path: root/www/pserv/files/patch-main.c

--- main.c.orig	Mon Sep 22 10:39:24 2003
+++ main.c	Thu Oct 16 14:00:02 2003
@@ -23,6 +23,7 @@
 char defaultFileName[MAX_PATH_LEN+1];
 char logFileName[MAX_PATH_LEN+1];
 char mimeTypesFileName[MAX_PATH_LEN+1];
+char phpFileName[MAX_PATH_LEN+1];
 char cgiRoot[MAX_PATH_LEN+1]; /* root for CGI scripts exec */
 struct timeval sockTimeVal;
 mimeData *mimeArray; /* here we will hold all MIME data, inited once, never to be changed */
@@ -206,10 +207,10 @@
     int reqSize;
     int readLines;
     int tokenEnd;
-   
-    /* we copy the header lines to an array for easier parsing */ 
+
+    /* we copy the header lines to an array for easier parsing */
     /* but first we make sure that our string has a newline and an end */
-    req[BUFFER_SIZE] = '\0';    
+    req[BUFFER_SIZE] = '\0';
     reqSize = strlen(req);
     req[reqSize] = '\n';
     reqSize++;
@@ -230,7 +231,7 @@
     for (k = 0; k < readLines; k++)
         printf("%d - |%s|\n", k, reqArray[k]);
 #endif
-    
+
     /* first line: method, path and protocol version */
     /* we copy to a temporary buffer to be more secure against overflows */
     i = j = 0;
@@ -246,7 +247,7 @@
     else
         tokenEnd = NO;
     i++;
-    
+
     /* we look for the document address */
     j = 0;
     reqStruct->documentAddress[0] = '\0';
@@ -259,14 +260,14 @@
         else
             token[j] = '\0';      /* to make sure we have a string */
         /* now we need to convert some escapings from the path like %20 */
-	convertPercents(token, j);
+        convertPercents(token, j);
         strcpy(reqStruct->documentAddress, token);  /* copy back */
         if (reqArray[0][i] == '\0')
             tokenEnd = YES;
         else
             tokenEnd = NO;
         i++;
-    
+
         /* we need now to separate path from query string ("?" separated) */
         if (reqArray[0][i-1] == '?')
         {
@@ -282,7 +283,7 @@
             i++;
         }
     }
-    
+
     /* we analyze the HTTP protocol version */
     /* default is 0.9 since that version didn't report itself */
     strcpy(reqStruct->protocolVersion, "HTTP/0.9");
@@ -306,10 +307,13 @@
     else if (!strncmp(reqArray[1], "Connection: Keep-Alive", strlen("Connection: keep-alive")))
         reqStruct->keepAlive = YES;
 
-    /* user-agent, content-length and else */
+    /* user-agent, content-length, content-type, cookie and else */
     i = 1;
     j = NO;
     reqStruct->userAgent[0] = '\0';
+    reqStruct->contentLength = -1;
+    reqStruct->contentType[0] = '\0';
+    reqStruct->cookie[0] = '\0';
     while (i < readLines)
     {
         if (!strncmp(reqArray[i], "User-Agent:", strlen("User-Agent:")))
@@ -317,14 +321,28 @@
             strncpy(reqStruct->userAgent, &reqArray[i][strlen("User-Agent: ")], USER_AGENT_LEN - 1);
             reqStruct->userAgent[USER_AGENT_LEN] = '\0';
         }
-	else if (!strncmp(reqArray[i], "Content-Length:", strlen("Content-length:")) || !strncmp(reqArray[i], "Content-length:", strlen("Content-length:")))
-    	{
-	    strcpy(token, &reqArray[i][strlen("Content-length: ")]);
-	    sscanf(token, "%ld", &(reqStruct->contentLength));
+        else if (!strncmp(reqArray[i], "Content-Length:", strlen("Content-length:")) || !strncmp(reqArray[i], "Content-length:", strlen("Content-length:")))
+        {
+            strcpy(token, &reqArray[i][strlen("Content-length: ")]);
