1 /*
2  * Copyright (c) 2020-2022 Tracey Emery <tracey@traceyemery.net>
3  * Copyright (c) 2013 David Gwynne <dlg@openbsd.org>
4  * Copyright (c) 2013 Florian Obser <florian@openbsd.org>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 #include <arpa/inet.h>
20 #include <sys/queue.h>
21 #include <sys/socket.h>
22 #include <sys/types.h>
23 #include <sys/uio.h>
24 
25 #include <errno.h>
26 #include <event.h>
27 #include <stdlib.h>
28 #include <stdio.h>
29 #include <string.h>
30 #include <time.h>
31 #include <unistd.h>
32 
33 #include "got_error.h"
34 
35 #include "got_compat.h"
36 
37 #include "proc.h"
38 #include "gotwebd.h"
39 
40 size_t	 fcgi_parse_record(uint8_t *, size_t, struct request *);
41 void	 fcgi_parse_begin_request(uint8_t *, uint16_t, struct request *,
42 	    uint16_t);
43 void	 fcgi_parse_params(uint8_t *, uint16_t, struct request *, uint16_t);
44 void	 fcgi_send_response(struct request *, int, const void *, size_t);
45 
46 void	 dump_fcgi_record_header(const char *, struct fcgi_record_header *);
47 void	 dump_fcgi_begin_request_body(const char *,
48 	    struct fcgi_begin_request_body *);
49 void	 dump_fcgi_end_request_body(const char *,
50 	    struct fcgi_end_request_body *);
51 
52 extern int	 cgi_inflight;
53 extern volatile int client_cnt;
54 
55 void
56 fcgi_request(int fd, short events, void *arg)
57 {
58 	struct request *c = arg;
59 	ssize_t n;
60 	size_t parsed = 0;
61 
62 	n = read(fd, c->buf + c->buf_pos + c->buf_len,
63 	    FCGI_RECORD_SIZE - c->buf_pos-c->buf_len);
64 
65 	switch (n) {
66 	case -1:
67 		switch (errno) {
68 		case EINTR:
69 		case EAGAIN:
70 			return;
71 		default:
72 			goto fail;
73 		}
74 		break;
75 
76 	case 0:
77 		log_debug("closed connection");
78 		goto fail;
79 	default:
80 		break;
81 	}
82 
83 	c->buf_len += n;
84 
85 	/*
86 	 * Parse the records as they are received. Per the FastCGI
87 	 * specification, the server need only receive the FastCGI
88 	 * parameter records in full; it is free to begin execution
89 	 * at that point, which is what happens here.
90 	 */
91 	do {
92 		parsed = fcgi_parse_record(c->buf + c->buf_pos, c->buf_len, c);
93 		if (parsed != 0) {
94 			c->buf_pos += parsed;
95 			c->buf_len -= parsed;
96 		}
97 	} while (parsed > 0 && c->buf_len > 0);
98 
99 	/* Make space for further reads */
100 	if (parsed != 0)
101 		if (c->buf_len > 0) {
102 			bcopy(c->buf + c->buf_pos, c->buf, c->buf_len);
103 			c->buf_pos = 0;
104 		}
105 	return;
106 fail:
107 	fcgi_cleanup_request(c);
108 }
109 
110 size_t
111 fcgi_parse_record(uint8_t *buf, size_t n, struct request *c)
112 {
113 	struct fcgi_record_header *h;
114 
115 	if (n < sizeof(struct fcgi_record_header))
116 		 return 0;
117 
118 	h = (struct fcgi_record_header*) buf;
119 
120 	dump_fcgi_record("", h);
121 
122 	if (n < sizeof(struct fcgi_record_header) + ntohs(h->content_len)
123 	    + h->padding_len)
124 		 return 0;
125 
126 	if (h->version != 1)
127 		log_warn("wrong version");
128 
129 	switch (h->type) {
130 	case FCGI_BEGIN_REQUEST:
131 		fcgi_parse_begin_request(buf +
132 		    sizeof(struct fcgi_record_header),
