- Tightened setuid operation to not allow any user or group changes.

- Added support for --cgi mode.


git-svn-id: https://shellinabox.googlecode.com/svn/trunk@22 0da03de8-d603-11dd-86c2-0f8696b7b6f9

Makefile.am

@@ -62,6 +62,7 @@ shellinaboxd_SOURCES = shellinabox/shellinaboxd.c                             \
                        shellinabox/service.h                                  \
                        shellinabox/session.c                                  \
                        shellinabox/session.h                                  \
+                       shellinabox/cgi_root.html                              \
                        shellinabox/root_page.html                             \
                        shellinabox/vt100.js                                   \
                        shellinabox/shell_in_a_box.js                          \

Makefile.in

@@ -73,7 +73,8 @@ am__dirstamp = $(am__leading_dot)dirstamp
 am_shellinaboxd_OBJECTS = shellinaboxd.$(OBJEXT) \
 	externalfile.$(OBJEXT) launcher.$(OBJEXT) privileges.$(OBJEXT) \
 	service.$(OBJEXT) session.$(OBJEXT) \
-	shellinabox/root_page.$(OBJEXT) shellinabox/vt100.$(OBJEXT) \
+	shellinabox/cgi_root.$(OBJEXT) shellinabox/root_page.$(OBJEXT) \
+	shellinabox/vt100.$(OBJEXT) \
 	shellinabox/shell_in_a_box.$(OBJEXT) \
 	shellinabox/styles.$(OBJEXT) shellinabox/favicon.$(OBJEXT) \
 	shellinabox/beep.$(OBJEXT)
@@ -299,6 +300,7 @@ shellinaboxd_SOURCES = shellinabox/shellinaboxd.c                             \
                        shellinabox/service.h                                  \
                        shellinabox/session.c                                  \
                        shellinabox/session.h                                  \
+                       shellinabox/cgi_root.html                              \
                        shellinabox/root_page.html                             \
                        shellinabox/vt100.js                                   \
                        shellinabox/shell_in_a_box.js                          \
@@ -394,6 +396,8 @@ shellinabox/$(am__dirstamp):
 shellinabox/$(DEPDIR)/$(am__dirstamp):
 	@$(MKDIR_P) shellinabox/$(DEPDIR)
 	@: > shellinabox/$(DEPDIR)/$(am__dirstamp)
+shellinabox/cgi_root.$(OBJEXT): shellinabox/$(am__dirstamp) \
+	shellinabox/$(DEPDIR)/$(am__dirstamp)
 shellinabox/root_page.$(OBJEXT): shellinabox/$(am__dirstamp) \
 	shellinabox/$(DEPDIR)/$(am__dirstamp)
 shellinabox/vt100.$(OBJEXT): shellinabox/$(am__dirstamp) \
@@ -413,6 +417,7 @@ shellinaboxd$(EXEEXT): $(shellinaboxd_OBJECTS) $(shellinaboxd_DEPENDENCIES)
 mostlyclean-compile:
 	-rm -f *.$(OBJEXT)
 	-rm -f shellinabox/beep.$(OBJEXT)
+	-rm -f shellinabox/cgi_root.$(OBJEXT)
 	-rm -f shellinabox/favicon.$(OBJEXT)
 	-rm -f shellinabox/root_page.$(OBJEXT)
 	-rm -f shellinabox/shell_in_a_box.$(OBJEXT)

libhttp/http.h

@@ -64,8 +64,11 @@ typedef struct ServerConnection ServerConnection;
 typedef struct Server Server;
 typedef struct URL URL;
 
+Server *newCGIServer(int portMin, int portMax, int timeout);
 Server *newServer(int port);
 void deleteServer(Server *server);
+int  serverGetListeningPort(Server *server);
+int  serverGetFd(Server *server);
 void serverRegisterHttpHandler(Server *server, const char *url,
                                int (*handler)(HttpConnection *, void *,
                                               const char *, int), void *arg);

libhttp/libhttp.sym

@@ -1,5 +1,8 @@
+newCGIServer
 newServer
 deleteServer
+serverGetListeningPort
+serverGetFd
 serverRegisterHttpHandler
 serverRegisterStreamingHttpHandler
 serverAddConnection

libhttp/server.c

@@ -49,6 +49,7 @@
 #include <string.h>
 #include <sys/poll.h>
 #include <sys/socket.h>
+#include <sys/time.h>
 #include <sys/types.h>
 #include <unistd.h>
 
