lighttpd1.4/src/mod_ssi.c

1691 lines
47 KiB
C
Raw Normal View History

#include "first.h"
#include "fdevent.h"
#include "fdlog.h"
#include "log.h"
#include "array.h"
#include "buffer.h"
#include "chunk.h"
#include "http_cgi.h"
#include "http_chunk.h"
#include "http_etag.h"
#include "http_header.h"
#include "request.h"
#include "stat_cache.h"
#include "plugin.h"
#include "response.h"
#include "sys-socket.h"
#include "sys-time.h"
#include <sys/types.h>
#include <sys/stat.h>
2020-11-19 08:21:22 +00:00
#ifdef HAVE_SYS_WAIT_H
#include <sys/wait.h>
2020-11-19 08:21:22 +00:00
#endif
#include <ctype.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
2016-04-18 03:37:40 +00:00
#include <fcntl.h>
#include <unistd.h>
#ifdef HAVE_PWD_H
# include <pwd.h>
#endif
#ifdef HAVE_SYS_FILIO_H
# include <sys/filio.h>
#endif
typedef struct {
const array *ssi_extension;
const buffer *content_type;
unsigned short conditional_requests;
unsigned short ssi_exec;
unsigned short ssi_recursion_max;
} plugin_config;
typedef struct {
PLUGIN_DATA;
plugin_config defaults;
plugin_config conf;
array *ssi_vars;
array *ssi_cgi_env;
buffer stat_fn;
buffer timefmt;
} plugin_data;
typedef struct {
array *ssi_vars;
array *ssi_cgi_env;
buffer *stat_fn;
buffer *timefmt;
int sizefmt;
int if_level, if_is_false_level, if_is_false, if_is_false_endif;
unsigned short ssi_recursion_depth;
chunkqueue wq;
log_error_st *errh;
plugin_config conf;
} handler_ctx;
static handler_ctx * handler_ctx_init(plugin_data *p, log_error_st *errh) {
handler_ctx *hctx = calloc(1, sizeof(*hctx));
force_assert(hctx);
hctx->errh = errh;
hctx->timefmt = &p->timefmt;
hctx->stat_fn = &p->stat_fn;
hctx->ssi_vars = p->ssi_vars;
hctx->ssi_cgi_env = p->ssi_cgi_env;
memcpy(&hctx->conf, &p->conf, sizeof(plugin_config));
return hctx;
}
static void handler_ctx_free(handler_ctx *hctx) {
chunkqueue_reset(&hctx->wq);
free(hctx);
}
/* The newest modified time of included files for include statement */
[multiple] Y2038 32-bit signed time_t mitigations Most OS platforms have already provided solutions to Y2038 32-bit signed time_t 5 - 10 years ago (or more!) Notable exceptions are Linux i686 and FreeBSD i386. Since 32-bit systems tend to be embedded systems, and since many distros take years to pick up new software, this commit aims to provide Y2038 mitigations for lighttpd running on 32-bit systems with Y2038-unsafe 32-bit signed time_t * Y2038: lighttpd 1.4.60 and later report Y2038 safety $ lighttpd -V + Y2038 support # Y2038-SAFE $ lighttpd -V - Y2038 support (unsafe 32-bit signed time_t) # Y2038-UNSAFE * Y2038: general platform info * Y2038-SAFE: lighttpd 64-bit builds on platforms using 64-bit time_t - all major 64-bit platforms (known to this author) use 64-bit time_t * Y2038-SAFE: lighttpd 32-bit builds on platforms using 64-bit time_t - Linux x32 ABI (different from i686) - FreeBSD all 32-bit and 64-bit architectures *except* 32-bit i386 - NetBSD 6.0 (released Oct 2012) all 32-bit and 64-bit architectures - OpenBSD 5.5 (released May 2014) all 32-bit and 64-bit architectures - Microsoft Windows XP and Visual Studio 2005 (? unsure ?) Another reference suggests Visual Studio 2015 defaults to 64-bit time_t - MacOS 10.15 Catalina (released 2019) drops support for 32-bit apps * Y2038-SAFE: lighttpd 32-bit builds on platforms using 32-bit unsigned time_t - e.g. OpenVMS (unknown if lighttpd builds on this platform) * Y2038-UNSAFE: lighttpd 32-bit builds on platforms using 32-bit signed time_t - Linux 32-bit (including i686) - glibc 32-bit library support not yet available for 64-bit time_t - https://sourceware.org/glibc/wiki/Y2038ProofnessDesign - Linux kernel 5.6 on 32-bit platforms does support 64-bit time_t https://itsubuntu.com/linux-kernel-5-6-to-fix-the-year-2038-issue-unix-y2k/ - https://www.gnu.org/software/libc/manual/html_node/64_002dbit-time-symbol-handling.html "Note: at this point, 64-bit time support in dual-time configurations is work-in-progress, so for these configurations, the public API only makes the 32-bit time support available. In a later change, the public API will allow user code to choose the time size for a given compilation unit." - compiling with -D_TIME_BITS=64 currently has no effect - glibc recent (Jul 2021) mailing list discussion - https://public-inbox.org/bug-gnulib/878s2ozq70.fsf@oldenburg.str.redhat.com/T/ - FreeBSD i386 - DragonFlyBSD 32-bit * Y2038 mitigations attempted on Y2038-UNSAFE platforms (32-bit signed time_t) * lighttpd prefers system monotonic clock instead of realtime clock in places where realtime clock is not required * lighttpd treats negative time_t values as after 19 Jan 2038 03:14:07 GMT * (lighttpd presumes that lighttpd will not encounter dates before 1970 during normal operation.) * lighttpd casts struct stat st.st_mtime (and st.st_*time) through uint64_t to convert