-
Notifications
You must be signed in to change notification settings - Fork 16
/
althttpd.c
3715 lines (3561 loc) · 127 KB
/
althttpd.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/*
** 2001-09-15
**
** The author disclaims copyright to this source code. In place of
** a legal notice, here is a blessing:
**
** May you do good and not evil.
** May you find forgiveness for yourself and forgive others.
** May you share freely, never taking more than you give.
**
*************************************************************************
**
** This source code file implements a small, simple, stand-alone HTTP
** server.
**
** Features:
**
** * Launched from inetd/xinetd/systemd, or as a stand-alone server
** * One process per request
** * Deliver static content or run CGI or SCGI
** * Virtual sites based on the "Host:" property of the HTTP header
** * Runs in a chroot jail
** * Unified log file in a CSV format
** * Small code base (this 1 file) to facilitate security auditing
** * Simple setup - no configuration files to misconfigure
**
** This file implements a small and simple but secure and effective web
** server. There are no frills. Anything that could be reasonably
** omitted has been.
**
** Setup rules:
**
** (1) Launch as root from inetd/systemd like this:
**
** althttpd -logfile logfile -root /home/www -user nobody
**
** It will automatically chroot to /home/www and become user "nobody".
** The logfile name should be relative to the chroot jail.
**
** (2) Directories of the form "*.website" (ex: www_sqlite_org.website)
** contain content. The directory is chosen based on the HTTP_HOST
** request header. If there is no HTTP_HOST header or if the
** corresponding host directory does not exist, then the
** "default.website" is used.
**
** In stand-alone mode (when the --port option is used) if neither
** the HTTP_HOST.website nor "default.website" directories exist,
** then files are served directly from the root directory. In
** one-require mode (when the --port option is not used) then an
** error is raised if "default.website" does not exist.
**
** If the HTTP_HOST header contains any charaters other than
** [a-zA-Z0-9_.,*~/] then a 403 error is generated.
**
** (3) Any file or directory whose name begins with "." or "-" is ignored,
** except if the URL begins with "/.well-known/" then initial "." and
** "-" characters are allowed, but not initial "..". The exception is
** for RFC-5785 to allow letsencrypt or certbot to generate a TLS cert
** using webroot.
**
** (4) Characters other than [0-9a-zA-Z,-./:_~] and any %HH characters
** escapes in the filename are all translated into "_". This is
** a defense against cross-site scripting attacks and other mischief.
**
** (5) Executable files are run as CGI. Files whose name ends with ".scgi"
** trigger an SCGI request (see item 9 below). All other files
** are delivered as is.
**
** (6) If a file named "-auth" exists in the same directory as the file to
** be run as CGI/SCGI or to be delivered, then it contains information
** for HTTP Basic authorization. See file format details below.
**
** (7) To run as a stand-alone server, simply add the "-port N" command-line
** option to define which TCP port to listen on. If the argument is
** "--port N1..N2" then TCP ports between N1 and N2 are scanned looking
** for one that is open and the first open port is used.
**
** (8) For static content, the mimetype is determined by the file suffix
** using a table built into the source code below. If you have
** unusual content files, you might need to extend this table.
**
** (9) Content files that end with ".scgi" and that contain text of the
** form "SCGI hostname port" will format an SCGI request and send it
** to hostname:port, then relay back the reply. Error behavior is
** determined by subsequent lines of the .scgi file. See SCGI below
** for details.
**
** (10) If compiled with -DENABLE_TLS and linked against OpenSSL and
** launched with a --cert option to identify a certificate file, then
** TLS is used to encrypt the connection.
**
** Command-line Options:
**
** --root DIR Defines the directory that contains the various
** $HOST.website subdirectories, each containing web content
** for a single virtual host. If launched as root and if
** "--user USER" also appears on the command-line and if
** "--jail 0" is omitted, then the process runs in a chroot
** jail rooted at this directory and under the userid USER.
** This option is required for xinetd launch but defaults
** to "." for a stand-alone web server.
