/*---------------------------------------------------------------------------*/
static
PT_THREAD(handle_input(struct httpd_state *s))
{
PSOCK_BEGIN(&s->sin);
PSOCK_READTO(&s->sin, ISO_space);
if(strncmp(s->inputbuf, http_get, 4) != 0) {
PSOCK_CLOSE_EXIT(&s->sin);
}
PSOCK_READTO(&s->sin, ISO_space);
if(s->inputbuf[0] != ISO_slash) {
PSOCK_CLOSE_EXIT(&s->sin);
}
if(s->inputbuf[1] == ISO_space) {
strncpy(s->filename, http_index_html, sizeof(s->filename));
} else {
s->inputbuf[PSOCK_DATALEN(&s->sin) - 1] = 0;
strncpy(s->filename, &s->inputbuf[0], sizeof(s->filename));
}
httpd_log_file(uip_conn->ripaddr, s->filename);
s->state = STATE_OUTPUT;
while(1) {
PSOCK_READTO(&s->sin, ISO_nl);
if(strncmp(s->inputbuf, http_referer, 8) == 0) {
s->inputbuf[PSOCK_DATALEN(&s->sin) - 2] = 0;
httpd_log(&s->inputbuf[9]);
}
}
PSOCK_END(&s->sin);
}
static gboolean
run (int argc, char **argv, GCancellable *cancellable, GError **error)
{
gboolean ret = FALSE;
g_autoptr(GOptionContext) context = NULL;
const char *dirpath;
OtTrivialHttpd appstruct = { 0, };
OtTrivialHttpd *app = &appstruct;
glnx_unref_object SoupServer *server = NULL;
g_autoptr(GFileMonitor) dirmon = NULL;
context = g_option_context_new ("[DIR] - Simple webserver");
g_option_context_add_main_entries (context, options, NULL);
app->root_dfd = -1;
if (!g_option_context_parse (context, &argc, &argv, error))
goto out;
if (argc > 1)
dirpath = argv[1];
else
dirpath = ".";
if (!glnx_opendirat (AT_FDCWD, dirpath, TRUE, &app->root_dfd, error))
goto out;
if (!(opt_random_500s_percentage >= 0 && opt_random_500s_percentage <= 99))
{
g_set_error (error, G_IO_ERROR, G_IO_ERROR_FAILED,
"Invalid --random-500s=%u", opt_random_500s_percentage);
goto out;
}
if (opt_log)
{
GOutputStream *stream = NULL;
if (g_strcmp0 (opt_log, "-") == 0)
{
if (opt_daemonize)
{
ot_util_usage_error (context, "Cannot use --log-file=- and --daemonize at the same time", error);
goto out;
}
stream = G_OUTPUT_STREAM (g_unix_output_stream_new (STDOUT_FILENO, FALSE));
}
else
{
g_autoptr(GFile) log_file = NULL;
GFileOutputStream* log_stream;
log_file = g_file_new_for_path (opt_log);
log_stream = g_file_create (log_file,
G_FILE_CREATE_PRIVATE,
cancellable,
error);
if (!log_stream)
goto out;
stream = G_OUTPUT_STREAM (log_stream);
}
app->log = stream;
}
#if SOUP_CHECK_VERSION(2, 48, 0)
server = soup_server_new (SOUP_SERVER_SERVER_HEADER, "ostree-httpd ", NULL);
if (!soup_server_listen_all (server, opt_port, 0, error))
goto out;
#else
server = soup_server_new (SOUP_SERVER_PORT, opt_port,
SOUP_SERVER_SERVER_HEADER, "ostree-httpd ",
NULL);
#endif
soup_server_add_handler (server, NULL, httpd_callback, app, NULL);
if (opt_port_file)
{
g_autofree char *portstr = NULL;
#if SOUP_CHECK_VERSION(2, 48, 0)
GSList *listeners = soup_server_get_listeners (server);
g_autoptr(GSocket) listener = NULL;
g_autoptr(GSocketAddress) addr = NULL;
g_assert (listeners);
listener = g_object_ref (listeners->data);
g_slist_free (listeners);
listeners = NULL;
addr = g_socket_get_local_address (listener, error);
if (!addr)
goto out;
g_assert (G_IS_INET_SOCKET_ADDRESS (addr));
portstr = g_strdup_printf ("%u\n", g_inet_socket_address_get_port ((GInetSocketAddress*)addr));
#else