negative timestamps for comparisions with 64-bit timestamps (treating negative timestamp values as after 19 Jan 2038 03:14:07 GMT) * lighttpd provides unix_time64_t (int64_t) and * lighttpd provides struct unix_timespec64 (unix_timespec64_t) (struct timespec equivalent using unix_time64_t tv_sec member) * lighttpd provides gmtime64_r() and localtime64_r() wrappers for platforms 32-bit platforms using 32-bit time_t and lighttpd temporarily shifts the year in order to use gmtime_r() and localtime_r() (or gmtime() and localtime()) from standard libraries, before readjusting year and passing struct tm to formatting functions such as strftime() * lighttpd provides TIME64_CAST() macro to cast signed 32-bit time_t to unsigned 32-bit and then to unix_time64_t * Note: while lighttpd tries handle times past 19 Jan 2038 03:14:07 GMT on 32-bit platforms using 32-bit signed time_t, underlying libraries and underlying filesystems might not behave properly after 32-bit signed time_t overflows (19 Jan 2038 03:14:08 GMT). If a given 32-bit OS does not work properly using negative time_t values, then lighttpd likely will not work properly on that system. * Other references and blogs - https://en.wikipedia.org/wiki/Year_2038_problem - https://en.wikipedia.org/wiki/Time_formatting_and_storage_bugs - http://www.lieberbiber.de/2017/03/14/a-look-at-the-year-20362038-problems-and-time-proofness-in-various-systems/
2021-07-12 18:46:49 +00:00
static volatile unix_time64_t include_file_last_mtime = 0;
INIT_FUNC(mod_ssi_init) {
plugin_data *p;
p = calloc(1, sizeof(*p));
force_assert(p);
p->ssi_vars = array_init(8);
p->ssi_cgi_env = array_init(32);
return p;
}
FREE_FUNC(mod_ssi_free) {
plugin_data *p = p_d;
array_free(p->ssi_vars);
array_free(p->ssi_cgi_env);
free(p->timefmt.ptr);
free(p->stat_fn.ptr);
}
static void mod_ssi_merge_config_cpv(plugin_config * const pconf, const config_plugin_value_t * const cpv) {
switch (cpv->k_id) { /* index into static config_plugin_keys_t cpk[] */
case 0: /* ssi.extension */
pconf->ssi_extension = cpv->v.a;
break;
case 1: /* ssi.content-type */
pconf->content_type = cpv->v.b;
break;
case 2: /* ssi.conditional-requests */
pconf->conditional_requests = cpv->v.u;
break;
case 3: /* ssi.exec */
pconf->ssi_exec = cpv->v.u;
break;
case 4: /* ssi.recursion-max */
pconf->ssi_recursion_max = cpv->v.shrt;
break;
default:/* should not happen */
return;
}
}
static void mod_ssi_merge_config(plugin_config * const pconf, const config_plugin_value_t *cpv) {
do {
mod_ssi_merge_config_cpv(pconf, cpv);
} while ((++cpv)->k_id != -1);
}
static void mod_ssi_patch_config(request_st * const r, plugin_data * const p) {
memcpy(&p->conf, &p->defaults, sizeof(plugin_config));
for (int i = 1, used = p->nconfig; i < used; ++i) {
if (config_check_cond(r, (uint32_t)p->cvlist[i].k_id))
mod_ssi_merge_config(&p->conf, p->cvlist + p->cvlist[i].v.u2[0]);
}
}
SETDEFAULTS_FUNC(mod_ssi_set_defaults) {
static const config_plugin_keys_t cpk[] = {
{ CONST_STR_LEN("ssi.extension"),
T_CONFIG_ARRAY_VLIST,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("ssi.content-type"),
T_CONFIG_STRING,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("ssi.conditional-requests"),
T_CONFIG_BOOL,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("ssi.exec"),
T_CONFIG_BOOL,
T_CONFIG_SCOPE_CONNECTION }
,{ CONST_STR_LEN("ssi.recursion-max"),
T_CONFIG_SHORT,
T_CONFIG_SCOPE_CONNECTION }
,{ NULL, 0,
T_CONFIG_UNSET,
T_CONFIG_SCOPE_UNSET }
};
plugin_data * const p = p_d;
if (!config_plugin_values_init(srv, p, cpk, "mod_ssi"))
return HANDLER_ERROR;
[multiple] reduce redundant NULL buffer checks This commit is a large set of code changes and results in removal of hundreds, perhaps thousands, of CPU instructions, a portion of which are on hot code paths. Most (buffer *) used by lighttpd are not NULL, especially since buffers were inlined into numerous larger structs such as request_st and chunk. In the small number of instances where that is not the case, a NULL check is often performed earlier in a function where that buffer is later used with a buffer_* func. In the handful of cases that remained, a NULL check was added, e.g. with r->http_host and r->conf.server_tag. - check for empty strings at config time and set value to NULL if blank string will be ignored at runtime; at runtime, simple pointer check for NULL can be used to check for a value that has been set and is not blank ("") - use buffer_is_blank() instead of buffer_string_is_empty(), and use buffer_is_unset() instead of buffer_is_empty(), where buffer is known not to be NULL so that NULL check can be skipped - use buffer_clen() instead of buffer_string_length() when buffer is known not to be NULL (to avoid NULL check at runtime) - use buffer_truncate() instead of buffer_string_set_length() to truncate string, and use buffer_extend() to extend Examples where buffer known not to be NULL: - cpv->v.b from config_plugin_values_init is not NULL if T_CONFIG_BOOL (though we might set it to NULL if buffer_is_blank(cpv->v.b)) - address of buffer is arg (&foo) (compiler optimizer detects this in most, but not all, cases) - buffer is checked for NULL earlier in func - buffer is accessed in same scope without a NULL check (e.g. b->ptr) internal behavior change: callers must not pass a NULL buffer to some funcs. - buffer_init_buffer() requires non-null args - buffer_copy_buffer() requires non-null args - buffer_append_string_buffer() requires non-null args - buffer_string_space() requires non-null arg
