httpd.c 67 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462
  1. /* vi: set sw=4 ts=4: */
  2. /*
  3. * httpd implementation for busybox
  4. *
  5. * Copyright (C) 2002,2003 Glenn Engel <glenne@engel.org>
  6. * Copyright (C) 2003-2006 Vladimir Oleynik <dzo@simtreas.ru>
  7. *
  8. * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  9. *
  10. *****************************************************************************
  11. *
  12. * Typical usage:
  13. * For non root user:
  14. * httpd -p 8080 -h $HOME/public_html
  15. * For daemon start from rc script with uid=0:
  16. * httpd -u www
  17. * which is equivalent to (assuming user www has uid 80):
  18. * httpd -p 80 -u 80 -h $PWD -c /etc/httpd.conf -r "Web Server Authentication"
  19. *
  20. * When an url starts with "/cgi-bin/" it is assumed to be a cgi script.
  21. * The server changes directory to the location of the script and executes it
  22. * after setting QUERY_STRING and other environment variables.
  23. *
  24. * Doc:
  25. * "CGI Environment Variables": http://hoohoo.ncsa.uiuc.edu/cgi/env.html
  26. *
  27. * The applet can also be invoked as an url arg decoder and html text encoder
  28. * as follows:
  29. * foo=`httpd -d $foo` # decode "Hello%20World" as "Hello World"
  30. * bar=`httpd -e "<Hello World>"` # encode as "&#60Hello&#32World&#62"
  31. * Note that url encoding for arguments is not the same as html encoding for
  32. * presentation. -d decodes an url-encoded argument while -e encodes in html
  33. * for page display.
  34. *
  35. * httpd.conf has the following format:
  36. *
  37. * H:/serverroot # define the server root. It will override -h
  38. * A:172.20. # Allow address from 172.20.0.0/16
  39. * A:10.0.0.0/25 # Allow any address from 10.0.0.0-10.0.0.127
  40. * A:10.0.0.0/255.255.255.128 # Allow any address that previous set
  41. * A:127.0.0.1 # Allow local loopback connections
  42. * D:* # Deny from other IP connections
  43. * E404:/path/e404.html # /path/e404.html is the 404 (not found) error page
  44. * I:index.html # Show index.html when a directory is requested
  45. *
  46. * P:/url:[http://]hostname[:port]/new/path
  47. * # When /urlXXXXXX is requested, reverse proxy
  48. * # it to http://hostname[:port]/new/pathXXXXXX
  49. *
  50. * /cgi-bin:foo:bar # Require user foo, pwd bar on urls starting with /cgi-bin/
  51. * /adm:admin:setup # Require user admin, pwd setup on urls starting with /adm/
  52. * /adm:toor:PaSsWd # or user toor, pwd PaSsWd on urls starting with /adm/
  53. * .au:audio/basic # additional mime type for audio.au files
  54. * *.php:/path/php # run xxx.php through an interpreter
  55. *
  56. * A/D may be as a/d or allow/deny - only first char matters.
  57. * Deny/Allow IP logic:
  58. * - Default is to allow all (Allow all (A:*) is a no-op).
  59. * - Deny rules take precedence over allow rules.
  60. * - "Deny all" rule (D:*) is applied last.
  61. *
  62. * Example:
  63. * 1. Allow only specified addresses
  64. * A:172.20 # Allow any address that begins with 172.20.
  65. * A:10.10. # Allow any address that begins with 10.10.
  66. * A:127.0.0.1 # Allow local loopback connections
  67. * D:* # Deny from other IP connections
  68. *
  69. * 2. Only deny specified addresses
  70. * D:1.2.3. # deny from 1.2.3.0 - 1.2.3.255
  71. * D:2.3.4. # deny from 2.3.4.0 - 2.3.4.255
  72. * A:* # (optional line added for clarity)
  73. *
  74. * If a sub directory contains a config file it is parsed and merged with
  75. * any existing settings as if it was appended to the original configuration.
  76. *
  77. * subdir paths are relative to the containing subdir and thus cannot
  78. * affect the parent rules.
  79. *
  80. * Note that since the sub dir is parsed in the forked thread servicing the
  81. * subdir http request, any merge is discarded when the process exits. As a
  82. * result, the subdir settings only have a lifetime of a single request.
  83. *
  84. * Custom error pages can contain an absolute path or be relative to
  85. * 'home_httpd'. Error pages are to be static files (no CGI or script). Error
  86. * page can only be defined in the root configuration file and are not taken
  87. * into account in local (directories) config files.
  88. *
  89. * If -c is not set, an attempt will be made to open the default
  90. * root configuration file. If -c is set and the file is not found, the
  91. * server exits with an error.
  92. *
  93. */
  94. /* TODO: use TCP_CORK, parse_config() */
  95. #include "libbb.h"
  96. #if ENABLE_FEATURE_HTTPD_USE_SENDFILE
  97. # include <sys/sendfile.h>
  98. #endif
  99. /* amount of buffering in a pipe */
  100. #ifndef PIPE_BUF
  101. # define PIPE_BUF 4096
  102. #endif
  103. #define DEBUG 0
  104. #define IOBUF_SIZE 8192
  105. #if PIPE_BUF >= IOBUF_SIZE
  106. # error "PIPE_BUF >= IOBUF_SIZE"
  107. #endif
  108. #define HEADER_READ_TIMEOUT 60
  109. static const char DEFAULT_PATH_HTTPD_CONF[] ALIGN1 = "/etc";
  110. static const char HTTPD_CONF[] ALIGN1 = "httpd.conf";
  111. static const char HTTP_200[] ALIGN1 = "HTTP/1.0 200 OK\r\n";
  112. static const char index_html[] ALIGN1 = "index.html";
  113. typedef struct has_next_ptr {
  114. struct has_next_ptr *next;
  115. } has_next_ptr;
  116. /* Must have "next" as a first member */
  117. typedef struct Htaccess {
  118. struct Htaccess *next;
  119. char *after_colon;
  120. char before_colon[1]; /* really bigger, must be last */
  121. } Htaccess;
  122. /* Must have "next" as a first member */
  123. typedef struct Htaccess_IP {
  124. struct Htaccess_IP *next;
  125. unsigned ip;
  126. unsigned mask;
  127. int allow_deny;
  128. } Htaccess_IP;
  129. /* Must have "next" as a first member */
  130. typedef struct Htaccess_Proxy {
  131. struct Htaccess_Proxy *next;
  132. char *url_from;
  133. char *host_port;
  134. char *url_to;
  135. } Htaccess_Proxy;
  136. enum {
  137. HTTP_OK = 200,
  138. HTTP_PARTIAL_CONTENT = 206,
  139. HTTP_MOVED_TEMPORARILY = 302,
  140. HTTP_BAD_REQUEST = 400, /* malformed syntax */
  141. HTTP_UNAUTHORIZED = 401, /* authentication needed, respond with auth hdr */
  142. HTTP_NOT_FOUND = 404,
  143. HTTP_FORBIDDEN = 403,
  144. HTTP_REQUEST_TIMEOUT = 408,
  145. HTTP_NOT_IMPLEMENTED = 501, /* used for unrecognized requests */
  146. HTTP_INTERNAL_SERVER_ERROR = 500,
  147. HTTP_CONTINUE = 100,
  148. #if 0 /* future use */
  149. HTTP_SWITCHING_PROTOCOLS = 101,
  150. HTTP_CREATED = 201,
  151. HTTP_ACCEPTED = 202,
  152. HTTP_NON_AUTHORITATIVE_INFO = 203,
  153. HTTP_NO_CONTENT = 204,
  154. HTTP_MULTIPLE_CHOICES = 300,
  155. HTTP_MOVED_PERMANENTLY = 301,
  156. HTTP_NOT_MODIFIED = 304,
  157. HTTP_PAYMENT_REQUIRED = 402,
  158. HTTP_BAD_GATEWAY = 502,
  159. HTTP_SERVICE_UNAVAILABLE = 503, /* overload, maintenance */
  160. #endif
  161. };
  162. static const uint16_t http_response_type[] ALIGN2 = {
  163. HTTP_OK,
  164. #if ENABLE_FEATURE_HTTPD_RANGES
  165. HTTP_PARTIAL_CONTENT,
  166. #endif
  167. HTTP_MOVED_TEMPORARILY,
  168. HTTP_REQUEST_TIMEOUT,
  169. HTTP_NOT_IMPLEMENTED,
  170. #if ENABLE_FEATURE_HTTPD_BASIC_AUTH
  171. HTTP_UNAUTHORIZED,
  172. #endif
  173. HTTP_NOT_FOUND,
  174. HTTP_BAD_REQUEST,
  175. HTTP_FORBIDDEN,
  176. HTTP_INTERNAL_SERVER_ERROR,
  177. #if 0 /* not implemented */
  178. HTTP_CREATED,
  179. HTTP_ACCEPTED,
  180. HTTP_NO_CONTENT,
  181. HTTP_MULTIPLE_CHOICES,
  182. HTTP_MOVED_PERMANENTLY,
  183. HTTP_NOT_MODIFIED,
  184. HTTP_BAD_GATEWAY,
  185. HTTP_SERVICE_UNAVAILABLE,
  186. #endif
  187. };
  188. static const struct {
  189. const char *name;
  190. const char *info;
  191. } http_response[ARRAY_SIZE(http_response_type)] = {
  192. { "OK", NULL },
  193. #if ENABLE_FEATURE_HTTPD_RANGES
  194. { "Partial Content", NULL },
  195. #endif
  196. { "Found", NULL },
  197. { "Request Timeout", "No request appeared within 60 seconds" },
  198. { "Not Implemented", "The requested method is not recognized" },
  199. #if ENABLE_FEATURE_HTTPD_BASIC_AUTH
  200. { "Unauthorized", "" },
  201. #endif
  202. { "Not Found", "The requested URL was not found" },
  203. { "Bad Request", "Unsupported method" },
  204. { "Forbidden", "" },
  205. { "Internal Server Error", "Internal Server Error" },
  206. #if 0 /* not implemented */
  207. { "Created" },
  208. { "Accepted" },
  209. { "No Content" },
  210. { "Multiple Choices" },
  211. { "Moved Permanently" },
  212. { "Not Modified" },
  213. { "Bad Gateway", "" },
  214. { "Service Unavailable", "" },
  215. #endif
  216. };
  217. struct globals {
  218. int verbose; /* must be int (used by getopt32) */
  219. smallint flg_deny_all;
  220. unsigned rmt_ip; /* used for IP-based allow/deny rules */
  221. time_t last_mod;
  222. char *rmt_ip_str; /* for $REMOTE_ADDR and $REMOTE_PORT */
  223. const char *bind_addr_or_port;
  224. const char *g_query;
  225. const char *opt_c_configFile;
  226. const char *home_httpd;
  227. const char *index_page;
  228. const char *found_mime_type;
  229. const char *found_moved_temporarily;
  230. Htaccess_IP *ip_a_d; /* config allow/deny lines */
  231. IF_FEATURE_HTTPD_BASIC_AUTH(const char *g_realm;)
  232. IF_FEATURE_HTTPD_BASIC_AUTH(char *remoteuser;)
  233. IF_FEATURE_HTTPD_CGI(char *referer;)
  234. IF_FEATURE_HTTPD_CGI(char *user_agent;)
  235. IF_FEATURE_HTTPD_CGI(char *host;)
  236. IF_FEATURE_HTTPD_CGI(char *http_accept;)
  237. IF_FEATURE_HTTPD_CGI(char *http_accept_language;)
  238. off_t file_size; /* -1 - unknown */
  239. #if ENABLE_FEATURE_HTTPD_RANGES
  240. off_t range_start;
  241. off_t range_end;
  242. off_t range_len;
  243. #endif
  244. #if ENABLE_FEATURE_HTTPD_BASIC_AUTH
  245. Htaccess *g_auth; /* config user:password lines */
  246. #endif
  247. Htaccess *mime_a; /* config mime types */
  248. #if ENABLE_FEATURE_HTTPD_CONFIG_WITH_SCRIPT_INTERPR
  249. Htaccess *script_i; /* config script interpreters */
  250. #endif
  251. char *iobuf; /* [IOBUF_SIZE] */
  252. #define hdr_buf bb_common_bufsiz1
  253. char *hdr_ptr;
  254. int hdr_cnt;
  255. #if ENABLE_FEATURE_HTTPD_ERROR_PAGES
  256. const char *http_error_page[ARRAY_SIZE(http_response_type)];
  257. #endif
  258. #if ENABLE_FEATURE_HTTPD_PROXY
  259. Htaccess_Proxy *proxy;
  260. #endif
  261. #if ENABLE_FEATURE_HTTPD_GZIP
  262. /* client can handle gzip / we are going to send gzip */
  263. smallint content_gzip;
  264. #endif
  265. };
  266. #define G (*ptr_to_globals)
  267. #define verbose (G.verbose )
  268. #define flg_deny_all (G.flg_deny_all )
  269. #define rmt_ip (G.rmt_ip )
  270. #define bind_addr_or_port (G.bind_addr_or_port)
  271. #define g_query (G.g_query )
  272. #define opt_c_configFile (G.opt_c_configFile )
  273. #define home_httpd (G.home_httpd )
  274. #define index_page (G.index_page )
  275. #define found_mime_type (G.found_mime_type )
  276. #define found_moved_temporarily (G.found_moved_temporarily)
  277. #define last_mod (G.last_mod )
  278. #define ip_a_d (G.ip_a_d )
  279. #define g_realm (G.g_realm )
  280. #define remoteuser (G.remoteuser )
  281. #define referer (G.referer )
  282. #define user_agent (G.user_agent )
  283. #define host (G.host )
  284. #define http_accept (G.http_accept )
  285. #define http_accept_language (G.http_accept_language)
  286. #define file_size (G.file_size )
  287. #if ENABLE_FEATURE_HTTPD_RANGES
  288. #define range_start (G.range_start )
  289. #define range_end (G.range_end )
  290. #define range_len (G.range_len )
  291. #else
  292. enum {
  293. range_start = 0,
  294. range_end = MAXINT(off_t) - 1,
  295. range_len = MAXINT(off_t),
  296. };
  297. #endif
  298. #define rmt_ip_str (G.rmt_ip_str )
  299. #define g_auth (G.g_auth )
  300. #define mime_a (G.mime_a )
  301. #define script_i (G.script_i )
  302. #define iobuf (G.iobuf )
  303. #define hdr_ptr (G.hdr_ptr )
  304. #define hdr_cnt (G.hdr_cnt )
  305. #define http_error_page (G.http_error_page )
  306. #define proxy (G.proxy )
  307. #if ENABLE_FEATURE_HTTPD_GZIP
  308. # define content_gzip (G.content_gzip )
  309. #else
  310. # define content_gzip 0
  311. #endif
  312. #define INIT_G() do { \
  313. SET_PTR_TO_GLOBALS(xzalloc(sizeof(G))); \
  314. IF_FEATURE_HTTPD_BASIC_AUTH(g_realm = "Web Server Authentication";) \
  315. bind_addr_or_port = "80"; \
  316. index_page = index_html; \
  317. file_size = -1; \
  318. } while (0)
  319. #define STRNCASECMP(a, str) strncasecmp((a), (str), sizeof(str)-1)
  320. /* Prototypes */
  321. enum {
  322. SEND_HEADERS = (1 << 0),
  323. SEND_BODY = (1 << 1),
  324. SEND_HEADERS_AND_BODY = SEND_HEADERS + SEND_BODY,
  325. };
  326. static void send_file_and_exit(const char *url, int what) NORETURN;
  327. static void free_llist(has_next_ptr **pptr)
  328. {
  329. has_next_ptr *cur = *pptr;
  330. while (cur) {
  331. has_next_ptr *t = cur;
  332. cur = cur->next;
  333. free(t);
  334. }
  335. *pptr = NULL;
  336. }
  337. static ALWAYS_INLINE void free_Htaccess_list(Htaccess **pptr)
  338. {
  339. free_llist((has_next_ptr**)pptr);
  340. }
  341. static ALWAYS_INLINE void free_Htaccess_IP_list(Htaccess_IP **pptr)
  342. {
  343. free_llist((has_next_ptr**)pptr);
  344. }
  345. /* Returns presumed mask width in bits or < 0 on error.