portstr = g_strdup_printf ("%u\n", soup_server_get_port (server));
#endif
if (g_strcmp0 ("-", opt_port_file) == 0)
{
fputs (portstr, stdout); // not g_print - this must go to stdout, not a handler
fflush (stdout);
}
else if (!g_file_set_contents (opt_port_file, portstr, strlen (portstr), error))
goto out;
}
#if !SOUP_CHECK_VERSION(2, 48, 0)
soup_server_run_async (server);
#endif
if (opt_daemonize)
{
pid_t pid = fork();
if (pid == -1)
{
int errsv = errno;
g_set_error_literal (error, G_IO_ERROR, g_io_error_from_errno (errsv),
g_strerror (errsv));
goto out;
}
else if (pid > 0)
{
ret = TRUE;
goto out;
}
/* Child, continue */
if (setsid () < 0)
err (1, "setsid");
/* Daemonising: close stdout/stderr so $() et al work on us */
if (freopen("/dev/null", "r", stdin) == NULL)
err (1, "freopen");
if (freopen("/dev/null", "w", stdout) == NULL)
err (1, "freopen");
if (freopen("/dev/null", "w", stderr) == NULL)
err (1, "freopen");
}
else
{
/* Since we're used for testing purposes, let's just do this by
* default. This ensures we exit when our parent does.
*/
if (prctl (PR_SET_PDEATHSIG, SIGTERM) != 0)
{
if (errno != ENOSYS)
{
glnx_set_error_from_errno (error);
goto out;
}
}
}
app->running = TRUE;
if (opt_autoexit)
{
gboolean is_symlink = FALSE;
g_autoptr(GFile) root = NULL;
g_autoptr(GFileInfo) info = NULL;
root = g_file_new_for_path (dirpath);
info = g_file_query_info (root,
G_FILE_ATTRIBUTE_STANDARD_IS_SYMLINK,
G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS,
cancellable, error);
if (!info)
goto out;
is_symlink = g_file_info_get_is_symlink (info);
if (is_symlink)
dirmon = g_file_monitor_file (root, 0, cancellable, error);
else
dirmon = g_file_monitor_directory (root, 0, cancellable, error);
if (!dirmon)
goto out;
g_signal_connect (dirmon, "changed", G_CALLBACK (on_dir_changed), app);
}
httpd_log (app, "serving at root %s\n", dirpath);
while (app->running)
g_main_context_iteration (NULL, TRUE);
ret = TRUE;
out:
if (app->root_dfd != -1)
(void) close (app->root_dfd);
g_clear_object (&app->log);
return ret;
}
static void
do_get (OtTrivialHttpd *self,
SoupServer *server,
SoupMessage *msg,
const char *path,
SoupClientContext *context)
{
char *slash;
int ret;
struct stat stbuf;
httpd_log (self, "serving %s\n", path);
if (opt_expected_cookies)
{
GSList *cookies = soup_cookies_from_request (msg);
GSList *l;
int i;
for (i = 0 ; opt_expected_cookies[i] != NULL; i++)
{
gboolean found = FALSE;
gchar *k = opt_expected_cookies[i];
gchar *v = strchr (k, '=') + 1;
for (l = cookies; l != NULL ; l = g_slist_next (l))
{
SoupCookie *c = l->data;
if (!strncmp (k, soup_cookie_get_name (c), v - k - 1) &&
!strcmp (v, soup_cookie_get_value (c)))
{
found = TRUE;
break;
}
}
if (!found)
{
httpd_log (self, "Expected cookie not found %s\n", k);
soup_message_set_status (msg, SOUP_STATUS_FORBIDDEN);
soup_cookies_free (cookies);
goto out;
}
}
soup_cookies_free (cookies);
}
if (opt_expected_headers)
{
for (int i = 0 ; opt_expected_headers[i] != NULL; i++)
{
const gchar *kv = opt_expected_headers[i];
const gchar *eq = strchr (kv, '=');
g_assert (eq);
{
g_autofree char *k = g_strndup (kv, eq - kv);
const gchar *expected_v = eq + 1;
const gchar *found_v = soup_message_headers_get_one (msg->request_headers, k);
