2 * Copyright (C) 2009 Red Hat Inc.
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation; either version 2 of the License, or
7 * (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, write to the Free Software
16 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
19 /* This code parses and executes the commands sent by guests. It
20 * is therefore particularly security sensitive. The protocol is
21 * documented in hostinfo-protocol(5).
37 #include <apr_general.h>
38 #include <apr_pools.h>
40 #include <apr_strings.h>
42 #include "hostinfod.h"
44 #define PROTOCOL_VERSION "1.0"
47 apr_hash_t *commands = NULL;
49 static const char *string_of_arg_type (enum arg_type);
50 static int not_printable (const char *str);
51 static int contains_crlf (const char *str);
52 static char *parse_c_string (struct guest_description *hval, const char *str, size_t *posn);
53 static int parse_long (struct guest_description *hval, const char *str, size_t *posn, long *ret);
56 execute_command (const struct timespec *now,
57 struct guest_description *hval, const char *command)
62 apr_array_header_t *args;
67 struct timespec *last;
69 debug ("%s: %s", hval->name, command);
71 /* Create a new pool for allocation during the lifetime of the
72 * request/response. **NB** the hval->reply field is allocated
73 * from this pool, which is why it gets nulled below.
76 apr_pool_destroy (hval->rpool);
79 hval->reply_size = hval->reply_posn = 0;
80 apr_pool_create (&hval->rpool, hval->pool);
82 /* Split up the command. Commands have a very narrowly-defined
83 * format, and we reject any malformed commands with a 400 error.
85 * NB. A lot of the code below assumes 7 bit, printable ASCII,
86 * and this is only safe because of the call to 'not_printable'
89 len = strlen (command);
90 if (len < 1 || len > 4094 || not_printable (command)) {
91 warning ("%s: command too short, too long or contained unprintable chars (len = %zu)",
93 send_error (hval, 400);
97 /* Command is alphanumeric string, non-zero length. */
99 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
100 "abcdefghijklmnopqrstuvwxyz"
103 warning ("%s: no command part in request", hval->name);
104 send_error (hval, 400);
108 cmd = apr_pstrmemdup (hval->rpool, command, i);
109 for (j = 0; j < i; ++j)
110 cmd[j] = tolower (cmd[j]);
112 args = apr_array_make (hval->rpool, 0, sizeof (struct arg));
114 while (command[i]) { /* command[i] is the space before the next arg */
115 if (command[i] != ' ') {
116 warning ("%s: there must be a single space between command and each argument",
118 send_error (hval, 400);
125 switch (command[i]) {
127 warning ("%s: trailing space after command", hval->name);
128 send_error (hval, 400);
131 case '"': /* string literal */
132 arg.type = arg_type_string;
133 arg.u.str = parse_c_string (hval, command, &i);
135 send_error (hval, 400);
140 case '-': /* integer literal */
152 arg.type = arg_type_int;
153 if (parse_long (hval, command, &i, &arg.u.i) == -1) {
154 send_error (hval, 400);
159 case 't': /* boolean */
163 arg.type = arg_type_bool;
164 if (strncasecmp (&command[i], "true", 4) == 0) {
167 } else if (strncasecmp (&command[i], "false", 5) == 0) {
176 warning ("%s: unknown or malformed argument starting at position %zu ('%c')",
177 hval->name, i, command[i]);
178 send_error (hval, 400);
182 APR_ARRAY_PUSH (args, struct arg) = arg;
186 /* Debug output what the guest sent / what we decoded. */
187 debug ("%s: command '%s' with %d args", hval->name, cmd, args->nelts);
188 for (i = 0; i < args->nelts; ++i) {
189 struct arg arg = APR_ARRAY_IDX (args, i, struct arg);
194 debug ("%s: arg %zu : %s = %ld",
195 hval->name, i, string_of_arg_type (arg.type), arg.u.i);
197 case arg_type_string:
198 debug ("%s: arg %zu : %s = %s",
199 hval->name, i, string_of_arg_type (arg.type), arg.u.str);
205 /* Know about this command? */
206 fn = apr_hash_get (commands, cmd, APR_HASH_KEY_STRING);
208 send_error (hval, 404);
212 /* Before dispatching the command, check the command is enabled
213 * and guest is not calling it too frequently.
215 check_guests_file (hval, cmd, &interval, &enabled);
218 warning ("%s: guest tried disabled command '%s'", hval->name, cmd);
219 send_error (hval, 401);
223 last = apr_hash_get (hval->lasttime, cmd, APR_HASH_KEY_STRING);
225 struct timespec timediff;
226 double interval_int, interval_frac;
227 struct timespec interval_ts;
229 diff_timespec (&timediff, now, last);
231 interval_frac = modf (interval, &interval_int);
232 interval_ts.tv_sec = interval_int;
233 interval_ts.tv_nsec = interval_frac * 1000000000;
235 debug ("%s: %s: interval %ds %ldns, time since last %ds %ldns",
237 (int) interval_ts.tv_sec, interval_ts.tv_nsec,
238 (int) timediff.tv_sec, timediff.tv_nsec);
240 if (interval_ts.tv_sec > timediff.tv_sec ||
241 (interval_ts.tv_sec == timediff.tv_sec &&
242 interval_ts.tv_nsec > timediff.tv_nsec)) {
243 warning ("%s: command '%s' exceeded interval allowed", hval->name, cmd);
244 send_error (hval, 406);
249 last = apr_pmemdup (hval->pool, now, sizeof *now);
250 apr_hash_set (hval->lasttime, cmd, APR_HASH_KEY_STRING, last);
252 /* Dispatch the command. */
253 fn (hval, cmd, args);
256 /* All commands must consist only of printable 7 bit ASCII.