  346. * Updates strp, stores IP at provided pointer */
  347. static int scan_ip(const char **strp, unsigned *ipp, unsigned char endc)
  348. {
  349. const char *p = *strp;
  350. int auto_mask = 8;
  351. unsigned ip = 0;
  352. int j;
  353. if (*p == '/')
  354. return -auto_mask;
  355. for (j = 0; j < 4; j++) {
  356. unsigned octet;
  357. if ((*p < '0' || *p > '9') && *p != '/' && *p)
  358. return -auto_mask;
  359. octet = 0;
  360. while (*p >= '0' && *p <= '9') {
  361. octet *= 10;
  362. octet += *p - '0';
  363. if (octet > 255)
  364. return -auto_mask;
  365. p++;
  366. }
  367. if (*p == '.')
  368. p++;
  369. if (*p != '/' && *p)
  370. auto_mask += 8;
  371. ip = (ip << 8) | octet;
  372. }
  373. if (*p) {
  374. if (*p != endc)
  375. return -auto_mask;
  376. p++;
  377. if (*p == '\0')
  378. return -auto_mask;
  379. }
  380. *ipp = ip;
  381. *strp = p;
  382. return auto_mask;
  383. }
  384. /* Returns 0 on success. Stores IP and mask at provided pointers */
  385. static int scan_ip_mask(const char *str, unsigned *ipp, unsigned *maskp)
  386. {
  387. int i;
  388. unsigned mask;
  389. char *p;
  390. i = scan_ip(&str, ipp, '/');
  391. if (i < 0)
  392. return i;
  393. if (*str) {
  394. /* there is /xxx after dotted-IP address */
  395. i = bb_strtou(str, &p, 10);
  396. if (*p == '.') {
  397. /* 'xxx' itself is dotted-IP mask, parse it */
  398. /* (return 0 (success) only if it has N.N.N.N form) */
  399. return scan_ip(&str, maskp, '\0') - 32;
  400. }
  401. if (*p)
  402. return -1;
  403. }
  404. if (i > 32)
  405. return -1;
  406. if (sizeof(unsigned) == 4 && i == 32) {
  407. /* mask >>= 32 below may not work */
  408. mask = 0;
  409. } else {
  410. mask = 0xffffffff;
  411. mask >>= i;
  412. }
  413. /* i == 0 -> *maskp = 0x00000000
  414. * i == 1 -> *maskp = 0x80000000
  415. * i == 4 -> *maskp = 0xf0000000
  416. * i == 31 -> *maskp = 0xfffffffe
  417. * i == 32 -> *maskp = 0xffffffff */
  418. *maskp = (uint32_t)(~mask);
  419. return 0;
  420. }
  421. /*
  422. * Parse configuration file into in-memory linked list.
  423. *
  424. * Any previous IP rules are discarded.
  425. * If the flag argument is not SUBDIR_PARSE then all /path and mime rules
  426. * are also discarded. That is, previous settings are retained if flag is
  427. * SUBDIR_PARSE.
  428. * Error pages are only parsed on the main config file.
  429. *
  430. * path Path where to look for httpd.conf (without filename).
  431. * flag Type of the parse request.
  432. */
  433. /* flag param: */
  434. enum {
  435. FIRST_PARSE = 0, /* path will be "/etc" */
  436. SIGNALED_PARSE = 1, /* path will be "/etc" */
  437. SUBDIR_PARSE = 2, /* path will be derived from URL */
  438. };
  439. static void parse_conf(const char *path, int flag)
  440. {
  441. /* internally used extra flag state */
  442. enum { TRY_CURDIR_PARSE = 3 };
  443. FILE *f;
  444. const char *filename;
  445. char buf[160];
  446. /* discard old rules */
  447. free_Htaccess_IP_list(&ip_a_d);
  448. flg_deny_all = 0;
  449. /* retain previous auth and mime config only for subdir parse */
  450. if (flag != SUBDIR_PARSE) {
  451. free_Htaccess_list(&mime_a);
  452. #if ENABLE_FEATURE_HTTPD_BASIC_AUTH
  453. free_Htaccess_list(&g_auth);
  454. #endif
  455. #if ENABLE_FEATURE_HTTPD_CONFIG_WITH_SCRIPT_INTERPR
  456. free_Htaccess_list(&script_i);
  457. #endif
  458. }
  459. filename = opt_c_configFile;
  460. if (flag == SUBDIR_PARSE || filename == NULL) {
  461. filename = alloca(strlen(path) + sizeof(HTTPD_CONF) + 2);
  462. sprintf((char *)filename, "%s/%s", path, HTTPD_CONF);
  463. }
  464. while ((f = fopen_for_read(filename)) == NULL) {
  465. if (flag >= SUBDIR_PARSE) { /* SUBDIR or TRY_CURDIR */
  466. /* config file not found, no changes to config */
  467. return;
  468. }
  469. if (flag == FIRST_PARSE) {
  470. /* -c CONFFILE given, but CONFFILE doesn't exist? */
  471. if (opt_c_configFile)
  472. bb_simple_perror_msg_and_die(opt_c_configFile);
  473. /* else: no -c, thus we looked at /etc/httpd.conf,
  474. * and it's not there. try ./httpd.conf: */
  475. }
  476. flag = TRY_CURDIR_PARSE;
  477. filename = HTTPD_CONF;
  478. }
  479. #if ENABLE_FEATURE_HTTPD_BASIC_AUTH
  480. /* in "/file:user:pass" lines, we prepend path in subdirs */
  481. if (flag != SUBDIR_PARSE)
  482. path = "";
  483. #endif
  484. /* The lines can be:
  485. *
  486. * I:default_index_file
  487. * H:http_home
  488. * [AD]:IP[/mask] # allow/deny, * for wildcard
  489. * Ennn:error.html # error page for status nnn
  490. * P:/url:[http://]hostname[:port]/new/path # reverse proxy
  491. * .ext:mime/type # mime type
  492. * *.php:/path/php # run xxx.php through an interpreter
  493. * /file:user:pass # username and password
  494. */
  495. while (fgets(buf, sizeof(buf), f) != NULL) {
  496. unsigned strlen_buf;
  497. unsigned char ch;
  498. char *after_colon;
  499. { /* remove all whitespace, and # comments */
  500. char *p, *p0;
  501. p0 = buf;
  502. /* skip non-whitespace beginning. Often the whole line
  503. * is non-whitespace. We want this case to work fast,
  504. * without needless copying, therefore we don't merge
  505. * this operation into next while loop. */
  506. while ((ch = *p0) != '\0' && ch != '\n' && ch != '#'
  507. && ch != ' ' && ch != '\t'
  508. ) {
  509. p0++;
  510. }
  511. p = p0;
  512. /* if we enter this loop, we have some whitespace.