2021-06-09 02:57:36 +00:00
/* process and validate config directives
* (init i to 0 if global context; to 1 to skip empty global context) */
for (int i = !p->cvlist[0].v.u2[1]; i < p->nconfig; ++i) {
config_plugin_value_t *cpv = p->cvlist + p->cvlist[i].v.u2[0];
for (; -1 != cpv->k_id; ++cpv) {
switch (cpv->k_id) {
case 0: /* ssi.extension */
break;
case 1: /* ssi.content-type */
if (buffer_is_blank(cpv->v.b))
cpv->v.b = NULL;
break;
case 2: /* ssi.conditional-requests */
case 3: /* ssi.exec */
case 4: /* ssi.recursion-max */
break;
default:/* should not happen */
break;
}
}
}
p->defaults.ssi_exec = 1;
/* initialize p->defaults from global config context */
if (p->nconfig > 0 && p->cvlist->v.u2[1]) {
const config_plugin_value_t *cpv = p->cvlist + p->cvlist->v.u2[0];
if (-1 != cpv->k_id)
mod_ssi_merge_config(&p->defaults, cpv);
}
return HANDLER_GO_ON;
}
2016-04-18 03:37:40 +00:00
#define TK_AND 1
#define TK_OR 2
#define TK_EQ 3
#define TK_NE 4
#define TK_GT 5
#define TK_GE 6
#define TK_LT 7
#define TK_LE 8
#define TK_NOT 9
#define TK_LPARAN 10
#define TK_RPARAN 11
#define TK_VALUE 12
typedef struct {
const char *input;
size_t offset;
size_t size;
int in_brace;
int depth;
handler_ctx *p;
} ssi_tokenizer_t;
typedef struct {
buffer str;
enum { SSI_TYPE_UNSET, SSI_TYPE_BOOL, SSI_TYPE_STRING } type;
int bo;
} ssi_val_t;
__attribute_pure__
static int ssi_val_tobool(const ssi_val_t *B) {
return B->type == SSI_TYPE_BOOL ? B->bo : !buffer_is_blank(&B->str);
}
__attribute_pure__
static int ssi_eval_expr_cmp(const ssi_val_t * const v1, const ssi_val_t * const v2, const int cond) {
int cmp = (v1->type != SSI_TYPE_BOOL && v2->type != SSI_TYPE_BOOL)
? strcmp(v1->str.ptr ? v1->str.ptr : "",
v2->str.ptr ? v2->str.ptr : "")
: ssi_val_tobool(v1) - ssi_val_tobool(v2);
switch (cond) {
case TK_EQ: return (cmp == 0);
case TK_NE: return (cmp != 0);
case TK_GE: return (cmp >= 0);
case TK_GT: return (cmp > 0);
case TK_LE: return (cmp <= 0);
case TK_LT: return (cmp < 0);
default: return 0;/*(should not happen)*/
}
}
__attribute_pure__
static int ssi_eval_expr_cmp_bool(const ssi_val_t * const v1, const ssi_val_t * const v2, const int cond) {
return (cond == TK_OR)
? ssi_val_tobool(v1) || ssi_val_tobool(v2) /* TK_OR */
: ssi_val_tobool(v1) && ssi_val_tobool(v2); /* TK_AND */
}
static void ssi_eval_expr_append_val(buffer * const b, const char *s, const size_t slen) {
if (buffer_is_blank(b))
buffer_append_string_len(b, s, slen);
else if (slen)
buffer_append_str2(b, CONST_STR_LEN(" "), s, slen);
}
static int ssi_expr_tokenizer(ssi_tokenizer_t * const t, buffer * const token) {
size_t i;
while (t->offset < t->size
&& (t->input[t->offset] == ' ' || t->input[t->offset] == '\t')) {
++t->offset;
}
if (t->offset >= t->size)
return 0;
if (t->input[t->offset] == '\0') {
log_error(t->p->errh, __FILE__, __LINE__,
"pos: %zu foobar", t->offset+1);
return -1;
}
switch (t->input[t->offset]) {
case '=':
#if 0 /*(maybe accept "==", too)*/
if (t->input[t->offset + 1] == '=')
++t->offset;
#endif
t->offset++;
return TK_EQ;
case '>':
if (t->input[t->offset + 1] == '=') {
t->offset += 2;
return TK_GE;
}
else {
t->offset += 1;
return TK_GT;
}
case '<':
if (t->input[t->offset + 1] == '=') {
t->offset += 2;
return TK_LE;
}
else {
t->offset += 1;
return TK_LT;
}
case '!':
if (t->input[t->offset + 1] == '=') {
t->offset += 2;
return TK_NE;
}
else {
t->offset += 1;
return TK_NOT;
}
case '&':
if (t->input[t->offset + 1] == '&') {
t->offset += 2;
return TK_AND;
}
else {
log_error(t->p->errh, __FILE__, __LINE__,
"pos: %zu missing second &", t->offset+1);
return -1;
}
case '|':
if (t->input[t->offset + 1] == '|') {
t->offset += 2;
return TK_OR;
}
else {
log_error(t->p->errh, __FILE__, __LINE__,
"pos: %zu missing second |", t->offset+1);
return -1;
}
case '(':
t->offset++;
t->in_brace++;
return TK_LPARAN;
case ')':
t->offset++;
t->in_brace--;
return TK_RPARAN;
case '\'':
/* search for the terminating "'" */
i = 1;
while (t->input[t->offset + i] && t->input[t->offset + i] != '\'')
++i;
if (t->input[t->offset + i]) {
ssi_eval_expr_append_val(token, t->input + t->offset + 1, i-1);
t->offset += i + 1;
return TK_VALUE;
}
else {
