src/mod_cgi.c

   1 #include "first.h"
   2
   3 #include "server.h"
   4 #include "stat_cache.h"
   5 #include "keyvalue.h"
   6 #include "log.h"
   7 #include "connections.h"
   8 #include "joblist.h"
   9 #include "response.h"
  10 #include "http_chunk.h"
  11 #include "network_backends.h"
  12
  13 #include "plugin.h"
  14
  15 #include <sys/types.h>
  16 #include "sys-mmap.h"
  17
  18 #ifdef __WIN32
  19 # include <winsock2.h>
  20 #else
  21 # include <sys/socket.h>
  22 # include <sys/wait.h>
  23 # include <netinet/in.h>
  24 # include <arpa/inet.h>
  25 #endif
  26
  27 #include <unistd.h>
  28 #include <errno.h>
  29 #include <stdlib.h>
  30 #include <string.h>
  31 #include <fdevent.h>
  32 #include <signal.h>
  33 #include <ctype.h>
  34 #include <assert.h>
  35
  36 #include <stdio.h>
  37 #include <fcntl.h>
  38
  39 #if defined(O_CLOEXEC) && (!defined(__FreeBSD__) || defined(SOCK_CLOEXEC)) \
  40  && !(defined(__APPLE__) && defined(__MACH__))
  41 #define pipe_cloexec(pipefd) pipe2((pipefd), O_CLOEXEC)
  42 #elif defined FD_CLOEXEC
  43 #define pipe_cloexec(pipefd) \
  44   (   0 == pipe(pipefd) \
  45    && 0 == fcntl(pipefd[0], F_SETFD, FD_CLOEXEC) \
  46    && 0 == fcntl(pipefd[1], F_SETFD, FD_CLOEXEC) \
  47     ? 0 \
  48     : -1)
  49 #else
  50 #define pipe_cloexec(pipefd) pipe(pipefd)
  51 #endif
  52
  53 enum {EOL_UNSET, EOL_N, EOL_RN};
  54
  55 typedef struct {
  56         char **ptr;
  57
  58         size_t size;
  59         size_t used;
  60 } char_array;
  61
  62 typedef struct {
  63         pid_t *ptr;
  64         size_t used;
  65         size_t size;
  66 } buffer_pid_t;
  67
  68 typedef struct {
  69         array *cgi;
  70         unsigned short execute_x_only;
  71         unsigned short xsendfile_allow;
  72         array *xsendfile_docroot;
  73 } plugin_config;
  74
  75 typedef struct {
  76         PLUGIN_DATA;
  77         buffer_pid_t cgi_pid;
  78
  79         buffer *parse_response;
  80
  81         plugin_config **config_storage;
  82
  83         plugin_config conf;
  84 } plugin_data;
  85
  86 typedef struct {
  87         pid_t pid;
  88         int fd;
  89         int fdtocgi;
  90         int fde_ndx; /* index into the fd-event buffer */
  91         int fde_ndx_tocgi; /* index into the fd-event buffer */
  92
  93         connection *remote_conn;  /* dumb pointer */
  94         plugin_data *plugin_data; /* dumb pointer */
  95
  96         buffer *response;
  97         buffer *response_header;
  98 } handler_ctx;
  99
 100 static handler_ctx * cgi_handler_ctx_init(void) {
 101         handler_ctx *hctx = calloc(1, sizeof(*hctx));
 102
 103         force_assert(hctx);
 104
 105         hctx->response = buffer_init();
 106         hctx->response_header = buffer_init();
 107         hctx->fd = -1;
 108         hctx->fdtocgi = -1;
 109
 110         return hctx;
 111 }
 112
 113 static void cgi_handler_ctx_free(handler_ctx *hctx) {
 114         buffer_free(hctx->response);
 115         buffer_free(hctx->response_header);
 116
 117         free(hctx);
 118 }
 119
 120 enum {FDEVENT_HANDLED_UNSET, FDEVENT_HANDLED_FINISHED, FDEVENT_HANDLED_NOT_FINISHED, FDEVENT_HANDLED_COMEBACK, FDEVENT_HANDLED_ERROR};
 121
 122 INIT_FUNC(mod_cgi_init) {
 123         plugin_data *p;
 124
 125         p = calloc(1, sizeof(*p));
 126
 127         force_assert(p);
 128
 129         p->parse_response = buffer_init();
 130
 131         return p;
 132 }
 133
 134
 135 FREE_FUNC(mod_cgi_free) {
 136         plugin_data *p = p_d;
 137         buffer_pid_t *r = &(p->cgi_pid);
 138
 139         UNUSED(srv);
 140
 141         if (p->config_storage) {
 142                 size_t i;
 143                 for (i = 0; i < srv->config_context->used; i++) {
 144                         plugin_config *s = p->config_storage[i];
 145
 146                         if (NULL == s) continue;
 147
 148                         array_free(s->cgi);
 149                         array_free(s->xsendfile_docroot);
 150
 151                         free(s);
 152                 }
 153                 free(p->config_storage);
 154         }
 155
 156
 157         if (r->ptr) free(r->ptr);
 158
 159         buffer_free(p->parse_response);
 160
 161         free(p);
 162
 163         return HANDLER_GO_ON;
 164 }
 165
 166 SETDEFAULTS_FUNC(mod_fastcgi_set_defaults) {
 167         plugin_data *p = p_d;
 168         size_t i = 0;
 169
 170         config_values_t cv[] = {
 171                 { "cgi.assign",                  NULL, T_CONFIG_ARRAY, T_CONFIG_SCOPE_CONNECTION },       /* 0 */
 172                 { "cgi.execute-x-only",          NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION },     /* 1 */
 173                 { "cgi.x-sendfile",              NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION },     /* 2 */
 174                 { "cgi.x-sendfile-docroot",      NULL, T_CONFIG_ARRAY,   T_CONFIG_SCOPE_CONNECTION },     /* 3 */
 175                 { NULL,                          NULL, T_CONFIG_UNSET, T_CONFIG_SCOPE_UNSET}
 176         };
 177
 178         if (!p) return HANDLER_ERROR;
 179
 180         p->config_storage = calloc(1, srv->config_context->used * sizeof(plugin_config *));
 181         force_assert(p->config_storage);
 182
 183         for (i = 0; i < srv->config_context->used; i++) {
 184                 data_config const* config = (data_config const*)srv->config_context->data[i];
 185                 plugin_config *s;
 186
 187                 s = calloc(1, sizeof(plugin_config));
 188                 force_assert(s);
 189
 190                 s->cgi    = array_init();
 191                 s->execute_x_only = 0;
 192                 s->xsendfile_allow= 0;
 193                 s->xsendfile_docroot = array_init();
 194
 195                 cv[0].destination = s->cgi;
 196                 cv[1].destination = &(s->execute_x_only);
 197                 cv[2].destination = &(s->xsendfile_allow);
 198                 cv[3].destination = s->xsendfile_docroot;
 199
 200                 p->config_storage[i] = s;
 201
 202                 if (0 != config_insert_values_global(srv, config->value, cv, i == 0 ? T_CONFIG_SCOPE_SERVER : T_CONFIG_SCOPE_CONNECTION)) {
 203                         return HANDLER_ERROR;
 204                 }
 205
 206                 if (s->xsendfile_docroot->used) {
 207                         size_t j;
 208                         for (j = 0; j < s->xsendfile_docroot->used; ++j) {
 209                                 data_string *ds = (data_string *)s->xsendfile_docroot->data[j];
 210                                 if (ds->type != TYPE_STRING) {
 211                                         log_error_write(srv, __FILE__, __LINE__, "s",
 212                                                 "unexpected type for key cgi.x-sendfile-docroot; expected: cgi.x-sendfile-docroot = ( \"/allowed/path\", ... )");
 213                                         return HANDLER_ERROR;
 214                                 }
 215                                 if (ds->value->ptr[0] != '/') {
 216                                         log_error_write(srv, __FILE__, __LINE__, "SBs",
 217                                                 "cgi.x-sendfile-docroot paths must begin with '/'; invalid: \"", ds->value, "\"");
 218                                         return HANDLER_ERROR;
 219                                 }
 220                                 buffer_path_simplify(ds->value, ds->value);
 221                                 buffer_append_slash(ds->value);
 222                         }
 223                 }
 224         }
 225
 226         return HANDLER_GO_ON;
 227 }
 228
 229
 230 static int cgi_pid_add(server *srv, plugin_data *p, pid_t pid) {
 231         int m = -1;
 232         size_t i;
 233         buffer_pid_t *r = &(p->cgi_pid);
 234
 235         UNUSED(srv);
 236
 237         for (i = 0; i < r->used; i++) {
 238                 if (r->ptr[i] > m) m = r->ptr[i];
 239         }
 240
 241         if (r->size == 0) {
 242                 r->size = 16;
 243                 r->ptr = malloc(sizeof(*r->ptr) * r->size);
 244                 force_assert(r->ptr);
 245         } else if (r->used == r->size) {
 246                 r->size += 16;
 247                 r->ptr = realloc(r->ptr, sizeof(*r->ptr) * r->size);
 248                 force_assert(r->ptr);
 249         }
 250
 251         r->ptr[r->used++] = pid;
 252
 253         return m;
 254 }
 255
 256 static int cgi_pid_del(server *srv, plugin_data *p, pid_t pid) {
 257         size_t i;
 258         buffer_pid_t *r = &(p->cgi_pid);
