }
377 
378 int
379 fcgi_write(void *arg, const void *buf, size_t len)
380 {
381 	struct request	*c = arg;
382 
383 	return fcgi_send_response(c, FCGI_STDOUT, buf, len);
384 }
385 
386 void
387 fcgi_create_end_record(struct request *c)
388 {
389 	struct fcgi_end_request_body end_request;
390 
391 	memset(&end_request, 0, sizeof(end_request));
392 	end_request.app_status = htonl(0); /* script status */
393 	end_request.protocol_status = FCGI_REQUEST_COMPLETE;
394 
395 	fcgi_send_response(c, FCGI_END_REQUEST, &end_request,
396 	    sizeof(end_request));
397 }
398 
399 void
400 fcgi_cleanup_request(struct request *c)
401 {
402 	cgi_inflight--;
403 	client_cnt--;
404 
405 	evtimer_del(&c->tmo);
406 	if (event_initialized(&c->ev))
407 		event_del(&c->ev);
408 
409 	close(c->fd);
410 	template_free(c->tp);
411 	if (c->t != NULL)
412 		gotweb_free_transport(c->t);
413 	free(c);
414 }
415 
416 void
417 dump_fcgi_record(const char *p, struct fcgi_record_header *h)
418 {
419 	dump_fcgi_record_header(p, h);
420 
421 	if (h->type == FCGI_BEGIN_REQUEST)
422 		dump_fcgi_begin_request_body(p,
423 		    (struct fcgi_begin_request_body *)(h + 1));
424 	else if (h->type == FCGI_END_REQUEST)
425 		dump_fcgi_end_request_body(p,
426 		    (struct fcgi_end_request_body *)(h + 1));
427 }
428 
429 void
430 dump_fcgi_record_header(const char* p, struct fcgi_record_header *h)
431 {
432 	log_debug("%sversion:         %d", p, h->version);
433 	log_debug("%stype:            %d", p, h->type);
434 	log_debug("%srequestId:       %d", p, ntohs(h->id));
435 	log_debug("%scontentLength:   %d", p, ntohs(h->content_len));
436 	log_debug("%spaddingLength:   %d", p, h->padding_len);
437 	log_debug("%sreserved:        %d", p, h->reserved);
438 }
439 
440 void
441 dump_fcgi_begin_request_body(const char *p, struct fcgi_begin_request_body *b)
442 {
443 	log_debug("%srole             %d", p, ntohs(b->role));
444 	log_debug("%sflags            %d", p, b->flags);
445 }
446 
447 void
448 dump_fcgi_end_request_body(const char *p, struct fcgi_end_request_body *b)
449 {
450 	log_debug("%sappStatus:       %d", p, ntohl(b->app_status));
451 	log_debug("%sprotocolStatus:  %d", p, b->protocol_status);
452 }