log_error(t->p->errh, __FILE__, __LINE__,
"pos: %zu missing closing quote", t->offset+1);
return -1;
}
case '$': {
const char *var;
size_t varlen;
if (t->input[t->offset + 1] == '{') {
i = 2;
while (t->input[t->offset + i] && t->input[t->offset + i] != '}')
++i;
if (t->input[t->offset + i] != '}') {
log_error(t->p->errh, __FILE__, __LINE__,
"pos: %zu missing closing curly-brace", t->offset+1);
return -1;
}
++i; /* step past '}' */
var = t->input + t->offset + 2;
varlen = i-3;
}
else {
for (i = 1; light_isalpha(t->input[t->offset + i]) ||
t->input[t->offset + i] == '_' ||
((i > 1) && light_isdigit(t->input[t->offset + i])); ++i) ;
var = t->input + t->offset + 1;
varlen = i-1;
}
const data_string *ds;
if ((ds = (const data_string *)
array_get_element_klen(t->p->ssi_cgi_env, var, varlen))
|| (ds = (const data_string *)
array_get_element_klen(t->p->ssi_vars, var, varlen)))
ssi_eval_expr_append_val(token, BUF_PTR_LEN(&ds->value));
t->offset += i;
return TK_VALUE;
}
default:
for (i = 0; isgraph(((unsigned char *)t->input)[t->offset + i]); ++i) {
char d = t->input[t->offset + i];
switch(d) {
default: continue;
case ' ':
case '\t':
case ')':
case '(':
case '\'':
case '=':
case '!':
case '<':
case '>':
case '&':
case '|':
break;
}
break;
}
ssi_eval_expr_append_val(token, t->input + t->offset, i);
t->offset += i;
return TK_VALUE;
}
}
static int ssi_eval_expr_loop(ssi_tokenizer_t * const t, ssi_val_t * const v);
static int ssi_eval_expr_step(ssi_tokenizer_t * const t, ssi_val_t * const v) {
buffer_clear(&v->str);
v->type = SSI_TYPE_UNSET; /*(not SSI_TYPE_BOOL)*/
int next;
const int level = t->in_brace;
switch ((next = ssi_expr_tokenizer(t, &v->str))) {
case TK_VALUE:
do { next = ssi_expr_tokenizer(t, &v->str); } while (next == TK_VALUE);
return next;
case TK_LPARAN:
if (t->in_brace > 16) return -1; /*(arbitrary limit)*/
next = ssi_eval_expr_loop(t, v);
if (next == TK_RPARAN && level == t->in_brace) {
int result = ssi_val_tobool(v);
next = ssi_eval_expr_step(t, v); /*(resets v)*/
v->bo = result;
v->type = SSI_TYPE_BOOL;
return (next==TK_AND || next==TK_OR || next==TK_RPARAN || 0==next)
? next
: -1;
}
else
return -1;
case TK_RPARAN:
return t->in_brace >= 0 ? TK_RPARAN : -1;
case TK_NOT:
if (++t->depth > 16) return -1; /*(arbitrary limit)*/
next = ssi_eval_expr_step(t, v);
--t->depth;
if (-1 == next) return next;
v->bo = !ssi_val_tobool(v);
v->type = SSI_TYPE_BOOL;
return next;
default:
return next;
}
}
static int ssi_eval_expr_loop_cmp(ssi_tokenizer_t * const t, ssi_val_t * const v1, int cond) {
ssi_val_t v2 = { { NULL, 0, 0 }, SSI_TYPE_UNSET, 0 };
int next = ssi_eval_expr_step(t, &v2);
if (-1 != next) {
v1->bo = ssi_eval_expr_cmp(v1, &v2, cond);
v1->type = SSI_TYPE_BOOL;
}
buffer_free_ptr(&v2.str);
return next;
}
static int ssi_eval_expr_loop(ssi_tokenizer_t * const t, ssi_val_t * const v1) {
int next = ssi_eval_expr_step(t, v1);
switch (next) {
case TK_AND: case TK_OR:
break;
case TK_EQ: case TK_NE:
case TK_GT: case TK_GE:
case TK_LT: case TK_LE:
next = ssi_eval_expr_loop_cmp(t, v1, next);
if (next == TK_RPARAN || 0 == next) return next;
if (next != TK_AND && next != TK_OR) {
log_error(t->p->errh, __FILE__, __LINE__,
"pos: %zu parser failed somehow near here", t->offset+1);
return -1;
}
break;
default:
return next;
}
/*(Note: '&&' and '||' evaluations are not short-circuited)*/
ssi_val_t v2 = { { NULL, 0, 0 }, SSI_TYPE_UNSET, 0 };
do {
int cond = next;
next = ssi_eval_expr_step(t, &v2);
switch (next) {
case TK_AND: case TK_OR: case 0:
break;
case TK_EQ: case TK_NE:
case TK_GT: case TK_GE:
case TK_LT: case TK_LE:
next = ssi_eval_expr_loop_cmp(t, &v2, next);
if (-1 == next) continue;
break;
case TK_RPARAN:
break;
default:
continue;
}
v1->bo = ssi_eval_expr_cmp_bool(v1, &v2, cond);
v1->type = SSI_TYPE_BOOL;
} while (next == TK_AND || next == TK_OR);
buffer_free_ptr(&v2.str);
return next;
}
static int ssi_eval_expr(handler_ctx *p, const char *expr) {
ssi_tokenizer_t t;
t.input = expr;
t.offset = 0;
t.size = strlen(expr);
t.in_brace = 0;
t.depth = 0;
t.p = p;
ssi_val_t v = { { NULL, 0, 0 }, SSI_TYPE_UNSET, 0 };
int rc = ssi_eval_expr_loop(&t, &v);
rc = (0 == rc && 0 == t.in_brace && 0 == t.depth)
? ssi_val_tobool(&v)
: -1;
buffer_free_ptr(&v.str);
return rc;
}
static int ssi_env_add(void *venv, const char *key, size_t klen, const char *val, size_t vlen) {
array_set_key_value((array *)venv, key, klen, val, vlen);
return 0;
}
static int build_ssi_cgi_vars(request_st * const r, handler_ctx * const p) {
http_cgi_opts opts = { 0, 0, NULL, NULL };
/* temporarily remove Authorization from request headers
* so that Authorization does not end up in SSI environment */
buffer *vb_auth = http_header_request_get(r, HTTP_HEADER_AUTHORIZATION, CONST_STR_LEN("Authorization"));
buffer b_auth;
if (vb_auth) {
memcpy(&b_auth, vb_auth, sizeof(buffer));
memset(vb_auth, 0, sizeof(buffer));
}