 259
 260         UNUSED(srv);
 261
 262         for (i = 0; i < r->used; i++) {
 263                 if (r->ptr[i] == pid) break;
 264         }
 265
 266         if (i != r->used) {
 267                 /* found */
 268
 269                 if (i != r->used - 1) {
 270                         r->ptr[i] = r->ptr[r->used - 1];
 271                 }
 272                 r->used--;
 273         }
 274
 275         return 0;
 276 }
 277
 278 static int cgi_response_parse(server *srv, connection *con, plugin_data *p, buffer *in) {
 279         char *ns;
 280         const char *s;
 281         int line = 0;
 282
 283         UNUSED(srv);
 284
 285         buffer_copy_buffer(p->parse_response, in);
 286
 287         for (s = p->parse_response->ptr;
 288              NULL != (ns = strchr(s, '\n'));
 289              s = ns + 1, line++) {
 290                 const char *key, *value;
 291                 int key_len;
 292                 data_string *ds;
 293
 294                 /* strip the \n */
 295                 ns[0] = '\0';
 296
 297                 if (ns > s && ns[-1] == '\r') ns[-1] = '\0';
 298
 299                 if (line == 0 &&
 300                     0 == strncmp(s, "HTTP/1.", 7)) {
 301                         /* non-parsed header ... we parse them anyway */
 302
 303                         if ((s[7] == '1' ||
 304                              s[7] == '0') &&
 305                             s[8] == ' ') {
 306                                 int status;
 307                                 /* after the space should be a status code for us */
 308
 309                                 status = strtol(s+9, NULL, 10);
 310
 311                                 if (status >= 100 &&
 312                                     status < 1000) {
 313                                         /* we expected 3 digits and didn't got them */
 314                                         con->parsed_response |= HTTP_STATUS;
 315                                         con->http_status = status;
 316                                 }
 317                         }
 318                 } else {
 319                         /* parse the headers */
 320                         key = s;
 321                         if (NULL == (value = strchr(s, ':'))) {
 322                                 /* we expect: "<key>: <value>\r\n" */
 323                                 continue;
 324                         }
 325
 326                         key_len = value - key;
 327                         value += 1;
 328
 329                         /* skip LWS */
 330                         while (*value == ' ' || *value == '\t') value++;
 331
 332                         if (NULL == (ds = (data_string *)array_get_unused_element(con->response.headers, TYPE_STRING))) {
 333                                 ds = data_response_init();
 334                         }
 335                         buffer_copy_string_len(ds->key, key, key_len);
 336                         buffer_copy_string(ds->value, value);
 337
 338                         array_insert_unique(con->response.headers, (data_unset *)ds);
 339
 340                         switch(key_len) {
 341                         case 4:
 342                                 if (0 == strncasecmp(key, "Date", key_len)) {
 343                                         con->parsed_response |= HTTP_DATE;
 344                                 }
 345                                 break;
 346                         case 6:
 347                                 if (0 == strncasecmp(key, "Status", key_len)) {
 348                                         int status = strtol(value, NULL, 10);
 349                                         if (status >= 100 && status < 1000) {
 350                                                 con->http_status = status;
 351                                                 con->parsed_response |= HTTP_STATUS;
 352                                         } else {
 353                                                 con->http_status = 502;
 354                                         }
 355                                 }
 356                                 break;
 357                         case 8:
 358                                 if (0 == strncasecmp(key, "Location", key_len)) {
 359                                         con->parsed_response |= HTTP_LOCATION;
 360                                 }
 361                                 break;
 362                         case 10:
 363                                 if (0 == strncasecmp(key, "Connection", key_len)) {
 364                                         con->response.keep_alive = (0 == strcasecmp(value, "Keep-Alive")) ? 1 : 0;
 365                                         con->parsed_response |= HTTP_CONNECTION;
 366                                 }
 367                                 break;
 368                         case 14:
 369                                 if (0 == strncasecmp(key, "Content-Length", key_len)) {
 370                                         con->response.content_length = strtoul(value, NULL, 10);
 371                                         con->parsed_response |= HTTP_CONTENT_LENGTH;
 372                                 }
 373                                 break;
 374                         default:
 375                                 break;
 376                         }
 377                 }
 378         }
 379
 380         /* CGI/1.1 rev 03 - 7.2.1.2 */
 381         if ((con->parsed_response & HTTP_LOCATION) &&
 382             !(con->parsed_response & HTTP_STATUS)) {
 383                 con->http_status = 302;
 384         }
 385
 386         return 0;
 387 }
 388
 389
 390 static int cgi_demux_response(server *srv, handler_ctx *hctx) {
 391         plugin_data *p    = hctx->plugin_data;
 392         connection  *con  = hctx->remote_conn;
 393
 394         while(1) {
 395                 int n;
 396                 int toread;
 397
 398 #if defined(__WIN32)
 399                 buffer_string_prepare_copy(hctx->response, 4 * 1024);
 400 #else
 401                 if (ioctl(con->fd, FIONREAD, &toread) || toread <= 4*1024) {
 402                         buffer_string_prepare_copy(hctx->response, 4 * 1024);
 403                 } else {
 404                         if (toread > MAX_READ_LIMIT) toread = MAX_READ_LIMIT;
 405                         buffer_string_prepare_copy(hctx->response, toread);
 406                 }
 407 #endif
 408
 409                 if (-1 == (n = read(hctx->fd, hctx->response->ptr, hctx->response->size - 1))) {
 410                         if (errno == EAGAIN || errno == EINTR) {
 411                                 /* would block, wait for signal */
 412                                 fdevent_event_add(srv->ev, &(hctx->fde_ndx), hctx->fd, FDEVENT_IN);
 413                                 return FDEVENT_HANDLED_NOT_FINISHED;
 414                         }
 415                         /* error */
 416                         log_error_write(srv, __FILE__, __LINE__, "sdd", strerror(errno), con->fd, hctx->fd);
 417                         return FDEVENT_HANDLED_ERROR;
 418                 }
 419
 420                 if (n == 0) {
 421                         /* read finished */
 422                         return FDEVENT_HANDLED_FINISHED;
 423                 }
 424
 425                 buffer_commit(hctx->response, n);
 426
 427                 /* split header from body */
 428
 429                 if (con->file_started == 0) {
 430                         int is_header = 0;
 431                         int is_header_end = 0;
 432                         size_t last_eol = 0;
 433                         size_t i, header_len;
 434
 435                         buffer_append_string_buffer(hctx->response_header, hctx->response);
 436
 437                         /**
 438                          * we have to handle a few cases:
 439                          *
 440                          * nph:
 441                          *
 442                          *   HTTP/1.0 200 Ok\n
 443                          *   Header: Value\n
 444                          *   \n
 445                          *
 446                          * CGI:
 447                          *   Header: Value\n
 448                          *   Status: 200\n
 449                          *   \n
 450                          *
 451                          * and different mixes of \n and \r\n combinations
 452                          *
 453                          * Some users also forget about CGI and just send a response and hope
