04-notify-on-block.patch

Copyright (c) 2021 - 2024 Matthias Pressfreund

Permission to use, copy, modify, and distribute this software for any
purpose with or without fee is hereby granted, provided that the above
copyright notice and this permission notice appear in all copies.

THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

Index: usr.sbin/httpd/config.c
@@ -1,6 +1,7 @@
 /*	$OpenBSD: config.c,v 1.65 2024/01/17 08:22:40 claudio Exp $	*/
 
 /*
+ * Copyright (c) 2021 Matthias Pressfreund
  * Copyright (c) 2011 - 2015 Reyk Floeter <reyk@openbsd.org>
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -456,6 +457,7 @@
 	uint8_t			*p = imsg->data;
 	unsigned int		 f;
 	size_t			 s;
+	struct timeval		*tv;
 
 	if ((srv_conf = calloc(1, sizeof(*srv_conf))) == NULL)
 		return (-1);
@@ -596,6 +598,16 @@
 		srv_conf->flags |= parent->flags & SRVFLAG_ERRDOCS;
 		(void)strlcpy(srv_conf->errdocroot, parent->errdocroot,
 		    sizeof(srv_conf->errdocroot));
+
+		if (*srv_conf->notifier.socket.sun_path == '\0')
+			srv_conf->notifier.socket = parent->notifier.socket;
+		if (*srv_conf->notifier.message == '\0')
+			(void)strlcpy(srv_conf->notifier.message,
+			    parent->notifier.message,
+			    sizeof(srv_conf->notifier.message));
+		tv = &srv_conf->notifier.timeout;
+		if (!timeval_isset(tv))
+			*tv = parent->notifier.timeout;
 
 		DPRINTF("%s: %s %d location \"%s\", "
 		    "parent \"%s[%u]\", flags: %s",
Index: usr.sbin/httpd/httpd.conf.5
@@ -592,6 +592,117 @@
 .Xr syslog 3
 instead of the log files.
 .El
+.It Oo Ic no Oc Ic notify-on-block Ar option | Brq ...
+Makes
+.Xr httpd 8
+send a notification message to a listening UNIX-domain socket right after the
+connection to the client has been closed due to a
+.Ic block
+directive.
+If specified on
+.Ic server
+level,
+.Ic notify-on-block
+will be inherited by all enclosed locations unless
+.Ic no notify-on-block
+is specified.
+In case making the connection or sending the message fails (either because of
+transmission error or timeout), a corresponding warning will be written into
+the system log.
+.Pp
+Options may be specified either one at a time or enclosed in curly braces.
+Valid options are:
+.Bl -tag -width Ds
+.It Ic message Ar string ... | Ic drop
+Specifies the notification message to be sent and may consist of one or more
+parts.
+Each part may be either a regular
+.Ar string
+or one of the newline substitutes
+.Ic cr
+.Pq Sq Dv \er
+or
+.Ic lf
+.Pq Sq Dv \en .
+The parts will be concatenated in the given order.
+.Pp
+Additionally, a
+.Ar string
+may contain the following macros which will be expanded at runtime:
+.Pp
+.Bl -tag -width $HTTP_USER_AGENT -offset indent -compact
+.It Ic $HTTP_HOST
+The host from the HTTP
+.Sq Dv Host
+header.
+.It Ic $HTTP_REFERRER
+The referrer from the HTTP
+.Sq Dv Referer
+header.
+.It Ic $HTTP_USER_AGENT
+The user agent from the HTTP
+.Sq Dv User-Agent
+header.
+.It Ic $REMOTE_ADDR
+The client IP address.
+.It Ic $REMOTE_PORT
+The client source port.
+.It Ic $REMOTE_USER
+The HTTP authenticated remote user.
+.It Ic $REQUEST_METHOD
+The HTTP method the connected client used when making the request.
+.It Ic $REQUEST_SCHEME
+The request scheme
+.Pq So Dv http Sc No or Sq Dv https .
+.It Ic $REQUEST_URI
+The request path and optional query string.
+.It Ic $RESPONSE_CODE
+The 3-digit HTTP response code sent to the client or
+.Sq Dv 000
+if the connection was dropped.
+.It Ic $RESPONSE_URI
+The URI sent to the client in the HTTP
+.Sq Dv Location
+header.
+.El
+.Pp
+The following example defines a two line message, line 1 containing the client
+IP address, line 2 the requested URI, using
+.Sq Dv \en
+as the newline character:
+.Bd -literal -offset indent
+notify-on-block {
+	socket "/run/example.sock"
+	message "$REMOTE_ADDR" lf \(rs
+		"$REQUEST_URI"
+}
+.Ed
+.Pp
+Here, the two string parts of the
+.Ic message
+internally concatenate and transform to
+.Pp
+.Dl message \(dq$REMOTE_ADDR\en$REQUEST_URI\(dq
+.Pp
+If
+.Ic drop
+is specified instead of an actual message, a previously (perhaps in a parent
+.Ic server )
+defined message will be deleted.
+.It Ic socket Ar path
+Specifies the
+.Ar path
+to the listening UNIX-domain socket that will be notified.
+.It Oo Ic no Oc Ic timeout Ar millis
+Set the maximum time the server will try to send the notification message to
+.Ar millis
+milliseconds, or disable the
+.Ic timeout
+by specifying the
+.Ic no
+keyword.
+Defaults to 2000 milliseconds.
+.El
 .It Ic pass
 Disable any previous
 .Ic block
Index: usr.sbin/httpd/httpd.h
@@ -27,6 +27,7 @@
 #include <sys/queue.h>
 #include <sys/tree.h>
 #include <sys/time.h>
+#include <sys/un.h>
 