array_reset_data_strings(p->ssi_cgi_env);
if (0 != http_cgi_headers(r, &opts, ssi_env_add, p->ssi_cgi_env)) {
r->http_status = 400;
return -1;
}
if (vb_auth) {
memcpy(vb_auth, &b_auth, sizeof(buffer));
}
return 0;
}
[multiple] Y2038 32-bit signed time_t mitigations Most OS platforms have already provided solutions to Y2038 32-bit signed time_t 5 - 10 years ago (or more!) Notable exceptions are Linux i686 and FreeBSD i386. Since 32-bit systems tend to be embedded systems, and since many distros take years to pick up new software, this commit aims to provide Y2038 mitigations for lighttpd running on 32-bit systems with Y2038-unsafe 32-bit signed time_t * Y2038: lighttpd 1.4.60 and later report Y2038 safety $ lighttpd -V + Y2038 support # Y2038-SAFE $ lighttpd -V - Y2038 support (unsafe 32-bit signed time_t) # Y2038-UNSAFE * Y2038: general platform info * Y2038-SAFE: lighttpd 64-bit builds on platforms using 64-bit time_t - all major 64-bit platforms (known to this author) use 64-bit time_t * Y2038-SAFE: lighttpd 32-bit builds on platforms using 64-bit time_t - Linux x32 ABI (different from i686) - FreeBSD all 32-bit and 64-bit architectures *except* 32-bit i386 - NetBSD 6.0 (released Oct 2012) all 32-bit and 64-bit architectures - OpenBSD 5.5 (released May 2014) all 32-bit and 64-bit architectures - Microsoft Windows XP and Visual Studio 2005 (? unsure ?) Another reference suggests Visual Studio 2015 defaults to 64-bit time_t - MacOS 10.15 Catalina (released 2019) drops support for 32-bit apps * Y2038-SAFE: lighttpd 32-bit builds on platforms using 32-bit unsigned time_t - e.g. OpenVMS (unknown if lighttpd builds on this platform) * Y2038-UNSAFE: lighttpd 32-bit builds on platforms using 32-bit signed time_t - Linux 32-bit (including i686) - glibc 32-bit library support not yet available for 64-bit time_t - https://sourceware.org/glibc/wiki/Y2038ProofnessDesign - Linux kernel 5.6 on 32-bit platforms does support 64-bit time_t https://itsubuntu.com/linux-kernel-5-6-to-fix-the-year-2038-issue-unix-y2k/ - https://www.gnu.org/software/libc/manual/html_node/64_002dbit-time-symbol-handling.html "Note: at this point, 64-bit time support in dual-time configurations is work-in-progress, so for these configurations, the public API only makes the 32-bit time support available. In a later change, the public API will allow user code to choose the time size for a given compilation unit." - compiling with -D_TIME_BITS=64 currently has no effect - glibc recent (Jul 2021) mailing list discussion - https://public-inbox.org/bug-gnulib/878s2ozq70.fsf@oldenburg.str.redhat.com/T/ - FreeBSD i386 - DragonFlyBSD 32-bit * Y2038 mitigations attempted on Y2038-UNSAFE platforms (32-bit signed time_t) * lighttpd prefers system monotonic clock instead of realtime clock in places where realtime clock is not required * lighttpd treats negative time_t values as after 19 Jan 2038 03:14:07 GMT * (lighttpd presumes that lighttpd will not encounter dates before 1970 during normal operation.) * lighttpd casts struct stat st.st_mtime (and st.st_*time) through uint64_t to convert negative timestamps for comparisions with 64-bit timestamps (treating negative timestamp values as after 19 Jan 2038 03:14:07 GMT) * lighttpd provides unix_time64_t (int64_t) and * lighttpd provides struct unix_timespec64 (unix_timespec64_t) (struct timespec equivalent using unix_time64_t tv_sec member) * lighttpd provides gmtime64_r() and localtime64_r() wrappers for platforms 32-bit platforms using 32-bit time_t and lighttpd temporarily shifts the year in order to use gmtime_r() and localtime_r() (or gmtime() and localtime()) from standard libraries, before readjusting year and passing struct tm to formatting functions such as strftime() * lighttpd provides TIME64_CAST() macro to cast signed 32-bit time_t to unsigned 32-bit and then to unix_time64_t * Note: while lighttpd tries handle times past 19 Jan 2038 03:14:07 GMT on 32-bit platforms using 32-bit signed time_t, underlying libraries and underlying filesystems might not behave properly after 32-bit signed time_t overflows (19 Jan 2038 03:14:08 GMT). If a given 32-bit OS does not work properly using negative time_t values, then lighttpd likely will not work properly on that system. * Other references and blogs - https://en.wikipedia.org/wiki/Year_2038_problem - https://en.wikipedia.org/wiki/Time_formatting_and_storage_bugs - http://www.lieberbiber.de/2017/03/14/a-look-at-the-year-20362038-problems-and-time-proofness-in-various-systems/
2021-07-12 18:46:49 +00:00
static void mod_ssi_timefmt (buffer * const b, buffer *timefmtb, unix_time64_t t, int localtm) {
struct tm tm;
