/* * Copyright (c) 2007-2008, Cameron Rich * * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are met: * * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * * Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. * * Neither the name of the axTLS project nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include <stdio.h> #include <stdlib.h> #include <ctype.h> #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> #include <time.h> #include <string.h> #include "axhttp.h" #define HTTP_VERSION "HTTP/1.1" static const char * index_file = "index.html"; static int special_read(struct connstruct *cn, void *buf, size_t count); static int special_write(struct connstruct *cn, const char *buf, size_t count); static void send_error(struct connstruct *cn, int err); static int hexit(char c); static void urldecode(char *buf); static void buildactualfile(struct connstruct *cn); static int sanitizefile(const char *buf); static int sanitizehost(char *buf); static int htaccess_check(struct connstruct *cn); static const char *getmimetype(const char *name); #if defined(CONFIG_HTTP_DIRECTORIES) static void urlencode(const uint8_t *s, char *t); static void procdirlisting(struct connstruct *cn); #endif #if defined(CONFIG_HTTP_HAS_CGI) static void proccgi(struct connstruct *cn); static void decode_path_info(struct connstruct *cn, char *path_info); static int init_read_post_data(char *buf, char *data, struct connstruct *cn, int old_rv); #endif #ifdef CONFIG_HTTP_HAS_AUTHORIZATION static int auth_check(struct connstruct *cn); #endif #if AXDEBUG #define AXDEBUGSTART \ { \ FILE *axdout; \ axdout = fopen("/var/log/axdebug", "a"); \ #define AXDEBUGEND \ fclose(axdout); \ } #else /* AXDEBUG */ #define AXDEBUGSTART #define AXDEBUGEND #endif /* AXDEBUG */ /* Returns 1 if elems should continue being read, 0 otherwise */ static int procheadelem(struct connstruct *cn, char *buf) { char *delim, *value; if ((delim = strchr(buf, ' ')) == NULL) return 0; *delim = 0; value = delim+1; if (strcmp(buf, "GET") == 0 || strcmp(buf, "HEAD") == 0 || strcmp(buf, "POST") == 0) { if (buf[0] == 'H') cn->reqtype = TYPE_HEAD; else if (buf[0] == 'P') cn->reqtype = TYPE_POST; if ((delim = strchr(value, ' ')) == NULL) /* expect HTTP type */ return 0; *delim = 0; urldecode(value); if (sanitizefile(value) == 0) { send_error(cn, 403); return 0; } #if defined(CONFIG_HTTP_HAS_CGI) decode_path_info(cn, value); #else my_strncpy(cn->filereq, value, MAXREQUESTLENGTH); #endif cn->if_modified_since = -1; } else if (strcmp(buf, "Host:") == 0) { if (sanitizehost(value) == 0) { removeconnection(cn); return 0; } my_strncpy(cn->server_name, value, MAXREQUESTLENGTH); } else if (strcmp(buf, "Connection:") == 0 && strcmp(value, "close") == 0) { cn->close_when_done = 1; } else if (strcmp(buf, "If-Modified-Since:") == 0) { cn->if_modified_since = tdate_parse(value); } else if (strcmp(buf, "Expect:") == 0) { send_error(cn, 417); /* expectation failed */ return 0; } #ifdef CONFIG_HTTP_HAS_AUTHORIZATION else if (strcmp(buf, "Authorization:") == 0 && strncmp(value, "Basic ", 6) == 0) { int size; if (base64_decode(&value[6], strlen(&value[6]), (uint8_t *)cn->authorization, &size)) cn->authorization[0] = 0; /* error */ else cn->authorization[size] = 0; } #endif #if defined(CONFIG_HTTP_HAS_CGI) else if (strcmp(buf, "Content-Length:") == 0) { sscanf(value, "%d", &cn->content_length); } else if (strcmp(buf, "Cookie:") == 0) { my_strncpy(cn->cookie, value, MAXREQUESTLENGTH); } #endif return 1; } #if defined(CONFIG_HTTP_DIRECTORIES) static void procdirlisting(struct connstruct *cn) { char buf[MAXREQUESTLENGTH]; char actualfile[1024]; if (cn->reqtype == TYPE_HEAD) { snprintf(buf, sizeof(buf), HTTP_VERSION " 200 OK\nContent-Type: text/html\n\n"); write(cn->networkdesc, buf, strlen(buf)); removeconnection(cn); return; } strcpy(actualfile, cn->actualfile); #ifdef WIN32 strcat(actualfile, "*"); cn->dirp = FindFirstFile(actualfile, &cn->file_data); if (cn->dirp == INVALID_HANDLE_VALUE) { send_error(cn, 404); return; } #else if ((cn->dirp = opendir(actualfile)) == NULL) { send_error(cn, 404); return; } #endif snprintf(buf, sizeof(buf), HTTP_VERSION " 200 OK\nContent-Type: text/html\n\n" "<html><body>\n<title>Directory Listing</title>\n" "<h3>Directory listing of %s://%s%s</h3><br />\n", cn->is_ssl ? "https" : "http", cn->server_name, cn->filereq); special_write(cn, buf, strlen(buf)); cn->state = STATE_DOING_DIR; } void procdodir(struct connstruct *cn) { #ifndef WIN32 struct dirent *dp; #endif char buf[MAXREQUESTLENGTH]; char encbuf[1024]; char *file; do { buf[0] = 0; #ifdef WIN32 if (!FindNextFile(cn->dirp, &cn->file_data)) #else if ((dp = readdir(cn->dirp)) == NULL) #endif { snprintf(buf, sizeof(buf), "</body></html>\n"); special_write(cn, buf, strlen(buf)); removeconnection(cn); #ifndef WIN32 closedir(cn->dirp); #endif return; } #ifdef WIN32 file = cn->file_data.cFileName; #else file = dp->d_name; #endif /* if no index file, don't display the ".." directory */ if (cn->filereq[0] == '/' && cn->filereq[1] == '\0' && strcmp(file, "..") == 0) continue; /* don't display files beginning with "." */ if (file[0] == '.' && file[1] != '.') continue; /* make sure a '/' is at the end of a directory */ if (cn->filereq[strlen(cn->filereq)-1] != '/') strcat(cn->filereq, "/"); /* see if the dir + file is another directory */ snprintf(buf, sizeof(buf), "%s%s", cn->actualfile, file); if (isdir(buf)) strcat(file, "/"); urlencode((uint8_t *)file, encbuf); snprintf(buf, sizeof(buf), "<a href=\"%s%s\">%s</a><br />\n", cn->filereq, encbuf, file); } while (special_write(cn, buf, strlen(buf))); } /* Encode funny chars -> %xx in newly allocated storage */ /* (preserves '/' !) */ static void urlencode(const uint8_t *s, char *t) { const uint8_t *p = s; char *tp = t; for (; *p; p++) { if ((*p > 0x00 && *p < ',') || (*p > '9' && *p < 'A') || (*p > 'Z' && *p < '_') || (*p > '_' && *p < 'a') || (*p > 'z' && *p < 0xA1)) { sprintf((char *)tp, "%%%02X", *p); tp += 3; } else { *tp = *p; tp++; } } *tp='\0'; } #endif void procreadhead(struct connstruct *cn) { char buf[MAXREQUESTLENGTH*4], *tp, *next; int rv; memset(buf, 