133 		    ntohs(h->content_len), c, ntohs(h->id));
134 		break;
135 	case FCGI_PARAMS:
136 		fcgi_parse_params(buf + sizeof(struct fcgi_record_header),
137 		    ntohs(h->content_len), c, ntohs(h->id));
138 		break;
139 	case FCGI_STDIN:
140 	case FCGI_ABORT_REQUEST:
141 		fcgi_create_end_record(c);
142 		fcgi_cleanup_request(c);
143 		return 0;
144 	default:
145 		log_warn("unimplemented type %d", h->type);
146 		break;
147 	}
148 
149 	return (sizeof(struct fcgi_record_header) + ntohs(h->content_len)
150 	    + h->padding_len);
151 }
152 
153 void
154 fcgi_parse_begin_request(uint8_t *buf, uint16_t n,
155     struct request *c, uint16_t id)
156 {
157 	/* XXX -- FCGI_CANT_MPX_CONN */
158 	if (c->request_started) {
159 		log_warn("unexpected FCGI_BEGIN_REQUEST, ignoring");
160 		return;
161 	}
162 
163 	if (n != sizeof(struct fcgi_begin_request_body)) {
164 		log_warn("wrong size %d != %lu", n,
165 		    sizeof(struct fcgi_begin_request_body));
166 		return;
167 	}
168 
169 	c->request_started = 1;
170 
171 	c->id = id;
172 	SLIST_INIT(&c->env);
173 	c->env_count = 0;
174 }
175 
176 void
177 fcgi_parse_params(uint8_t *buf, uint16_t n, struct request *c, uint16_t id)
178 {
179 	struct env_val *env_entry;
180 	uint32_t name_len, val_len;
181 	uint8_t *sd, *dr_buf;
182 
183 	if (!c->request_started) {
184 		log_warn("FCGI_PARAMS without FCGI_BEGIN_REQUEST, ignoring");
185 		return;
186 	}
187 
188 	if (c->id != id) {
189 		log_warn("unexpected id, ignoring");
190 		return;
191 	}
192 
193 	if (n == 0) {
194 		gotweb_process_request(c);
195 		return;
196 	}
197 
198 	while (n > 0) {
199 		if (buf[0] >> 7 == 0) {
200 			name_len = buf[0];
201 			n--;
202 			buf++;
203 		} else {
204 			if (n > 3) {
205 				name_len = ((buf[0] & 0x7f) << 24) +
206 				    (buf[1] << 16) + (buf[2] << 8) + buf[3];
207 				n -= 4;
208 				buf += 4;
209 			} else
210 				return;
211 		}
212 
213 		if (n > 0) {
214 			if (buf[0] >> 7 == 0) {
215 				val_len = buf[0];
216 				n--;
217 				buf++;
218 			} else {
219 				if (n > 3) {
220 					val_len = ((buf[0] & 0x7f) << 24) +
221 					    (buf[1] << 16) + (buf[2] << 8) +
222 					     buf[3];
223 					n -= 4;
224 					buf += 4;
225 				} else
226 					return;
227 			}
228 		} else
229 			return;
230 
231 		if (n < name_len + val_len)
232 			return;
233 
234 		if ((env_entry = malloc(sizeof(struct env_val))) == NULL) {
235 			log_warn("cannot malloc env_entry");
236 			return;
237 		}
238 
239 		if ((env_entry->val = calloc(sizeof(char), name_len + val_len +
240 		    2)) == NULL) {
241 			log_warn("cannot allocate env_entry->val");
242 			free(env_entry);
243 			return;
244 		}
245 
246 		bcopy(buf, env_entry->val, name_len);
247 		buf += name_len;
248 		n -= name_len;
249 
250 		env_entry->val[name_len] = '\0';
251 		if (val_len < MAX_QUERYSTRING && strcmp(env_entry->val,
252 		    "QUERY_STRING") == 0 && c->querystring[0] == '\0') {
253 			bcopy(buf, c->querystring, val_len);
254 			c->querystring[val_len] = '\0';
255 		}
256 		if (val_len < GOTWEBD_MAXTEXT && strcmp(env_entry->val,
257 		    "HTTP_HOST") == 0 && c->http_host[0] == '\0') {
258 
259 			/*