[multiple] reduce redundant NULL buffer checks This commit is a large set of code changes and results in removal of hundreds, perhaps thousands, of CPU instructions, a portion of which are on hot code paths. Most (buffer *) used by lighttpd are not NULL, especially since buffers were inlined into numerous larger structs such as request_st and chunk. In the small number of instances where that is not the case, a NULL check is often performed earlier in a function where that buffer is later used with a buffer_* func. In the handful of cases that remained, a NULL check was added, e.g. with r->http_host and r->conf.server_tag. - check for empty strings at config time and set value to NULL if blank string will be ignored at runtime; at runtime, simple pointer check for NULL can be used to check for a value that has been set and is not blank ("") - use buffer_is_blank() instead of buffer_string_is_empty(), and use buffer_is_unset() instead of buffer_is_empty(), where buffer is known not to be NULL so that NULL check can be skipped - use buffer_clen() instead of buffer_string_length() when buffer is known not to be NULL (to avoid NULL check at runtime) - use buffer_truncate() instead of buffer_string_set_length() to truncate string, and use buffer_extend() to extend Examples where buffer known not to be NULL: - cpv->v.b from config_plugin_values_init is not NULL if T_CONFIG_BOOL (though we might set it to NULL if buffer_is_blank(cpv->v.b)) - address of buffer is arg (&foo) (compiler optimizer detects this in most, but not all, cases) - buffer is checked for NULL earlier in func - buffer is accessed in same scope without a NULL check (e.g. b->ptr) internal behavior change: callers must not pass a NULL buffer to some funcs. - buffer_init_buffer() requires non-null args - buffer_copy_buffer() requires non-null args - buffer_append_string_buffer() requires non-null args - buffer_string_space() requires non-null arg
2021-06-09 02:57:36 +00:00
const char * const timefmt = buffer_is_blank(timefmtb)
? "%a, %d %b %Y %T %Z"
: timefmtb->ptr;
[multiple] Y2038 32-bit signed time_t mitigations Most OS platforms have already provided solutions to Y2038 32-bit signed time_t 5 - 10 years ago (or more!) Notable exceptions are Linux i686 and FreeBSD i386. Since 32-bit systems tend to be embedded systems, and since many distros take years to pick up new software, this commit aims to provide Y2038 mitigations for lighttpd running on 32-bit systems with Y2038-unsafe 32-bit signed time_t * Y2038: lighttpd 1.4.60 and later report Y2038 safety $ lighttpd -V + Y2038 support # Y2038-SAFE $ lighttpd -V - Y2038 support (unsafe 32-bit signed time_t) # Y2038-UNSAFE * Y2038: general platform info * Y2038-SAFE: lighttpd 64-bit builds on platforms using 64-bit time_t - all major 64-bit platforms (known to this author) use 64-bit time_t * Y2038-SAFE: lighttpd 32-bit builds on platforms using 64-bit time_t - Linux x32 ABI (different from i686) - FreeBSD all 32-bit and 64-bit architectures *except* 32-bit i386 - NetBSD 6.0 (released Oct 2012) all 32-bit and 64-bit architectures - OpenBSD 5.5 (released May 2014) all 32-bit and 64-bit architectures - Microsoft Windows XP and Visual Studio 2005 (? unsure ?) Another reference suggests Visual Studio 2015 defaults to 64-bit time_t - MacOS 10.15 Catalina (released 2019) drops support for 32-bit apps * Y2038-SAFE: lighttpd 32-bit builds on platforms using 32-bit unsigned time_t - e.g. OpenVMS (unknown if lighttpd builds on this platform) * Y2038-UNSAFE: lighttpd 32-bit builds on platforms using 32-bit signed time_t - Linux 32-bit (including i686) - glibc 32-bit library support not yet available for 64-bit time_t - https://sourceware.org/glibc/wiki/Y2038ProofnessDesign - Linux kernel 5.6 on 32-bit platforms does support 64-bit time_t https://itsubuntu.com/linux-kernel-5-6-to-fix-the-year-2038-issue-unix-y2k/ - https://www.gnu.org/software/libc/manual/html_node/64_002dbit-time-symbol-handling.html "Note: at this point, 64-bit time support in dual-time configurations is work-in-progress, so for these configurations, the public API only makes the 32-bit time support available. In a later change, the public API will allow user code to choose the time size for a given compilation unit." - compiling with -D_TIME_BITS=64 currently has no effect - glibc recent (Jul 2021) mailing list discussion - https://public-inbox.org/bug-gnulib/878s2ozq70.fsf@oldenburg.str.redhat.com/T/ - FreeBSD i386 - DragonFlyBSD 32-bit * Y2038 mitigations attempted on Y2038-UNSAFE platforms (32-bit signed time_t) * lighttpd prefers system monotonic clock instead of realtime clock in places where realtime clock is not required * lighttpd treats negative time_t values as after 19 Jan 2038 03:14:07 GMT * (lighttpd presumes that lighttpd will not encounter dates before 1970 during normal operation.) * lighttpd casts struct stat st.st_mtime (and st.st_*time) through uint64_t to convert negative timestamps for comparisions with 64-bit timestamps (treating negative