0, MAXREQUESTLENGTH*4); rv = special_read(cn, buf, sizeof(buf)-1); if (rv <= 0) { if (rv < 0) /* really dead? */ removeconnection(cn); return; } buf[rv] = '\0'; next = tp = buf; #ifdef CONFIG_HTTP_HAS_AUTHORIZATION cn->authorization[0] = 0; #endif /* Split up lines and send to procheadelem() */ while (*next != '\0') { /* If we have a blank line, advance to next stage */ if (*next == '\r' || *next == '\n') { #if defined(CONFIG_HTTP_HAS_CGI) if (cn->reqtype == TYPE_POST && cn->content_length > 0) { if (init_read_post_data(buf,next,cn,rv) == 0) return; } #endif buildactualfile(cn); cn->state = STATE_WANT_TO_SEND_HEAD; return; } while (*next != '\r' && *next != '\n' && *next != '\0') next++; if (*next == '\r') { *next = '\0'; next += 2; } else if (*next == '\n') *next++ = '\0'; if (procheadelem(cn, tp) == 0) return; tp = next; } } /* In this function we assume that the file has been checked for * maliciousness (".."s, etc) and has been decoded */ void procsendhead(struct connstruct *cn) { char buf[MAXREQUESTLENGTH]; struct stat stbuf; time_t now = cn->timeout - CONFIG_HTTP_TIMEOUT; char date[32]; int file_exists; /* are we trying to access a file over the HTTP connection instead of a * HTTPS connection? Or is this directory disabled? */ if (htaccess_check(cn)) { send_error(cn, 403); return; } #ifdef CONFIG_HTTP_HAS_AUTHORIZATION if (auth_check(cn)) /* see if there is a '.htpasswd' file */ { #ifdef CONFIG_HTTP_VERBOSE printf("axhttpd: access to %s denied\n", cn->filereq); TTY_FLUSH(); #endif removeconnection(cn); return; } #endif file_exists = stat(cn->actualfile, &stbuf); #if defined(CONFIG_HTTP_HAS_CGI) if (file_exists != -1 && cn->is_cgi) { if ((stbuf.st_mode & S_IEXEC) == 0 || isdir(cn->actualfile)) { /* A non-executable file, or directory? */ send_error(cn, 403); } else proccgi(cn); return; } #endif /* look for "index.html"? */ if (isdir(cn->actualfile)) { char tbuf[MAXREQUESTLENGTH]; snprintf(tbuf, MAXREQUESTLENGTH, "%s%s", cn->actualfile, index_file); if ((file_exists = stat(tbuf, &stbuf)) != -1) my_strncpy(cn->actualfile, tbuf, MAXREQUESTLENGTH); else { #if defined(CONFIG_HTTP_DIRECTORIES) /* If not, we do a directory listing of it */ procdirlisting(cn); #else send_error(cn, 404); #endif return; } } if (file_exists == -1) { send_error(cn, 404); return; } strcpy(date, ctime(&now)); /* has the file been read before? */ if (cn->if_modified_since != -1 && (cn->if_modified_since == 0 || cn->if_modified_since >= stbuf.st_mtime)) { snprintf(buf, sizeof(buf), HTTP_VERSION" 304 Not Modified\nServer: " "%s\nDate: %s\n", server_version, date); special_write(cn, buf, strlen(buf)); cn->state = STATE_WANT_TO_READ_HEAD; return; } if (cn->reqtype == TYPE_HEAD) { removeconnection(cn); return; } else { int flags = O_RDONLY; #if defined(WIN32) || defined(CONFIG_PLATFORM_CYGWIN) flags |= O_BINARY; #endif cn->filedesc = open(cn->actualfile, flags); if (cn->filedesc < 0) { send_error(cn, 404); return; } snprintf(buf, sizeof(buf), HTTP_VERSION" 200 OK\nServer: %s\n" "Content-Type: %s\nContent-Length: %ld\n" "Date: %sLast-Modified: %s\n", server_version, getmimetype(cn->actualfile), (long) stbuf.st_size, date, ctime(&stbuf.st_mtime)); /* ctime() has a \n on the end */ special_write(cn, buf, strlen(buf)); #ifdef CONFIG_HTTP_VERBOSE printf("axhttpd: %s:/%s\n", cn->is_ssl ? "https" : "http", cn->filereq); TTY_FLUSH(); #endif #ifdef WIN32 for (;;) { procreadfile(cn); if (cn->filedesc == -1) break; do { procsendfile(cn); } while (cn->state != STATE_WANT_TO_READ_FILE); } #else cn->state = STATE_WANT_TO_READ_FILE; #endif } } void procreadfile(struct connstruct *cn) { int rv = read(cn->filedesc, cn->databuf, BLOCKSIZE); if (rv <= 0) { close(cn->filedesc); cn->filedesc = -1; if (cn->close_when_done) /* close immediately */ removeconnection(cn); else { /* keep socket open - HTTP 1.1 */ cn->state = STATE_WANT_TO_READ_HEAD; cn->numbytes = 0; } return; } cn->numbytes = rv; cn->state = STATE_WANT_TO_SEND_FILE; } void procsendfile(struct connstruct *cn) { int rv = special_write(cn, cn->databuf, cn->numbytes); if (rv < 0) removeconnection(cn); else if (rv == cn->numbytes) { cn->state = STATE_WANT_TO_READ_FILE; } else if (rv == 0) { /* Do nothing */ } else { memmove(cn->databuf, cn->databuf + rv, cn->numbytes - rv); cn->numbytes -= rv; } } #if defined(CONFIG_HTTP_HAS_CGI) /* Should this be a bit more dynamic? It would mean more calls to malloc etc */ #define CGI_ARG_SIZE 17 static void proccgi(struct connstruct *cn) { int tpipe[2], spipe[2]; char *myargs[2]; char cgienv[CGI_ARG_SIZE][MAXREQUESTLENGTH]; char * cgiptr[CGI_ARG_SIZE+4]; const char *type = "HEAD"; int cgi_index = 0, i; pid_t pid; #ifdef WIN32 int tmp_stdout; #endif snprintf(cgienv[0], MAXREQUESTLENGTH, HTTP_VERSION" 200 OK\nServer: %s\n%s", server_version, (cn->reqtype == TYPE_HEAD) ? "\n" : ""); special_write(cn, cgienv[0], strlen(cgienv[0])); if (cn->reqtype == TYPE_HEAD) { removeconnection(cn); return; } #ifdef CONFIG_HTTP_VERBOSE printf("[CGI]: %s:/%s\n", cn->is_ssl ? "https" : "http", cn->filereq); TTY_FLUSH(); #endif /* win32 cgi is a bit too painful */ #ifndef WIN32 /* set up pipe that is used for sending POST query data to CGI script*/ if (cn->reqtype == TYPE_POST) { if (pipe(spipe) == -1) { printf("[CGI]: could not create pipe"); TTY_FLUSH(); return; } } if (pipe(tpipe) == -1) { printf("[CGI]: could not create pipe"); TTY_FLUSH(); return; } /* * use vfork() instead of fork() for performance */ if ((pid = vfork()) > 0) /* parent */ { /* Send POST query data to CGI script */ if ((cn->reqtype == TYPE_POST) && (cn->content_length > 0)) { write(spipe[1], cn->post_data, cn->content_length); close(spipe[0]); close(spipe[1]); /* free the memory that is allocated in read_post_data() */ free(cn->post_data); cn->post_data = NULL; } /* Close the write descriptor */ close(tpipe[1]); cn->filedesc = tpipe[0]; cn->state = STATE_WANT_TO_READ_FILE; cn->close_when_done = 1; return; } if (pid < 0) /* vfork failed */ exit(1); /* The problem child... */ /* Our stdout/stderr goes to the socket */ dup2(tpipe[1], 1); dup2(tpipe[1], 2); /* If it was a POST request, send the socket data to our stdin */ if (cn->reqtype == TYPE_POST) dup2(spipe[0], 0); else /* Otherwise we can shutdown the read side of the sock */ shutdown(cn->networkdesc, 0); myargs[0] = cn->actualfile; myargs[1] = NULL; /* * set the cgi args. A url is defined by: * http://$SERVER_NAME:$SERVER_PORT$SCRIPT_NAME$PATH_INFO?