 #include <net/if.h>
 #include <netinet/in.h>
@@ -89,6 +90,8 @@
 #define SERVER_DEF_TLS_LIFETIME	(2 * 3600)
 #define SERVER_MIN_TLS_LIFETIME	(60)
 #define SERVER_MAX_TLS_LIFETIME	(24 * 3600)
+#define SERVER_MAXNOTIFYMESSAGE	512
+#define SERVER_NOTIFYTIMEOUT	2000
 
 #define MEDIATYPE_NAMEMAX	128	/* file name extension */
 #define MEDIATYPE_TYPEMAX	64	/* length of type/subtype */
@@ -498,6 +501,26 @@
 	struct client_addr	 xff;
 };
 
+struct socket_notifier {
+	struct sockaddr_un	 socket;
+	char			 message[SERVER_MAXNOTIFYMESSAGE];
+	struct timeval		 timeout;
+};
+#define timeval_isset(t)	((t)->tv_sec != 0 || (t)->tv_usec != 0)
+#define timeval_setmillis(t, m)	do {		\
+	(t)->tv_sec = (m) / 1000;		\
+	(t)->tv_usec = (m) % 1000 * 1000;	\
+} while (0)
+
+struct notify_message {
+	const char	*str;
+	size_t		 size;
+	size_t		 n;
+	const char	*path;
+	struct timeval	*tv;
+	struct event	*ev;
+};
+
 struct server_config {
 	uint32_t		 id;
 	uint32_t		 parent_id;
@@ -572,6 +595,7 @@
 
 	char			 fcgiscript[PATH_MAX];
 	struct addr_filter	 clientfilter[HTTPD_CLIENT_FILTER_MAX];
+	struct socket_notifier	 notifier;
 
 	TAILQ_ENTRY(server_config) entry;
 };
Index: usr.sbin/httpd/parse.y
@@ -145,15 +145,15 @@
 %token	TIMEOUT TLS TYPE TYPES HSTS MAXAGE SUBDOMAINS DEFAULT PRELOAD REQUEST
 %token	ERROR INCLUDE AUTHENTICATE WITH BLOCK DROP RETURN PASS REWRITE
 %token	CA CLIENT CRL OPTIONAL PARAM FORWARDED FOUND NOT
-%token	ERRDOCS GZIPSTATIC CACHE SCRIPT FROM
+%token	ERRDOCS GZIPSTATIC CACHE SCRIPT FROM NOTIFY MESSAGE CR LF
 %token	<v.string>	STRING
 %token  <v.number>	NUMBER
 %type	<v.port>	port
 %type	<v.string>	fcgiport
 %type	<v.number>	opttls optmatch optfound
 %type	<v.tv>		timeout
-%type	<v.string>	numberstring optstring
-%type	<v.string>	optclientfilter clientfilters_l
+%type	<v.string>	numberstring optstring stringornl
+%type	<v.string>	optclientfilter clientfilters_l msgopts_l
 %type	<v.auth>	authopts
 