+            sscanf(token, "%ld", &(reqStruct->contentLength));
 #ifdef PRINTF_DEBUG
-	    printf("content length %ld\n", reqStruct->contentLength);
+            printf("content length %ld\n", reqStruct->contentLength);
 #endif
-	}
+        }
+        else if (!strncmp(reqArray[i], "Content-Type:", strlen("Content-type:")) || !strncmp(reqArray[i], "Content-type:", strlen("Content-type:")))
+        {
+            strncpy(reqStruct->contentType, &reqArray[i][strlen("Content-type: ")], CONTENT_TYPE_LEN - 1);
+#ifdef PRINTF_DEBUG
+            printf("content type %s\n", reqStruct->contentType);
+#endif
+        }
+        else if (!strncmp(reqArray[i], "Cookie:", strlen("Cookie:")))
+        {
+            strncpy(reqStruct->cookie, &reqArray[i][strlen("Cookie: ")], MAX_COOKIE_LEN - 1);
+#ifdef PRINTF_DEBUG
+            printf("cookie %s\n", reqStruct->cookie);
+#endif
+        }
         i++;
     }
     /* if we didn't find a User-Aget we fill in a (N)ot(R)ecognized */
@@ -414,18 +432,39 @@
                     /* we append the default file name */
                     strcat(completeFilePath, defaultFileName);
                     analyzeExtension(mimeType, completeFilePath);
-                    dumpFile(sock, completeFilePath, mimeType, req);
+#ifdef PHP
+                    if (strncmp(mimeType, "application/x-httpd-php", 23))
+#endif
+                        dumpFile(sock, completeFilePath, mimeType, req);
+#ifdef PHP
+                    else
+                        phpHandler(port, sock, phpFileName, completeFilePath, req, NULL);
+#endif
                 }
 #else
                 /* we append the default file name */
                 strcat(completeFilePath, defaultFileName);
                 analyzeExtension(mimeType, completeFilePath);
-                dumpFile(sock, completeFilePath, mimeType, req);
+#ifdef PHP
+                if (strncmp(mimeType, "application/x-httpd-php", 23))
+#endif
+                    dumpFile(sock, completeFilePath, mimeType, req);
+#ifdef PHP
+                else
+                    phpHandler(port, sock, phpFileName, completeFilePath, req, NULL);
+#endif
 #endif
             } else
             { /* it is a plain file */
                 analyzeExtension(mimeType, completeFilePath);
-                dumpFile(sock, completeFilePath, mimeType, req);
+#ifdef PHP
+                if (strncmp(mimeType, "application/x-httpd-php", 23))
+#endif
+                    dumpFile(sock, completeFilePath, mimeType, req);
+#ifdef PHP
+                else
+                    phpHandler(port, sock, phpFileName, completeFilePath, req, NULL);
+#endif
             }
         }
     } else if (!strcmp(req.method, "HEAD"))
@@ -494,7 +533,14 @@
                 strcat(completeFilePath, defaultFileName);
             }
             analyzeExtension(mimeType, completeFilePath);
-            dumpHeader(sock, completeFilePath, mimeType, req);
+#ifdef PHP
+            if (strncmp(mimeType, "application/x-httpd-php", 23))
+#endif
+                dumpFile(sock, completeFilePath, mimeType, req);
+#ifdef PHP
+            else
+                phpHandler(port, sock, phpFileName, completeFilePath, req, NULL);
+#endif
         }
     } else if (!strcmp(req.method, "POST"))
     {
@@ -507,13 +553,6 @@
         int readFinished;
         
         printf("Handling of POST method\n");
-        /* first we check if the path contains the directory selected for cgi's and in case handle it */