timestamp values as after 19 Jan 2038 03:14:07 GMT) * lighttpd provides unix_time64_t (int64_t) and * lighttpd provides struct unix_timespec64 (unix_timespec64_t) (struct timespec equivalent using unix_time64_t tv_sec member) * lighttpd provides gmtime64_r() and localtime64_r() wrappers for platforms 32-bit platforms using 32-bit time_t and lighttpd temporarily shifts the year in order to use gmtime_r() and localtime_r() (or gmtime() and localtime()) from standard libraries, before readjusting year and passing struct tm to formatting functions such as strftime() * lighttpd provides TIME64_CAST() macro to cast signed 32-bit time_t to unsigned 32-bit and then to unix_time64_t * Note: while lighttpd tries handle times past 19 Jan 2038 03:14:07 GMT on 32-bit platforms using 32-bit signed time_t, underlying libraries and underlying filesystems might not behave properly after 32-bit signed time_t overflows (19 Jan 2038 03:14:08 GMT). If a given 32-bit OS does not work properly using negative time_t values, then lighttpd likely will not work properly on that system. * Other references and blogs - https://en.wikipedia.org/wiki/Year_2038_problem - https://en.wikipedia.org/wiki/Time_formatting_and_storage_bugs - http://www.lieberbiber.de/2017/03/14/a-look-at-the-year-20362038-problems-and-time-proofness-in-various-systems/
2021-07-12 18:46:49 +00:00
buffer_append_strftime(b, timefmt, localtm
? localtime64_r(&t, &tm)
: gmtime64_r(&t, &tm));
[multiple] reduce redundant NULL buffer checks This commit is a large set of code changes and results in removal of hundreds, perhaps thousands, of CPU instructions, a portion of which are on hot code paths. Most (buffer *) used by lighttpd are not NULL, especially since buffers were inlined into numerous larger structs such as request_st and chunk. In the small number of instances where that is not the case, a NULL check is often performed earlier in a function where that buffer is later used with a buffer_* func. In the handful of cases that remained, a NULL check was added, e.g. with r->http_host and r->conf.server_tag. - check for empty strings at config time and set value to NULL if blank string will be ignored at runtime; at runtime, simple pointer check for NULL can be used to check for a value that has been set and is not blank ("") - use buffer_is_blank() instead of buffer_string_is_empty(), and use buffer_is_unset() instead of buffer_is_empty(), where buffer is known not to be NULL so that NULL check can be skipped - use buffer_clen() instead of buffer_string_length() when buffer is known not to be NULL (to avoid NULL check at runtime) - use buffer_truncate() instead of buffer_string_set_length() to truncate string, and use buffer_extend() to extend Examples where buffer known not to be NULL: - cpv->v.b from config_plugin_values_init is not NULL if T_CONFIG_BOOL (though we might set it to NULL if buffer_is_blank(cpv->v.b)) - address of buffer is arg (&foo) (compiler optimizer detects this in most, but not all, cases) - buffer is checked for NULL earlier in func - buffer is accessed in same scope without a NULL check (e.g. b->ptr) internal behavior change: callers must not pass a NULL buffer to some funcs. - buffer_init_buffer() requires non-null args - buffer_copy_buffer() requires non-null args - buffer_append_string_buffer() requires non-null args - buffer_string_space() requires non-null arg
2021-06-09 02:57:36 +00:00
if (buffer_is_blank(b))
buffer_copy_string_len(b, CONST_STR_LEN("(none)"));
}
static int mod_ssi_process_file(request_st *r, handler_ctx *p, struct stat *st);
static int process_ssi_stmt(request_st * const r, handler_ctx * const p, const char ** const l, size_t n, struct stat * const st) {
2016-04-18 03:37:40 +00:00
/**
* <!--#element attribute=value attribute=value ... -->
*
* config DONE
* errmsg -- missing
* sizefmt DONE
* timefmt DONE
* echo DONE
* var DONE
* encoding -- missing
* exec DONE
* cgi -- never
* cmd DONE
* fsize DONE
* file DONE
* virtual DONE
* flastmod DONE
* file DONE
* virtual DONE
* include DONE
* file DONE
* virtual DONE
* printenv DONE
* set DONE
* var DONE
* value DONE
*
* if DONE
* elif DONE
* else DONE
* endif DONE
*
*
* expressions
* AND, OR DONE
* comp DONE
* ${...} -- missing
* $... DONE
* '...' DONE
* ( ... ) DONE
*
*
*
* ** all DONE **
* DATE_GMT
* The current date in Greenwich Mean Time.
* DATE_LOCAL
* The current date in the local time zone.
* DOCUMENT_NAME
* The filename (excluding directories) of the document requested by the user.
* DOCUMENT_URI
* The (%-decoded) URL path of the document requested by the user. Note that in the case of nested include files, this is not then URL for the current document.
* LAST_MODIFIED
* The last modification date of the document requested by the user.
* USER_NAME
* Contains the owner of the file which included it.