 %%
@@ -1270,6 +1270,25 @@
 			srv_conf->flags &= ~SRVFLAG_BLOCK;
 			srv_conf->flags |= SRVFLAG_NO_BLOCK;
 		}
+		| NO NOTIFY			{
+			memset(&srv_conf->notifier, 0,
+			    sizeof(srv_conf->notifier));
+		}
+		| NOTIFY			{
+			if (parentsrv != NULL)
+				srv_conf->notifier =
+				    parentsrv->srv_conf.notifier;
+		} notifyopts_v			{
+			struct timeval	*tv;
+
+			if (*srv_conf->notifier.message == '\0') {
+				yyerror("empty notify message");
+				YYERROR;
+			}
+			tv = &srv_conf->notifier.timeout;
+			if (!timeval_isset(tv))
+				timeval_setmillis(tv, SERVER_NOTIFYTIMEOUT);
+		}
 		;
 
 block		: BLOCK				{
@@ -1278,6 +1297,92 @@
 		}
 		;
 
+notifyopts_v	: '{' optnl notifyopts_l '}'
+		| notifyopts
+		;
+
+notifyopts_l	: notifyopts optcommanl notifyopts_l
+		| notifyopts optnl
+		;
+
+notifyopts	: MESSAGE DROP		{
+			*srv_conf->notifier.message = '\0';
+		}
+		| MESSAGE msgopts_l	{
+			if (strlcpy(srv_conf->notifier.message, $2,
+			    sizeof(srv_conf->notifier.message)) >=
+			    sizeof(srv_conf->notifier.message)) {
+				yyerror("notify message too long");
+				free($2);
+				YYERROR;
+			}
+			free($2);
+	   	}
+		| NO TIMEOUT		{
+			memset(&srv_conf->notifier.timeout, 0,
+			    sizeof(srv_conf->notifier.timeout));
+		}
+		| SOCKET STRING		{
+			if (strlcpy(srv_conf->notifier.socket.sun_path, $2,
+			    sizeof(srv_conf->notifier.socket.sun_path)) >=
+			    sizeof(srv_conf->notifier.socket.sun_path)) {
+				yyerror("notify socket path too long");
+				free($2);
+				YYERROR;
+			}
+			free($2);
+			srv_conf->notifier.socket.sun_family = AF_UNIX;
+		}
+		| TIMEOUT NUMBER	{
+			if ($2 <= 0 || $2 > LONG_MAX) {
+				yyerror("notify timeout out of bounds");
+				YYERROR;
+			}
+			timeval_setmillis(&srv_conf->notifier.timeout, $2);
+		}
+		;
+
+msgopts_l	: msgopts_l stringornl	{
+			char	*s;
+
+			if (asprintf(&s, "%s%s", $1, $2) == -1) {
+				yyerror("asprintf: \"%s%s\"", $1, $2);
+				free($1);
+				free($2);
+				YYERROR;
+			}
+			free($1);
+			free($2);
+			$$ = s;
+		}
+		| stringornl		{
+			$$ = $1;
+		}
+		;
+
+stringornl	: CR		{
+	   		char	*s;
+
+	   		if ((s = strdup("\r")) == NULL) {
+				yyerror("strdup: \"\\r\"");
+				YYERROR;
+			}
+			$$ = s;
+		}
+		| LF		{
+	   		char	*s;
+
+	   		if ((s = strdup("\n")) == NULL) {
+				yyerror("strdup: \"\\n\"");
+				YYERROR;
+			}
+			$$ = s;
+		}
+		| STRING	{
+			$$ = $1;
+		}
+		;
+
 optmatch	: /* empty */		{ $$ = 0; }
 		| MATCH			{ $$ = 1; }
 		;
@@ -1709,6 +1814,7 @@
 		{ "combined",		COMBINED },
 		{ "common",		COMMON },
 		{ "connection",		CONNECTION },
+		{ "cr",			CR },
 		{ "crl",		CRL },
 		{ "default",		DEFAULT },
 		{ "dhe",		DHE },
@@ -1727,6 +1833,7 @@
 		{ "index",		INDEX },
 		{ "ip",			IP },
 		{ "key",		KEY },
+		{ "lf",			LF },
 		{ "lifetime",		LIFETIME },
 		{ "listen",		LISTEN },
 		{ "location",		LOCATION },
@@ -1735,9 +1842,11 @@
 		{ "match",		MATCH },
 		{ "max",		MAXIMUM },
 		{ "max-age",		MAXAGE },
+		{ "message",		MESSAGE },
 		{ "no",			NO },
 		{ "nodelay",		NODELAY },
 		{ "not",		NOT },
+		{ "notify-on-block",	NOTIFY },
 		{ "ocsp",		OCSP },
 		{ "on",			ON },
 		{ "optional",		OPTIONAL },
Index: usr.sbin/httpd/server_http.c
@@ -39,6 +39,7 @@
 #include <ctype.h>
 #include <vis.h>
 #include <fcntl.h>
+#include <netdb.h>
 