**
** --port N Run in standalone mode listening on TCP port N, or from
** --port N1..N2 the first available TCP port in the range from N1 to N2.
**
** --user USER Define the user under which the process should run if
** originally launched as root. This process will refuse to
** run as root (for security). If this option is omitted and
** the process is launched as root, it will abort without
** processing any HTTP requests.
**
** --logfile FILE Append a single-line, CSV-format, log file entry to FILE
** for each HTTP request. FILE should be a full pathname.
** The FILE name is interpreted inside the chroot jail. The
** FILE name is expanded using strftime() if it contains
** at least one '%' and is not too long.
**
** --ipshun DIR If the remote IP address is also the name of a file
** in DIR that has size N bytes and where either N is zero
** or the m-time of the file is less than N time-units ago
** then that IP address is being shunned and no requests
** are processed. The time-unit is a compile-time option
** (BANISH_TIME) that defaults to 300 seconds. If this
** happens, the client gets a 503 Service Unavailable
** reply. Furthermore, althttpd will create ip-shunning
** files following a 404 Not Found error if the request
** URI is an obvious hack attempt.
**
** --https BOOLEAN Indicates that input is coming over SSL and is being
** decoded upstream, perhaps by stunnel. This option
** does *not* activate built-in TLS support. Use --cert
** for that.
**
** --page NAME Come up in stand-alone mode, and then try to launch a
** web-browser pointing to the NAME document after the
** listening socket has been created. This option
** implies --loopback and "--port 8080..8100".
**
** --loopback Only accept loop-back TCP connections (connections
** originating from the same host). This is the
** default if --root is omitted.
**
** --family ipv4 Only accept input from IPV4 or IPV6, respectively.
** --family ipv6 These options are only meaningful if althttpd is run
** as a stand-alone server.
**
** --jail BOOLEAN Indicates whether or not to form a chroot jail if
** initially run as root. The default is true, so the only
** useful variant of this option is "--jail 0" which prevents
** the formation of the chroot jail.
**
** --max-age SEC The value for "Cache-Control: max-age=%d". Defaults to
** 120 seconds.
**
** --max-cpu SEC Maximum number of seconds of CPU time allowed per
** HTTP connection. Default 30 (build option:
** -DMAX_CPU=integer). 0 means no limit.
**
** --debug BOOLEAN Disables input timeouts. This is useful for debugging
** when inputs are being typed in manually.
**
** Additional command-line options available when compiling with ENABLE_TLS:
**
** --cert FILE The TLS certificate, the "fullchain.pem" file
**
** --pkey FILE The TLS private key, the "privkey.pem" file. May be
** omitted if the --cert file is the concatenation of
** the fullchain.pem and the privkey.pem.
**
**
** Command-line options can take either one or two initial "-" characters.
** So "--debug" and "-debug" mean the same thing, for example.
**
**
** Security Features:
**
** (1) This program automatically puts itself inside a chroot jail if
** it can and if not specifically prohibited by the "--jail 0"
** command-line option. The root of the jail is the directory that
** contains the various $HOST.website content subdirectories.
**
** (2) No input is read while this process has root privileges. Root
** privileges are dropped prior to reading any input (but after entering
** the chroot jail, of course). If root privileges cannot be dropped
** (for example because the --user command-line option was omitted or
** because the user specified by the --user option does not exist),
** then the process aborts with an error prior to reading any input.
**
** (3) The length of an HTTP request is limited to MAX_CONTENT_LENGTH bytes
** (default: 250 million). Any HTTP request longer than this fails
** with an error. (Build option: -DMAX_CONTENT_LENGTH=integer)
**
** (4) There are hard-coded time-outs on each HTTP request. If this process
** waits longer than the timeout for the complete request, or for CGI
** to finish running, then this process aborts. (The timeout feature
** can be disabled using the --debug command-line option.)
**
** (5) If the HTTP_HOST request header contains characters other than
** [0-9a-zA-Z,-./:_~] then the entire request is rejected.
**
** (6) Any characters in the URI pathname other than [0-9a-zA-Z,-./:_~]
** are converted into "_". This applies to the pathname only, not
** to the query parameters or fragment.