  513. * discard it */
  514. while (ch != '\0' && ch != '\n' && ch != '#') {
  515. if (ch != ' ' && ch != '\t') {
  516. *p++ = ch;
  517. }
  518. ch = *++p0;
  519. }
  520. *p = '\0';
  521. strlen_buf = p - buf;
  522. if (strlen_buf == 0)
  523. continue; /* empty line */
  524. }
  525. after_colon = strchr(buf, ':');
  526. /* strange line? */
  527. if (after_colon == NULL || *++after_colon == '\0')
  528. goto config_error;
  529. ch = (buf[0] & ~0x20); /* toupper if it's a letter */
  530. if (ch == 'I') {
  531. if (index_page != index_html)
  532. free((char*)index_page);
  533. index_page = xstrdup(after_colon);
  534. continue;
  535. }
  536. /* do not allow jumping around using H in subdir's configs */
  537. if (flag == FIRST_PARSE && ch == 'H') {
  538. home_httpd = xstrdup(after_colon);
  539. xchdir(home_httpd);
  540. continue;
  541. }
  542. if (ch == 'A' || ch == 'D') {
  543. Htaccess_IP *pip;
  544. if (*after_colon == '*') {
  545. if (ch == 'D') {
  546. /* memorize "deny all" */
  547. flg_deny_all = 1;
  548. }
  549. /* skip assumed "A:*", it is a default anyway */
  550. continue;
  551. }
  552. /* store "allow/deny IP/mask" line */
  553. pip = xzalloc(sizeof(*pip));
  554. if (scan_ip_mask(after_colon, &pip->ip, &pip->mask)) {
  555. /* IP{/mask} syntax error detected, protect all */
  556. ch = 'D';
  557. pip->mask = 0;
  558. }
  559. pip->allow_deny = ch;
  560. if (ch == 'D') {
  561. /* Deny:from_IP - prepend */
  562. pip->next = ip_a_d;
  563. ip_a_d = pip;
  564. } else {
  565. /* A:from_IP - append (thus all D's precedes A's) */
  566. Htaccess_IP *prev_IP = ip_a_d;
  567. if (prev_IP == NULL) {
  568. ip_a_d = pip;
  569. } else {
  570. while (prev_IP->next)
  571. prev_IP = prev_IP->next;
  572. prev_IP->next = pip;
  573. }
  574. }
  575. continue;
  576. }
  577. #if ENABLE_FEATURE_HTTPD_ERROR_PAGES
  578. if (flag == FIRST_PARSE && ch == 'E') {
  579. unsigned i;
  580. int status = atoi(buf + 1); /* error status code */
  581. if (status < HTTP_CONTINUE) {
  582. goto config_error;
  583. }
  584. /* then error page; find matching status */
  585. for (i = 0; i < ARRAY_SIZE(http_response_type); i++) {
  586. if (http_response_type[i] == status) {
  587. /* We chdir to home_httpd, thus no need to
  588. * concat_path_file(home_httpd, after_colon)
  589. * here */
  590. http_error_page[i] = xstrdup(after_colon);
  591. break;
  592. }
  593. }
  594. continue;
  595. }
  596. #endif
  597. #if ENABLE_FEATURE_HTTPD_PROXY
  598. if (flag == FIRST_PARSE && ch == 'P') {
  599. /* P:/url:[http://]hostname[:port]/new/path */
  600. char *url_from, *host_port, *url_to;
  601. Htaccess_Proxy *proxy_entry;
  602. url_from = after_colon;
  603. host_port = strchr(after_colon, ':');
  604. if (host_port == NULL) {
  605. goto config_error;
  606. }
  607. *host_port++ = '\0';
  608. if (strncmp(host_port, "http://", 7) == 0)
  609. host_port += 7;
  610. if (*host_port == '\0') {
  611. goto config_error;
  612. }
  613. url_to = strchr(host_port, '/');
  614. if (url_to == NULL) {
  615. goto config_error;
  616. }
  617. *url_to = '\0';
  618. proxy_entry = xzalloc(sizeof(*proxy_entry));
  619. proxy_entry->url_from = xstrdup(url_from);
  620. proxy_entry->host_port = xstrdup(host_port);
  621. *url_to = '/';
  622. proxy_entry->url_to = xstrdup(url_to);
  623. proxy_entry->next = proxy;
  624. proxy = proxy_entry;
  625. continue;
  626. }
  627. #endif
  628. /* the rest of directives are non-alphabetic,
  629. * must avoid using "toupper'ed" ch */
  630. ch = buf[0];
  631. if (ch == '.' /* ".ext:mime/type" */
  632. #if ENABLE_FEATURE_HTTPD_CONFIG_WITH_SCRIPT_INTERPR
  633. || (ch == '*' && buf[1] == '.') /* "*.php:/path/php" */
  634. #endif
  635. ) {
  636. char *p;
  637. Htaccess *cur;
  638. cur = xzalloc(sizeof(*cur) /* includes space for NUL */ + strlen_buf);
  639. strcpy(cur->before_colon, buf);
  640. p = cur->before_colon + (after_colon - buf);
  641. p[-1] = '\0';
  642. cur->after_colon = p;
  643. if (ch == '.') {
  644. /* .mime line: prepend to mime_a list */
  645. cur->next = mime_a;
  646. mime_a = cur;
  647. }
  648. #if ENABLE_FEATURE_HTTPD_CONFIG_WITH_SCRIPT_INTERPR
  649. else {
  650. /* script interpreter line: prepend to script_i list */
  651. cur->next = script_i;
  652. script_i = cur;
  653. }
  654. #endif
  655. continue;
  656. }
  657. #if ENABLE_FEATURE_HTTPD_BASIC_AUTH
  658. if (ch == '/') { /* "/file:user:pass" */
  659. char *p;
  660. Htaccess *cur;
  661. unsigned file_len;
  662. /* note: path is "" unless we are in SUBDIR parse,
  663. * otherwise it does NOT start with "/" */
  664. cur = xzalloc(sizeof(*cur) /* includes space for NUL */
  665. + 1 + strlen(path)
  666. + strlen_buf
  667. );
  668. /* form "/path/file" */
  669. sprintf(cur->before_colon, "/%s%.*s",
  670. path,
  671. (int) (after_colon - buf - 1), /* includes "/", but not ":" */
  672. buf);
  673. /* canonicalize it */
  674. p = bb_simplify_abs_path_inplace(cur->before_colon);
  675. file_len = p - cur->before_colon;
  676. /* add "user:pass" after NUL */
  677. strcpy(++p, after_colon);
  678. cur->after_colon = p;
  679. /* insert cur into g_auth */
  680. /* g_auth is sorted by decreased filename length */
  681. {
  682. Htaccess *auth, **authp;
  683. authp = &g_auth;
  684. while ((auth = *authp) != NULL) {
  685. if (file_len >= strlen(auth->before_colon)) {
  686. /* insert cur before auth */
  687. cur->next = auth;
  688. break;
  689. }
  690. authp = &auth->next;
  691. }
  692. *authp = cur;
  693. }
  694. continue;
  695. }
  696. #endif /* BASIC_AUTH */
  697. /* the line is not recognized */
  698. config_error:
  699. bb_error_msg("config error '%s' in '%s'", buf, filename);
  700. } /* while (fgets) */
  701. fclose(f);
  702. }
  703. #if ENABLE_FEATURE_HTTPD_ENCODE_URL_STR
  704. /*
  705. * Given a string, html-encode special characters.
  706. * This is used for the -e command line option to provide an easy way
  707. * for scripts to encode result data without confusing browsers. The
  708. * returned string pointer is memory allocated by malloc().
  709. *
  710. * Returns a pointer to the encoded string (malloced).
  711. */
  712. static char *encodeString(const char *string)
  713. {
  714. /* take the simple route and encode everything */
  715. /* could possibly scan once to get length. */
  716. int len = strlen(string);
  717. char *out = xmalloc(len * 6 + 1);
  718. char *p = out;
  719. char ch;
  720. while ((ch = *string++) != '\0') {
  721. /* very simple check for what to encode */
  722. if (isalnum(ch))
  723. *p++ = ch;
  724. else
  725. p += sprintf(p, "&#%d;", (unsigned char) ch);
  726. }
  727. *p = '\0';
  728. return out;
  729. }
  730. #endif
  731. /*
  732. * Given a URL encoded string, convert it to plain ascii.
  733. * Since decoding always makes strings smaller, the decode is done in-place.
  734. * Thus, callers should xstrdup() the argument if they do not want the
  735. * argument modified. The return is the original pointer, allowing this
  736. * function to be easily used as arguments to other functions.
  737. *
  738. * string The first string to decode.
  739. * option_d 1 if called for httpd -d
  740. *
  741. * Returns a pointer to the decoded string (same as input).
  742. */
  743. static unsigned hex_to_bin(unsigned char c)
  744. {
  745. unsigned v;
  746. v = c - '0';
  747. if (v <= 9)
  748. return v;
  749. /* c | 0x20: letters to lower case, non-letters
  750. * to (potentially different) non-letters */
  751. v = (unsigned)(c | 0x20) - 'a';
  752. if (v <= 5)
  753. return v + 10;
  754. return ~0;
  755. /* For testing:
  756. void t(char c) { printf("'%c'(%u) %u\n", c, c, hex_to_bin(c)); }
  757. int main() { t(0x10); t(0x20); t('0'); t('9'); t('A'); t('F'); t('a'); t('f');
  758. t('0'-1); t('9'+1); t('A'-1); t('F'+1); t('a'-1); t('f'+1); return 0; }
  759. */
  760. }
  761. static char *decodeString(char *orig, int option_d)
  762. {
  763. /* note that decoded string is always shorter than original */
  764. char *string = orig;
  765. char *ptr = string;
  766. char c;
  767. while ((c = *ptr++) != '\0') {
  768. unsigned v;
  769. if (option_d && c == '+') {
  770. *string++ = ' ';
  771. continue;
  772. }
  773. if (c != '%') {
  774. *string++ = c;
  775. continue;
  776. }
  777. v = hex_to_bin(ptr[0]);
  778. if (v > 15) {
  779. bad_hex:
  780. if (!option_d)
  781. return NULL;
  782. *string++ = '%';
  783. continue;
  784. }
  785. v = (v * 16) | hex_to_bin(ptr[1]);
  786. if (v > 255)
  787. goto bad_hex;
  788. if (!option_d && (v == '/' || v == '\0')) {
  789. /* caller takes it as indication of invalid
  790. * (dangerous wrt exploits) chars */
  791. return orig + 1;
  792. }
  793. *string++ = v;
  794. ptr += 2;
  795. }
  796. *string = '\0';
  797. return orig;
  798. }
  799. #if ENABLE_FEATURE_HTTPD_BASIC_AUTH
  800. /*
  801. * Decode a base64 data stream as per rfc1521.
  802. * Note that the rfc states that non base64 chars are to be ignored.
  803. * Since the decode always results in a shorter size than the input,
  804. * it is OK to pass the input arg as an output arg.
  805. * Parameter: a pointer to a base64 encoded string.
  806. * Decoded data is stored in-place.
  807. */
  808. static void decodeBase64(char *Data)
  809. {
  810. const unsigned char *in = (const unsigned char *)Data;
  811. /* The decoded size will be at most 3/4 the size of the encoded */
  812. unsigned ch = 0;
  813. int i = 0;
  814. while (*in) {
  815. int t = *in++;
  816. if (t >= '0' && t <= '9')
  817. t = t - '0' + 52;
  818. else if (t >= 'A' && t <= 'Z')
  819. t = t - 'A';
  820. else if (t >= 'a' && t <= 'z')
  821. t = t - 'a' + 26;
  822. else if (t == '+')
  823. t = 62;
  824. else if (t == '/')
  825. t = 63;
  826. else if (t == '=')
  827. t = 0;
  828. else
  829. continue;
  830. ch = (ch << 6) | t;
  831. i++;
  832. if (i == 4) {
  833. *Data++ = (char) (ch >> 16);
  834. *Data++ = (char) (ch >> 8);
  835. *Data++ = (char) ch;
  836. i = 0;
  837. }
  838. }
  839. *Data = '\0';
  840. }
  841. #endif
  842. /*
  843. * Create a listen server socket on the designated port.
  844. */
  845. static int openServer(void)
  846. {
  847. unsigned n = bb_strtou(bind_addr_or_port, NULL, 10);
  848. if (!errno && n && n <= 0xffff)
  849. n = create_and_bind_stream_or_die(NULL, n);
  850. else
  851. n = create_and_bind_stream_or_die(bind_addr_or_port, 80);
  852. xlisten(n, 9);
  853. return n;
  854. }
  855. /*
  856. * Log the connection closure and exit.
  857. */
  858. static void log_and_exit(void) NORETURN;
  859. static void log_and_exit(void)
  860. {
  861. /* Paranoia. IE said to be buggy. It may send some extra data
  862. * or be confused by us just exiting without SHUT_WR. Oh well. */
  863. shutdown(1, SHUT_WR);
  864. /* Why??
  865. (this also messes up stdin when user runs httpd -i from terminal)
  866. ndelay_on(0);
  867. while (read(STDIN_FILENO, iobuf, IOBUF_SIZE) > 0)
  868. continue;
  869. */
  870. if (verbose > 2)
  871. bb_error_msg("closed");
  872. _exit(xfunc_error_retval);
  873. }
  874. /*
  875. * Create and send HTTP response headers.
  876. * The arguments are combined and sent as one write operation. Note that
  877. * IE will puke big-time if the headers are not sent in one packet and the
  878. * second packet is delayed for any reason.
  879. * responseNum - the result code to send.
  880. */
  881. static void send_headers(int responseNum)
  882. {
  883. static const char RFC1123FMT[] ALIGN1 = "%a, %d %b %Y %H:%M:%S GMT";
  884. const char *responseString = "";
  885. const char *infoString = NULL;
  886. const char *mime_type;
  887. #if ENABLE_FEATURE_HTTPD_ERROR_PAGES
  888. const char *error_page = NULL;
  889. #endif
  890. unsigned i;
  891. time_t timer = time(NULL);
  892. char tmp_str[80];
  893. int len;
  894. for (i = 0; i < ARRAY_SIZE(http_response_type); i++) {
  895. if (http_response_type[i] == responseNum) {
  896. responseString = http_response[i].name;
  897. infoString = http_response[i].info;
  898. #if ENABLE_FEATURE_HTTPD_ERROR_PAGES
  899. error_page = http_error_page[i];
  900. #endif
  901. break;
  902. }
  903. }
  904. /* error message is HTML */
  905. mime_type = responseNum == HTTP_OK ?