 #include "httpd.h"
 #include "http.h"
@@ -58,6 +59,10 @@
 		    const char *);
 int		 server_clientfilter(struct server_config *,
 		    struct server_client_addr *);
+char		*server_notify_init(struct client *, struct socket_notifier *,
+		    unsigned int, const char *);
+int		 server_notify_send(struct socket_notifier *, const char *);
+void		 server_notify_write(int, short, void *);
 
 static struct http_method	 http_methods[] = HTTP_METHODS;
 static struct http_error	 http_errors[] = HTTP_ERRORS;
@@ -1276,6 +1281,7 @@
 	int			 portval = -1, ret;
 	char			*hostval, *query;
 	const char		*errstr = NULL;
+	char			*notify_msg = NULL;
 
 	/* Preserve original path */
 	if (desc->http_path == NULL ||
@@ -1437,8 +1443,17 @@
 	}
 
 	if (srv_conf->flags & SRVFLAG_BLOCK) {
+		if (*srv_conf->notifier.socket.sun_path != '\0' &&
+		    (notify_msg = server_notify_init(clt, &srv_conf->notifier,
+		    srv_conf->return_code, srv_conf->return_uri)) == NULL)
+			log_warn("failed initializing notifier at '%s'",
+			    srv_conf->notifier.socket.sun_path);
 		server_abort_http(clt, srv_conf->return_code,
 		    srv_conf->return_uri);
+		if (notify_msg != NULL) {
+			server_notify_send(&srv_conf->notifier, notify_msg);
+			free(notify_msg);
+		}
 		return (-1);
 	} else if (srv_conf->flags & SRVFLAG_AUTH &&
 	    server_http_authenticate(srv_conf, clt) == -1) {
@@ -1454,6 +1469,194 @@
 	srv_conf = clt->clt_srv_conf;
 	server_abort_http(clt, 500, srv_conf->root);
 	return (-1);
+}
+
+char *
+server_notify_init(struct client *clt, struct socket_notifier *notifier,
+    unsigned int code, const char *uri)
+{
+	char			*msg, *str = NULL;
+	struct http_descriptor	*desc;
+	struct server_config	*srv_conf;
+	struct kv		 key, *k;
+	char			 hbuf[NI_MAXHOST], ibuf[IBUF_READ_SIZE];
+
+	if ((msg = strdup(notifier->message)) == NULL)
+		fatal("strdup");
+	desc = clt->clt_descreq;
+	srv_conf = clt->clt_srv_conf;
+	msg = replace_var(msg, "$HTTP_HOST",
+	    desc->http_host == NULL ? "" : desc->http_host);
+	if (strstr(msg, "$HTTP_REFERRER") != NULL) {
+		key.kv_key = "Referer"; /* sic */
+		if ((k = kv_find(&desc->http_headers, &key)) != NULL &&
+		    k->kv_value != NULL) {
+			if (stravis(&str, k->kv_value, HTTPD_LOGVIS) == -1)
+				goto err;
+
+		} else if ((str = calloc(1, 1)) == NULL)
+			fatal("calloc");
+		msg = replace_var(msg, "$HTTP_REFERRER", str);
+		free(str);
+		str = NULL;
+	}
+	if (strstr(msg, "$HTTP_USER_AGENT") != NULL) {
+		key.kv_key = "User-Agent";
+		if ((k = kv_find(&desc->http_headers, &key)) != NULL &&
+		    k->kv_value != NULL) {
+			if (stravis(&str, k->kv_value, HTTPD_LOGVIS) == -1)
+				goto err;
+
+		} else if ((str = calloc(1, 1)) == NULL)
+			fatal("calloc");
+		msg = replace_var(msg, "$HTTP_USER_AGENT", str);
+		free(str);
+		str = NULL;
+	}
+	if (strstr(msg, "$HTTP_VERSION") != NULL) {
+		if (stravis(&str, desc->http_version, HTTPD_LOGVIS) == -1)
+			goto err;
+
+		msg = replace_var(msg, "$HTTP_VERSION", str);
+		free(str);
+		str = NULL;
+	}
+	if (strstr(msg, "$REMOTE_ADDR") != NULL) {
+		if (print_host(&clt->clt_ss, hbuf, sizeof(hbuf)) == NULL)
+			goto err;
+
+		msg = replace_var(msg, "$REMOTE_ADDR", hbuf);
+	}
+	if (strstr(msg, "$REMOTE_PORT") != NULL) {
+		if (asprintf(&str, "%u", ntohs(clt->clt_port)) == -1)
+			fatal("asprintf");