-        if (strncmp(req.documentAddress, CGI_MATCH_STRING, strlen(CGI_MATCH_STRING)))
-        {
-            /* non cgi POST is not supported */
-            sayError(sock, UNHANDLED_METHOD, "", req);
-            return -1;
-        }
 #ifdef PRINTF_DEBUG
         printf ("begin of post handling\n");
 
@@ -523,9 +562,15 @@
         totalRead = 0;
         stuckCounter = 0;
         timeOutCounter = 0;
-        while (!readFinished)
-        {
-            howMany = recv(newSocket, tempBuff, BUFFER_SIZE, 0);
+
+        /* SECURITY: Avoid malicious Content-Length -- check \r\n\r\n\0 also */
+        if (req.contentLength < 0 || req.contentLength >= BUFFER_SIZE-5) {
+                sayError(sock, 500, "", req);
+                return -1;
+        }
+
+        /* SECURITY: Remove loop to prevent buffer overflow */
+            howMany = recv(newSocket, tempBuff, req.contentLength+5, 0);
 	    tempBuff[howMany] = '\0'; /* seems that some Unices need this */
 #ifdef PRINTF_DEBUG
         printf ("read: %d\n%s\n", howMany, tempBuff);
@@ -579,16 +624,15 @@
 	    	if (howMany == req.contentLength)
 		    readFinished = YES;
             }
-    }
 #ifdef PRINTF_DEBUG
-    printf("total read %d\n", totalRead);
+        printf("total read %d\n", totalRead);
 #endif
-    if (totalRead == 0)
-    {
-        printf("Request read error\n");
-    } else
-    {
-        if (buff[totalRead - 1] != '\n') /* we need a trailing \n or the script will wait forever */
+        if (totalRead == 0)
+        {
+            printf("Request read error\n");
+        } else
+        {
+            if (buff[totalRead - 1] != '\n') /* we need a trailing \n or the script will wait forever */
             {
                 buff[totalRead++] = '\n';
                 buff[totalRead] = '\0';
@@ -596,7 +640,77 @@
 #ifdef PRINTF_DEBUG
             printf("buff: |%s|\n", buff);
 #endif
-            cgiHandler(port, sock, req, buff);
+            if (!strncmp(req.documentAddress, CGI_MATCH_STRING, strlen(CGI_MATCH_STRING)))
+            {
+                cgiHandler(port, sock, req, buff);
+            } else
+            {
+#ifdef PHP
+                strcpy(completeFilePath, homePath);
+                strcat(completeFilePath, req.documentAddress);
+                /* now we check if the given path tries to get out of the root */
+                {
+                    int i,j;
+                    int sL;
+                    char dirName[MAX_PATH_LEN+1];
+                    int depthCount = 0;
+
+                    sL = strlen(req.documentAddress);
+                    dirName[0] = '\0';
+                    if (sL > 3) {
+                        dirName[0] = req.documentAddress[1];
+                        dirName[1] = req.documentAddress[2];
+                        dirName[2] = req.documentAddress[3];
+                        dirName[3] ='\0';
+                        if (!strcmp(dirName, "../"))
+                        {
+                            sayError(sock, FORBIDDEN, req.documentAddress, req);
+                            return -1;
+                        }
+                    }
+                    j = 0;
+                    for (i = 1; i < sL; i++) {
+                        if (req.documentAddress[i] == '/')
+                        {
+                            dirName[j] = '\0';
+                            if (strcmp(dirName, ".."))