*
*/
size_t i, ssicmd = 0;
buffer *tb = NULL;
static const struct {
const char *var;
enum { SSI_UNSET, SSI_ECHO, SSI_FSIZE, SSI_INCLUDE, SSI_FLASTMOD,
SSI_CONFIG, SSI_PRINTENV, SSI_SET, SSI_IF, SSI_ELIF,
SSI_ELSE, SSI_ENDIF, SSI_EXEC, SSI_COMMENT } type;
} ssicmds[] = {
{ "echo", SSI_ECHO },
{ "include", SSI_INCLUDE },
{ "flastmod", SSI_FLASTMOD },
{ "fsize", SSI_FSIZE },
{ "config", SSI_CONFIG },
{ "printenv", SSI_PRINTENV },
{ "set", SSI_SET },
{ "if", SSI_IF },
{ "elif", SSI_ELIF },
{ "endif", SSI_ENDIF },
{ "else", SSI_ELSE },
{ "exec", SSI_EXEC },
{ "comment", SSI_COMMENT },
{ NULL, SSI_UNSET }
};
for (i = 0; ssicmds[i].var; i++) {
if (0 == strcmp(l[1], ssicmds[i].var)) {
ssicmd = ssicmds[i].type;
break;
}
}
chunkqueue * const cq = &p->wq;
switch(ssicmd) {
case SSI_ECHO: {
/* echo */
int var = 0;
/* int enc = 0; */
const char *var_val = NULL;
static const struct {
const char *var;
enum {
SSI_ECHO_UNSET,
SSI_ECHO_DATE_GMT,
SSI_ECHO_DATE_LOCAL,
SSI_ECHO_DOCUMENT_NAME,
SSI_ECHO_DOCUMENT_URI,
SSI_ECHO_LAST_MODIFIED,
SSI_ECHO_USER_NAME,
SSI_ECHO_SCRIPT_URI,
SSI_ECHO_SCRIPT_URL,
} type;
} echovars[] = {
{ "DATE_GMT", SSI_ECHO_DATE_GMT },
{ "DATE_LOCAL", SSI_ECHO_DATE_LOCAL },
{ "DOCUMENT_NAME", SSI_ECHO_DOCUMENT_NAME },
{ "DOCUMENT_URI", SSI_ECHO_DOCUMENT_URI },
{ "LAST_MODIFIED", SSI_ECHO_LAST_MODIFIED },
{ "USER_NAME", SSI_ECHO_USER_NAME },
{ "SCRIPT_URI", SSI_ECHO_SCRIPT_URI },
{ "SCRIPT_URL", SSI_ECHO_SCRIPT_URL },
{ NULL, SSI_ECHO_UNSET }
};
/*
static const struct {
const char *var;
enum { SSI_ENC_UNSET, SSI_ENC_URL, SSI_ENC_NONE, SSI_ENC_ENTITY } type;
} encvars[] = {
{ "url", SSI_ENC_URL },
{ "none", SSI_ENC_NONE },
{ "entity", SSI_ENC_ENTITY },
{ NULL, SSI_ENC_UNSET }
};
*/
for (i = 2; i < n; i += 2) {
if (0 == strcmp(l[i], "var")) {
int j;
var_val = l[i+1];
for (j = 0; echovars[j].var; j++) {
if (0 == strcmp(l[i+1], echovars[j].var)) {
var = echovars[j].type;
break;
}
}
} else if (0 == strcmp(l[i], "encoding")) {
/*
int j;
for (j = 0; encvars[j].var; j++) {
if (0 == strcmp(l[i+1], encvars[j].var)) {
enc = encvars[j].type;
break;
}
}
*/
} else {
log_error(r->conf.errh, __FILE__, __LINE__,
"ssi: unknown attribute for %s %s", l[1], l[i]);
}
}
if (p->if_is_false) break;
if (!var_val) {
log_error(r->conf.errh, __FILE__, __LINE__,
"ssi: %s var is missing", l[1]);
break;
}
switch(var) {
case SSI_ECHO_USER_NAME: {
tb = r->tmp_buf;
buffer_clear(tb);
#ifdef HAVE_PWD_H
struct passwd *pw;
2016-04-18 03:37:40 +00:00
if (NULL == (pw = getpwuid(st->st_uid))) {
buffer_append_int(tb, st->st_uid);
} else {
buffer_copy_string(tb, pw->pw_name);
}
#else
buffer_append_int(tb, st->st_uid);
#endif
[multiple] reduce redundant NULL buffer checks This commit is a large set of code changes and results in removal of hundreds, perhaps thousands, of CPU instructions, a portion of which are on hot code paths. Most (buffer *) used by lighttpd are not NULL, especially since buffers were inlined into numerous larger structs such as request_st and chunk. In the small number of instances where that is not the case, a NULL check is often performed earlier in a function where that buffer is later used with a buffer_* func. In the handful of cases that remained, a NULL check was added, e.g. with r->http_host and r->conf.server_tag. - check for empty strings at config time and set value to NULL if blank string will be ignored at runtime; at runtime, simple pointer check for NULL can be used to check for a value that has been set and is not blank ("") - use buffer_is_blank() instead of buffer_string_is_empty(), and use buffer_is_unset() instead of buffer_is_empty(), where buffer is known not to be NULL so that NULL check can be skipped - use buffer_clen() instead of buffer_string_length() when buffer is known not to be NULL (to avoid NULL check at runtime) - use buffer_truncate() instead of buffer_string_set_length() to truncate string, and use buffer_extend() to extend Examples where buffer known not to be NULL: - cpv->v.b from config_plugin_values_init is not NULL if T_CONFIG_BOOL (though we might set it to NULL if buffer_is_blank(cpv->v.b)) - address of buffer is arg (&foo) (compiler optimizer detects this in most, but not all, cases) - buffer is checked for NULL earlier in func - buffer is accessed in same scope without a NULL check (e.g. b->ptr) internal behavior change: callers must not pass a NULL buffer to some funcs. - buffer_init_buffer() requires non-null args - buffer_copy_buffer() requires non-null args - buffer_append_string_buffer() requires non-null args - buffer_string_space() requires non-null arg
2021-06-09 02:57:36 +00:00
chunkqueue_append_mem(cq, BUF_PTR_LEN(tb));
break;
}