@@ -166,6 +167,58 @@ static int serverQuitHandler(struct HttpConnection *http, void *arg) {
   return HTTP_DONE;
 }
 
+struct Server *newCGIServer(int portMin, int portMax, int timeout) {
+  struct Server *server         = newServer(0);
+  server->serverTimeout         = timeout;
+  int true                      = 1;
+  server->serverFd              = socket(PF_INET, SOCK_STREAM, 0);
+  check(server->serverFd >= 0);
+  check(!setsockopt(server->serverFd, SOL_SOCKET, SO_REUSEADDR,
+                    &true, sizeof(true)));
+  struct sockaddr_in serverAddr = { 0 };
+  serverAddr.sin_family         = AF_INET;
+  serverAddr.sin_addr.s_addr    = INADDR_ANY;
+
+  // Linux unlike BSD does not have support for picking a local port range.
+  // So, we have to randomly pick a port from our allowed port range, and then
+  // keep iterating until we find an unused port.
+  if (portMin || portMax) {
+    struct timeval tv;
+    check(!gettimeofday(&tv, NULL));
+    srand((int)(tv.tv_usec ^ tv.tv_sec));
+    check(portMin > 0);
+    check(portMax < 65536);
+    check(portMax >= portMin);
+    int portStart               = rand() % (portMax - portMin + 1) + portMin;
+    for (int p = 0; p <= portMax-portMin; p++) {
+      int port                  = (p+portStart)%(portMax-portMin+1)+ portMin;
+      serverAddr.sin_port       = htons(port);
+      if (!bind(server->serverFd, (struct sockaddr *)&serverAddr,
+                sizeof(serverAddr))) {
+        break;
+      }
+      serverAddr.sin_port       = 0;
+    }
+    if (!serverAddr.sin_port) {
+      fatal("Failed to find any available port");
+    }
+  }
+
+  check(!listen(server->serverFd, SOMAXCONN));
+  socklen_t socklen             = (socklen_t)sizeof(serverAddr);
+  check(!getsockname(server->serverFd, (struct sockaddr *)&serverAddr,
+                     &socklen));
+  check(socklen == sizeof(serverAddr));
+  server->port                  = ntohs(serverAddr.sin_port);
+  info("Listening on port %d", server->port);
+
+  check(server->pollFds         = malloc(sizeof(struct pollfd)));
+  server->pollFds->fd           = server->serverFd;
+  server->pollFds->events       = POLLIN;
+
+  return server;
+}
+
 struct Server *newServer(int port) {
   struct Server *server;
   check(server = malloc(sizeof(struct Server)));
@@ -177,6 +230,7 @@ void initServer(struct Server *server, int port) {
   server->port                  = port;
   server->looping               = 0;
   server->exitAll               = 0;
+  server->serverTimeout         = -1;
   server->serverFd              = -1;
   server->numericHosts          = 0;
   server->pollFds               = NULL;
@@ -208,6 +262,14 @@ void deleteServer(struct Server *server) {
   free(server);
 }
 
+int serverGetListeningPort(struct Server *server) {
+  return server->port;
+}
+
+int serverGetFd(struct Server *server) {
+  return server->serverFd;
+}
+
 struct ServerConnection *serverAddConnection(struct Server *server, int fd,
                          int (*handleConnection)(struct ServerConnection *c,
                                                  void *arg, short *events,
@@ -363,6 +425,14 @@ void serverLoop(struct Server *server) {
       }
     }
 