+                                depthCount ++;
+                            else
+                                depthCount--;
+                            j = 0;
+                        } else
+                            dirName[j++] = req.documentAddress[i];
+                    }
+                    if (depthCount < 0)
+                    {
+                        sayError(sock, FORBIDDEN, req.documentAddress, req);
+                        return -1;
+                    }
+                }
+                /* now we check if the given file is a directory or a plain file */
+                stat(completeFilePath, &fileStats);
+                if ((fileStats.st_mode & S_IFDIR) == S_IFDIR)
+                {
+                    /* if does not end with a slash, we get an error */
+                    if(completeFilePath[strlen(completeFilePath)-1] != '/')
+                    {
+                        sayError(sock, NOT_FOUND, req.documentAddress, req);
+                        return -1;
+                    }
+                    /* we append the default file name */
+                    strcat(completeFilePath, defaultFileName);
+                }
+                analyzeExtension(mimeType, completeFilePath);
+                if (strncmp(mimeType, "application/x-httpd-php", 23))
+                {
+#endif
+                    /* non cgi POST is not supported */
+                    sayError(sock, UNHANDLED_METHOD, "", req);
+                    return -1;
+#ifdef PHP
+                } else phpHandler(port, sock, phpFileName, completeFilePath, req, buff);
+#endif
+            }
         }
     } else
     {
@@ -625,7 +739,7 @@
     f = fopen(configFile, "r");
     if (f == NULL)
     {
-        printf("Error opening config file. Setting defaults.\n");
+        printf("Config file not found. Setting defaults.\n");
         *serverPort = DEFAULT_PORT;
         *maxChildren = DEFAULT_MAX_CHILDREN;
         strcpy(homePath, DEFAULT_DOCS_LOCATION);
@@ -634,7 +748,9 @@
         sockTimeVal.tv_usec = DEFAULT_USEC_TO;
         strcpy(logFileName, DEFAULT_LOG_FILE);
         strcpy(mimeTypesFileName, DEFAULT_MIME_FILE);
+        strcpy(phpFileName, DEFAULT_PHP_FILE);
         strcpy(cgiRoot, DEFAULT_CGI_ROOT);
+        initMimeTypes();
         return -1;
     }
     if (!feof(f)) fscanf(f, "%s %s", str1, str2);
@@ -735,11 +851,25 @@
         if (mimeTypesFileName == NULL)
         {
             strcpy(mimeTypesFileName, DEFAULT_MIME_FILE);
-            printf("Error reading mimeTypesFileName from file, setting default, %s\n", mimeTypesFileName);
+            printf("Error reading mimeTypesFile from file, setting default, %s\n", mimeTypesFileName);
         }
     } else {
         strcpy(mimeTypesFileName, DEFAULT_MIME_FILE);
-        printf("Error reading mimeTypesFileName from file, setting default, %s\n", mimeTypesFileName);
+        printf("Error reading mimeTypesFile from file, setting default, %s\n", mimeTypesFileName);
+    }
+    if (!feof(f)) fscanf(f, "%s %s", str1, str2);
+    if (str1 != NULL && str2 != NULL && !strcmp(str1, "phpFile"))
+    {
+        sscanf(str2, "%s", phpFileName);
+        if (logFileName == NULL)
+        {
+            strcpy(phpFileName, DEFAULT_LOG_FILE);
+            printf("Error reading phpFile from file, setting default, %s\n", phpFileName);
+        }
+    } else
+    {
+        strcpy(phpFileName, DEFAULT_PHP_FILE);
+        printf("Error reading phpFile from file, setting default, %s\n", phpFileName);
     }
     if (!feof(f)) fscanf(f, "%s %s", str1, str2);
     if (str1 != NULL && str2 != NULL && !strcmp(str1, "cgiRoot"))
@@ -775,6 +905,7 @@
     int readFinished;
     struct request gottenReq;
     int isKeepAlive;
+    int bool;
     struct sockaddr_in listenName;           /* data struct for the listen port */
     struct sockaddr_in acceptedSockStruct;   /* sockaddr for the internetworking */
     int acceptedSocketLen;                   /* size of the structure */
@@ -808,9 +939,16 @@
         printf("socket creation error occoured\n");
         return -1;
     }
+    bool = 1;
+    error = setsockopt (theSocket, SOL_SOCKET, SO_REUSEADDR, &bool, sizeof(bool));
+    if (error == -1)
+    {   if (errno == EADDRINUSE)
+        printf("set socket option error occoured\n");
+        return -1;
+    }
     error = bind (theSocket, (struct sockaddr*)  &listenName, sizeof(listenName));
     if (error == -1)
-    {
+    {   if (errno == EADDRINUSE)
         printf("socket binding error occoured\n");
         return -2;
     }