260 			 * lazily get subdomain
261 			 * will only get domain if no subdomain exists
262 			 * this can still work if gotweb server name is the same
263 			 */
264 			sd = strchr(buf, '.');
265 			if (sd)
266 				*sd = '\0';
267 
268 			bcopy(buf, c->http_host, val_len);
269 			c->http_host[val_len] = '\0';
270 		}
271 		if (val_len < MAX_DOCUMENT_ROOT && strcmp(env_entry->val,
272 		    "DOCUMENT_ROOT") == 0 && c->document_root[0] == '\0') {
273 
274 			/* drop first char, as it's always / */
275 			dr_buf = &buf[1];
276 
277 			bcopy(dr_buf, c->document_root, val_len - 1);
278 			c->document_root[val_len] = '\0';
279 		}
280 		if (val_len < MAX_SERVER_NAME && strcmp(env_entry->val,
281 		    "SERVER_NAME") == 0 && c->server_name[0] == '\0') {
282 			/* drop first char, as it's always / */
283 
284 			bcopy(buf, c->server_name, val_len);
285 			c->server_name[val_len] = '\0';
286 		}
287 		env_entry->val[name_len] = '=';
288 
289 		bcopy(buf, (env_entry->val) + name_len + 1, val_len);
290 		buf += val_len;
291 		n -= val_len;
292 
293 		SLIST_INSERT_HEAD(&c->env, env_entry, entry);
294 		log_debug("env[%d], %s", c->env_count, env_entry->val);
295 		c->env_count++;
296 	}
297 }
298 
299 void
300 fcgi_timeout(int fd, short events, void *arg)
301 {
302 	fcgi_cleanup_request((struct request*) arg);
303 }
304 
305 int
306 fcgi_gen_binary_response(struct request *c, const uint8_t *data, int len)
307 {
308 	if (c->sock->client_status == CLIENT_DISCONNECT)
309 		return -1;
310 
311 	if (data == NULL || len == 0)
312 		return 0;
313 
314 	fcgi_send_response(c, FCGI_STDOUT, data, len);
315 	return 0;
316 }
317 
318 int
319 fcgi_gen_response(struct request *c, const char *data)
320 {
321 	if (data == NULL || *data == '\0')
322 		return 0;
323 	return fcgi_gen_binary_response(c, data, strlen(data));
324 }
325 
326 static void
327 send_response(struct request *c, int type, const uint8_t *data,
328     size_t len)
329 {
330 	static const uint8_t padding[FCGI_PADDING_SIZE];
331 	struct fcgi_record_header header;
332 	struct iovec iov[3];
333 	struct timespec ts;
334 	ssize_t nw;
335 	size_t padded_len, tot;
336 	int i, err = 0, th = 2000;
337 
338 	ts.tv_sec = 0;
339 	ts.tv_nsec = 50;
340 
341 	memset(&header, 0, sizeof(header));
342 	header.version = 1;
343 	header.type = type;
344 	header.id = htons(c->id);
345 	header.content_len = htons(len);
346 
347 	/* The FastCGI spec suggests to align the output buffer */
348 	tot = sizeof(header) + len;
349 	padded_len = FCGI_ALIGN(tot);
350 	if (padded_len > tot) {
351 		header.padding_len = padded_len - tot;
352 		tot += header.padding_len;
353 	}
354 
355 	iov[0].iov_base = &header;
356 	iov[0].iov_len = sizeof(header);
357 
358 	iov[1].iov_base = (void *)data;
359 	iov[1].iov_len = len;
360 
361 	iov[2].iov_base = (void *)padding;
362 	iov[2].iov_len = header.padding_len;
363 
364 	dump_fcgi_record("resp ", &header);
365 
366 	/*
367 	 * XXX: add some simple write heuristics here
368 	 * On slower VMs, spotty connections, etc., we don't want to go right to
369 	 * disconnect. Let's at least try to write the data a few times before
370 	 * giving up.