  906. found_mime_type : "text/html";
  907. if (verbose)
  908. bb_error_msg("response:%u", responseNum);
  909. /* emit the current date */
  910. strftime(tmp_str, sizeof(tmp_str), RFC1123FMT, gmtime(&timer));
  911. len = sprintf(iobuf,
  912. "HTTP/1.0 %d %s\r\nContent-type: %s\r\n"
  913. "Date: %s\r\nConnection: close\r\n",
  914. responseNum, responseString, mime_type, tmp_str);
  915. #if ENABLE_FEATURE_HTTPD_BASIC_AUTH
  916. if (responseNum == HTTP_UNAUTHORIZED) {
  917. len += sprintf(iobuf + len,
  918. "WWW-Authenticate: Basic realm=\"%s\"\r\n",
  919. g_realm);
  920. }
  921. #endif
  922. if (responseNum == HTTP_MOVED_TEMPORARILY) {
  923. len += sprintf(iobuf + len, "Location: %s/%s%s\r\n",
  924. found_moved_temporarily,
  925. (g_query ? "?" : ""),
  926. (g_query ? g_query : ""));
  927. }
  928. #if ENABLE_FEATURE_HTTPD_ERROR_PAGES
  929. if (error_page && access(error_page, R_OK) == 0) {
  930. strcat(iobuf, "\r\n");
  931. len += 2;
  932. if (DEBUG)
  933. fprintf(stderr, "headers: '%s'\n", iobuf);
  934. full_write(STDOUT_FILENO, iobuf, len);
  935. if (DEBUG)
  936. fprintf(stderr, "writing error page: '%s'\n", error_page);
  937. return send_file_and_exit(error_page, SEND_BODY);
  938. }
  939. #endif
  940. if (file_size != -1) { /* file */
  941. strftime(tmp_str, sizeof(tmp_str), RFC1123FMT, gmtime(&last_mod));
  942. #if ENABLE_FEATURE_HTTPD_RANGES
  943. if (responseNum == HTTP_PARTIAL_CONTENT) {
  944. len += sprintf(iobuf + len, "Content-Range: bytes %"OFF_FMT"u-%"OFF_FMT"u/%"OFF_FMT"u\r\n",
  945. range_start,
  946. range_end,
  947. file_size);
  948. file_size = range_end - range_start + 1;
  949. }
  950. #endif
  951. len += sprintf(iobuf + len,
  952. #if ENABLE_FEATURE_HTTPD_RANGES
  953. "Accept-Ranges: bytes\r\n"
  954. #endif
  955. "Last-Modified: %s\r\n%s %"OFF_FMT"u\r\n",
  956. tmp_str,
  957. content_gzip ? "Transfer-length:" : "Content-length:",
  958. file_size
  959. );
  960. }
  961. if (content_gzip)
  962. len += sprintf(iobuf + len, "Content-Encoding: gzip\r\n");
  963. iobuf[len++] = '\r';
  964. iobuf[len++] = '\n';
  965. if (infoString) {
  966. len += sprintf(iobuf + len,
  967. "<HTML><HEAD><TITLE>%d %s</TITLE></HEAD>\n"
  968. "<BODY><H1>%d %s</H1>\n%s\n</BODY></HTML>\n",
  969. responseNum, responseString,
  970. responseNum, responseString, infoString);
  971. }
  972. if (DEBUG)
  973. fprintf(stderr, "headers: '%s'\n", iobuf);
  974. if (full_write(STDOUT_FILENO, iobuf, len) != len) {
  975. if (verbose > 1)
  976. bb_perror_msg("error");
  977. log_and_exit();
  978. }
  979. }
  980. static void send_headers_and_exit(int responseNum) NORETURN;
  981. static void send_headers_and_exit(int responseNum)
  982. {
  983. send_headers(responseNum);
  984. log_and_exit();
  985. }
  986. /*
  987. * Read from the socket until '\n' or EOF. '\r' chars are removed.
  988. * '\n' is replaced with NUL.
  989. * Return number of characters read or 0 if nothing is read
  990. * ('\r' and '\n' are not counted).
  991. * Data is returned in iobuf.
  992. */
  993. static int get_line(void)
  994. {
  995. int count = 0;
  996. char c;
  997. alarm(HEADER_READ_TIMEOUT);
  998. while (1) {
  999. if (hdr_cnt <= 0) {
  1000. hdr_cnt = safe_read(STDIN_FILENO, hdr_buf, sizeof(hdr_buf));
  1001. if (hdr_cnt <= 0)
  1002. break;
  1003. hdr_ptr = hdr_buf;
  1004. }
  1005. iobuf[count] = c = *hdr_ptr++;
  1006. hdr_cnt--;
  1007. if (c == '\r')
  1008. continue;
  1009. if (c == '\n') {
  1010. iobuf[count] = '\0';
  1011. break;
  1012. }
  1013. if (count < (IOBUF_SIZE - 1)) /* check overflow */
  1014. count++;
  1015. }
  1016. return count;
  1017. }
  1018. #if ENABLE_FEATURE_HTTPD_CGI || ENABLE_FEATURE_HTTPD_PROXY
  1019. /* gcc 4.2.1 fares better with NOINLINE */
  1020. static NOINLINE void cgi_io_loop_and_exit(int fromCgi_rd, int toCgi_wr, int post_len) NORETURN;
  1021. static NOINLINE void cgi_io_loop_and_exit(int fromCgi_rd, int toCgi_wr, int post_len)
  1022. {
  1023. enum { FROM_CGI = 1, TO_CGI = 2 }; /* indexes in pfd[] */
  1024. struct pollfd pfd[3];
  1025. int out_cnt; /* we buffer a bit of initial CGI output */
  1026. int count;
  1027. /* iobuf is used for CGI -> network data,
  1028. * hdr_buf is for network -> CGI data (POSTDATA) */
  1029. /* If CGI dies, we still want to correctly finish reading its output
  1030. * and send it to the peer. So please no SIGPIPEs! */
  1031. signal(SIGPIPE, SIG_IGN);
  1032. // We inconsistently handle a case when more POSTDATA from network
  1033. // is coming than we expected. We may give *some part* of that
  1034. // extra data to CGI.
  1035. //if (hdr_cnt > post_len) {
  1036. // /* We got more POSTDATA from network than we expected */
  1037. // hdr_cnt = post_len;
  1038. //}
  1039. post_len -= hdr_cnt;
  1040. /* post_len - number of POST bytes not yet read from network */
  1041. /* NB: breaking out of this loop jumps to log_and_exit() */
  1042. out_cnt = 0;
  1043. while (1) {
  1044. memset(pfd, 0, sizeof(pfd));
  1045. pfd[FROM_CGI].fd = fromCgi_rd;
  1046. pfd[FROM_CGI].events = POLLIN;
  1047. if (toCgi_wr) {
  1048. pfd[TO_CGI].fd = toCgi_wr;
  1049. if (hdr_cnt > 0) {
  1050. pfd[TO_CGI].events = POLLOUT;
  1051. } else if (post_len > 0) {
  1052. pfd[0].events = POLLIN;
  1053. } else {
  1054. /* post_len <= 0 && hdr_cnt <= 0:
  1055. * no more POST data to CGI,
  1056. * let CGI see EOF on CGI's stdin */
  1057. if (toCgi_wr != fromCgi_rd)
  1058. close(toCgi_wr);
  1059. toCgi_wr = 0;
  1060. }
  1061. }
  1062. /* Now wait on the set of sockets */
  1063. count = safe_poll(pfd, toCgi_wr ? TO_CGI+1 : FROM_CGI+1, -1);
  1064. if (count <= 0) {
  1065. #if 0
  1066. if (safe_waitpid(pid, &status, WNOHANG) <= 0) {
  1067. /* Weird. CGI didn't exit and no fd's
  1068. * are ready, yet poll returned?! */
  1069. continue;
  1070. }
  1071. if (DEBUG && WIFEXITED(status))
  1072. bb_error_msg("CGI exited, status=%d", WEXITSTATUS(status));
  1073. if (DEBUG && WIFSIGNALED(status))
  1074. bb_error_msg("CGI killed, signal=%d", WTERMSIG(status));
  1075. #endif
  1076. break;
  1077. }
  1078. if (pfd[TO_CGI].revents) {
  1079. /* hdr_cnt > 0 here due to the way pfd[TO_CGI].events set */
  1080. /* Have data from peer and can write to CGI */
  1081. count = safe_write(toCgi_wr, hdr_ptr, hdr_cnt);
  1082. /* Doesn't happen, we dont use nonblocking IO here
  1083. *if (count < 0 && errno == EAGAIN) {
  1084. * ...
  1085. *} else */
  1086. if (count > 0) {
  1087. hdr_ptr += count;
  1088. hdr_cnt -= count;
  1089. } else {
  1090. /* EOF/broken pipe to CGI, stop piping POST data */
  1091. hdr_cnt = post_len = 0;
  1092. }
  1093. }
  1094. if (pfd[0].revents) {
  1095. /* post_len > 0 && hdr_cnt == 0 here */
  1096. /* We expect data, prev data portion is eaten by CGI
  1097. * and there *is* data to read from the peer
  1098. * (POSTDATA) */
  1099. //count = post_len > (int)sizeof(hdr_buf) ? (int)sizeof(hdr_buf) : post_len;
  1100. //count = safe_read(STDIN_FILENO, hdr_buf, count);
  1101. count = safe_read(STDIN_FILENO, hdr_buf, sizeof(hdr_buf));
  1102. if (count > 0) {
  1103. hdr_cnt = count;
  1104. hdr_ptr = hdr_buf;
  1105. post_len -= count;
  1106. } else {
  1107. /* no more POST data can be read */
  1108. post_len = 0;
  1109. }
  1110. }
  1111. if (pfd[FROM_CGI].revents) {
  1112. /* There is something to read from CGI */
  1113. char *rbuf = iobuf;
  1114. /* Are we still buffering CGI output? */
  1115. if (out_cnt >= 0) {
  1116. /* HTTP_200[] has single "\r\n" at the end.
  1117. * According to http://hoohoo.ncsa.uiuc.edu/cgi/out.html,
  1118. * CGI scripts MUST send their own header terminated by
  1119. * empty line, then data. That's why we have only one
  1120. * <cr><lf> pair here. We will output "200 OK" line
  1121. * if needed, but CGI still has to provide blank line
  1122. * between header and body */
  1123. /* Must use safe_read, not full_read, because
  1124. * CGI may output a few first bytes and then wait
  1125. * for POSTDATA without closing stdout.
  1126. * With full_read we may wait here forever. */
  1127. count = safe_read(fromCgi_rd, rbuf + out_cnt, PIPE_BUF - 8);
  1128. if (count <= 0) {
  1129. /* eof (or error) and there was no "HTTP",
  1130. * so write it, then write received data */
  1131. if (out_cnt) {
  1132. full_write(STDOUT_FILENO, HTTP_200, sizeof(HTTP_200)-1);
  1133. full_write(STDOUT_FILENO, rbuf, out_cnt);
  1134. }
  1135. break; /* CGI stdout is closed, exiting */
  1136. }
  1137. out_cnt += count;
  1138. count = 0;
  1139. /* "Status" header format is: "Status: 302 Redirected\r\n" */
  1140. if (out_cnt >= 8 && memcmp(rbuf, "Status: ", 8) == 0) {
  1141. /* send "HTTP/1.0 " */
  1142. if (full_write(STDOUT_FILENO, HTTP_200, 9) != 9)
  1143. break;
  1144. rbuf += 8; /* skip "Status: " */
  1145. count = out_cnt - 8;
  1146. out_cnt = -1; /* buffering off */
  1147. } else if (out_cnt >= 4) {
  1148. /* Did CGI add "HTTP"? */
  1149. if (memcmp(rbuf, HTTP_200, 4) != 0) {
  1150. /* there is no "HTTP", do it ourself */
  1151. if (full_write(STDOUT_FILENO, HTTP_200, sizeof(HTTP_200)-1) != sizeof(HTTP_200)-1)
  1152. break;
  1153. }
  1154. /* Commented out:
  1155. if (!strstr(rbuf, "ontent-")) {
  1156. full_write(s, "Content-type: text/plain\r\n\r\n", 28);
  1157. }
  1158. * Counter-example of valid CGI without Content-type:
  1159. * echo -en "HTTP/1.0 302 Found\r\n"
  1160. * echo -en "Location: http://www.busybox.net\r\n"
  1161. * echo -en "\r\n"
  1162. */
  1163. count = out_cnt;
  1164. out_cnt = -1; /* buffering off */
  1165. }
  1166. } else {
  1167. count = safe_read(fromCgi_rd, rbuf, PIPE_BUF);
  1168. if (count <= 0)
  1169. break; /* eof (or error) */
  1170. }
  1171. if (full_write(STDOUT_FILENO, rbuf, count) != count)
  1172. break;
  1173. if (DEBUG)
  1174. fprintf(stderr, "cgi read %d bytes: '%.*s'\n", count, count, rbuf);
  1175. } /* if (pfd[FROM_CGI].revents) */
  1176. } /* while (1) */
  1177. log_and_exit();
  1178. }
  1179. #endif
  1180. #if ENABLE_FEATURE_HTTPD_CGI
  1181. static void setenv1(const char *name, const char *value)
  1182. {
  1183. setenv(name, value ? value : "", 1);
  1184. }
  1185. /*
  1186. * Spawn CGI script, forward CGI's stdin/out <=> network
  1187. *
  1188. * Environment variables are set up and the script is invoked with pipes
  1189. * for stdin/stdout. If a POST is being done the script is fed the POST
  1190. * data in addition to setting the QUERY_STRING variable (for GETs or POSTs).
  1191. *
  1192. * Parameters:
  1193. * const char *url The requested URL (with leading /).
  1194. * int post_len Length of the POST body.