if (!found_v)
{
httpd_log (self, "Expected header not found %s\n", k);
soup_message_set_status (msg, SOUP_STATUS_FORBIDDEN);
goto out;
}
if (strcmp (found_v, expected_v) != 0)
{
httpd_log (self, "Expected header %s: %s but found %s\n", k, expected_v, found_v);
soup_message_set_status (msg, SOUP_STATUS_FORBIDDEN);
goto out;
}
}
}
}
if (strstr (path, "../") != NULL)
{
soup_message_set_status (msg, SOUP_STATUS_FORBIDDEN);
goto out;
}
if (opt_random_500s_percentage > 0 &&
emitted_random_500s_count < opt_random_500s_max &&
g_random_int_range (0, 100) < opt_random_500s_percentage)
{
emitted_random_500s_count++;
soup_message_set_status (msg, SOUP_STATUS_INTERNAL_SERVER_ERROR);
goto out;
}
while (path[0] == '/')
path++;
do
ret = fstatat (self->root_dfd, path, &stbuf, 0);
while (ret == -1 && errno == EINTR);
if (ret == -1)
{
if (errno == EPERM)
soup_message_set_status (msg, SOUP_STATUS_FORBIDDEN);
else if (errno == ENOENT)
soup_message_set_status (msg, SOUP_STATUS_NOT_FOUND);
else
soup_message_set_status (msg, SOUP_STATUS_INTERNAL_SERVER_ERROR);
goto out;
}
if (!is_safe_to_access (&stbuf))
{
soup_message_set_status (msg, SOUP_STATUS_FORBIDDEN);
goto out;
}
if (S_ISDIR (stbuf.st_mode))
{
slash = strrchr (path, '/');
if (!slash || slash[1])
{
g_autofree char *redir_uri = NULL;
redir_uri = g_strdup_printf ("%s/", soup_message_get_uri (msg)->path);
soup_message_set_redirect (msg, SOUP_STATUS_MOVED_PERMANENTLY,
redir_uri);
}
else
{
g_autofree char *index_realpath = g_strconcat (path, "/index.html", NULL);
if (fstatat (self->root_dfd, index_realpath, &stbuf, 0) != -1)
{
g_autofree char *index_path = g_strconcat (path, "/index.html", NULL);
do_get (self, server, msg, index_path, context);
}
else
{
GString *listing = get_directory_listing (self->root_dfd, path);
soup_message_set_response (msg, "text/html",
SOUP_MEMORY_TAKE,
listing->str, listing->len);
soup_message_set_status (msg, SOUP_STATUS_OK);
g_string_free (listing, FALSE);
}
}
}
else
{
if (!S_ISREG (stbuf.st_mode))
{
soup_message_set_status (msg, SOUP_STATUS_FORBIDDEN);
goto out;
}
if (msg->method == SOUP_METHOD_GET)
{
glnx_autofd int fd = -1;
g_autoptr(GMappedFile) mapping = NULL;
gsize buffer_length, file_size;
SoupRange *ranges;
int ranges_length;
gboolean have_ranges;
fd = openat (self->root_dfd, path, O_RDONLY | O_CLOEXEC);
if (fd < 0)
{
soup_message_set_status (msg, SOUP_STATUS_INTERNAL_SERVER_ERROR);
goto out;
}
mapping = g_mapped_file_new_from_fd (fd, FALSE, NULL);
if (!mapping)
{
soup_message_set_status (msg, SOUP_STATUS_INTERNAL_SERVER_ERROR);
goto out;
}
(void) close (fd); fd = -1;
file_size = g_mapped_file_get_length (mapping);
have_ranges = soup_message_headers_get_ranges(msg->request_headers, file_size, &ranges, &ranges_length);
if (opt_force_ranges && !have_ranges && g_strrstr (path, "/objects") != NULL)
{
SoupSocket *sock;
buffer_length = file_size/2;
soup_message_headers_set_content_length (msg->response_headers, file_size);
soup_message_headers_append (msg->response_headers,
"Connection", "close");
/* soup-message-io will wait for us to add
* another chunk after the first, to fill out
* the declared Content-Length. Instead, we
* forcibly close the socket at that point.