371 	 */
372 	while (tot > 0) {
373 		nw = writev(c->fd, iov, nitems(iov));
374 		if (nw == 0) {
375 			c->sock->client_status = CLIENT_DISCONNECT;
376 			break;
377 		}
378 		if (nw == -1) {
379 			err++;
380 			if (errno == EAGAIN && err < th) {
381 				nanosleep(&ts, NULL);
382 				continue;
383 			}
384 			log_warn("%s: write failure", __func__);
385 			c->sock->client_status = CLIENT_DISCONNECT;
386 			break;
387 		}
388 
389 		if (nw != tot)
390 			log_debug("%s: partial write: %zu vs %zu", __func__,
391 			    nw, tot);
392 
393 		tot -= nw;
394 		for (i = 0; i < nitems(iov); ++i) {
395 			if (nw < iov[i].iov_len) {
396 				iov[i].iov_base += nw;
397 				iov[i].iov_len -= nw;
398 				break;
399 			}
400 			nw -= iov[i].iov_len;
401 			iov[i].iov_len = 0;
402 		}
403 	}
404 }
405 
406 void
407 fcgi_send_response(struct request *c, int type, const void *data,
408     size_t len)
409 {
410 	while (len > FCGI_CONTENT_SIZE) {
411 		send_response(c, type, data, len);
412 		if (c->sock->client_status == CLIENT_DISCONNECT)
413 			return;
414 
415 		data += FCGI_CONTENT_SIZE;
416 		len -= FCGI_CONTENT_SIZE;
417 	}
418 
419 	if (len == 0)
420 		return;
421 
422 	send_response(c, type, data, len);
423 }
424 
425 void
426 fcgi_create_end_record(struct request *c)
427 {
428 	struct fcgi_end_request_body end_request;
429 
430 	memset(&end_request, 0, sizeof(end_request));
431 	end_request.app_status = htonl(0); /* script status */
432 	end_request.protocol_status = FCGI_REQUEST_COMPLETE;
433 
434 	fcgi_send_response(c, FCGI_END_REQUEST, &end_request,
435 	    sizeof(end_request));
436 }
437 
438 void
439 fcgi_cleanup_request(struct request *c)
440 {
441 	cgi_inflight--;
442 	client_cnt--;
443 
444 	evtimer_del(&c->tmo);
445 	if (event_initialized(&c->ev))
446 		event_del(&c->ev);
447 
448 	close(c->fd);
449 	gotweb_free_transport(c->t);
450 	free(c);
451 }
452 
453 void
454 dump_fcgi_record(const char *p, struct fcgi_record_header *h)
455 {
456 	dump_fcgi_record_header(p, h);
457 
458 	if (h->type == FCGI_BEGIN_REQUEST)
459 		dump_fcgi_begin_request_body(p,
460 		    (struct fcgi_begin_request_body *)(h + 1));
461 	else if (h->type == FCGI_END_REQUEST)
462 		dump_fcgi_end_request_body(p,
463 		    (struct fcgi_end_request_body *)(h + 1));
464 }
465 
466 void
467 dump_fcgi_record_header(const char* p, struct fcgi_record_header *h)
468 {
469 	log_debug("%sversion:         %d", p, h->version);
470 	log_debug("%stype:            %d", p, h->type);
471 	log_debug("%srequestId:       %d", p, ntohs(h->id));
472 	log_debug("%scontentLength:   %d", p, ntohs(h->content_len));
473 	log_debug("%spaddingLength:   %d", p, h->padding_len);
474 	log_debug("%sreserved:        %d", p, h->reserved);
475 }
476 
477 void
478 dump_fcgi_begin_request_body(const char *p, struct fcgi_begin_request_body *b)
479 {
480 	log_debug("%srole             %d", p, ntohs(b->role));
481 	log_debug("%sflags            %d", p, b->flags);
482 }
483 
484 void
485 dump_fcgi_end_request_body(const char *p, struct fcgi_end_request_body *b)
486 {
487 	log_debug("%sappStatus:       %d", p, ntohl(b->app_status));
488 	log_debug("%sprotocolStatus:  %d", p, b->protocol_status);
489 }