  1195. * const char *cookie For set HTTP_COOKIE.
  1196. * const char *content_type For set CONTENT_TYPE.
  1197. */
  1198. static void send_cgi_and_exit(
  1199. const char *url,
  1200. const char *request,
  1201. int post_len,
  1202. const char *cookie,
  1203. const char *content_type) NORETURN;
  1204. static void send_cgi_and_exit(
  1205. const char *url,
  1206. const char *request,
  1207. int post_len,
  1208. const char *cookie,
  1209. const char *content_type)
  1210. {
  1211. struct fd_pair fromCgi; /* CGI -> httpd pipe */
  1212. struct fd_pair toCgi; /* httpd -> CGI pipe */
  1213. char *script;
  1214. int pid;
  1215. /* Make a copy. NB: caller guarantees:
  1216. * url[0] == '/', url[1] != '/' */
  1217. url = xstrdup(url);
  1218. /*
  1219. * We are mucking with environment _first_ and then vfork/exec,
  1220. * this allows us to use vfork safely. Parent doesn't care about
  1221. * these environment changes anyway.
  1222. */
  1223. /* Check for [dirs/]script.cgi/PATH_INFO */
  1224. script = (char*)url;
  1225. while ((script = strchr(script + 1, '/')) != NULL) {
  1226. *script = '\0';
  1227. if (!is_directory(url + 1, 1, NULL)) {
  1228. /* not directory, found script.cgi/PATH_INFO */
  1229. *script = '/';
  1230. break;
  1231. }
  1232. *script = '/'; /* is directory, find next '/' */
  1233. }
  1234. setenv1("PATH_INFO", script); /* set to /PATH_INFO or "" */
  1235. setenv1("REQUEST_METHOD", request);
  1236. if (g_query) {
  1237. putenv(xasprintf("%s=%s?%s", "REQUEST_URI", url, g_query));
  1238. } else {
  1239. setenv1("REQUEST_URI", url);
  1240. }
  1241. if (script != NULL)
  1242. *script = '\0'; /* cut off /PATH_INFO */
  1243. /* SCRIPT_FILENAME is required by PHP in CGI mode */
  1244. if (home_httpd[0] == '/') {
  1245. char *fullpath = concat_path_file(home_httpd, url);
  1246. setenv1("SCRIPT_FILENAME", fullpath);
  1247. }
  1248. /* set SCRIPT_NAME as full path: /cgi-bin/dirs/script.cgi */
  1249. setenv1("SCRIPT_NAME", url);
  1250. /* http://hoohoo.ncsa.uiuc.edu/cgi/env.html:
  1251. * QUERY_STRING: The information which follows the ? in the URL
  1252. * which referenced this script. This is the query information.
  1253. * It should not be decoded in any fashion. This variable
  1254. * should always be set when there is query information,
  1255. * regardless of command line decoding. */
  1256. /* (Older versions of bbox seem to do some decoding) */
  1257. setenv1("QUERY_STRING", g_query);
  1258. putenv((char*)"SERVER_SOFTWARE=busybox httpd/"BB_VER);
  1259. putenv((char*)"SERVER_PROTOCOL=HTTP/1.0");
  1260. putenv((char*)"GATEWAY_INTERFACE=CGI/1.1");
  1261. /* Having _separate_ variables for IP and port defeats
  1262. * the purpose of having socket abstraction. Which "port"
  1263. * are you using on Unix domain socket?
  1264. * IOW - REMOTE_PEER="1.2.3.4:56" makes much more sense.
  1265. * Oh well... */
  1266. {
  1267. char *p = rmt_ip_str ? rmt_ip_str : (char*)"";
  1268. char *cp = strrchr(p, ':');
  1269. if (ENABLE_FEATURE_IPV6 && cp && strchr(cp, ']'))
  1270. cp = NULL;
  1271. if (cp) *cp = '\0'; /* delete :PORT */
  1272. setenv1("REMOTE_ADDR", p);
  1273. if (cp) {
  1274. *cp = ':';
  1275. #if ENABLE_FEATURE_HTTPD_SET_REMOTE_PORT_TO_ENV
  1276. setenv1("REMOTE_PORT", cp + 1);
  1277. #endif
  1278. }
  1279. }
  1280. setenv1("HTTP_USER_AGENT", user_agent);
  1281. if (http_accept)
  1282. setenv1("HTTP_ACCEPT", http_accept);
  1283. if (http_accept_language)
  1284. setenv1("HTTP_ACCEPT_LANGUAGE", http_accept_language);
  1285. if (post_len)
  1286. putenv(xasprintf("CONTENT_LENGTH=%d", post_len));
  1287. if (cookie)
  1288. setenv1("HTTP_COOKIE", cookie);
  1289. if (content_type)
  1290. setenv1("CONTENT_TYPE", content_type);
  1291. #if ENABLE_FEATURE_HTTPD_BASIC_AUTH
  1292. if (remoteuser) {
  1293. setenv1("REMOTE_USER", remoteuser);
  1294. putenv((char*)"AUTH_TYPE=Basic");
  1295. }
  1296. #endif
  1297. if (referer)
  1298. setenv1("HTTP_REFERER", referer);
  1299. setenv1("HTTP_HOST", host); /* set to "" if NULL */
  1300. /* setenv1("SERVER_NAME", safe_gethostname()); - don't do this,
  1301. * just run "env SERVER_NAME=xyz httpd ..." instead */
  1302. xpiped_pair(fromCgi);
  1303. xpiped_pair(toCgi);
  1304. pid = vfork();
  1305. if (pid < 0) {
  1306. /* TODO: log perror? */
  1307. log_and_exit();
  1308. }
  1309. if (!pid) {
  1310. /* Child process */
  1311. char *argv[3];
  1312. xfunc_error_retval = 242;
  1313. /* NB: close _first_, then move fds! */
  1314. close(toCgi.wr);
  1315. close(fromCgi.rd);
  1316. xmove_fd(toCgi.rd, 0); /* replace stdin with the pipe */
  1317. xmove_fd(fromCgi.wr, 1); /* replace stdout with the pipe */
  1318. /* User seeing stderr output can be a security problem.
  1319. * If CGI really wants that, it can always do dup itself. */
  1320. /* dup2(1, 2); */
  1321. /* Chdiring to script's dir */
  1322. script = strrchr(url, '/');
  1323. if (script != url) { /* paranoia */
  1324. *script = '\0';
  1325. if (chdir(url + 1) != 0) {
  1326. bb_perror_msg("chdir(%s)", url + 1);
  1327. goto error_execing_cgi;
  1328. }
  1329. // not needed: *script = '/';
  1330. }
  1331. script++;
  1332. /* set argv[0] to name without path */
  1333. argv[0] = script;
  1334. argv[1] = NULL;
  1335. #if ENABLE_FEATURE_HTTPD_CONFIG_WITH_SCRIPT_INTERPR
  1336. {
  1337. char *suffix = strrchr(script, '.');
  1338. if (suffix) {
  1339. Htaccess *cur;
  1340. for (cur = script_i; cur; cur = cur->next) {
  1341. if (strcmp(cur->before_colon + 1, suffix) == 0) {
  1342. /* found interpreter name */
  1343. argv[0] = cur->after_colon;
  1344. argv[1] = script;
  1345. argv[2] = NULL;
  1346. break;
  1347. }
  1348. }
  1349. }
  1350. }
  1351. #endif
  1352. /* restore default signal dispositions for CGI process */
  1353. bb_signals(0
  1354. | (1 << SIGCHLD)
  1355. | (1 << SIGPIPE)
  1356. | (1 << SIGHUP)
  1357. , SIG_DFL);
  1358. /* _NOT_ execvp. We do not search PATH. argv[0] is a filename
  1359. * without any dir components and will only match a file
  1360. * in the current directory */
  1361. execv(argv[0], argv);
  1362. if (verbose)
  1363. bb_perror_msg("can't execute '%s'", argv[0]);
  1364. error_execing_cgi:
  1365. /* send to stdout
  1366. * (we are CGI here, our stdout is pumped to the net) */
  1367. send_headers_and_exit(HTTP_NOT_FOUND);
  1368. } /* end child */
  1369. /* Parent process */
  1370. /* Restore variables possibly changed by child */
  1371. xfunc_error_retval = 0;
  1372. /* Pump data */
  1373. close(fromCgi.wr);
  1374. close(toCgi.rd);
  1375. cgi_io_loop_and_exit(fromCgi.rd, toCgi.wr, post_len);
  1376. }
  1377. #endif /* FEATURE_HTTPD_CGI */
  1378. /*
  1379. * Send a file response to a HTTP request, and exit
  1380. *
  1381. * Parameters:
  1382. * const char *url The requested URL (with leading /).
  1383. * what What to send (headers/body/both).
  1384. */
  1385. static NOINLINE void send_file_and_exit(const char *url, int what)
  1386. {
  1387. char *suffix;
  1388. int fd;
  1389. ssize_t count;
  1390. if (content_gzip) {
  1391. /* does <url>.gz exist? Then use it instead */
  1392. char *gzurl = xasprintf("%s.gz", url);
  1393. fd = open(gzurl, O_RDONLY);
  1394. free(gzurl);
  1395. if (fd != -1) {
  1396. struct stat sb;
  1397. fstat(fd, &sb);
  1398. file_size = sb.st_size;
  1399. } else {
  1400. IF_FEATURE_HTTPD_GZIP(content_gzip = 0;)
  1401. fd = open(url, O_RDONLY);
  1402. }
  1403. } else {
  1404. fd = open(url, O_RDONLY);
  1405. }
  1406. if (fd < 0) {
  1407. if (DEBUG)
  1408. bb_perror_msg("can't open '%s'", url);
  1409. /* Error pages are sent by using send_file_and_exit(SEND_BODY).
  1410. * IOW: it is unsafe to call send_headers_and_exit
  1411. * if what is SEND_BODY! Can recurse! */
  1412. if (what != SEND_BODY)
  1413. send_headers_and_exit(HTTP_NOT_FOUND);
  1414. log_and_exit();
  1415. }
  1416. /* If you want to know about EPIPE below
  1417. * (happens if you abort downloads from local httpd): */
  1418. signal(SIGPIPE, SIG_IGN);
  1419. /* If not found, default is "application/octet-stream" */
  1420. found_mime_type = "application/octet-stream";
  1421. suffix = strrchr(url, '.');
  1422. if (suffix) {
  1423. static const char suffixTable[] ALIGN1 =
  1424. /* Shorter suffix must be first:
  1425. * ".html.htm" will fail for ".htm"
  1426. */
  1427. ".txt.h.c.cc.cpp\0" "text/plain\0"
  1428. /* .htm line must be after .h line */
  1429. ".htm.html\0" "text/html\0"
  1430. ".jpg.jpeg\0" "image/jpeg\0"
  1431. ".gif\0" "image/gif\0"
  1432. ".png\0" "image/png\0"
  1433. /* .css line must be after .c line */
  1434. ".css\0" "text/css\0"
  1435. ".wav\0" "audio/wav\0"
  1436. ".avi\0" "video/x-msvideo\0"
  1437. ".qt.mov\0" "video/quicktime\0"
  1438. ".mpe.mpeg\0" "video/mpeg\0"
  1439. ".mid.midi\0" "audio/midi\0"
  1440. ".mp3\0" "audio/mpeg\0"
  1441. #if 0 /* unpopular */
  1442. ".au\0" "audio/basic\0"
  1443. ".pac\0" "application/x-ns-proxy-autoconfig\0"
  1444. ".vrml.wrl\0" "model/vrml\0"
  1445. #endif
  1446. /* compiler adds another "\0" here */
  1447. ;
  1448. Htaccess *cur;
  1449. /* Examine built-in table */
  1450. const char *table = suffixTable;
  1451. const char *table_next;
  1452. for (; *table; table = table_next) {
  1453. const char *try_suffix;
  1454. const char *mime_type;
  1455. mime_type = table + strlen(table) + 1;
  1456. table_next = mime_type + strlen(mime_type) + 1;
  1457. try_suffix = strstr(table, suffix);
  1458. if (!try_suffix)
  1459. continue;
  1460. try_suffix += strlen(suffix);
  1461. if (*try_suffix == '\0' || *try_suffix == '.') {
  1462. found_mime_type = mime_type;
  1463. break;
  1464. }
  1465. /* Example: strstr(table, ".av") != NULL, but it
  1466. * does not match ".avi" after all and we end up here.
  1467. * The table is arranged so that in this case we know
  1468. * that it can't match anything in the following lines,
  1469. * and we stop the search: */
  1470. break;
  1471. }
  1472. /* ...then user's table */
  1473. for (cur = mime_a; cur; cur = cur->next) {
  1474. if (strcmp(cur->before_colon, suffix) == 0) {
  1475. found_mime_type = cur->after_colon;
  1476. break;
  1477. }
  1478. }
  1479. }
  1480. if (DEBUG)
  1481. bb_error_msg("sending file '%s' content-type: %s",
  1482. url, found_mime_type);
  1483. #if ENABLE_FEATURE_HTTPD_RANGES
  1484. if (what == SEND_BODY /* err pages and ranges don't mix */
  1485. || content_gzip /* we are sending compressed page: can't do ranges */ ///why?