257 * NB. Don't use isprint(3).
260 not_printable (const char *str)
264 while ((c = *(unsigned char *)str)) {
265 if (c < 32 || c > 126)
273 contains_crlf (const char *str)
277 while ((c = *(unsigned char *)str)) {
278 if (c == '\r' || c == '\n')
289 case '0': case '1': case '2': case '3': case '4':
290 case '5': case '6': case '7': case '8': case '9':
292 case 'a': case 'b': case 'c': case 'd': case 'e': case 'f':
294 case 'A': case 'B': case 'C': case 'D': case 'E': case 'F':
302 parse_c_string (struct guest_description *hval, const char *str, size_t *posn)
304 apr_array_header_t *r;
307 r = apr_array_make (hval->rpool, 0, 1);
308 #define APPEND(c) APR_ARRAY_PUSH (r,char) = (c);
310 assert (str[*posn] == '"');
313 while (str[*posn] != '"') {
314 if (str[*posn] == '\\') { /* Start of \escape sequence. */
315 switch (str[*posn+1]) {
316 case '0': case '1': case '2': case '3':
317 if ((str[*posn+2] >= '0' && str[*posn+2] <= '7') &&
318 (str[*posn+3] >= '0' && str[*posn+3] <= '7')) {
319 c = (str[*posn+1] - '0') * 0100;
320 c += (str[*posn+2] - '0') * 010;
321 c += str[*posn+3] - '0';
326 warning ("%s: \\0 cannot appear in string literal", hval->name);
331 warning ("%s: invalid octal sequence in string literal", hval->name);
335 if (isxdigit (str[*posn+2]) && isxdigit (str[*posn+3])) {
336 c = hexval (str[*posn+2]) * 0x10;
337 c += hexval (str[*posn+3]);
342 warning ("%s: \\0 cannot appear in string literal", hval->name);
347 warning ("%s: invalid hex sequence in string literal", hval->name);
388 warning ("%s: unterminated escape sequence in string literal",
392 } else if (str[*posn] == '\0') { /* Unterminated string literal. */
393 warning ("%s: unterminated string literal in request", hval->name);
395 } else { /* Ordinary character. */
401 /* Finish off the string and return it. */
403 (*posn)++; /* Skips over the final quote. */
409 parse_long (struct guest_description *hval,
410 const char *str, size_t *posn, long *ret)
412 error ("XXXXXXX parse_long not implemented XXXXXXX");
416 /* For single line replies. */
418 send_reply (struct guest_description *hval, int code, const char *fs, ...)
423 /* All success codes must be 2xx. */
424 assert (code >= 200 && code < 300);
427 msg = apr_pvsprintf (hval->rpool, fs, args);
430 /* The result string must not contain any CR or LF characters. If
431 * not it's an internal error in the command, or else the caller has
432 * (somehow) managed to pass a bad string through.
434 if (contains_crlf (msg)) {
435 error ("%s: send_reply: refusing the send a reply message containing CR/LF characters. This is a serious internal error in the current command.",
437 send_error (hval, 500);
443 apr_psprintf (hval->rpool, PROTOCOL_VERSION " %03d %s" CRLF,
445 hval->reply_size = strlen (hval->reply);
446 hval->reply_posn = 0;
447 hval->state = guest_state_reply;
451 send_error (struct guest_description *hval, int code)
455 /* All errors must be 4xx or 5xx. */
456 assert (code >= 400 && code < 600);
458 /* NB: If you add a code, update COMMON STATUS CODES section
459 * in hostinfo-protocol.pod.
462 case 400: msg = "Bad request"; break;
463 case 401: msg = "Command disabled"; break;
464 case 404: msg = "Command not found"; break;
465 case 406: msg = "Too frequent"; break;
466 case 500: msg = "Internal server error"; break;
467 default: msg = "Unknown error"; break;
470 /* Construct the reply. */
472 apr_psprintf (hval->rpool, PROTOCOL_VERSION " %03d %s" CRLF,
474 hval->reply_size = strlen (hval->reply);
475 hval->reply_posn = 0;
476 hval->state = guest_state_reply;
478 /* Penalty is always increased on errors, to ensure the guest
479 * cannot flood us with invalid commands.
485 string_of_arg_type (enum arg_type t)
488 case arg_type_string: return "string";
489 case arg_type_int: return "int";
490 case arg_type_bool: return "bool";
496 get_args (apr_array_header_t *args, const char *argfs, ...)
501 va_start (vargs, argfs);
506 if (i >= args->nelts) {
511 arg = APR_ARRAY_IDX (args, i, struct arg);
515 if (arg.type == arg_type_string)
516 * va_arg (vargs, const char **) = arg.u.str;
524 if (arg.type == arg_type_int)
525 * va_arg (vargs, int *) = arg.u.i;
533 if (arg.type == arg_type_bool)
534 * va_arg (vargs, int *) = arg.u.i;
542 error ("get_args: invalid character '%c'", *argfs);