**
** (7) If the first character of any URI pathname component is "." or "-"
** then a 404 Not Found reply is generated. This prevents attacks
** such as including ".." or "." directory elements in the pathname
** and allows placing files and directories in the content subdirectory
** that are invisible to all HTTP requests, by making the first
** character of the file or subdirectory name "-" or ".".
**
** (8) The request URI must begin with "/" or else a 404 error is generated.
**
** (9) This program never sets the value of an environment variable to a
** string that begins with "() {".
**
** Security Auditing:
**
** This webserver mostly only serves static content. Any security risk will
** come from CGI and SCGI. To check an installation for security, then, it
** makes sense to focus on the CGI and SCGI scripts.
**
** To locate all CGI files:
**
** find *.website -executable -type f -print
** OR: find *.website -perm +0111 -type f -print
**
** The first form of the "find" command is preferred, but is only supported
** by GNU find. On a Mac, you'll have to use the second form.
**
** To find all SCGI files:
**
** find *.website -name '*.scgi' -type f -print
**
** If any file is a security concern, it can be disabled on a live
** installation by turning off read permissions:
**
** chmod 0000 file-of-concern
**
** SCGI Specification Files:
**
** Content files (files without the execute bit set) that end with ".scgi"
** specify a connection to an SCGI server. The format of the .scgi file
** follows this template:
**
** SCGI hostname port
** fallback: fallback-filename
** relight: relight-command
**
** The first line specifies the location and TCP/IP port of the SCGI
** server that will handle the request. Subsequent lines determine
** what to do if the SCGI server cannot be contacted. If the
** "relight:" line is present, then the relight-command is run using
** system() and the connection is retried after a 1-second delay. Use
** "&" at the end of the relight-command to run it in the background.
** Make sure the relight-command does not generate output, or that
** output will become part of the SCGI reply. Add a ">/dev/null"
** suffix (before the "&") to the relight-command if necessary to
** suppress output. If there is no relight-command, or if the relight
** is attempted but the SCGI server still cannot be contacted, then
** the content of the fallback-filename file is returned as a
** substitute for the SCGI request. The mimetype is determined by the
** suffix on the fallback-filename. The fallback-filename would
** typically be an error message indicating that the service is
** temporarily unavailable.
**
** Basic Authorization:
**
** If the file "-auth" exists in the same directory as the content file
** (for both static content and CGI) then it contains the information used
** for basic authorization. The file format is as follows:
**
** * Blank lines and lines that begin with '#' are ignored
** * "http-redirect" forces a redirect to HTTPS if not there already
** * "https-only" disallows operation in HTTP
** * "user NAME LOGIN:PASSWORD" checks to see if LOGIN:PASSWORD
** authorization credentials are provided, and if so sets the
** REMOTE_USER to NAME.
** * "realm TEXT" sets the realm to TEXT.
**
** There can be multiple "user" lines. If no "user" line matches, the
** request fails with a 401 error.
**
** Because of security rule (7), there is no way for the content of the "-auth"
** file to leak out via HTTP request.
*/
#include <stdio.h>
#include <ctype.h>
#include <syslog.h>
#include <stdlib.h>
#include <sys/stat.h>
#include <unistd.h>
#include <fcntl.h>
#include <string.h>
#include <pwd.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/resource.h>
#include <sys/socket.h>
#include <sys/wait.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <stdarg.h>
#include <time.h>
#include <sys/times.h>
#include <netdb.h>
#include <errno.h>
#include <sys/resource.h>
#include <signal.h>
#include <dirent.h>
#ifdef linux
#include <sys/sendfile.h>
#endif
#include <assert.h>
/*
** Configure the server by setting the following macros and recompiling.
*/
#ifndef DEFAULT_PORT
#define DEFAULT_PORT "80" /* Default TCP port for HTTP */
#endif
#ifndef MAX_CONTENT_LENGTH
#define MAX_CONTENT_LENGTH 250000000 /* Max length of HTTP request content */
#endif
#ifndef MAX_CPU
#define MAX_CPU 30 /* Max CPU cycles in seconds */
#endif
#ifndef ALTHTTPD_VERSION
#define ALTHTTPD_VERSION "2.0"