  1486. ) {
  1487. range_start = 0;
  1488. }
  1489. range_len = MAXINT(off_t);
  1490. if (range_start) {
  1491. if (!range_end) {
  1492. range_end = file_size - 1;
  1493. }
  1494. if (range_end < range_start
  1495. || lseek(fd, range_start, SEEK_SET) != range_start
  1496. ) {
  1497. lseek(fd, 0, SEEK_SET);
  1498. range_start = 0;
  1499. } else {
  1500. range_len = range_end - range_start + 1;
  1501. send_headers(HTTP_PARTIAL_CONTENT);
  1502. what = SEND_BODY;
  1503. }
  1504. }
  1505. #endif
  1506. if (what & SEND_HEADERS)
  1507. send_headers(HTTP_OK);
  1508. #if ENABLE_FEATURE_HTTPD_USE_SENDFILE
  1509. {
  1510. off_t offset = range_start;
  1511. while (1) {
  1512. /* sz is rounded down to 64k */
  1513. ssize_t sz = MAXINT(ssize_t) - 0xffff;
  1514. IF_FEATURE_HTTPD_RANGES(if (sz > range_len) sz = range_len;)
  1515. count = sendfile(STDOUT_FILENO, fd, &offset, sz);
  1516. if (count < 0) {
  1517. if (offset == range_start)
  1518. break; /* fall back to read/write loop */
  1519. goto fin;
  1520. }
  1521. IF_FEATURE_HTTPD_RANGES(range_len -= sz;)
  1522. if (count == 0 || range_len == 0)
  1523. log_and_exit();
  1524. }
  1525. }
  1526. #endif
  1527. while ((count = safe_read(fd, iobuf, IOBUF_SIZE)) > 0) {
  1528. ssize_t n;
  1529. IF_FEATURE_HTTPD_RANGES(if (count > range_len) count = range_len;)
  1530. n = full_write(STDOUT_FILENO, iobuf, count);
  1531. if (count != n)
  1532. break;
  1533. IF_FEATURE_HTTPD_RANGES(range_len -= count;)
  1534. if (range_len == 0)
  1535. break;
  1536. }
  1537. if (count < 0) {
  1538. IF_FEATURE_HTTPD_USE_SENDFILE(fin:)
  1539. if (verbose > 1)
  1540. bb_perror_msg("error");
  1541. }
  1542. log_and_exit();
  1543. }
  1544. static int checkPermIP(void)
  1545. {
  1546. Htaccess_IP *cur;
  1547. for (cur = ip_a_d; cur; cur = cur->next) {
  1548. #if DEBUG
  1549. fprintf(stderr,
  1550. "checkPermIP: '%s' ? '%u.%u.%u.%u/%u.%u.%u.%u'\n",
  1551. rmt_ip_str,
  1552. (unsigned char)(cur->ip >> 24),
  1553. (unsigned char)(cur->ip >> 16),
  1554. (unsigned char)(cur->ip >> 8),
  1555. (unsigned char)(cur->ip),
  1556. (unsigned char)(cur->mask >> 24),
  1557. (unsigned char)(cur->mask >> 16),
  1558. (unsigned char)(cur->mask >> 8),
  1559. (unsigned char)(cur->mask)
  1560. );
  1561. #endif
  1562. if ((rmt_ip & cur->mask) == cur->ip)
  1563. return (cur->allow_deny == 'A'); /* A -> 1 */
  1564. }
  1565. return !flg_deny_all; /* depends on whether we saw "D:*" */
  1566. }
  1567. #if ENABLE_FEATURE_HTTPD_BASIC_AUTH
  1568. /*
  1569. * Config file entries are of the form "/<path>:<user>:<passwd>".
  1570. * If config file has no prefix match for path, access is allowed.
  1571. *
  1572. * path The file path
  1573. * user_and_passwd "user:passwd" to validate
  1574. *
  1575. * Returns 1 if user_and_passwd is OK.
  1576. */
  1577. static int check_user_passwd(const char *path, const char *user_and_passwd)
  1578. {
  1579. Htaccess *cur;
  1580. const char *prev = NULL;
  1581. for (cur = g_auth; cur; cur = cur->next) {
  1582. const char *dir_prefix;
  1583. size_t len;
  1584. dir_prefix = cur->before_colon;
  1585. /* WHY? */
  1586. /* If already saw a match, don't accept other different matches */
  1587. if (prev && strcmp(prev, dir_prefix) != 0)
  1588. continue;
  1589. if (DEBUG)
  1590. fprintf(stderr, "checkPerm: '%s' ? '%s'\n", dir_prefix, user_and_passwd);
  1591. /* If it's not a prefix match, continue searching */
  1592. len = strlen(dir_prefix);
  1593. if (len != 1 /* dir_prefix "/" matches all, don't need to check */
  1594. && (strncmp(dir_prefix, path, len) != 0
  1595. || (path[len] != '/' && path[len] != '\0'))
  1596. ) {
  1597. continue;
  1598. }
  1599. /* Path match found */
  1600. prev = dir_prefix;
  1601. if (ENABLE_FEATURE_HTTPD_AUTH_MD5) {
  1602. char *md5_passwd;
  1603. md5_passwd = strchr(cur->after_colon, ':');
  1604. if (md5_passwd && md5_passwd[1] == '$' && md5_passwd[2] == '1'
  1605. && md5_passwd[3] == '$' && md5_passwd[4]
  1606. ) {
  1607. char *encrypted;
  1608. int r, user_len_p1;
  1609. md5_passwd++;
  1610. user_len_p1 = md5_passwd - cur->after_colon;
  1611. /* comparing "user:" */
  1612. if (strncmp(cur->after_colon, user_and_passwd, user_len_p1) != 0) {
  1613. continue;
  1614. }
  1615. encrypted = pw_encrypt(
  1616. user_and_passwd + user_len_p1 /* cleartext pwd from user */,
  1617. md5_passwd /*salt */, 1 /* cleanup */);
  1618. r = strcmp(encrypted, md5_passwd);
  1619. free(encrypted);
  1620. if (r == 0)
  1621. goto set_remoteuser_var; /* Ok */
  1622. continue;
  1623. }
  1624. }
  1625. /* Comparing plaintext "user:pass" in one go */
  1626. if (strcmp(cur->after_colon, user_and_passwd) == 0) {
  1627. set_remoteuser_var:
  1628. remoteuser = xstrndup(user_and_passwd,
  1629. strchrnul(user_and_passwd, ':') - user_and_passwd);
  1630. return 1; /* Ok */
  1631. }
  1632. } /* for */
  1633. /* 0(bad) if prev is set: matches were found but passwd was wrong */
  1634. return (prev == NULL);
  1635. }
  1636. #endif /* FEATURE_HTTPD_BASIC_AUTH */
  1637. #if ENABLE_FEATURE_HTTPD_PROXY
  1638. static Htaccess_Proxy *find_proxy_entry(const char *url)
  1639. {
  1640. Htaccess_Proxy *p;
  1641. for (p = proxy; p; p = p->next) {
  1642. if (strncmp(url, p->url_from, strlen(p->url_from)) == 0)
  1643. return p;
  1644. }
  1645. return NULL;
  1646. }
  1647. #endif
  1648. /*
  1649. * Handle timeouts
  1650. */
  1651. static void send_REQUEST_TIMEOUT_and_exit(int sig) NORETURN;
  1652. static void send_REQUEST_TIMEOUT_and_exit(int sig UNUSED_PARAM)
  1653. {
  1654. send_headers_and_exit(HTTP_REQUEST_TIMEOUT);
  1655. }
  1656. /*
  1657. * Handle an incoming http request and exit.
  1658. */
  1659. static void handle_incoming_and_exit(const len_and_sockaddr *fromAddr) NORETURN;
  1660. static void handle_incoming_and_exit(const len_and_sockaddr *fromAddr)
  1661. {
  1662. static const char request_GET[] ALIGN1 = "GET";
  1663. struct stat sb;
  1664. char *urlcopy;
  1665. char *urlp;
  1666. char *tptr;
  1667. #if ENABLE_FEATURE_HTTPD_CGI
  1668. static const char request_HEAD[] ALIGN1 = "HEAD";
  1669. const char *prequest;
  1670. char *cookie = NULL;
  1671. char *content_type = NULL;
  1672. unsigned long length = 0;
  1673. #elif ENABLE_FEATURE_HTTPD_PROXY
  1674. #define prequest request_GET
  1675. unsigned long length = 0;
  1676. #endif
  1677. #if ENABLE_FEATURE_HTTPD_BASIC_AUTH
  1678. smallint authorized = -1;
  1679. #endif
  1680. smallint ip_allowed;
  1681. char http_major_version;
  1682. #if ENABLE_FEATURE_HTTPD_PROXY
  1683. char http_minor_version;
  1684. char *header_buf = header_buf; /* for gcc */
  1685. char *header_ptr = header_ptr;
  1686. Htaccess_Proxy *proxy_entry;
  1687. #endif
  1688. /* Allocation of iobuf is postponed until now
  1689. * (IOW, server process doesn't need to waste 8k) */
  1690. iobuf = xmalloc(IOBUF_SIZE);
  1691. rmt_ip = 0;
  1692. if (fromAddr->u.sa.sa_family == AF_INET) {
  1693. rmt_ip = ntohl(fromAddr->u.sin.sin_addr.s_addr);
  1694. }
  1695. #if ENABLE_FEATURE_IPV6
  1696. if (fromAddr->u.sa.sa_family == AF_INET6
  1697. && fromAddr->u.sin6.sin6_addr.s6_addr32[0] == 0
  1698. && fromAddr->u.sin6.sin6_addr.s6_addr32[1] == 0
  1699. && ntohl(fromAddr->u.sin6.sin6_addr.s6_addr32[2]) == 0xffff)
  1700. rmt_ip = ntohl(fromAddr->u.sin6.sin6_addr.s6_addr32[3]);
  1701. #endif
  1702. if (ENABLE_FEATURE_HTTPD_CGI || DEBUG || verbose) {
  1703. /* NB: can be NULL (user runs httpd -i by hand?) */
  1704. rmt_ip_str = xmalloc_sockaddr2dotted(&fromAddr->u.sa);
  1705. }
  1706. if (verbose) {
  1707. /* this trick makes -v logging much simpler */
  1708. if (rmt_ip_str)
  1709. applet_name = rmt_ip_str;
  1710. if (verbose > 2)
  1711. bb_error_msg("connected");
  1712. }
  1713. /* Install timeout handler. get_line() needs it. */
  1714. signal(SIGALRM, send_REQUEST_TIMEOUT_and_exit);
  1715. if (!get_line()) /* EOF or error or empty line */
  1716. send_headers_and_exit(HTTP_BAD_REQUEST);
  1717. /* Determine type of request (GET/POST) */
  1718. urlp = strpbrk(iobuf, " \t");
  1719. if (urlp == NULL)
  1720. send_headers_and_exit(HTTP_BAD_REQUEST);
  1721. *urlp++ = '\0';
  1722. #if ENABLE_FEATURE_HTTPD_CGI
  1723. prequest = request_GET;
  1724. if (strcasecmp(iobuf, prequest) != 0) {
  1725. prequest = request_HEAD;
  1726. if (strcasecmp(iobuf, prequest) != 0) {
  1727. prequest = "POST";
  1728. if (strcasecmp(iobuf, prequest) != 0)
  1729. send_headers_and_exit(HTTP_NOT_IMPLEMENTED);
  1730. }
  1731. }
  1732. #else
  1733. if (strcasecmp(iobuf, request_GET) != 0)
  1734. send_headers_and_exit(HTTP_NOT_IMPLEMENTED);
  1735. #endif
  1736. urlp = skip_whitespace(urlp);
  1737. if (urlp[0] != '/')
  1738. send_headers_and_exit(HTTP_BAD_REQUEST);
  1739. /* Find end of URL and parse HTTP version, if any */
  1740. http_major_version = '0';
  1741. IF_FEATURE_HTTPD_PROXY(http_minor_version = '0';)
  1742. tptr = strchrnul(urlp, ' ');
  1743. /* Is it " HTTP/"? */
  1744. if (tptr[0] && strncmp(tptr + 1, HTTP_200, 5) == 0) {
  1745. http_major_version = tptr[6];
  1746. IF_FEATURE_HTTPD_PROXY(http_minor_version = tptr[8];)
  1747. }
  1748. *tptr = '\0';
  1749. /* Copy URL from after "GET "/"POST " to stack-allocated char[] */
  1750. urlcopy = alloca((tptr - urlp) + 2 + strlen(index_page));
  1751. /*if (urlcopy == NULL)
  1752. * send_headers_and_exit(HTTP_INTERNAL_SERVER_ERROR);*/
  1753. strcpy(urlcopy, urlp);
  1754. /* NB: urlcopy ptr is never changed after this */
  1755. /* Extract url args if present */
  1756. g_query = NULL;
  1757. tptr = strchr(urlcopy, '?');
  1758. if (tptr) {
  1759. *tptr++ = '\0';
  1760. g_query = tptr;
  1761. }
  1762. /* Decode URL escape sequences */
  1763. tptr = decodeString(urlcopy, 0);
  1764. if (tptr == NULL)
  1765. send_headers_and_exit(HTTP_BAD_REQUEST);
  1766. if (tptr == urlcopy + 1) {