*/
sock = soup_client_context_get_socket (context);
g_signal_connect (msg, "wrote-chunk", G_CALLBACK (close_socket), sock);
}
else
buffer_length = file_size;
if (have_ranges)
{
if (ranges_length > 0 && ranges[0].start >= file_size)
{
soup_message_set_status (msg, SOUP_STATUS_REQUESTED_RANGE_NOT_SATISFIABLE);
soup_message_headers_free_ranges (msg->request_headers, ranges);
goto out;
}
soup_message_headers_free_ranges (msg->request_headers, ranges);
}
if (buffer_length > 0)
{
SoupBuffer *buffer;
buffer = soup_buffer_new_with_owner (g_mapped_file_get_contents (mapping),
buffer_length,
g_mapped_file_ref (mapping),
(GDestroyNotify)g_mapped_file_unref);
soup_message_body_append_buffer (msg->response_body, buffer);
soup_buffer_free (buffer);
}
}
else /* msg->method == SOUP_METHOD_HEAD */
{
g_autofree char *length = NULL;
/* We could just use the same code for both GET and
* HEAD (soup-message-server-io.c will fix things up).
* But we'll optimize and avoid the extra I/O.
*/
length = g_strdup_printf ("%lu", (gulong)stbuf.st_size);
soup_message_headers_append (msg->response_headers,
"Content-Length", length);
}
soup_message_set_status (msg, SOUP_STATUS_OK);
}
out:
{
guint status = 0;
g_autofree gchar *reason = NULL;
g_object_get (msg,
"status-code", &status,
"reason-phrase", &reason,
NULL);
httpd_log (self, " status: %s (%u)\n", reason, status);
}
return;
}
int ssl_server_init(char* ca_file, char *crt_file, char *key_file, char *dhp_file, char *ssl_cipher_list)
{
static const char *ssl_ctx_id = "httpd";
long ssl_options;
if (!crt_file || !f_exists(crt_file)) {
httpd_log("%s: Server certificate (%s) is not found!", SYSLOG_ID_SSL, crt_file);
httpd_log("Please manual build the certificate via \"%s\" script.", "https-cert.sh");
return -1;
}
if (!key_file || !f_exists(key_file)) {
httpd_log("%s: Server private key (%s) is not found!", SYSLOG_ID_SSL, key_file);
httpd_log("Please manual build the certificate via \"%s\" script.", "https-cert.sh");
return -1;
}
SSL_load_error_strings();
SSL_library_init();
ssl_ctx = SSL_CTX_new(SSLv23_server_method());
if (!ssl_ctx) {
httpd_log("%s: Unable to create SSL context!", SYSLOG_ID_SSL);
return -1;
}
ssl_options = SSL_OP_ALL | SSL_OP_NO_COMPRESSION | SSL_OP_NO_SSLv2 |
SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION;
SSL_CTX_set_options(ssl_ctx, ssl_options);
SSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_NONE, NULL);
if (ssl_cipher_list && strlen(ssl_cipher_list) > 2) {
if (SSL_CTX_set_cipher_list(ssl_ctx, ssl_cipher_list) != 1) {
httpd_log("%s: Cannot set SSL cipher list (%s)!", SYSLOG_ID_SSL, ssl_cipher_list);
} else {
SSL_CTX_set_options(ssl_ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
}
}
if (ca_file && f_exists(ca_file)) {
if (SSL_CTX_load_verify_locations(ssl_ctx, ca_file, NULL) != 1) {
httpd_log("%s: Cannot load CA certificate (%s)!", SYSLOG_ID_SSL, ca_file);
}
}