 454                          * we handle it. No headers, no header-content seperator
 455                          *
 456                          */
 457
 458                         /* nph (non-parsed headers) */
 459                         if (0 == strncmp(hctx->response_header->ptr, "HTTP/1.", 7)) is_header = 1;
 460
 461                         header_len = buffer_string_length(hctx->response_header);
 462                         for (i = 0; !is_header_end && i < header_len; i++) {
 463                                 char c = hctx->response_header->ptr[i];
 464
 465                                 switch (c) {
 466                                 case ':':
 467                                         /* we found a colon
 468                                          *
 469                                          * looks like we have a normal header
 470                                          */
 471                                         is_header = 1;
 472                                         break;
 473                                 case '\n':
 474                                         /* EOL */
 475                                         if (is_header == 0) {
 476                                                 /* we got a EOL but we don't seem to got a HTTP header */
 477
 478                                                 is_header_end = 1;
 479
 480                                                 break;
 481                                         }
 482
 483                                         /**
 484                                          * check if we saw a \n(\r)?\n sequence
 485                                          */
 486                                         if (last_eol > 0 &&
 487                                             ((i - last_eol == 1) ||
 488                                              (i - last_eol == 2 && hctx->response_header->ptr[i - 1] == '\r'))) {
 489                                                 is_header_end = 1;
 490                                                 break;
 491                                         }
 492
 493                                         last_eol = i;
 494
 495                                         break;
 496                                 }
 497                         }
 498
 499                         if (is_header_end) {
 500                                 if (!is_header) {
 501                                         /* no header, but a body */
 502                                         if (0 != http_chunk_append_buffer(srv, con, hctx->response_header)) {
 503                                                 return FDEVENT_HANDLED_ERROR;
 504                                         }
 505                                 } else {
 506                                         const char *bstart;
 507                                         size_t blen;
 508
 509                                         /* the body starts after the EOL */
 510                                         bstart = hctx->response_header->ptr + i;
 511                                         blen = header_len - i;
 512
 513                                         /**
 514                                          * i still points to the char after the terminating EOL EOL
 515                                          *
 516                                          * put it on the last \n again
 517                                          */
 518                                         i--;
 519
 520                                         /* string the last \r?\n */
 521                                         if (i > 0 && (hctx->response_header->ptr[i - 1] == '\r')) {
 522                                                 i--;
 523                                         }
 524
 525                                         buffer_string_set_length(hctx->response_header, i);
 526
 527                                         /* parse the response header */
 528                                         cgi_response_parse(srv, con, p, hctx->response_header);
 529
 530                                         if (con->http_status >= 300 && con->http_status < 400) {
 531                                                 /*(con->parsed_response & HTTP_LOCATION)*/
 532                                                 data_string *ds;
 533                                                 if (NULL != (ds = (data_string *) array_get_element(con->response.headers, "Location"))
 534                                                     && ds->value->ptr[0] == '/') {
 535                                                         if (++con->loops_per_request > 5) {
 536                                                                 log_error_write(srv, __FILE__, __LINE__, "sb", "too many internal loops while processing request:", con->request.orig_uri);
 537                                                                 con->http_status = 500; /* Internal Server Error */
 538                                                                 con->mode = DIRECT;
 539                                                                 return FDEVENT_HANDLED_FINISHED;
 540                                                         }
 541
 542                                                         buffer_copy_buffer(con->request.uri, ds->value);
 543
 544                                                         if (con->request.content_length) {
 545                                                                 if ((off_t)con->request.content_length != chunkqueue_length(con->request_content_queue)) {
 546                                                                         con->keep_alive = 0;
 547                                                                 }
 548                                                                 con->request.content_length = 0;
 549                                                                 chunkqueue_reset(con->request_content_queue);
 550                                                         }
 551
 552                                                         if (con->http_status != 307 && con->http_status != 308) {
 553                                                                 /* Note: request body (if any) sent to initial dynamic handler
 554                                                                  * and is not available to the internal redirect */
 555                                                                 con->request.http_method = HTTP_METHOD_GET;
 556                                                         }
 557
 558                                                         connection_response_reset(srv, con); /*(includes con->http_status = 0)*/
 559
 560                                                         con->mode = DIRECT;
 561                                                         return FDEVENT_HANDLED_COMEBACK;
 562                                                 }
 563                                         }
 564
 565                                         if (p->conf.xsendfile_allow) {
 566                                                 data_string *ds;
 567                                                 if (NULL != (ds = (data_string *) array_get_element(con->response.headers, "X-Sendfile"))) {
 568                                                         http_response_xsendfile(srv, con, ds->value, p->conf.xsendfile_docroot);
 569                                                         return FDEVENT_HANDLED_FINISHED;
 570                                                 }
 571                                         }
 572
 573                                         if (blen > 0) {
 574                                                 if (0 != http_chunk_append_mem(srv, con, bstart, blen)) {
 575                                                         return FDEVENT_HANDLED_ERROR;
 576                                                 }
 577                                         }
 578                                 }
 579
 580                                 con->file_started = 1;
 581                         } else {
 582                                 /*(reuse MAX_HTTP_REQUEST_HEADER as max size for response headers from backends)*/
 583                                 if (header_len > MAX_HTTP_REQUEST_HEADER) {
 584                                         log_error_write(srv, __FILE__, __LINE__, "sb", "response headers too large for", con->uri.path);