$QUERY_STRING * TODO: other CGI parameters? */ sprintf(cgienv[cgi_index++], "SERVER_SOFTWARE=%s", server_version); strcpy(cgienv[cgi_index++], "DOCUMENT_ROOT=" CONFIG_HTTP_WEBROOT); snprintf(cgienv[cgi_index++], MAXREQUESTLENGTH, "SERVER_NAME=%s", cn->server_name); sprintf(cgienv[cgi_index++], "SERVER_PORT=%d", cn->is_ssl ? CONFIG_HTTP_HTTPS_PORT : CONFIG_HTTP_PORT); snprintf(cgienv[cgi_index++], MAXREQUESTLENGTH, "REQUEST_URI=%s", cn->uri_request); snprintf(cgienv[cgi_index++], MAXREQUESTLENGTH, "SCRIPT_NAME=%s", cn->filereq); snprintf(cgienv[cgi_index++], MAXREQUESTLENGTH, "PATH_INFO=%s", cn->uri_path_info); snprintf(cgienv[cgi_index++], MAXREQUESTLENGTH, "QUERY_STRING=%s", cn->uri_query); snprintf(cgienv[cgi_index++], MAXREQUESTLENGTH, "REMOTE_ADDR=%s", cn->remote_addr); snprintf(cgienv[cgi_index++], MAXREQUESTLENGTH, "HTTP_COOKIE=%s", cn->cookie); /* note: small size */ #if defined(CONFIG_HTTP_HAS_AUTHORIZATION) snprintf(cgienv[cgi_index++], MAXREQUESTLENGTH, "REMOTE_USER=%s", cn->authorization); #endif switch (cn->reqtype) { case TYPE_GET: type = "GET"; break; case TYPE_POST: type = "POST"; sprintf(cgienv[cgi_index++], "CONTENT_LENGTH=%d", cn->content_length); strcpy(cgienv[cgi_index++], /* hard-code? */ "CONTENT_TYPE=application/x-www-form-urlencoded"); break; } sprintf(cgienv[cgi_index++], "REQUEST_METHOD=%s", type); if (cn->is_ssl) strcpy(cgienv[cgi_index++], "HTTPS=on"); #ifdef CONFIG_PLATFORM_CYGWIN /* TODO: find out why Lua needs this */ strcpy(cgienv[cgi_index++], "PATH=/usr/bin"); #endif if (cgi_index >= CGI_ARG_SIZE) { printf("Content-type: text/plain\n\nToo many CGI args (%d, %d)\n", cgi_index, CGI_ARG_SIZE); _exit(1); } /* copy across the pointer indexes */ for (i = 0; i < cgi_index; i++) cgiptr[i] = cgienv[i]; cgiptr[i++] = "AUTH_TYPE=Basic"; cgiptr[i++] = "GATEWAY_INTERFACE=CGI/1.1"; cgiptr[i++] = "SERVER_PROTOCOL="HTTP_VERSION; cgiptr[i] = NULL; execve(myargs[0], myargs, cgiptr); printf("Content-type: text/plain\n\nshouldn't get here\n"); _exit(1); #endif } static char * cgi_filetype_match(struct connstruct *cn, const char *fn) { struct cgiextstruct *tp = cgiexts; while (tp != NULL) { char *t; if ((t = strstr(fn, tp->ext)) != NULL) { t += strlen(tp->ext); if (*t == '/' || *t == '\0') { #ifdef CONFIG_HTTP_ENABLE_LUA if (strcmp(tp->ext, ".lua") == 0 || strcmp(tp->ext, ".lp") == 0) cn->is_lua = 1; #endif return t; } else return NULL; } tp = tp->next; } return NULL; } static void decode_path_info(struct connstruct *cn, char *path_info) { char *cgi_delim; cn->is_cgi = 0; #ifdef CONFIG_HTTP_ENABLE_LUA cn->is_lua = 0; #endif *cn->uri_request = '\0'; *cn->uri_path_info = '\0'; *cn->uri_query = '\0'; my_strncpy(cn->uri_request, path_info, MAXREQUESTLENGTH); /* query info? */ if ((cgi_delim = strchr(path_info, '?'))) { *cgi_delim = '\0'; my_strncpy(cn->uri_query, cgi_delim+1, MAXREQUESTLENGTH); } if ((cgi_delim = cgi_filetype_match(cn, path_info)) != NULL) { cn->is_cgi = 1; /* definitely a CGI script */ /* path info? */ if (*cgi_delim != '\0') { my_strncpy(cn->uri_path_info, cgi_delim, MAXREQUESTLENGTH); *cgi_delim = '\0'; } } /* the bit at the start must be the script name */ my_strncpy(cn->filereq, path_info, MAXREQUESTLENGTH); } static int init_read_post_data(char *buf, char *data, struct connstruct *cn, int old_rv) { char *next = data; int rv = old_rv; char *post_data; /* Too much Post data to send. MAXPOSTDATASIZE should be configured (now it can be chaged in the header file) */ if (cn->content_length > MAXPOSTDATASIZE) { send_error(cn, 418); return 0; } /* remove CRLF */ while ((*next == '\r' || *next == '\n') && (next < &buf[rv])) next++; if (cn->post_data == NULL) { cn->post_data = (char *) calloc(1, (cn->content_length + 1)); /* Allocate buffer for the POST data that will be used by proccgi to send POST data to the CGI script */ if (cn->post_data == NULL) { printf("axhttpd: could not allocate memory for POST data\n"); TTY_FLUSH(); send_error(cn, 599); return 0; } } cn->post_state = 0; cn->post_read = 0; post_data = cn->post_data; while (next < &buf[rv]) { /*copy POST data to buffer*/ *post_data = *next; post_data++; next++; cn->post_read++; if (cn->post_read == cn->content_length) { /* No more POST data to be copied */ *post_data = '\0'; return 1; } } /* More POST data has to be read. read_post_data will continue with that */ cn->post_state = 1; return 0; } void read_post_data(struct connstruct *cn) { char buf[MAXREQUESTLENGTH*4], *next; char *post_data; int rv; bzero(buf,MAXREQUESTLENGTH*4); rv = special_read(cn, buf, sizeof(buf)-1); if (rv <= 0) { if (rv < 0) /* really dead? */ removeconnection(cn); return; } buf[rv] = '\0'; next = buf; post_data = &cn->post_data[cn->post_read]; while (next < &buf[rv]) { *post_data = *next; post_data++; next++; cn->post_read++; if (cn->post_read == cn->content_length) { /* No more POST data to be copied */ *post_data='\0'; cn->post_state = 0; buildactualfile(cn); cn->state = STATE_WANT_TO_SEND_HEAD; return; } } /* More POST data to read */ } #endif /* CONFIG_HTTP_HAS_CGI */ /* Decode string %xx -> char (in place) */ static void urldecode(char *buf) { int v; char *p, *s, *w; w = p = buf; while (*p) { v = 0; if (*p == '%') { s = p; s++; if (isxdigit((int) s[0]) && isxdigit((int) s[1])) { v = hexit(s[0])*16 + hexit(s[1]); if (v) { /* do not decode %00 to null char */ *w = (char)v; p = &s[1]; } } } if (!v) *w=*p; p++; w++; } *w='\0'; } static int hexit(char c) { if (c >= '0' && c <= '9') return c - '0'; else if (c >= 'a' && c <= 'f') return c - 'a' + 10; else if (c >= 'A' && c <= 'F') return c - 'A' + 10; else return 0; } static void buildactualfile(struct connstruct *cn) { char *cp; snprintf(cn->actualfile, MAXREQUESTLENGTH, ".