#endif
#ifndef BANISH_TIME
#define BANISH_TIME 300 /* How long to banish for abuse (sec) */
#endif
#ifndef SERVER_SOFTWARE
# define SERVER_SOFTWARE "althttpd " ALTHTTPD_VERSION
#endif
#ifndef SERVER_SOFTWARE_TLS
# ifdef ENABLE_TLS
# define SERVER_SOFTWARE_TLS SERVER_SOFTWARE ", " OPENSSL_VERSION_TEXT
# else
# define SERVER_SOFTWARE_TLS SERVER_SOFTWARE
# endif
#endif
/*
** We record most of the state information as global variables. This
** saves having to pass information to subroutines as parameters, and
** makes the executable smaller...
*/
static const char *zRoot = 0; /* Root directory of the website */
static char *zPostData= 0; /* POST data */
static int nPostData = 0; /* Number of bytes of POST data */
static char *zProtocol = 0; /* The protocol being using by the browser */
static char *zMethod = 0; /* The method. Must be GET */
static char *zScript = 0; /* The object to retrieve */
static char *zRealScript = 0; /* The object to retrieve. Same as zScript
** except might have "/index.html" appended */
static char *zRequestUri = 0; /* Sanitized request uri */
static char *zHome = 0; /* The directory containing content */
static char *zQueryString = 0; /* The query string on the end of the name */
static char *zFile = 0; /* The filename of the object to retrieve */
static int lenFile = 0; /* Length of the zFile name */
static char *zDir = 0; /* Name of the directory holding zFile */
static char *zPathInfo = 0; /* Part of the pathname past the file */
static char *zAgent = 0; /* What type if browser is making this query */
static char *zServerName = 0; /* The name after the http:// */
static char *zServerPort = 0; /* The port number */
static char *zServerSoftware = 0;/* Software name and version info */
static char *zCookie = 0; /* Cookies reported with the request */
static char *zHttpHost = 0; /* Name according to the web browser */
static char *zRealPort = 0; /* The real TCP port when running as daemon */
static char *zRemoteAddr = 0; /* IP address of the request */
static char *zReferer = 0; /* Name of the page that refered to us */
static char *zAccept = 0; /* What formats will be accepted */
static char *zAcceptEncoding =0; /* gzip or default */
static char *zContentLength = 0; /* Content length reported in the header */
static char *zContentType = 0; /* Content type reported in the header */
static char *zQuerySuffix = 0; /* The part of the URL after the first ? */
static char *zAuthType = 0; /* Authorization type (basic or digest) */
static char *zAuthArg = 0; /* Authorization values */
static char *zRemoteUser = 0; /* REMOTE_USER set by authorization module */
static char *zIfNoneMatch= 0; /* The If-None-Match header value */
static char *zIfModifiedSince=0; /* The If-Modified-Since header value */
static char *zHttpScheme = "http";/* HTTP_SCHEME CGI variable */
static char *zHttps = 0; /* HTTPS CGI variable */
static int nIn = 0; /* Number of bytes of input */
static int nOut = 0; /* Number of bytes of output */
static char zReplyStatus[4]; /* Reply status code */
static int statusSent = 0; /* True after status line is sent */
static const char *zLogFile = 0; /* Log to this file */
static const char *zIPShunDir=0; /* Directory containing hostile IP addresses */
static int debugFlag = 0; /* True if being debugged */
static struct timeval beginTime; /* Time when this process starts */
static int closeConnection = 0; /* True to send Connection: close in reply */
static int nRequest = 0; /* Number of requests processed */
static int omitLog = 0; /* Do not make logfile entries if true */
static int useHttps = 0; /* 0=HTTP, 1=external HTTPS (stunnel),
** 2=builtin TLS support */
static int useTimeout = 1; /* True to use times */
static int nTimeoutLine = 0; /* Line number where timeout was set */
static int standalone = 0; /* Run as a standalone server (no inetd) */
static int ipv6Only = 0; /* Use IPv6 only */
static int ipv4Only = 0; /* Use IPv4 only */
static struct rusage priorSelf; /* Previously report SELF time */
static struct rusage priorChild; /* Previously report CHILD time */
static int mxAge = 120; /* Cache-control max-age */
static char *default_path = "/bin:/usr/bin"; /* Default PATH variable */
static char *zScgi = 0; /* Value of the SCGI env variable */
static int rangeStart = 0; /* Start of a Range: request */
static int rangeEnd = 0; /* End of a Range: request */
static int maxCpu = MAX_CPU; /* Maximum CPU time per process */
/* Forward reference */
static void Malfunction(int errNo, const char *zFormat, ...);
#ifdef ENABLE_TLS
#include <openssl/bio.h>
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/x509.h>
typedef struct TlsServerConn {
SSL *ssl; /* The SSL codec */
BIO *bio; /* SSL BIO object */
int iSocket; /* The socket */
} TlsServerConn;
/*
** There can only be a single OpenSSL IO connection open at a time.
** State information about that IO is stored in the following
** global singleton:
*/
static struct TlsState {
int isInit; /* 0: uninit 1: init as client 2: init as server */
SSL_CTX *ctx;
const char *zCertFile; /* --cert CLI arg */
const char *zKeyFile; /* --pkey CLI arg */
TlsServerConn * sslCon;
} tlsState = {
0, /* isInit */
NULL, /* SSL_CTX *ctx */
NULL, /* zCertFile */
NULL, /* zKeyFile */
NULL /* sslCon */
};
/*
** Read a single line of text from the client and stores it in zBuf
** (which must be at least nBuf bytes long). On error it
** calls Malfunction().
**
** If it reads anything, it returns zBuf.
*/
static char *tls_gets(void *pServerArg, char *zBuf, int nBuf){
int n = 0, err = 0;
int i;
TlsServerConn * const pServer = (TlsServerConn*)pServerArg;
if( BIO_eof(pServer->bio) ) return 0;
for(i=0; i<nBuf-1; i++){
n = SSL_read(pServer->ssl, &zBuf[i], 1);
err = SSL_get_error(pServer->ssl, n);
if( err!=0 ){
Malfunction(525,"SSL read error.");
}else if( 0==n || zBuf[i]=='\n' ){
break;
}
}
zBuf[i+1] = 0;
return zBuf;