 585                                         con->http_status = 502; /* Bad Gateway */
 586                                         con->mode = DIRECT;
 587                                         return FDEVENT_HANDLED_FINISHED;
 588                                 }
 589                         }
 590                 } else {
 591                         if (0 != http_chunk_append_buffer(srv, con, hctx->response)) {
 592                                 return FDEVENT_HANDLED_ERROR;
 593                         }
 594                         if ((con->conf.stream_response_body & FDEVENT_STREAM_RESPONSE_BUFMIN)
 595                             && chunkqueue_length(con->write_queue) > 65536 - 4096) {
 596                                 if (!con->is_writable) {
 597                                         /*(defer removal of FDEVENT_IN interest since
 598                                          * connection_state_machine() might be able to send data
 599                                          * immediately, unless !con->is_writable, where
 600                                          * connection_state_machine() might not loop back to call
 601                                          * mod_cgi_handle_subrequest())*/
 602                                         fdevent_event_clr(srv->ev, &(hctx->fde_ndx), hctx->fd, FDEVENT_IN);
 603                                 }
 604                                 break;
 605                         }
 606                 }
 607
 608 #if 0
 609                 log_error_write(srv, __FILE__, __LINE__, "ddss", con->fd, hctx->fd, connection_get_state(con->state), b->ptr);
 610 #endif
 611         }
 612
 613         return FDEVENT_HANDLED_NOT_FINISHED;
 614 }
 615
 616 static void cgi_connection_close_fdtocgi(server *srv, handler_ctx *hctx) {
 617         /*(closes only hctx->fdtocgi)*/
 618         fdevent_event_del(srv->ev, &(hctx->fde_ndx_tocgi), hctx->fdtocgi);
 619         fdevent_unregister(srv->ev, hctx->fdtocgi);
 620         fdevent_sched_close(srv->ev, hctx->fdtocgi, 0);
 621         hctx->fdtocgi = -1;
 622 }
 623
 624 static void cgi_connection_close(server *srv, handler_ctx *hctx) {
 625         int status;
 626         pid_t pid;
 627         plugin_data *p = hctx->plugin_data;
 628         connection *con = hctx->remote_conn;
 629
 630 #ifndef __WIN32
 631
 632         /* the connection to the browser went away, but we still have a connection
 633          * to the CGI script
 634          *
 635          * close cgi-connection
 636          */
 637
 638         if (hctx->fd != -1) {
 639                 /* close connection to the cgi-script */
 640                 fdevent_event_del(srv->ev, &(hctx->fde_ndx), hctx->fd);
 641                 fdevent_unregister(srv->ev, hctx->fd);
 642                 fdevent_sched_close(srv->ev, hctx->fd, 0);
 643         }
 644
 645         if (hctx->fdtocgi != -1) {
 646                 cgi_connection_close_fdtocgi(srv, hctx); /*(closes only hctx->fdtocgi)*/
 647         }
 648
 649         pid = hctx->pid;
 650
 651         con->plugin_ctx[p->id] = NULL;
 652
 653         cgi_handler_ctx_free(hctx);
 654
 655         /* if waitpid hasn't been called by response.c yet, do it here */
 656         if (pid) {
 657                 /* check if the CGI-script is already gone */
 658                 switch(waitpid(pid, &status, WNOHANG)) {
 659                 case 0:
 660                         /* not finished yet */
 661 #if 0
 662                         log_error_write(srv, __FILE__, __LINE__, "sd", "(debug) child isn't done yet, pid:", pid);
 663 #endif
 664                         break;
 665                 case -1:
 666                         /* */
 667                         if (errno == EINTR) break;
 668
 669                         /*
 670                          * errno == ECHILD happens if _subrequest catches the process-status before
 671                          * we have read the response of the cgi process
 672                          *
 673                          * -> catch status
 674                          * -> WAIT_FOR_EVENT
 675                          * -> read response
 676                          * -> we get here with waitpid == ECHILD
 677                          *
 678                          */
 679                         if (errno != ECHILD) {
 680                                 log_error_write(srv, __FILE__, __LINE__, "ss", "waitpid failed: ", strerror(errno));
 681                         }
 682                         /* anyway: don't wait for it anymore */
 683                         pid = 0;
 684                         break;
 685                 default:
 686                         if (WIFEXITED(status)) {
 687 #if 0
 688                                 log_error_write(srv, __FILE__, __LINE__, "sd", "(debug) cgi exited fine, pid:", pid);
 689 #endif
 690                         } else {
 691                                 log_error_write(srv, __FILE__, __LINE__, "sd", "cgi died, pid:", pid);
 692                         }
 693
 694                         pid = 0;
 695                         break;
 696                 }
 697
 698                 if (pid) {
 699                         kill(pid, SIGTERM);
 700
 701                         /* cgi-script is still alive, queue the PID for removal */
 702                         cgi_pid_add(srv, p, pid);
 703                 }
 704         }
 705 #endif
 706
 707         /* finish response (if not already con->file_started, con->file_finished) */
 708         if (con->mode == p->id) {
 709                 http_response_backend_done(srv, con);
 710         }
 711 }
 712
 713 static handler_t cgi_connection_close_callback(server *srv, connection *con, void *p_d) {
 714         plugin_data *p = p_d;
 715         handler_ctx *hctx = con->plugin_ctx[p->id];
 716         if (hctx) cgi_connection_close(srv, hctx);
 717
 718         return HANDLER_GO_ON;
 719 }
 720
 721
 722 static int cgi_write_request(server *srv, handler_ctx *hctx, int fd);
 723
 724
 725 static handler_t cgi_handle_fdevent_send (server *srv, void *ctx, int revents) {
 726         handler_ctx *hctx = ctx;
 727         connection  *con  = hctx->remote_conn;
 728
 729         /*(joblist only actually necessary here in mod_cgi fdevent send if returning HANDLER_ERROR)*/
 730         joblist_append(srv, con);
 731
 732         if (revents & FDEVENT_OUT) {
 733                 if (0 != cgi_write_request(srv, hctx, hctx->fdtocgi)) {
 734                         cgi_connection_close(srv, hctx);
 735                         return HANDLER_ERROR;
 736                 }
 737                 /* more request body to be sent to CGI */
 738         }
 739
 740         if (revents & FDEVENT_HUP) {
 741                 /* skip sending remaining data to CGI */
 742                 if (con->request.content_length) {
 743                         chunkqueue *cq = con->request_content_queue;
 744                         chunkqueue_mark_written(cq, chunkqueue_length(cq));
 745                         if (cq->bytes_in != (off_t)con->request.content_length) {
 746                                 con->keep_alive = 0;
 747                         }
 748                 }
 749
 750                 cgi_connection_close_fdtocgi(srv, hctx); /*(closes only hctx->fdtocgi)*/
 751         } else if (revents & FDEVENT_ERR) {
 752                 /* kill all connections to the cgi process */
 753 #if 1
 754                 log_error_write(srv, __FILE__, __LINE__, "s", "cgi-FDEVENT_ERR");
 755 #endif
 756                 cgi_connection_close(srv, hctx);
 757                 return HANDLER_ERROR;
 758         }
 759
 760         return HANDLER_FINISHED;
 761 }
 762
 763
 764 static int cgi_recv_response(server *srv, handler_ctx *hctx) {
 765                 switch (cgi_demux_response(srv, hctx)) {
 766                 case FDEVENT_HANDLED_NOT_FINISHED:
 767                         break;
 768                 case FDEVENT_HANDLED_FINISHED:
 769                         /* we are done */
 770
 771 #if 0
 772                         log_error_write(srv, __FILE__, __LINE__, "ddss", con->fd, hctx->fd, connection_get_state(con->state), "finished");
 773 #endif
 774                         cgi_connection_close(srv, hctx);
 775
 776                         /* if we get a IN|HUP and have read everything don't exec the close twice */
 777                         return HANDLER_FINISHED;
 778                 case FDEVENT_HANDLED_COMEBACK:
 779                         cgi_connection_close(srv, hctx);
 780                         return HANDLER_COMEBACK;