  1767. /* '/' or NUL is encoded */
  1768. send_headers_and_exit(HTTP_NOT_FOUND);
  1769. }
  1770. /* Canonicalize path */
  1771. /* Algorithm stolen from libbb bb_simplify_path(),
  1772. * but don't strdup, retain trailing slash, protect root */
  1773. urlp = tptr = urlcopy;
  1774. do {
  1775. if (*urlp == '/') {
  1776. /* skip duplicate (or initial) slash */
  1777. if (*tptr == '/') {
  1778. continue;
  1779. }
  1780. if (*tptr == '.') {
  1781. /* skip extra "/./" */
  1782. if (tptr[1] == '/' || !tptr[1]) {
  1783. continue;
  1784. }
  1785. /* "..": be careful */
  1786. if (tptr[1] == '.' && (tptr[2] == '/' || !tptr[2])) {
  1787. ++tptr;
  1788. if (urlp == urlcopy) /* protect root */
  1789. send_headers_and_exit(HTTP_BAD_REQUEST);
  1790. while (*--urlp != '/') /* omit previous dir */;
  1791. continue;
  1792. }
  1793. }
  1794. }
  1795. *++urlp = *tptr;
  1796. } while (*++tptr);
  1797. *++urlp = '\0'; /* terminate after last character */
  1798. /* If URL is a directory, add '/' */
  1799. if (urlp[-1] != '/') {
  1800. if (is_directory(urlcopy + 1, 1, NULL)) {
  1801. found_moved_temporarily = urlcopy;
  1802. }
  1803. }
  1804. /* Log it */
  1805. if (verbose > 1)
  1806. bb_error_msg("url:%s", urlcopy);
  1807. tptr = urlcopy;
  1808. ip_allowed = checkPermIP();
  1809. while (ip_allowed && (tptr = strchr(tptr + 1, '/')) != NULL) {
  1810. /* have path1/path2 */
  1811. *tptr = '\0';
  1812. if (is_directory(urlcopy + 1, 1, NULL)) {
  1813. /* may have subdir config */
  1814. parse_conf(urlcopy + 1, SUBDIR_PARSE);
  1815. ip_allowed = checkPermIP();
  1816. }
  1817. *tptr = '/';
  1818. }
  1819. #if ENABLE_FEATURE_HTTPD_PROXY
  1820. proxy_entry = find_proxy_entry(urlcopy);
  1821. if (proxy_entry)
  1822. header_buf = header_ptr = xmalloc(IOBUF_SIZE);
  1823. #endif
  1824. if (http_major_version >= '0') {
  1825. /* Request was with "... HTTP/nXXX", and n >= 0 */
  1826. /* Read until blank line */
  1827. while (1) {
  1828. if (!get_line())
  1829. break; /* EOF or error or empty line */
  1830. if (DEBUG)
  1831. bb_error_msg("header: '%s'", iobuf);
  1832. #if ENABLE_FEATURE_HTTPD_PROXY
  1833. /* We need 2 more bytes for yet another "\r\n" -
  1834. * see near fdprintf(proxy_fd...) further below */
  1835. if (proxy_entry && (header_ptr - header_buf) < IOBUF_SIZE - 2) {
  1836. int len = strlen(iobuf);
  1837. if (len > IOBUF_SIZE - (header_ptr - header_buf) - 4)
  1838. len = IOBUF_SIZE - (header_ptr - header_buf) - 4;
  1839. memcpy(header_ptr, iobuf, len);
  1840. header_ptr += len;
  1841. header_ptr[0] = '\r';
  1842. header_ptr[1] = '\n';
  1843. header_ptr += 2;
  1844. }
  1845. #endif
  1846. #if ENABLE_FEATURE_HTTPD_CGI || ENABLE_FEATURE_HTTPD_PROXY
  1847. /* Try and do our best to parse more lines */
  1848. if ((STRNCASECMP(iobuf, "Content-length:") == 0)) {
  1849. /* extra read only for POST */
  1850. if (prequest != request_GET
  1851. # if ENABLE_FEATURE_HTTPD_CGI
  1852. && prequest != request_HEAD
  1853. # endif
  1854. ) {
  1855. tptr = skip_whitespace(iobuf + sizeof("Content-length:") - 1);
  1856. if (!tptr[0])
  1857. send_headers_and_exit(HTTP_BAD_REQUEST);
  1858. /* not using strtoul: it ignores leading minus! */
  1859. length = bb_strtou(tptr, NULL, 10);
  1860. /* length is "ulong", but we need to pass it to int later */
  1861. if (errno || length > INT_MAX)
  1862. send_headers_and_exit(HTTP_BAD_REQUEST);
  1863. }
  1864. }
  1865. #endif
  1866. #if ENABLE_FEATURE_HTTPD_CGI
  1867. else if (STRNCASECMP(iobuf, "Cookie:") == 0) {
  1868. cookie = xstrdup(skip_whitespace(iobuf + sizeof("Cookie:")-1));
  1869. } else if (STRNCASECMP(iobuf, "Content-Type:") == 0) {
  1870. content_type = xstrdup(skip_whitespace(iobuf + sizeof("Content-Type:")-1));
  1871. } else if (STRNCASECMP(iobuf, "Referer:") == 0) {
  1872. referer = xstrdup(skip_whitespace(iobuf + sizeof("Referer:")-1));
  1873. } else if (STRNCASECMP(iobuf, "User-Agent:") == 0) {
  1874. user_agent = xstrdup(skip_whitespace(iobuf + sizeof("User-Agent:")-1));
  1875. } else if (STRNCASECMP(iobuf, "Host:") == 0) {
  1876. host = xstrdup(skip_whitespace(iobuf + sizeof("Host:")-1));
  1877. } else if (STRNCASECMP(iobuf, "Accept:") == 0) {
  1878. http_accept = xstrdup(skip_whitespace(iobuf + sizeof("Accept:")-1));
  1879. } else if (STRNCASECMP(iobuf, "Accept-Language:") == 0) {
  1880. http_accept_language = xstrdup(skip_whitespace(iobuf + sizeof("Accept-Language:")-1));
  1881. }
  1882. #endif
  1883. #if ENABLE_FEATURE_HTTPD_BASIC_AUTH
  1884. if (STRNCASECMP(iobuf, "Authorization:") == 0) {
  1885. /* We only allow Basic credentials.
  1886. * It shows up as "Authorization: Basic <user>:<passwd>" where
  1887. * "<user>:<passwd>" is base64 encoded.
  1888. */
  1889. tptr = skip_whitespace(iobuf + sizeof("Authorization:")-1);
  1890. if (STRNCASECMP(tptr, "Basic") != 0)
  1891. continue;
  1892. tptr += sizeof("Basic")-1;
  1893. /* decodeBase64() skips whitespace itself */
  1894. decodeBase64(tptr);
  1895. authorized = check_user_passwd(urlcopy, tptr);
  1896. }
  1897. #endif
  1898. #if ENABLE_FEATURE_HTTPD_RANGES
  1899. if (STRNCASECMP(iobuf, "Range:") == 0) {
  1900. /* We know only bytes=NNN-[MMM] */
  1901. char *s = skip_whitespace(iobuf + sizeof("Range:")-1);
  1902. if (strncmp(s, "bytes=", 6) == 0) {
  1903. s += sizeof("bytes=")-1;
  1904. range_start = BB_STRTOOFF(s, &s, 10);
  1905. if (s[0] != '-' || range_start < 0) {
  1906. range_start = 0;
  1907. } else if (s[1]) {
  1908. range_end = BB_STRTOOFF(s+1, NULL, 10);
  1909. if (errno || range_end < range_start)
  1910. range_start = 0;
  1911. }
  1912. }
  1913. }
  1914. #endif
  1915. #if ENABLE_FEATURE_HTTPD_GZIP
  1916. if (STRNCASECMP(iobuf, "Accept-Encoding:") == 0) {
  1917. /* Note: we do not support "gzip;q=0"
  1918. * method of _disabling_ gzip
  1919. * delivery. No one uses that, though */
  1920. const char *s = strstr(iobuf, "gzip");
  1921. if (s) {
  1922. // want more thorough checks?
  1923. //if (s[-1] == ' '
  1924. // || s[-1] == ','
  1925. // || s[-1] == ':'
  1926. //) {
  1927. content_gzip = 1;
  1928. //}
  1929. }
  1930. }
  1931. #endif
  1932. } /* while extra header reading */
  1933. }
  1934. /* We are done reading headers, disable peer timeout */
  1935. alarm(0);
  1936. if (strcmp(bb_basename(urlcopy), HTTPD_CONF) == 0 || !ip_allowed) {
  1937. /* protect listing [/path]/httpd.conf or IP deny */
  1938. send_headers_and_exit(HTTP_FORBIDDEN);
  1939. }
  1940. #if ENABLE_FEATURE_HTTPD_BASIC_AUTH
  1941. /* Case: no "Authorization:" was seen, but page does require passwd.
  1942. * Check that with dummy user:pass */
  1943. if (authorized < 0)
  1944. authorized = check_user_passwd(urlcopy, ":");
  1945. if (!authorized)
  1946. send_headers_and_exit(HTTP_UNAUTHORIZED);
  1947. #endif
  1948. if (found_moved_temporarily) {
  1949. send_headers_and_exit(HTTP_MOVED_TEMPORARILY);
  1950. }
  1951. #if ENABLE_FEATURE_HTTPD_PROXY
  1952. if (proxy_entry != NULL) {
  1953. int proxy_fd;
  1954. len_and_sockaddr *lsa;
  1955. proxy_fd = socket(AF_INET, SOCK_STREAM, 0);
  1956. if (proxy_fd < 0)
  1957. send_headers_and_exit(HTTP_INTERNAL_SERVER_ERROR);
  1958. lsa = host2sockaddr(proxy_entry->host_port, 80);
  1959. if (lsa == NULL)
  1960. send_headers_and_exit(HTTP_INTERNAL_SERVER_ERROR);
  1961. if (connect(proxy_fd, &lsa->u.sa, lsa->len) < 0)
  1962. send_headers_and_exit(HTTP_INTERNAL_SERVER_ERROR);
  1963. fdprintf(proxy_fd, "%s %s%s%s%s HTTP/%c.%c\r\n",
  1964. prequest, /* GET or POST */
  1965. proxy_entry->url_to, /* url part 1 */
  1966. urlcopy + strlen(proxy_entry->url_from), /* url part 2 */
  1967. (g_query ? "?" : ""), /* "?" (maybe) */
  1968. (g_query ? g_query : ""), /* query string (maybe) */
  1969. http_major_version, http_minor_version);
  1970. header_ptr[0] = '\r';
  1971. header_ptr[1] = '\n';
  1972. header_ptr += 2;
  1973. write(proxy_fd, header_buf, header_ptr - header_buf);
  1974. free(header_buf); /* on the order of 8k, free it */
  1975. cgi_io_loop_and_exit(proxy_fd, proxy_fd, length);
  1976. }
  1977. #endif
  1978. tptr = urlcopy + 1; /* skip first '/' */
  1979. #if ENABLE_FEATURE_HTTPD_CGI
  1980. if (strncmp(tptr, "cgi-bin/", 8) == 0) {
  1981. if (tptr[8] == '\0') {
  1982. /* protect listing "cgi-bin/" */
  1983. send_headers_and_exit(HTTP_FORBIDDEN);
  1984. }
  1985. send_cgi_and_exit(urlcopy, prequest, length, cookie, content_type);
  1986. }
  1987. #endif
  1988. if (urlp[-1] == '/')
  1989. strcpy(urlp, index_page);
  1990. if (stat(tptr, &sb) == 0) {
  1991. #if ENABLE_FEATURE_HTTPD_CONFIG_WITH_SCRIPT_INTERPR
  1992. char *suffix = strrchr(tptr, '.');
  1993. if (suffix) {
  1994. Htaccess *cur;
  1995. for (cur = script_i; cur; cur = cur->next) {
  1996. if (strcmp(cur->before_colon + 1, suffix) == 0) {
  1997. send_cgi_and_exit(urlcopy, prequest, length, cookie, content_type);
  1998. }
  1999. }
  2000. }
  2001. #endif
  2002. file_size = sb.st_size;
  2003. last_mod = sb.st_mtime;
  2004. }
  2005. #if ENABLE_FEATURE_HTTPD_CGI
  2006. else if (urlp[-1] == '/') {
  2007. /* It's a dir URL and there is no index.html
  2008. * Try cgi-bin/index.cgi */
  2009. if (access("/cgi-bin/index.cgi"+1, X_OK) == 0) {
  2010. urlp[0] = '\0';
  2011. g_query = urlcopy;
  2012. send_cgi_and_exit("/cgi-bin/index.cgi", prequest, length, cookie, content_type);
  2013. }
  2014. }
  2015. /* else fall through to send_file, it errors out if open fails: */
  2016. if (prequest != request_GET && prequest != request_HEAD) {
  2017. /* POST for files does not make sense */
  2018. send_headers_and_exit(HTTP_NOT_IMPLEMENTED);
  2019. }
  2020. send_file_and_exit(tptr,
  2021. (prequest != request_HEAD ? SEND_HEADERS_AND_BODY : SEND_HEADERS)
  2022. );
  2023. #else
  2024. send_file_and_exit(tptr, SEND_HEADERS_AND_BODY);
  2025. #endif
  2026. }
  2027. /*
  2028. * The main http server function.