if (SSL_CTX_use_certificate_file(ssl_ctx, crt_file, SSL_FILETYPE_PEM) != 1) {
httpd_log("%s: Cannot load server certificate (%s)!", SYSLOG_ID_SSL, crt_file);
ssl_server_uninit();
return 1;
}
if (SSL_CTX_use_PrivateKey_file(ssl_ctx, key_file, SSL_FILETYPE_PEM) != 1) {
httpd_log("%s: Cannot load server private key (%s)!", SYSLOG_ID_SSL, key_file);
ssl_server_uninit();
return 1;
}
if (SSL_CTX_check_private_key(ssl_ctx) != 1) {
httpd_log("%s: Private key does not match the certificate!", SYSLOG_ID_SSL);
ssl_server_uninit();
return 1;
}
if (dhp_file && f_exists(dhp_file)) {
/* DH parameters from file */
BIO *bio = BIO_new_file(dhp_file, "r");
if (bio) {
DH *dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
BIO_free(bio);
if (dh) {
SSL_CTX_set_tmp_dh(ssl_ctx, dh);
SSL_CTX_set_options(ssl_ctx, SSL_OP_SINGLE_DH_USE);
DH_free(dh);
} else {
httpd_log("%s: Cannot load DH parameters (%s)!", SYSLOG_ID_SSL, dhp_file);
}
}
} else {
/* Default DH parameters from RFC5114 */
DH *dh = DH_new();
if (dh) {
dh->p = BN_bin2bn(dh1024_p, sizeof(dh1024_p), NULL);
dh->g = BN_bin2bn(dh1024_g, sizeof(dh1024_g), NULL);
dh->length = 160;
if (dh->p && dh->g) {
SSL_CTX_set_tmp_dh(ssl_ctx, dh);
SSL_CTX_set_options(ssl_ctx, SSL_OP_SINGLE_DH_USE);
}
DH_free(dh);
}
}
SSL_CTX_set_default_read_ahead(ssl_ctx, 1);
SSL_CTX_set_session_cache_mode(ssl_ctx, SSL_SESS_CACHE_SERVER);
SSL_CTX_set_session_id_context(ssl_ctx, (unsigned char *)ssl_ctx_id, strlen(ssl_ctx_id));
SSL_CTX_sess_set_cache_size(ssl_ctx, 10);
SSL_CTX_set_info_callback(ssl_ctx, http_ssl_info_cb);
return 0;
}
static void
do_get (OtTrivialHttpd *self,
SoupServer *server,
SoupMessage *msg,
const char *path,
SoupClientContext *context)
{
char *slash;
int ret;
struct stat stbuf;
g_autofree char *safepath = NULL;
httpd_log (self, "serving %s\n", path);
if (strstr (path, "../") != NULL)
{
soup_message_set_status (msg, SOUP_STATUS_FORBIDDEN);
goto out;
}
if (opt_random_500s_percentage > 0 &&
emitted_random_500s_count < opt_random_500s_max &&
g_random_int_range (0, 100) < opt_random_500s_percentage)
{
emitted_random_500s_count++;
soup_message_set_status (msg, SOUP_STATUS_INTERNAL_SERVER_ERROR);
goto out;
}
if (path[0] == '/')
path++;
safepath = g_build_filename (gs_file_get_path_cached (self->root), path, NULL);
do
ret = stat (safepath, &stbuf);
while (ret == -1 && errno == EINTR);
if (ret == -1)
{
if (errno == EPERM)
soup_message_set_status (msg, SOUP_STATUS_FORBIDDEN);
else if (errno == ENOENT)
soup_message_set_status (msg, SOUP_STATUS_NOT_FOUND);
else
soup_message_set_status (msg, SOUP_STATUS_INTERNAL_SERVER_ERROR);
goto out;
}
if (!is_safe_to_access (&stbuf))
{
soup_message_set_status (msg, SOUP_STATUS_FORBIDDEN);
goto out;
}
if (S_ISDIR (stbuf.st_mode))
{
slash = strrchr (safepath, '/');
if (!slash || slash[1])
{
g_autofree char *redir_uri = NULL;
redir_uri = g_strdup_printf ("%s/", soup_message_get_uri (msg)->path);
soup_message_set_redirect (msg, SOUP_STATUS_MOVED_PERMANENTLY,