 781                 case FDEVENT_HANDLED_ERROR:
 782                         log_error_write(srv, __FILE__, __LINE__, "s", "demuxer failed: ");
 783
 784                         cgi_connection_close(srv, hctx);
 785                         return HANDLER_FINISHED;
 786                 }
 787
 788                 return HANDLER_GO_ON;
 789 }
 790
 791
 792 static handler_t cgi_handle_fdevent(server *srv, void *ctx, int revents) {
 793         handler_ctx *hctx = ctx;
 794         connection  *con  = hctx->remote_conn;
 795
 796         joblist_append(srv, con);
 797
 798         if (revents & FDEVENT_IN) {
 799                 handler_t rc = cgi_recv_response(srv, hctx);/*(might invalidate hctx)*/
 800                 if (rc != HANDLER_GO_ON) return rc;         /*(unless HANDLER_GO_ON)*/
 801         }
 802
 803         /* perhaps this issue is already handled */
 804         if (revents & FDEVENT_HUP) {
 805                 if (con->file_started) {
 806                         /* drain any remaining data from kernel pipe buffers
 807                          * even if (con->conf.stream_response_body
 808                          *          & FDEVENT_STREAM_RESPONSE_BUFMIN)
 809                          * since event loop will spin on fd FDEVENT_HUP event
 810                          * until unregistered. */
 811                         handler_t rc;
 812                         do {
 813                                 rc = cgi_recv_response(srv,hctx);/*(might invalidate hctx)*/
 814                         } while (rc == HANDLER_GO_ON);           /*(unless HANDLER_GO_ON)*/
 815                         return rc; /* HANDLER_FINISHED or HANDLER_COMEBACK or HANDLER_ERROR */
 816                 } else if (!buffer_string_is_empty(hctx->response_header)) {
 817                         /* unfinished header package which is a body in reality */
 818                         con->file_started = 1;
 819                         if (0 != http_chunk_append_buffer(srv, con, hctx->response_header)) {
 820                                 cgi_connection_close(srv, hctx);
 821                                 return HANDLER_ERROR;
 822                         }
 823                 } else {
 824 # if 0
 825                         log_error_write(srv, __FILE__, __LINE__, "sddd", "got HUP from cgi", con->fd, hctx->fd, revents);
 826 # endif
 827                 }
 828                 cgi_connection_close(srv, hctx);
 829         } else if (revents & FDEVENT_ERR) {
 830                 /* kill all connections to the cgi process */
 831                 cgi_connection_close(srv, hctx);
 832 #if 1
 833                 log_error_write(srv, __FILE__, __LINE__, "s", "cgi-FDEVENT_ERR");
 834 #endif
 835                 return HANDLER_ERROR;
 836         }
 837
 838         return HANDLER_FINISHED;
 839 }
 840
 841
 842 static int cgi_env_add(void *venv, const char *key, size_t key_len, const char *val, size_t val_len) {
 843         char_array *env = venv;
 844         char *dst;
 845
 846         if (!key || !val) return -1;
 847
 848         dst = malloc(key_len + val_len + 2);
 849         force_assert(dst);
 850         memcpy(dst, key, key_len);
 851         dst[key_len] = '=';
 852         memcpy(dst + key_len + 1, val, val_len);
 853         dst[key_len + 1 + val_len] = '\0';
 854
 855         if (env->size == 0) {
 856                 env->size = 16;
 857                 env->ptr = malloc(env->size * sizeof(*env->ptr));
 858                 force_assert(env->ptr);
 859         } else if (env->size == env->used) {
 860                 env->size += 16;
 861                 env->ptr = realloc(env->ptr, env->size * sizeof(*env->ptr));
 862                 force_assert(env->ptr);
 863         }
 864
 865         env->ptr[env->used++] = dst;
 866
 867         return 0;
 868 }
 869
 870 /* returns: 0: continue, -1: fatal error, -2: connection reset */
 871 /* similar to network_write_file_chunk_mmap, but doesn't use send on windows (because we're on pipes),
 872  * also mmaps and sends complete chunk instead of only small parts - the files
 873  * are supposed to be temp files with reasonable chunk sizes.
 874  *
 875  * Also always use mmap; the files are "trusted", as we created them.
 876  */
 877 static ssize_t cgi_write_file_chunk_mmap(server *srv, connection *con, int fd, chunkqueue *cq) {
 878         chunk* const c = cq->first;
 879         off_t offset, toSend, file_end;
 880         ssize_t r;
 881         size_t mmap_offset, mmap_avail;
 882         char *data;
 883
 884         force_assert(NULL != c);
 885         force_assert(FILE_CHUNK == c->type);
 886         force_assert(c->offset >= 0 && c->offset <= c->file.length);
 887
 888         offset = c->file.start + c->offset;
 889         toSend = c->file.length - c->offset;
 890         file_end = c->file.start + c->file.length; /* offset to file end in this chunk */
 891
 892         if (0 == toSend) {
 893                 chunkqueue_remove_finished_chunks(cq);
 894                 return 0;
 895         }
 896
 897         if (0 != network_open_file_chunk(srv, con, cq)) return -1;
 898
 899         /* (re)mmap the buffer if range is not covered completely */
 900         if (MAP_FAILED == c->file.mmap.start
 901                 || offset < c->file.mmap.offset
 902                 || file_end > (off_t)(c->file.mmap.offset + c->file.mmap.length)) {
 903
 904                 if (MAP_FAILED != c->file.mmap.start) {
 905                         munmap(c->file.mmap.start, c->file.mmap.length);
 906                         c->file.mmap.start = MAP_FAILED;
 907                 }
 908
 909                 c->file.mmap.offset = mmap_align_offset(offset);
 910                 c->file.mmap.length = file_end - c->file.mmap.offset;
 911
 912                 if (MAP_FAILED == (c->file.mmap.start = mmap(NULL, c->file.mmap.length, PROT_READ, MAP_PRIVATE, c->file.fd, c->file.mmap.offset))) {
 913                         if (toSend > 65536) toSend = 65536;
 914                         data = malloc(toSend);
 915                         force_assert(data);
 916                         if (-1 == lseek(c->file.fd, offset, SEEK_SET)
 917                             || 0 >= (toSend = read(c->file.fd, data, toSend))) {
 918                                 if (-1 == toSend) {
 919                                         log_error_write(srv, __FILE__, __LINE__, "ssbdo", "lseek/read failed:",
 920                                                 strerror(errno), c->file.name, c->file.fd, offset);
 921                                 } else { /*(0 == toSend)*/
 922                                         log_error_write(srv, __FILE__, __LINE__, "sbdo", "unexpected EOF (input truncated?):",
 923                                                 c->file.name, c->file.fd, offset);
 924                                 }
 925                                 free(data);
 926                                 return -1;
 927                         }
 928                 }
 929         }
 930
 931         if (MAP_FAILED != c->file.mmap.start) {
 932                 force_assert(offset >= c->file.mmap.offset);
 933                 mmap_offset = offset - c->file.mmap.offset;
 934                 force_assert(c->file.mmap.length > mmap_offset);
 935                 mmap_avail = c->file.mmap.length - mmap_offset;
 936                 force_assert(toSend <= (off_t) mmap_avail);
 937
 938                 data = c->file.mmap.start + mmap_offset;
 939         }
 940
 941         r = write(fd, data, toSend);
 942
 943         if (MAP_FAILED == c->file.mmap.start) free(data);
 944
 945         if (r < 0) {
 946                 switch (errno) {
 947                 case EAGAIN:
 948                 case EINTR:
 949                         return 0;
 950                 case EPIPE:
 951                 case ECONNRESET:
 952                         return -2;
 953                 default:
 954                         log_error_write(srv, __FILE__, __LINE__, "ssd",
 955                                 "write failed:", strerror(errno), fd);
 956                         return -1;
 957                 }
 958         }
 959
 960         if (r >= 0) {
 961                 chunkqueue_mark_written(cq, r);
 962         }
 963
 964         return r;
 965 }
 966
 967 static int cgi_write_request(server *srv, handler_ctx *hctx, int fd) {
 968         connection *con = hctx->remote_conn;
 969         chunkqueue *cq = con->request_content_queue;
 970         chunk *c;
 971
 972         /* old comment: windows doesn't support select() on pipes - wouldn't be easy to fix for all platforms.