}
/*
** Reads up tp nBuf bytes of TLS-decoded bytes from the client and
** stores them in zBuf, which must be least nBuf bytes long. Returns
** the number of bytes read. Fails fatally if nBuf is "too big" or if
** SSL_read() fails. Once pServerArg reaches EOF, this function simply
** returns 0 with no side effects.
*/
static size_t tls_read_server(void *pServerArg, void *zBuf, size_t nBuf){
int err = 0;
size_t rc = 0;
TlsServerConn * const pServer = (TlsServerConn*)pServerArg;
if( nBuf>0x7fffffff ){
Malfunction(526,"SSL read too big"); /* LOG: SSL read too big */
}
while( 0==err && nBuf!=rc && 0==BIO_eof(pServer->bio) ){
const int n = SSL_read(pServer->ssl, zBuf + rc, (int)(nBuf - rc));
if( n==0 ){
break;
}
err = SSL_get_error(pServer->ssl, n);
if(0==err){
rc += n;
}else{
Malfunction(527,"SSL read error."); /* LOG: SSL read error */
}
}
return rc;
}
/*
** Write cleartext bytes into the SSL server codec so that they can
** be encrypted and sent back to the client. On success, returns
** the number of bytes written, else returns a negative value.
*/
static int tls_write_server(void *pServerArg, void const *zBuf, size_t nBuf){
int n;
TlsServerConn * const pServer = (TlsServerConn*)pServerArg;
if( nBuf<=0 ) return 0;
if( nBuf>0x7fffffff ){
Malfunction(528,"SSL write too big"); /* LOG: SSL write too big */
}
n = SSL_write(pServer->ssl, zBuf, (int)nBuf);
if( n<=0 ){
/* Do NOT call Malfunction() from here, as Malfunction()
** may output via this function. The current error handling
** is somewhat unsatisfactory, as it can lead to negative
** response length sizes in the althttpd log. */
return -SSL_get_error(pServer->ssl, n);
}else{
return n;
}
}
#endif /* ENABLE_TLS */
/*
** A printf() proxy which outputs either to stdout or the outbound TLS
** connection, depending on connection state. It uses a
** statically-sized buffer for TLS output and will fail (via
** Malfunction()) if it's passed too much data. In non-TLS mode it has
** no such limitation. The buffer is generously sized, in any case, to
** be able to handle all of the headers output by althttpd as of the
** time of this writing.
*/
#ifdef ENABLE_TLS
static int althttpd_vprintf(char const * fmt, va_list va){
if( useHttps!=2 || NULL==tlsState.sslCon ){
return vprintf(fmt, va);
}else{
char pfBuffer[10000];
const int sz = vsnprintf(pfBuffer, sizeof(pfBuffer), fmt, va);
if( sz<(int)sizeof(pfBuffer) ){
return (int)tls_write_server(tlsState.sslCon, pfBuffer, sz);
}else{
Malfunction(529, /* LOG: Output buffer too small */
"Output buffer is too small. Wanted %d bytes.", sz);
return 0;
}
}
}
#else
#define althttpd_vprintf vprintf
#endif
#ifdef ENABLE_TLS
static int althttpd_printf(char const * fmt, ...){
int rc;
va_list va;
va_start(va,fmt);
rc = althttpd_vprintf(fmt, va);
va_end(va);
return rc;
}
static void *tls_new_server(int iSocket);
static void tls_close_server(void *pServerArg);
static void tls_atexit(void);
#else
#define althttpd_printf printf
#endif
/* forward references */
static int tls_init_conn(int iSocket);
static void tls_close_conn(void);
static void althttpd_fflush(FILE *f);
/*
** Flush the buffer then exit.
*/
static void althttpd_exit(void){
althttpd_fflush(stdout);
tls_close_conn();
exit(0);