+		msg = replace_var(msg, "$REMOTE_PORT", str);
+		free(str);
+		str = NULL;
+	}
+	msg = replace_var(msg, "$REMOTE_USER",
+	    (srv_conf->flags & SRVFLAG_AUTH) && clt->clt_remote_user != NULL ?
+	    clt->clt_remote_user : "");
+	msg = replace_var(msg, "$REQUEST_METHOD",
+	    server_httpmethod_byid(desc->http_method));
+	msg = replace_var(msg, "$REQUEST_SCHEME",
+	    srv_conf->flags & SRVFLAG_TLS ? "https" : "http");
+	if (strstr(msg, "$REQUEST_URI") != NULL) {
+		if (desc->http_query == NULL) {
+			if ((str = strdup(desc->http_path)) == NULL)
+				fatal("strdup");
+		} else if (asprintf(&str, "%s?%s", desc->http_path,
+		    desc->http_query) == -1)
+			fatal("asprintf");
+		msg = replace_var(msg, "$REQUEST_URI", str);
+		free(str);
+		str = NULL;
+	}
+	if (strstr(msg, "$RESPONSE_CODE") != NULL) {
+		if (asprintf(&str, "%03u", code) == -1)
+			fatal("asprintf");
+		msg = replace_var(msg, "$RESPONSE_CODE", str);
+		free(str);
+		str = NULL;
+	}
+	if (strstr(msg, "$RESPONSE_URI") != NULL) {
+		memset(ibuf, 0, sizeof(ibuf));
+		if (uri != NULL && server_expand_http(clt, uri, ibuf,
+		    sizeof(ibuf)) == NULL)
+			goto err;
+
+		msg = replace_var(msg, "$RESPONSE_URI", ibuf);
+	}
+
+	return (msg);
+
+ err:
+	free(str);
+	free(msg);
+	return (NULL);
+}
+
+int
+server_notify_send(struct socket_notifier *notifier, const char *message)
+{
+	int			 fd;
+	struct timeval		*tv;
+	struct notify_message	 msg;
+	struct event_base	*evb;
+	struct event		 ev;
+
+	if ((fd = socket(AF_UNIX, SOCK_STREAM, 0)) == -1)
+		fatal("socket");
+
+	tv = &notifier->timeout;
+	if (timeval_isset(tv) &&
+	    setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, tv, sizeof(*tv)) == -1)
+		fatal("setsockopt");
+
+	if (connect(fd, (struct sockaddr *)&notifier->socket,
+	    sizeof(notifier->socket)) == -1) {
+		log_warn("failed connecting to notify socket at '%s'",
+		    notifier->socket.sun_path);
+		close(fd);
+		return (-1);
+	}
+
+	if ((evb = event_base_new()) == NULL)
+		fatal("event_base_new");
+	event_set(&ev, fd, EV_WRITE, &server_notify_write, &msg);
+	if (event_base_set(evb, &ev) == -1)
+		fatal("event_base_set");
+	if (event_add(&ev, timeval_isset(tv) ? tv : NULL) == -1)
+		fatal("event_add");
+
+	msg.str = message;
+	msg.size = strlen(message) + 1;
+	msg.n = 0;
+	msg.path = notifier->socket.sun_path;
+	msg.tv = tv;
+	msg.ev = &ev;
+
+	if (event_base_dispatch(evb) == -1)
+		fatal("event_base_dispatch");
+
+	event_base_free(evb);
+	close(fd);
+	return (0);
+}
+
+void
+server_notify_write(int fd, short event, void *arg)
+{
+	struct notify_message	*msg = arg;
+	struct event		*ev = msg->ev;
+	const char		*path = msg->path;
+	struct timeval		*tv = msg->tv;
+	size_t			 n, size;
+	ssize_t			 nw;
+
+	if (event == EV_TIMEOUT) {
+		log_warnx("timeout while writing to notify socket at '%s'",
+		    path);
+		event_del(ev);
+		return;
+	}
+	/* EV_WRITE */
+	n = msg->n;
+	size = msg->size;
+	if ((nw = send(fd, &msg->str[n], size - n, MSG_NOSIGNAL)) == -1) {
+		log_warn("failed writing to notify socket at '%s'", path);
+		event_del(ev);
+		return;
+	}
+	n += nw;
+	if (n == size || nw == 0) {
+		event_del(ev);
+		return;
+	}
+	event_del(ev);
+	if (event_add(ev, timeval_isset(tv) ? tv : NULL) == -1)
+		fatal("event_add");
+	msg->n = n;
 }
 
 const char *