 973          * solution: if this is still a problem on windows, then substitute
 974          * socketpair() for pipe() and closesocket() for close() on windows.
 975          */
 976
 977         for (c = cq->first; c; c = cq->first) {
 978                 ssize_t r = -1;
 979
 980                 switch(c->type) {
 981                 case FILE_CHUNK:
 982                         r = cgi_write_file_chunk_mmap(srv, con, fd, cq);
 983                         break;
 984
 985                 case MEM_CHUNK:
 986                         if ((r = write(fd, c->mem->ptr + c->offset, buffer_string_length(c->mem) - c->offset)) < 0) {
 987                                 switch(errno) {
 988                                 case EAGAIN:
 989                                 case EINTR:
 990                                         /* ignore and try again */
 991                                         r = 0;
 992                                         break;
 993                                 case EPIPE:
 994                                 case ECONNRESET:
 995                                         /* connection closed */
 996                                         r = -2;
 997                                         break;
 998                                 default:
 999                                         /* fatal error */
1000                                         log_error_write(srv, __FILE__, __LINE__, "ss", "write failed due to: ", strerror(errno));
1001                                         r = -1;
1002                                         break;
1003                                 }
1004                         } else if (r > 0) {
1005                                 chunkqueue_mark_written(cq, r);
1006                         }
1007                         break;
1008                 }
1009
1010                 if (0 == r) break; /*(might block)*/
1011
1012                 switch (r) {
1013                 case -1:
1014                         /* fatal error */
1015                         return -1;
1016                 case -2:
1017                         /* connection reset */
1018                         log_error_write(srv, __FILE__, __LINE__, "s", "failed to send post data to cgi, connection closed by CGI");
1019                         /* skip all remaining data */
1020                         chunkqueue_mark_written(cq, chunkqueue_length(cq));
1021                         break;
1022                 default:
1023                         break;
1024                 }
1025         }
1026
1027         if (cq->bytes_out == (off_t)con->request.content_length) {
1028                 /* sent all request body input */
1029                 /* close connection to the cgi-script */
1030                 if (-1 == hctx->fdtocgi) { /*(received request body sent in initial send to pipe buffer)*/
1031                         --srv->cur_fds;
1032                         if (close(fd)) {
1033                                 log_error_write(srv, __FILE__, __LINE__, "sds", "cgi stdin close failed ", fd, strerror(errno));
1034                         }
1035                 } else {
1036                         cgi_connection_close_fdtocgi(srv, hctx); /*(closes only hctx->fdtocgi)*/
1037                 }
1038         } else {
1039                 off_t cqlen = cq->bytes_in - cq->bytes_out;
1040                 if (cq->bytes_in < (off_t)con->request.content_length && cqlen < 65536 - 16384) {
1041                         /*(con->conf.stream_request_body & FDEVENT_STREAM_REQUEST)*/
1042                         if (!(con->conf.stream_request_body & FDEVENT_STREAM_REQUEST_POLLIN)) {
1043                                 con->conf.stream_request_body |= FDEVENT_STREAM_REQUEST_POLLIN;
1044                                 con->is_readable = 1; /* trigger optimistic read from client */
1045                         }
1046                 }
1047                 if (-1 == hctx->fdtocgi) { /*(not registered yet)*/
1048                         hctx->fdtocgi = fd;
1049                         hctx->fde_ndx_tocgi = -1;
1050                         fdevent_register(srv->ev, hctx->fdtocgi, cgi_handle_fdevent_send, hctx);
1051                 }
1052                 if (0 == cqlen) { /*(chunkqueue_is_empty(cq))*/
1053                         if ((fdevent_event_get_interest(srv->ev, hctx->fdtocgi) & FDEVENT_OUT)) {
1054                                 fdevent_event_set(srv->ev, &(hctx->fde_ndx_tocgi), hctx->fdtocgi, 0);
1055                         }
1056                 } else {
1057                         /* more request body remains to be sent to CGI so register for fdevents */
1058                         fdevent_event_set(srv->ev, &(hctx->fde_ndx_tocgi), hctx->fdtocgi, FDEVENT_OUT);
1059                 }
1060         }
1061
1062         return 0;
1063 }
1064
1065 static int cgi_create_env(server *srv, connection *con, plugin_data *p, handler_ctx *hctx, buffer *cgi_handler) {
1066         pid_t pid;
1067
1068         int to_cgi_fds[2];
1069         int from_cgi_fds[2];
1070         struct stat st;
1071         UNUSED(p);
1072
1073 #ifndef __WIN32
1074
1075         if (!buffer_string_is_empty(cgi_handler)) {
1076                 /* stat the exec file */
1077                 if (-1 == (stat(cgi_handler->ptr, &st))) {
1078                         log_error_write(srv, __FILE__, __LINE__, "sbss",
1079                                         "stat for cgi-handler", cgi_handler,
1080                                         "failed:", strerror(errno));
1081                         return -1;
1082                 }
1083         }
1084
1085         if (pipe_cloexec(to_cgi_fds)) {
1086                 log_error_write(srv, __FILE__, __LINE__, "ss", "pipe failed:", strerror(errno));
1087                 return -1;
1088         }
1089
1090         if (pipe_cloexec(from_cgi_fds)) {
1091                 close(to_cgi_fds[0]);
1092                 close(to_cgi_fds[1]);
1093                 log_error_write(srv, __FILE__, __LINE__, "ss", "pipe failed:", strerror(errno));
1094                 return -1;
1095         }
1096
1097         /* fork, execve */
1098         switch (pid = fork()) {
1099         case 0: {
1100                 /* child */
1101                 char **args;
1102                 int argc;
1103                 int i = 0;
1104                 char_array env;
1105                 char *c;
1106                 const char *s;
1107                 http_cgi_opts opts = { 0, 0, NULL, NULL };
1108
1109                 /* move stdout to from_cgi_fd[1] */
1110                 dup2(from_cgi_fds[1], STDOUT_FILENO);
1111               #ifndef FD_CLOEXEC
1112                 close(from_cgi_fds[1]);
1113                 /* not needed */
1114                 close(from_cgi_fds[0]);
1115               #endif
1116
1117                 /* move the stdin to to_cgi_fd[0] */
1118                 dup2(to_cgi_fds[0], STDIN_FILENO);
1119               #ifndef FD_CLOEXEC
1120                 close(to_cgi_fds[0]);
1121                 /* not needed */
1122                 close(to_cgi_fds[1]);
1123               #endif
1124
1125                 /* create environment */
1126                 env.ptr = NULL;
1127                 env.size = 0;
1128                 env.used = 0;
1129
1130                 http_cgi_headers(srv, con, &opts, cgi_env_add, &env);
1131
1132                 /* for valgrind */
1133                 if (NULL != (s = getenv("LD_PRELOAD"))) {
1134                         cgi_env_add(&env, CONST_STR_LEN("LD_PRELOAD"), s, strlen(s));
1135                 }
1136
1137                 if (NULL != (s = getenv("LD_LIBRARY_PATH"))) {
1138                         cgi_env_add(&env, CONST_STR_LEN("LD_LIBRARY_PATH"), s, strlen(s));