}
/*
** Mapping between CGI variable names and values stored in
** global variables.
*/
static struct {
char *zEnvName;
char **pzEnvValue;
} cgienv[] = {
{ "CONTENT_LENGTH", &zContentLength }, /* Must be first for SCGI */
{ "AUTH_TYPE", &zAuthType },
{ "AUTH_CONTENT", &zAuthArg },
{ "CONTENT_TYPE", &zContentType },
{ "DOCUMENT_ROOT", &zHome },
{ "HTTP_ACCEPT", &zAccept },
{ "HTTP_ACCEPT_ENCODING", &zAcceptEncoding },
{ "HTTP_COOKIE", &zCookie },
{ "HTTP_HOST", &zHttpHost },
{ "HTTP_IF_MODIFIED_SINCE", &zIfModifiedSince },
{ "HTTP_IF_NONE_MATCH", &zIfNoneMatch },
{ "HTTP_REFERER", &zReferer },
{ "HTTP_SCHEME", &zHttpScheme },
{ "HTTP_USER_AGENT", &zAgent },
{ "HTTPS", &zHttps },
{ "PATH", &default_path },
{ "PATH_INFO", &zPathInfo },
{ "QUERY_STRING", &zQueryString },
{ "REMOTE_ADDR", &zRemoteAddr },
{ "REQUEST_METHOD", &zMethod },
{ "REQUEST_URI", &zRequestUri },
{ "REMOTE_USER", &zRemoteUser },
{ "SCGI", &zScgi },
{ "SCRIPT_DIRECTORY", &zDir },
{ "SCRIPT_FILENAME", &zFile },
{ "SCRIPT_NAME", &zRealScript },
{ "SERVER_NAME", &zServerName },
{ "SERVER_PORT", &zServerPort },
{ "SERVER_PROTOCOL", &zProtocol },
{ "SERVER_SOFTWARE", &zServerSoftware },
};
/*
** Double any double-quote characters in a string. This is used to
** quote strings for output into the CSV log file.
*/
static char *Escape(const char *z){
size_t i, j;
size_t n;
char c;
char *zOut;
for(i=0; (c=z[i])!=0 && c!='"'; i++){}
if( c==0 ) return (char *)z;
n = 1;
for(i++; (c=z[i])!=0; i++){ if( c=='"' ) n++; }
zOut = malloc( i+n+1 );
if( zOut==0 ) return "";
for(i=j=0; (c=z[i])!=0; i++){
zOut[j++] = c;
if( c=='"' ) zOut[j++] = c;
}
zOut[j] = 0;
return zOut;
}
/*
** Convert a struct timeval into an integer number of microseconds
*/
static long long int tvms(struct timeval *p){
return ((long long int)p->tv_sec)*1000000 + (long long int)p->tv_usec;
}
/*
** Make an entry in the log file. If the HTTP connection should be
** closed, then terminate this process. Otherwise return.
*/
static void MakeLogEntry(int exitCode, int lineNum){
FILE *log;
if( zPostData ){
free(zPostData);
zPostData = 0;
}
if( zLogFile && !omitLog ){
struct timeval now;
struct tm *pTm;
struct rusage self, children;
int waitStatus;
const char *zRM = zRemoteUser ? zRemoteUser : "";
const char *zFilename;
size_t sz;
char zDate[200];
char zExpLogFile[500];
if( zScript==0 ) zScript = "";
if( zRealScript==0 ) zRealScript = "";
if( zRemoteAddr==0 ) zRemoteAddr = "";
if( zHttpHost==0 ) zHttpHost = "";
if( zReferer==0 ) zReferer = "";
if( zAgent==0 ) zAgent = "";
gettimeofday(&now, 0);
pTm = localtime(&now.tv_sec);
strftime(zDate, sizeof(zDate), "%Y-%m-%d %H:%M:%S", pTm);
sz = strftime(zExpLogFile, sizeof(zExpLogFile), zLogFile, pTm);
if( sz>0 && sz<sizeof(zExpLogFile)-2 ){
zFilename = zExpLogFile;
}else{
zFilename = zLogFile;
}
waitpid(-1, &waitStatus, WNOHANG);
getrusage(RUSAGE_SELF, &self);
getrusage(RUSAGE_CHILDREN, &children);
if( (log = fopen(zFilename,"a"))!=0 ){
#ifdef COMBINED_LOG_FORMAT
strftime(zDate, sizeof(zDate), "%d/%b/%Y:%H:%M:%S %Z", pTm);
fprintf(log, "%s - - [%s] \"%s %s %s\" %s %d \"%s\" \"%s\"\n",
zRemoteAddr, zDate, zMethod, zScript, zProtocol,
zReplyStatus, nOut, zReferer, zAgent);
#else
strftime(zDate, sizeof(zDate), "%Y-%m-%d %H:%M:%S", pTm);
/* Log record files:
** (1) Date and time
** (2) IP address
** (3) URL being accessed
** (4) Referer
** (5) Reply status
** (6) Bytes received
** (7) Bytes sent
** (8) Self user time
** (9) Self system time
** (10) Children user time
** (11) Children system time
** (12) Total wall-clock time
** (13) Request number for same TCP/IP connection
** (14) User agent
** (15) Remote user
** (16) Bytes of URL that correspond to the SCRIPT_NAME
** (17) Line number in source file
*/