%s", cn->filereq); #ifndef WIN32 /* Add directory slash if not there */ if (isdir(cn->actualfile) && cn->actualfile[strlen(cn->actualfile)-1] != '/') strcat(cn->actualfile, "/"); /* work out the directory name */ strncpy(cn->dirname, cn->actualfile, MAXREQUESTLENGTH); if ((cp = strrchr(cn->dirname, '/')) == NULL) cn->dirname[0] = 0; else *cp = 0; #else { char curr_dir[MAXREQUESTLENGTH]; char path[MAXREQUESTLENGTH]; char *t = cn->actualfile; GetCurrentDirectory(MAXREQUESTLENGTH, curr_dir); /* convert all the forward slashes to back slashes */ while ((t = strchr(t, '/'))) *t++ = '\\'; snprintf(path, MAXREQUESTLENGTH, "%s%s", curr_dir, cn->actualfile); memcpy(cn->actualfile, path, MAXREQUESTLENGTH); /* Add directory slash if not there */ if (isdir(cn->actualfile) && cn->actualfile[strlen(cn->actualfile)-1] != '\\') strcat(cn->actualfile, "\\"); /* work out the directory name */ strncpy(cn->dirname, cn->actualfile, MAXREQUESTLENGTH); if ((cp = strrchr(cn->dirname, '\\')) == NULL) cn->dirname[0] = 0; else *cp = 0; } #endif #if defined(CONFIG_HTTP_ENABLE_LUA) /* * Use the lua launcher if this file has a lua extension. Put this at the * end as we need the directory name. */ if (cn->is_lua) sprintf(cn->actualfile, "%s%s", CONFIG_HTTP_LUA_PREFIX, CONFIG_HTTP_LUA_CGI_LAUNCHER); #endif } static int sanitizefile(const char *buf) { int len, i; /* Don't accept anything not starting with a / */ if (*buf != '/') return 0; len = strlen(buf); for (i = 0; i < len; i++) { /* Check for "/." i.e. don't send files starting with a . */ if (buf[i] == '/' && buf[i+1] == '.') return 0; } return 1; } static int sanitizehost(char *buf) { while (*buf != '\0') { /* Handle the port */ if (*buf == ':') { *buf = '\0'; return 1; } /* Enforce some basic URL rules... */ if ((isalnum(*buf) == 0 && *buf != '-' && *buf != '.') || (*buf == '.' && *(buf+1) == '.') || (*buf == '.' && *(buf+1) == '-') || (*buf == '-' && *(buf+1) == '.')) return 0; buf++; } return 1; } static FILE * exist_check(struct connstruct *cn, const char *check_file) { char pathname[MAXREQUESTLENGTH]; snprintf(pathname, MAXREQUESTLENGTH, "%s/%s", cn->dirname, check_file); return fopen(pathname, "r"); } #ifdef CONFIG_HTTP_HAS_AUTHORIZATION static void send_authenticate(struct connstruct *cn, const char *realm) { char buf[1024]; snprintf(buf, sizeof(buf), HTTP_VERSION" 401 Unauthorized\n" "WWW-Authenticate: Basic\n" "realm=\"%s\"\n", realm); special_write(cn, buf, strlen(buf)); } static int check_digest(char *salt, const char *msg_passwd) { uint8_t b256_salt[MAXREQUESTLENGTH]; uint8_t real_passwd[MD5_SIZE]; int salt_size; char *b64_passwd; uint8_t md5_result[MD5_SIZE]; MD5_CTX ctx; /* retrieve the salt */ if ((b64_passwd = strchr(salt, '$')) == NULL) return -1; *b64_passwd++ = 0; if (base64_decode(salt, strlen(salt), b256_salt, &salt_size)) return -1; if (base64_decode(b64_passwd, strlen(b64_passwd), real_passwd, NULL)) return -1; /* very simple MD5 crypt algorithm, but then the salt we use is large */ MD5_Init(&ctx); MD5_Update(&ctx, b256_salt, salt_size); /* process the salt */ MD5_Update(&ctx, (uint8_t *)msg_passwd, strlen(msg_passwd)); MD5_Final(md5_result, &ctx); return memcmp(md5_result, real_passwd, MD5_SIZE);/* 0 = ok */ } static int auth_check(struct connstruct *cn) { char line[MAXREQUESTLENGTH]; FILE *fp; char *cp; if ((fp = exist_check(cn, ".htpasswd")) == NULL) return 0; /* no .htpasswd file, so let though */ if (cn->authorization[0] == 0) goto error; /* cn->authorization is in form "username:password" */ if ((cp = strchr(cn->authorization, ':')) == NULL) goto error; else *cp++ = 0; /* cp becomes the password */ while (fgets(line, sizeof(line), fp) != NULL) { char *b64_file_passwd; int l = strlen(line); /* nuke newline */ if (line[l-1] == '\n') line[l-1] = 0; /* line is form "username:salt(b64)$password(b64)" */ if ((b64_file_passwd = strchr(line, ':')) == NULL) continue; *b64_file_passwd++ = 0; if (strcmp(line, cn->authorization)) /* our user? */ continue; if (check_digest(b64_file_passwd, cp) == 0) { fclose(fp); return 0; } } error: fclose(fp); send_authenticate(cn, cn->server_name); return -1; } #endif static int htaccess_check(struct connstruct *cn) { char line[MAXREQUESTLENGTH]; FILE *fp; int ret = 0; if ((fp = exist_check(cn, ".htaccess")) == NULL) return 0; /* no .htaccess file, so let though */ while (fgets(line, sizeof(line), fp) != NULL) { if (strstr(line, "Deny all") || /* access to this dir denied */ /* Access will be denied unless SSL is active */ (!cn->is_ssl && strstr(line, "SSLRequireSSL")) || /* Access will be denied if SSL is active */ (cn->is_ssl && strstr(line, "SSLDenySSL"))) { ret = -1; break; } } fclose(fp); return ret; } static void send_error(struct connstruct *cn, int err) { char buf[MAXREQUESTLENGTH]; char *title; char *text; switch (err) { case 403: title = "Forbidden"; text = "File is protected"; #ifdef CONFIG_HTTP_VERBOSE printf("axhttpd: access to %s denied\n", cn->filereq); TTY_FLUSH(); #endif break; case 404: title = "Not Found"; text = title; break; case 418: title = "POST data size is to large"; text = title; break; default: title = "Unknown"; text = "Unknown"; break; } snprintf(buf, MAXREQUESTLENGTH, "HTTP/1.1 %d %s\n" "Content-Type: text/html\n" "Cache-Control: no-cache,no-store\n" "Connection: close\n\n" "<html>\n<head>\n<title>%d %s</title></head>\n" "<body><h1>%d %s</h1>\n</body></html>\n", err, title, err, title, err, text); special_write(cn, buf, strlen(buf)); removeconnection(cn); } static const char *getmimetype(const char *name) { /* only bother with a few mime types - let the browser figure the rest out */ if (strstr(name, ".htm")) return "text/html"; else if (strstr(name, ".css")) return "text/css"; else return "application/octet-stream"; } static int special_write(struct connstruct *cn, const char *buf, size_t count) { if (cn->is_ssl) { SSL *ssl = cn->ssl; return ssl ? ssl_write(ssl, (uint8_t *)buf, count) : -1; } else return SOCKET_WRITE(cn->networkdesc, buf, count); } static int special_read(struct connstruct *cn, void *buf, size_t count) { int res; if (cn->is_ssl) { uint8_t *read_buf; if ((res = ssl_read(cn->ssl, &read_buf)) > SSL_OK) { memcpy(buf, read_buf, res > (int)count ? count : res); } } else res = SOCKET_READ(cn->networkdesc, buf, count); return res; }