1139                 }
1140 #ifdef __CYGWIN__
1141                 /* CYGWIN needs SYSTEMROOT */
1142                 if (NULL != (s = getenv("SYSTEMROOT"))) {
1143                         cgi_env_add(&env, CONST_STR_LEN("SYSTEMROOT"), s, strlen(s));
1144                 }
1145 #endif
1146
1147                 if (env.size == env.used) {
1148                         env.size += 16;
1149                         env.ptr = realloc(env.ptr, env.size * sizeof(*env.ptr));
1150                 }
1151
1152                 env.ptr[env.used] = NULL;
1153
1154                 /* set up args */
1155                 argc = 3;
1156                 args = malloc(sizeof(*args) * argc);
1157                 force_assert(args);
1158                 i = 0;
1159
1160                 if (!buffer_string_is_empty(cgi_handler)) {
1161                         args[i++] = cgi_handler->ptr;
1162                 }
1163                 args[i++] = con->physical.path->ptr;
1164                 args[i  ] = NULL;
1165
1166                 /* search for the last / */
1167                 if (NULL != (c = strrchr(con->physical.path->ptr, '/'))) {
1168                         /* handle special case of file in root directory */
1169                         const char* physdir = (c == con->physical.path->ptr) ? "/" : con->physical.path->ptr;
1170
1171                         /* temporarily shorten con->physical.path to directory without terminating '/' */
1172                         *c = '\0';
1173                         /* change to the physical directory */
1174                         if (-1 == chdir(physdir)) {
1175                                 log_error_write(srv, __FILE__, __LINE__, "ssb", "chdir failed:", strerror(errno), con->physical.path);
1176                         }
1177                         *c = '/';
1178                 }
1179
1180                 /* we don't need the client socket */
1181                 for (i = 3; i < 256; i++) {
1182                         if (i != srv->errorlog_fd) close(i);
1183                 }
1184
1185                 /* exec the cgi */
1186                 execve(args[0], args, env.ptr);
1187
1188                 /* most log files may have been closed/redirected by this point,
1189                  * though stderr might still point to lighttpd.breakage.log */
1190                 perror(args[0]);
1191                 _exit(1);
1192         }
1193         case -1:
1194                 /* error */
1195                 log_error_write(srv, __FILE__, __LINE__, "ss", "fork failed:", strerror(errno));
1196                 close(from_cgi_fds[0]);
1197                 close(from_cgi_fds[1]);
1198                 close(to_cgi_fds[0]);
1199                 close(to_cgi_fds[1]);
1200                 return -1;
1201         default: {
1202                 /* parent process */
1203
1204                 close(from_cgi_fds[1]);
1205                 close(to_cgi_fds[0]);
1206
1207                 /* register PID and wait for them asynchronously */
1208
1209                 hctx->pid = pid;
1210                 hctx->fd = from_cgi_fds[0];
1211                 hctx->fde_ndx = -1;
1212
1213                 ++srv->cur_fds;
1214
1215                 if (0 == con->request.content_length) {
1216                         close(to_cgi_fds[1]);
1217                 } else {
1218                         /* there is content to send */
1219                         if (-1 == fdevent_fcntl_set_nb(srv->ev, to_cgi_fds[1])) {
1220                                 log_error_write(srv, __FILE__, __LINE__, "ss", "fcntl failed: ", strerror(errno));
1221                                 close(to_cgi_fds[1]);
1222                                 cgi_connection_close(srv, hctx);
1223                                 return -1;
1224                         }
1225
1226                         if (0 != cgi_write_request(srv, hctx, to_cgi_fds[1])) {
1227                                 close(to_cgi_fds[1]);
1228                                 cgi_connection_close(srv, hctx);
1229                                 return -1;
1230                         }
1231
1232                         ++srv->cur_fds;
1233                 }
1234
1235                 fdevent_register(srv->ev, hctx->fd, cgi_handle_fdevent, hctx);
1236                 if (-1 == fdevent_fcntl_set_nb(srv->ev, hctx->fd)) {
1237                         log_error_write(srv, __FILE__, __LINE__, "ss", "fcntl failed: ", strerror(errno));
1238                         cgi_connection_close(srv, hctx);
1239                         return -1;
1240                 }
1241                 fdevent_event_set(srv->ev, &(hctx->fde_ndx), hctx->fd, FDEVENT_IN);
1242
1243                 break;
1244         }
1245         }
1246
1247         return 0;
1248 #else
1249         return -1;
1250 #endif
1251 }
1252
1253 static buffer * cgi_get_handler(array *a, buffer *fn) {
1254         size_t k, s_len = buffer_string_length(fn);
1255         for (k = 0; k < a->used; ++k) {
1256                 data_string *ds = (data_string *)a->data[k];
1257                 size_t ct_len = buffer_string_length(ds->key);
1258
1259                 if (buffer_is_empty(ds->key)) continue;
1260                 if (s_len < ct_len) continue;
1261
1262                 if (0 == strncmp(fn->ptr + s_len - ct_len, ds->key->ptr, ct_len)) {
1263                         return ds->value;
1264                 }
1265         }
1266
1267         return NULL;
1268 }
1269
1270 #define PATCH(x) \
1271         p->conf.x = s->x;
1272 static int mod_cgi_patch_connection(server *srv, connection *con, plugin_data *p) {
1273         size_t i, j;
1274         plugin_config *s = p->config_storage[0];
1275
1276         PATCH(cgi);
1277         PATCH(execute_x_only);
1278         PATCH(xsendfile_allow);
1279         PATCH(xsendfile_docroot);
1280
1281         /* skip the first, the global context */
1282         for (i = 1; i < srv->config_context->used; i++) {
1283                 data_config *dc = (data_config *)srv->config_context->data[i];
1284                 s = p->config_storage[i];
1285
1286                 /* condition didn't match */
1287                 if (!config_check_cond(srv, con, dc)) continue;
1288
1289                 /* merge config */
1290                 for (j = 0; j < dc->value->used; j++) {
1291                         data_unset *du = dc->value->data[j];
1292
1293                         if (buffer_is_equal_string(du->key, CONST_STR_LEN("cgi.assign"))) {
1294                                 PATCH(cgi);
1295                         } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("cgi.execute-x-only"))) {
1296                                 PATCH(execute_x_only);
1297                         } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("cgi.x-sendfile"))) {
1298                                 PATCH(xsendfile_allow);
1299                         } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("cgi.x-sendfile-docroot"))) {
1300                                 PATCH(xsendfile_docroot);
1301                         }
1302                 }
1303         }
1304
1305         return 0;
1306 }
1307 #undef PATCH
1308
1309 URIHANDLER_FUNC(cgi_is_handled) {
1310         plugin_data *p = p_d;
1311         buffer *fn = con->physical.path;
1312         stat_cache_entry *sce = NULL;
1313         struct stat stbuf;
1314         struct stat *st;
1315
1316         if (con->mode != DIRECT) return HANDLER_GO_ON;
1317
1318         if (buffer_is_empty(fn)) return HANDLER_GO_ON;
1319
1320         mod_cgi_patch_connection(srv, con, p);
1321
1322         if (HANDLER_ERROR != stat_cache_get_entry(srv, con, con->physical.path, &sce)) {
1323                 st = &sce->st;