fprintf(log,
"%s,%s,\"%s://%s%s\",\"%s\","
"%s,%d,%d,%lld,%lld,%lld,%lld,%lld,%d,\"%s\",\"%s\",%d,%d\n",
zDate, zRemoteAddr, zHttpScheme, Escape(zHttpHost), Escape(zScript),
Escape(zReferer), zReplyStatus, nIn, nOut,
tvms(&self.ru_utime) - tvms(&priorSelf.ru_utime),
tvms(&self.ru_stime) - tvms(&priorSelf.ru_stime),
tvms(&children.ru_utime) - tvms(&priorChild.ru_utime),
tvms(&children.ru_stime) - tvms(&priorChild.ru_stime),
tvms(&now) - tvms(&beginTime),
nRequest, Escape(zAgent), Escape(zRM),
(int)(strlen(zHttpScheme)+strlen(zHttpHost)+strlen(zRealScript)+3),
lineNum
);
priorSelf = self;
priorChild = children;
#endif
fclose(log);
nIn = nOut = 0;
}
}
if( closeConnection ){
exit(exitCode);
}
statusSent = 0;
}
/*
** Allocate memory safely
*/
static char *SafeMalloc( size_t size ){
char *p;
p = (char*)malloc(size);
if( p==0 ){
strcpy(zReplyStatus, "998");
MakeLogEntry(1,100); /* LOG: Malloc() failed */
exit(1);
}
return p;
}
/* Forward reference */
static void BlockIPAddress(void);
static void ServiceUnavailable(int lineno);
/*
** Set the value of environment variable zVar to zValue.
*/
static void SetEnv(const char *zVar, const char *zValue){
char *z;
size_t len;
if( zValue==0 ) zValue="";
/* Disable an attempted bashdoor attack */
if( strncmp(zValue,"() {",4)==0 ){
BlockIPAddress();
ServiceUnavailable(902); /* LOG: 902 bashdoor attack */
zValue = "";
}
len = strlen(zVar) + strlen(zValue) + 2;
z = SafeMalloc(len);
sprintf(z,"%s=%s",zVar,zValue);
putenv(z);
}
/*
** Remove the first space-delimited token from a string and return
** a pointer to it. Add a NULL to the string to terminate the token.
** Make *zLeftOver point to the start of the next token.
*/
static char *GetFirstElement(char *zInput, char **zLeftOver){
char *zResult = 0;
if( zInput==0 ){
if( zLeftOver ) *zLeftOver = 0;
return 0;
}
while( isspace(*(unsigned char*)zInput) ){ zInput++; }
zResult = zInput;
while( *zInput && !isspace(*(unsigned char*)zInput) ){ zInput++; }
if( *zInput ){
*zInput = 0;
zInput++;
while( isspace(*(unsigned char*)zInput) ){ zInput++; }
}
if( zLeftOver ){ *zLeftOver = zInput; }
return zResult;
}
/*
** Make a copy of a string into memory obtained from malloc.
*/
static char *StrDup(const char *zSrc){
char *zDest;
size_t size;
if( zSrc==0 ) return 0;
size = strlen(zSrc) + 1;
zDest = (char*)SafeMalloc( size );
strcpy(zDest,zSrc);
return zDest;
}
static char *StrAppend(char *zPrior, const char *zSep, const char *zSrc){
char *zDest;
size_t size;
size_t n0, n1, n2;
if( zSrc==0 ) return 0;
if( zPrior==0 ) return StrDup(zSrc);
n0 = strlen(zPrior);
n1 = strlen(zSep);
n2 = strlen(zSrc);
size = n0+n1+n2+1;
zDest = (char*)SafeMalloc( size );
memcpy(zDest, zPrior, n0);
free(zPrior);
memcpy(&zDest[n0],zSep,n1);
memcpy(&zDest[n0+n1],zSrc,n2+1);
return zDest;
}
/*
** Construct the REQUEST_URI value from zString and zQueryString.
**
** REQUEST_URI is nominally the second field of the first line of the
** HTTP request. But we might have done some sanitization on the
** SCRIPT_NAME and/or PATH_INFO and we want to capture that in the
** REQUEST_URI. Hence, the REQUEST_URI is recomputed before being
** sent to CGI or SCGI.
*/
static void ComputeRequestUri(void){
if( zQueryString==0 || zQueryString[0]==0 ){
zRequestUri = zScript;
}else{
zRequestUri = StrAppend(zScript, "?", zQueryString);