redir_uri);
}
else
{
g_autofree char *index_realpath = g_strconcat (safepath, "/index.html", NULL);
if (stat (index_realpath, &stbuf) != -1)
{
g_autofree char *index_path = g_strconcat (path, "/index.html", NULL);
do_get (self, server, msg, index_path, context);
}
else
{
GString *listing = get_directory_listing (safepath);
soup_message_set_response (msg, "text/html",
SOUP_MEMORY_TAKE,
listing->str, listing->len);
soup_message_set_status (msg, SOUP_STATUS_OK);
g_string_free (listing, FALSE);
}
}
}
else
{
if (!S_ISREG (stbuf.st_mode))
{
soup_message_set_status (msg, SOUP_STATUS_FORBIDDEN);
goto out;
}
if (msg->method == SOUP_METHOD_GET)
{
g_autoptr(GMappedFile) mapping = NULL;
gsize buffer_length, file_size;
SoupRange *ranges;
int ranges_length;
gboolean have_ranges;
mapping = g_mapped_file_new (safepath, FALSE, NULL);
if (!mapping)
{
soup_message_set_status (msg, SOUP_STATUS_INTERNAL_SERVER_ERROR);
goto out;
}
file_size = g_mapped_file_get_length (mapping);
have_ranges = soup_message_headers_get_ranges(msg->request_headers, file_size, &ranges, &ranges_length);
if (opt_force_ranges && !have_ranges && g_strrstr (path, "/objects") != NULL)
{
SoupSocket *sock;
buffer_length = file_size/2;
soup_message_headers_set_content_length (msg->response_headers, file_size);
soup_message_headers_append (msg->response_headers,
"Connection", "close");
/* soup-message-io will wait for us to add
* another chunk after the first, to fill out
* the declared Content-Length. Instead, we
* forcibly close the socket at that point.
*/
sock = soup_client_context_get_socket (context);
g_signal_connect (msg, "wrote-chunk", G_CALLBACK (close_socket), sock);
}
else
buffer_length = file_size;
if (have_ranges)
{
if (ranges_length > 0 && ranges[0].start >= file_size)
{
soup_message_set_status (msg, SOUP_STATUS_REQUESTED_RANGE_NOT_SATISFIABLE);
soup_message_headers_free_ranges (msg->request_headers, ranges);
goto out;
}
soup_message_headers_free_ranges (msg->request_headers, ranges);
}
if (buffer_length > 0)
{
SoupBuffer *buffer;
buffer = soup_buffer_new_with_owner (g_mapped_file_get_contents (mapping),
buffer_length,
g_mapped_file_ref (mapping),
(GDestroyNotify)g_mapped_file_unref);
soup_message_body_append_buffer (msg->response_body, buffer);
soup_buffer_free (buffer);
}
}
else /* msg->method == SOUP_METHOD_HEAD */
{
g_autofree char *length = NULL;
/* We could just use the same code for both GET and
* HEAD (soup-message-server-io.c will fix things up).
* But we'll optimize and avoid the extra I/O.
*/
length = g_strdup_printf ("%lu", (gulong)stbuf.st_size);
soup_message_headers_append (msg->response_headers,
"Content-Length", length);
}
soup_message_set_status (msg, SOUP_STATUS_OK);
}
out:
{
guint status = 0;
g_autofree gchar *reason = NULL;
g_object_get (msg,
"status-code", &status,
"reason-phrase", &reason,
NULL);
httpd_log (self, " status: %s (%u)\n", reason, status);
}
return;
}