1324         } else {
1325                 /* CGI might be executable even if it is not readable
1326                  * (stat_cache_get_entry() currently checks file is readable)*/
1327                 if (0 != stat(con->physical.path->ptr, &stbuf)) return HANDLER_GO_ON;
1328                 st = &stbuf;
1329         }
1330
1331         if (!S_ISREG(st->st_mode)) return HANDLER_GO_ON;
1332         if (p->conf.execute_x_only == 1 && (st->st_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0) return HANDLER_GO_ON;
1333
1334         if (NULL != cgi_get_handler(p->conf.cgi, fn)) {
1335                 handler_ctx *hctx = cgi_handler_ctx_init();
1336                 hctx->remote_conn = con;
1337                 hctx->plugin_data = p;
1338                 con->plugin_ctx[p->id] = hctx;
1339                 con->mode = p->id;
1340         }
1341
1342         return HANDLER_GO_ON;
1343 }
1344
1345 TRIGGER_FUNC(cgi_trigger) {
1346         plugin_data *p = p_d;
1347         size_t ndx;
1348         /* the trigger handle only cares about lonely PID which we have to wait for */
1349 #ifndef __WIN32
1350
1351         for (ndx = 0; ndx < p->cgi_pid.used; ndx++) {
1352                 int status;
1353
1354                 switch(waitpid(p->cgi_pid.ptr[ndx], &status, WNOHANG)) {
1355                 case 0:
1356                         /* not finished yet */
1357 #if 0
1358                         log_error_write(srv, __FILE__, __LINE__, "sd", "(debug) child isn't done yet, pid:", p->cgi_pid.ptr[ndx]);
1359 #endif
1360                         break;
1361                 case -1:
1362                         if (errno == ECHILD) {
1363                                 /* someone else called waitpid... remove the pid to stop looping the error each time */
1364                                 log_error_write(srv, __FILE__, __LINE__, "s", "cgi child vanished, probably someone else called waitpid");
1365
1366                                 cgi_pid_del(srv, p, p->cgi_pid.ptr[ndx]);
1367                                 ndx--;
1368                                 continue;
1369                         }
1370
1371                         log_error_write(srv, __FILE__, __LINE__, "ss", "waitpid failed: ", strerror(errno));
1372
1373                         return HANDLER_ERROR;
1374                 default:
1375
1376                         if (WIFEXITED(status)) {
1377 #if 0
1378                                 log_error_write(srv, __FILE__, __LINE__, "sd", "(debug) cgi exited fine, pid:", p->cgi_pid.ptr[ndx]);
1379 #endif
1380                         } else if (WIFSIGNALED(status)) {
1381                                 /* FIXME: what if we killed the CGI script with a kill(..., SIGTERM) ?
1382                                  */
1383                                 if (WTERMSIG(status) != SIGTERM) {
1384                                         log_error_write(srv, __FILE__, __LINE__, "sd", "cleaning up CGI: process died with signal", WTERMSIG(status));
1385                                 }
1386                         } else {
1387                                 log_error_write(srv, __FILE__, __LINE__, "s", "cleaning up CGI: ended unexpectedly");
1388                         }
1389
1390                         cgi_pid_del(srv, p, p->cgi_pid.ptr[ndx]);
1391                         /* del modified the buffer structure
1392                          * and copies the last entry to the current one
1393                          * -> recheck the current index
1394                          */
1395                         ndx--;
1396                 }
1397         }
1398 #endif
1399         return HANDLER_GO_ON;
1400 }
1401
1402 /*
1403  * - HANDLER_GO_ON : not our job
1404  * - HANDLER_FINISHED: got response
1405  * - HANDLER_WAIT_FOR_EVENT: waiting for response
1406  */
1407 SUBREQUEST_FUNC(mod_cgi_handle_subrequest) {
1408         plugin_data *p = p_d;
1409         handler_ctx *hctx = con->plugin_ctx[p->id];
1410         chunkqueue *cq = con->request_content_queue;
1411
1412         if (con->mode != p->id) return HANDLER_GO_ON;
1413         if (NULL == hctx) return HANDLER_GO_ON;
1414
1415         if ((con->conf.stream_response_body & FDEVENT_STREAM_RESPONSE_BUFMIN)
1416             && con->file_started) {
1417                 if (chunkqueue_length(con->write_queue) > 65536 - 4096) {
1418                         fdevent_event_clr(srv->ev, &(hctx->fde_ndx), hctx->fd, FDEVENT_IN);
1419                 } else if (!(fdevent_event_get_interest(srv->ev, hctx->fd) & FDEVENT_IN)) {
1420                         /* optimistic read from backend, which might re-enable FDEVENT_IN */
1421                         handler_t rc = cgi_recv_response(srv, hctx); /*(might invalidate hctx)*/
1422                         if (rc != HANDLER_GO_ON) return rc;          /*(unless HANDLER_GO_ON)*/
1423                 }
1424         }
1425
1426         if (cq->bytes_in != (off_t)con->request.content_length) {
1427                 /*(64k - 4k to attempt to avoid temporary files
1428                  * in conjunction with FDEVENT_STREAM_REQUEST_BUFMIN)*/
1429                 if (cq->bytes_in - cq->bytes_out > 65536 - 4096
1430                     && (con->conf.stream_request_body & FDEVENT_STREAM_REQUEST_BUFMIN)){
1431                         con->conf.stream_request_body &= ~FDEVENT_STREAM_REQUEST_POLLIN;
1432                         if (-1 != hctx->fd) return HANDLER_WAIT_FOR_EVENT;
1433                 } else {
1434                         handler_t r = connection_handle_read_post_state(srv, con);
1435                         if (!chunkqueue_is_empty(cq)) {
1436                                 if (fdevent_event_get_interest(srv->ev, hctx->fdtocgi) & FDEVENT_OUT) {
1437                                         return (r == HANDLER_GO_ON) ? HANDLER_WAIT_FOR_EVENT : r;
1438                                 }
1439                         }
1440                         if (r != HANDLER_GO_ON) return r;
1441                 }
1442         }
1443
1444         if (-1 == hctx->fd) {
1445                 buffer *handler = cgi_get_handler(p->conf.cgi, con->physical.path);
1446                 if (!handler) return HANDLER_GO_ON; /*(should not happen; checked in cgi_is_handled())*/
1447                 if (cgi_create_env(srv, con, p, hctx, handler)) {
1448                         con->http_status = 500;
1449                         con->mode = DIRECT;
1450
1451                         return HANDLER_FINISHED;
1452                 }
1453 #if 0
1454         log_error_write(srv, __FILE__, __LINE__, "sdd", "subrequest, pid =", hctx, hctx->pid);
1455 #endif
1456         } else if (!chunkqueue_is_empty(con->request_content_queue)) {
1457                 if (0 != cgi_write_request(srv, hctx, hctx->fdtocgi)) {
1458                         cgi_connection_close(srv, hctx);
1459                         return HANDLER_ERROR;
1460                 }
1461         }
1462
1463         /* if not done, wait for CGI to close stdout, so we read EOF on pipe */
1464         return HANDLER_WAIT_FOR_EVENT;
1465 }
1466
1467
1468 int mod_cgi_plugin_init(plugin *p);
1469 int mod_cgi_plugin_init(plugin *p) {
1470         p->version     = LIGHTTPD_VERSION_ID;
1471         p->name        = buffer_init_string("cgi");
1472
1473         p->connection_reset = cgi_connection_close_callback;
1474         p->handle_subrequest_start = cgi_is_handled;
1475         p->handle_subrequest = mod_cgi_handle_subrequest;
1476         p->handle_trigger = cgi_trigger;
1477         p->init           = mod_cgi_init;
1478         p->cleanup        = mod_cgi_free;
1479         p->set_defaults   = mod_fastcgi_set_defaults;
1480
1481         p->data        = NULL;
1482
1483         return 0;
1484 }