}
}
/*
** Compare two ETag values. Return 0 if they match and non-zero if they differ.
**
** The one on the left might be a NULL pointer and it might be quoted.
*/
static int CompareEtags(const char *zA, const char *zB){
if( zA==0 ) return 1;
if( zA[0]=='"' ){
int lenB = (int)strlen(zB);
if( strncmp(zA+1, zB, lenB)==0 && zA[lenB+1]=='"' ) return 0;
}
return strcmp(zA, zB);
}
/*
** Break a line at the first \n or \r character seen.
*/
static void RemoveNewline(char *z){
if( z==0 ) return;
while( *z && *z!='\n' && *z!='\r' ){ z++; }
*z = 0;
}
/* Render seconds since 1970 as an RFC822 date string. Return
** a pointer to that string in a static buffer.
*/
static char *Rfc822Date(time_t t){
struct tm *tm;
static char zDate[100];
tm = gmtime(&t);
strftime(zDate, sizeof(zDate), "%a, %d %b %Y %H:%M:%S GMT", tm);
return zDate;
}
/*
** Print a date tag in the header. The name of the tag is zTag.
** The date is determined from the unix timestamp given.
*/
static int DateTag(const char *zTag, time_t t){
return althttpd_printf("%s: %s\r\n", zTag, Rfc822Date(t));
}
/*
** Parse an RFC822-formatted timestamp as we'd expect from HTTP and return
** a Unix epoch time. <= zero is returned on failure.
*/
time_t ParseRfc822Date(const char *zDate){
int mday, mon, year, yday, hour, min, sec;
char zIgnore[4];
char zMonth[4];
static const char *const azMonths[] =
{"Jan", "Feb", "Mar", "Apr", "May", "Jun",
"Jul", "Aug", "Sep", "Oct", "Nov", "Dec"};
if( 7==sscanf(zDate, "%3[A-Za-z], %d %3[A-Za-z] %d %d:%d:%d", zIgnore,
&mday, zMonth, &year, &hour, &min, &sec)){
if( year > 1900 ) year -= 1900;
for(mon=0; mon<12; mon++){
if( !strncmp( azMonths[mon], zMonth, 3 )){
int nDay;
int isLeapYr;
static int priorDays[] =
{ 0, 31, 59, 90,120,151,181,212,243,273,304,334 };
isLeapYr = year%4==0 && (year%100!=0 || (year+300)%400==0);
yday = priorDays[mon] + mday - 1;
if( isLeapYr && mon>1 ) yday++;
nDay = (year-70)*365 + (year-69)/4 - year/100 + (year+300)/400 + yday;
return ((time_t)(nDay*24 + hour)*60 + min)*60 + sec;
}
}
}
return 0;
}
/*
** Test procedure for ParseRfc822Date
*/
void TestParseRfc822Date(void){
time_t t1, t2;
for(t1=0; t1<0x7fffffff; t1 += 127){
t2 = ParseRfc822Date(Rfc822Date(t1));
assert( t1==t2 );
}
}
/*
** Print the first line of a response followed by the server type.
*/
static void StartResponse(const char *zResultCode){
time_t now;
time(&now);
if( statusSent ) return;
nOut += althttpd_printf("%s %s\r\n",
zProtocol ? zProtocol : "HTTP/1.1",
zResultCode);
strncpy(zReplyStatus, zResultCode, 3);
zReplyStatus[3] = 0;
if( zReplyStatus[0]>='4' ){
closeConnection = 1;
}
if( closeConnection ){
nOut += althttpd_printf("Connection: close\r\n");
}else{
nOut += althttpd_printf("Connection: keep-alive\r\n");
}
nOut += DateTag("Date", now);
statusSent = 1;
}
/*
** Check all of the files in the zIPShunDir directory. Unlink any
** files in that directory that have expired.
**
** This routine might be slow if there are a lot of blocker files.
** So it only runs when we are not in a hurry, such as prior to sending
** a 404 Not Found reply.
*/
static void UnlinkExpiredIPBlockers(void){
DIR *pDir;
struct dirent *pFile;
size_t nIPShunDir;
time_t now;
char zFilename[2000];
if( zIPShunDir==0 ) return;
if( zIPShunDir[0]!='/' ) return;
nIPShunDir = strlen(zIPShunDir);
while( nIPShunDir>0 && zIPShunDir[nIPShunDir-1]=='/' ) nIPShunDir--;
if( nIPShunDir > sizeof(zFilename)-100 ) return;
memcpy(zFilename, zIPShunDir, nIPShunDir);
zFilename[nIPShunDir] = 0;
pDir = opendir(zFilename);
if( pDir==0 ) return;
zFilename[nIPShunDir] = '/';
time(&now);
while( (pFile = readdir(pDir))!=0 ){
size_t nFile = strlen(pFile->d_name);
int rc;