+    // serverTimeout is always a delta value, unlike connection timeouts
+    // which are absolute times.
+    if (server->serverTimeout >= 0) {
+      if (timeout < 0 || timeout > server->serverTimeout + currentTime) {
+        timeout                           = server->serverTimeout+currentTime;
+      }
+    }
+
     if (timeout >= 0) {
       // Wait at least one second longer than needed, so that even if
       // poll() decides to return a second early (due to possible rounding
@@ -406,6 +476,12 @@ void serverLoop(struct Server *server) {
             INITIAL_TIMEOUT);
         }
       }
+    } else {
+      if (server->serverTimeout > 0 && !server->numConnections) {
+        // In CGI mode, exit the server, if we haven't had any active
+        // connections in a while.
+        break;
+      }
     }
     for (int i = 1;
          (isTimeout || eventCount > 0) && i <= server->numConnections;

libhttp/server.h

@@ -68,6 +68,7 @@ struct Server {
   int                     port;
   int                     looping;
   int                     exitAll;
+  int                     serverTimeout;
   int                     serverFd;
   int                     numericHosts;
   struct pollfd           *pollFds;
@@ -77,10 +78,13 @@ struct Server {
   struct SSLSupport       ssl;
 };
 
+struct Server *newCGIServer(int portMin, int portMax, int timeout);
 struct Server *newServer(int port);
 void initServer(struct Server *server, int port);
 void destroyServer(struct Server *server);
 void deleteServer(struct Server *server);
+int  serverGetListeningPort(struct Server *server);
+int  serverGetFd(struct Server *server);
 void serverRegisterHttpHandler(struct Server *server, const char *url,
                                int (*handler)(struct HttpConnection *, void *,
                                               const char *, int), void *arg);

logging/logging.h

@@ -74,7 +74,8 @@ void info(const char *fmt, ...)    __attribute__((format(printf, 1, 2)));
 void warn(const char *fmt, ...)    __attribute__((format(printf, 1, 2)));
 void error(const char *fmt, ...)   __attribute__((format(printf, 1, 2)));
 void message(const char *fmt, ...) __attribute__((format(printf, 1, 2)));
-void fatal(const char *fmt, ...)   __attribute__((format(printf, 1, 2)));
+void fatal(const char *fmt, ...)   __attribute__((format(printf, 1, 2),
+                                                  noreturn));
 int logIsDebug(void);
 int logIsInfo(void);
 int logIsWarn(void);

shellinabox/cgi_root.html

@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml" xml:lang="en" lang="en">
+  <head>
+    <!--
+    ShellInABox - Make command line applications available as AJAX web applications
+    Copyright (C) 2008 Markus Gutschke [email protected]
+    
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License version 2 as
+    published by the Free Software Foundation.
+    
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+    
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+    
+    In addition to these license terms, the author grants the following
+    additional rights:
+    
+    If you modify this program, or any covered work, by linking or
+    combining it with the OpenSSL project's OpenSSL library (or a
+    modified version of that library), containing parts covered by the
+    terms of the OpenSSL or SSLeay licenses, the author
+    grants you additional permission to convey the resulting work.
+    Corresponding Source for a non-source form of such a combination
+    shall include the source code for the parts of OpenSSL used as well
+    as that of the covered work.
+    
+    You may at your option choose to remove this additional permission from
+    the work, or from any part of it.
+    
+    It is possible to build this program in a way that it loads OpenSSL
+    libraries at run-time. If doing so, the following notices are required
+    by the OpenSSL and SSLeay licenses:
+    
+    This product includes software developed by the OpenSSL Project
+    for use in the OpenSSL Toolkit. (http://www.openssl.org/)
+    
+    This product includes cryptographic software written by Eric Young
+    ([email protected])   
+    
+    The most up-to-date version of this program is always available from
+    http://shellinabox.com
+    -->
+    <title>Shell In A Box</title>
+    <script type="text/javascript"><!--
+    (function() {
+      var url   = document.location.protocol + '//' +
+                  document.location.hostname + ':%d/';
+      var head  = document.getElementsByTagName('head')[0];
+      var link  = document.createElement('link');
+      link.rel  = 'shortcut icon';
+      link.type = 'image/x-icon';
+      link.href = url + 'favicon.ico';
+      head.appendChild(link);
+      document.write('<frameset cols="*">\n' +
+                       '<frame src="' + url +
+                          document.location.search.replace(/^\?/, '') + '#' +
+                          encodeURIComponent(document.location.href) + '">\n' +
+                     '</frameset>');      
+    })();
+    --></script>
+  </head>
+</html>