  2029. * Given a socket, listen for new connections and farm out
  2030. * the processing as a [v]forked process.
  2031. * Never returns.
  2032. */
  2033. #if BB_MMU
  2034. static void mini_httpd(int server_socket) NORETURN;
  2035. static void mini_httpd(int server_socket)
  2036. {
  2037. /* NB: it's best to not use xfuncs in this loop before fork().
  2038. * Otherwise server may die on transient errors (temporary
  2039. * out-of-memory condition, etc), which is Bad(tm).
  2040. * Try to do any dangerous calls after fork.
  2041. */
  2042. while (1) {
  2043. int n;
  2044. len_and_sockaddr fromAddr;
  2045. /* Wait for connections... */
  2046. fromAddr.len = LSA_SIZEOF_SA;
  2047. n = accept(server_socket, &fromAddr.u.sa, &fromAddr.len);
  2048. if (n < 0)
  2049. continue;
  2050. /* set the KEEPALIVE option to cull dead connections */
  2051. setsockopt(n, SOL_SOCKET, SO_KEEPALIVE, &const_int_1, sizeof(const_int_1));
  2052. if (fork() == 0) {
  2053. /* child */
  2054. /* Do not reload config on HUP */
  2055. signal(SIGHUP, SIG_IGN);
  2056. close(server_socket);
  2057. xmove_fd(n, 0);
  2058. xdup2(0, 1);
  2059. handle_incoming_and_exit(&fromAddr);
  2060. }
  2061. /* parent, or fork failed */
  2062. close(n);
  2063. } /* while (1) */
  2064. /* never reached */
  2065. }
  2066. #else
  2067. static void mini_httpd_nommu(int server_socket, int argc, char **argv) NORETURN;
  2068. static void mini_httpd_nommu(int server_socket, int argc, char **argv)
  2069. {
  2070. char *argv_copy[argc + 2];
  2071. argv_copy[0] = argv[0];
  2072. argv_copy[1] = (char*)"-i";
  2073. memcpy(&argv_copy[2], &argv[1], argc * sizeof(argv[0]));
  2074. /* NB: it's best to not use xfuncs in this loop before vfork().
  2075. * Otherwise server may die on transient errors (temporary
  2076. * out-of-memory condition, etc), which is Bad(tm).
  2077. * Try to do any dangerous calls after fork.
  2078. */
  2079. while (1) {
  2080. int n;
  2081. len_and_sockaddr fromAddr;
  2082. /* Wait for connections... */
  2083. fromAddr.len = LSA_SIZEOF_SA;
  2084. n = accept(server_socket, &fromAddr.u.sa, &fromAddr.len);
  2085. if (n < 0)
  2086. continue;
  2087. /* set the KEEPALIVE option to cull dead connections */
  2088. setsockopt(n, SOL_SOCKET, SO_KEEPALIVE, &const_int_1, sizeof(const_int_1));
  2089. if (vfork() == 0) {
  2090. /* child */
  2091. /* Do not reload config on HUP */
  2092. signal(SIGHUP, SIG_IGN);
  2093. close(server_socket);
  2094. xmove_fd(n, 0);
  2095. xdup2(0, 1);
  2096. /* Run a copy of ourself in inetd mode */
  2097. re_exec(argv_copy);
  2098. }
  2099. /* parent, or vfork failed */
  2100. close(n);
  2101. } /* while (1) */
  2102. /* never reached */
  2103. }
  2104. #endif
  2105. /*
  2106. * Process a HTTP connection on stdin/out.
  2107. * Never returns.
  2108. */
  2109. static void mini_httpd_inetd(void) NORETURN;
  2110. static void mini_httpd_inetd(void)
  2111. {
  2112. len_and_sockaddr fromAddr;
  2113. memset(&fromAddr, 0, sizeof(fromAddr));
  2114. fromAddr.len = LSA_SIZEOF_SA;
  2115. /* NB: can fail if user runs it by hand and types in http cmds */
  2116. getpeername(0, &fromAddr.u.sa, &fromAddr.len);
  2117. handle_incoming_and_exit(&fromAddr);
  2118. }
  2119. static void sighup_handler(int sig UNUSED_PARAM)
  2120. {
  2121. parse_conf(DEFAULT_PATH_HTTPD_CONF, SIGNALED_PARSE);
  2122. }
  2123. enum {
  2124. c_opt_config_file = 0,
  2125. d_opt_decode_url,
  2126. h_opt_home_httpd,
  2127. IF_FEATURE_HTTPD_ENCODE_URL_STR(e_opt_encode_url,)
  2128. IF_FEATURE_HTTPD_BASIC_AUTH( r_opt_realm ,)
  2129. IF_FEATURE_HTTPD_AUTH_MD5( m_opt_md5 ,)
  2130. IF_FEATURE_HTTPD_SETUID( u_opt_setuid ,)
  2131. p_opt_port ,
  2132. p_opt_inetd ,
  2133. p_opt_foreground,
  2134. p_opt_verbose ,
  2135. OPT_CONFIG_FILE = 1 << c_opt_config_file,
  2136. OPT_DECODE_URL = 1 << d_opt_decode_url,
  2137. OPT_HOME_HTTPD = 1 << h_opt_home_httpd,
  2138. OPT_ENCODE_URL = IF_FEATURE_HTTPD_ENCODE_URL_STR((1 << e_opt_encode_url)) + 0,
  2139. OPT_REALM = IF_FEATURE_HTTPD_BASIC_AUTH( (1 << r_opt_realm )) + 0,
  2140. OPT_MD5 = IF_FEATURE_HTTPD_AUTH_MD5( (1 << m_opt_md5 )) + 0,
  2141. OPT_SETUID = IF_FEATURE_HTTPD_SETUID( (1 << u_opt_setuid )) + 0,
  2142. OPT_PORT = 1 << p_opt_port,
  2143. OPT_INETD = 1 << p_opt_inetd,
  2144. OPT_FOREGROUND = 1 << p_opt_foreground,
  2145. OPT_VERBOSE = 1 << p_opt_verbose,
  2146. };
  2147. int httpd_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
  2148. int httpd_main(int argc UNUSED_PARAM, char **argv)
  2149. {
  2150. int server_socket = server_socket; /* for gcc */
  2151. unsigned opt;
  2152. char *url_for_decode;
  2153. IF_FEATURE_HTTPD_ENCODE_URL_STR(const char *url_for_encode;)
  2154. IF_FEATURE_HTTPD_SETUID(const char *s_ugid = NULL;)
  2155. IF_FEATURE_HTTPD_SETUID(struct bb_uidgid_t ugid;)
  2156. IF_FEATURE_HTTPD_AUTH_MD5(const char *pass;)
  2157. INIT_G();
  2158. #if ENABLE_LOCALE_SUPPORT
  2159. /* Undo busybox.c: we want to speak English in http (dates etc) */
  2160. setlocale(LC_TIME, "C");
  2161. #endif
  2162. home_httpd = xrealloc_getcwd_or_warn(NULL);
  2163. /* -v counts, -i implies -f */
  2164. opt_complementary = "vv:if";
  2165. /* We do not "absolutize" path given by -h (home) opt.
  2166. * If user gives relative path in -h,
  2167. * $SCRIPT_FILENAME will not be set. */
  2168. opt = getopt32(argv, "c:d:h:"
  2169. IF_FEATURE_HTTPD_ENCODE_URL_STR("e:")
  2170. IF_FEATURE_HTTPD_BASIC_AUTH("r:")
  2171. IF_FEATURE_HTTPD_AUTH_MD5("m:")
  2172. IF_FEATURE_HTTPD_SETUID("u:")
  2173. "p:ifv",
  2174. &opt_c_configFile, &url_for_decode, &home_httpd
  2175. IF_FEATURE_HTTPD_ENCODE_URL_STR(, &url_for_encode)
  2176. IF_FEATURE_HTTPD_BASIC_AUTH(, &g_realm)
  2177. IF_FEATURE_HTTPD_AUTH_MD5(, &pass)
  2178. IF_FEATURE_HTTPD_SETUID(, &s_ugid)
  2179. , &bind_addr_or_port
  2180. , &verbose
  2181. );
  2182. if (opt & OPT_DECODE_URL) {
  2183. fputs(decodeString(url_for_decode, 1), stdout);
  2184. return 0;
  2185. }
  2186. #if ENABLE_FEATURE_HTTPD_ENCODE_URL_STR
  2187. if (opt & OPT_ENCODE_URL) {
  2188. fputs(encodeString(url_for_encode), stdout);
  2189. return 0;
  2190. }
  2191. #endif
  2192. #if ENABLE_FEATURE_HTTPD_AUTH_MD5
  2193. if (opt & OPT_MD5) {
  2194. char salt[sizeof("$1$XXXXXXXX")];
  2195. salt[0] = '$';
  2196. salt[1] = '1';
  2197. salt[2] = '$';
  2198. crypt_make_salt(salt + 3, 4, 0);
  2199. puts(pw_encrypt(pass, salt, 1));
  2200. return 0;
  2201. }
  2202. #endif
  2203. #if ENABLE_FEATURE_HTTPD_SETUID
  2204. if (opt & OPT_SETUID) {
  2205. xget_uidgid(&ugid, s_ugid);
  2206. }
  2207. #endif
  2208. #if !BB_MMU
  2209. if (!(opt & OPT_FOREGROUND)) {
  2210. bb_daemonize_or_rexec(0, argv); /* don't change current directory */
  2211. }
  2212. #endif
  2213. xchdir(home_httpd);
  2214. if (!(opt & OPT_INETD)) {
  2215. signal(SIGCHLD, SIG_IGN);
  2216. server_socket = openServer();
  2217. #if ENABLE_FEATURE_HTTPD_SETUID
  2218. /* drop privileges */
  2219. if (opt & OPT_SETUID) {
  2220. if (ugid.gid != (gid_t)-1) {
  2221. if (setgroups(1, &ugid.gid) == -1)
  2222. bb_perror_msg_and_die("setgroups");
  2223. xsetgid(ugid.gid);
  2224. }
  2225. xsetuid(ugid.uid);
  2226. }
  2227. #endif
  2228. }
  2229. #if 0
  2230. /* User can do it himself: 'env - PATH="$PATH" httpd'
  2231. * We don't do it because we don't want to screw users
  2232. * which want to do
  2233. * 'env - VAR1=val1 VAR2=val2 httpd'
  2234. * and have VAR1 and VAR2 values visible in their CGIs.
  2235. * Besides, it is also smaller. */
  2236. {
  2237. char *p = getenv("PATH");
  2238. /* env strings themself are not freed, no need to xstrdup(p): */
  2239. clearenv();
  2240. if (p)
  2241. putenv(p - 5);
  2242. // if (!(opt & OPT_INETD))
  2243. // setenv_long("SERVER_PORT", ???);
  2244. }
  2245. #endif
  2246. parse_conf(DEFAULT_PATH_HTTPD_CONF, FIRST_PARSE);
  2247. if (!(opt & OPT_INETD))
  2248. signal(SIGHUP, sighup_handler);
  2249. xfunc_error_retval = 0;
  2250. if (opt & OPT_INETD)
  2251. mini_httpd_inetd();
  2252. #if BB_MMU
  2253. if (!(opt & OPT_FOREGROUND))
  2254. bb_daemonize(0); /* don't change current directory */
  2255. mini_httpd(server_socket); /* never returns */
  2256. #else
  2257. mini_httpd_nommu(server_socket, argc, argv); /* never returns */
  2258. #endif
  2259. /* return 0; */
  2260. }