tools/cachemgr.cc

   1 /*
   2  * $Id: cachemgr.cc,v 1.6 2007/12/14 23:11:53 amosjeffries Exp $
   3  *
   4  * DEBUG: section 0     CGI Cache Manager
   5  * AUTHOR: Duane Wessels
   6  *
   7  * SQUID Web Proxy Cache          http://www.squid-cache.org/
   8  * ----------------------------------------------------------
   9  *
  10  *  Squid is the result of efforts by numerous individuals from
  11  *  the Internet community; see the CONTRIBUTORS file for full
  12  *  details.   Many organizations have provided support for Squid's
  13  *  development; see the SPONSORS file for full details.  Squid is
  14  *  Copyrighted (C) 2001 by the Regents of the University of
  15  *  California; see the COPYRIGHT file for full details.  Squid
  16  *  incorporates software developed and/or copyrighted by other
  17  *  sources; see the CREDITS file for full details.
  18  *
  19  *  This program is free software; you can redistribute it and/or modify
  20  *  it under the terms of the GNU General Public License as published by
  21  *  the Free Software Foundation; either version 2 of the License, or
  22  *  (at your option) any later version.
  23  *
  24  *  This program is distributed in the hope that it will be useful,
  25  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  26  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  27  *  GNU General Public License for more details.
  28  *
  29  *  You should have received a copy of the GNU General Public License
  30  *  along with this program; if not, write to the Free Software
  31  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
  32  *
  33  */
  34
  35 #include "config.h"
  36
  37 #if HAVE_UNISTD_H
  38 #include <unistd.h>
  39 #endif
  40 #if HAVE_STDLIB_H
  41 #include <stdlib.h>
  42 #endif
  43 #if HAVE_STDIO_H
  44 #include <stdio.h>
  45 #endif
  46 #if HAVE_SYS_TYPES_H
  47 #include <sys/types.h>
  48 #endif
  49 #if HAVE_CTYPE_H
  50 #include <ctype.h>
  51 #endif
  52 #if HAVE_ERRNO_H
  53 #include <errno.h>
  54 #endif
  55 #if HAVE_FCNTL_H
  56 #include <fcntl.h>
  57 #endif
  58 #if HAVE_GRP_H
  59 #include <grp.h>
  60 #endif
  61 #if HAVE_GNUMALLOC_H
  62 #include <gnumalloc.h>
  63 #elif HAVE_MALLOC_H
  64 #include <malloc.h>
  65 #endif
  66 #if HAVE_MEMORY_H
  67 #include <memory.h>
  68 #endif
  69 #if HAVE_NETDB_H && !defined(_SQUID_NETDB_H_)   /* protect NEXTSTEP */
  70 #define _SQUID_NETDB_H_
  71 #include <netdb.h>
  72 #endif
  73 #if HAVE_PWD_H
  74 #include <pwd.h>
  75 #endif
  76 #if HAVE_SIGNAL_H
  77 #include <signal.h>
  78 #endif
  79 #if HAVE_TIME_H
  80 #include <time.h>
  81 #endif
  82 #if HAVE_SYS_PARAM_H
  83 #include <sys/param.h>
  84 #endif
  85 #if HAVE_SYS_TIME_H
  86 #include <sys/time.h>
  87 #endif
  88 #if HAVE_SYS_RESOURCE_H
  89 #include <sys/resource.h>       /* needs sys/time.h above it */
  90 #endif
  91 #if HAVE_SYS_SOCKET_H
  92 #include <sys/socket.h>
  93 #endif
  94 #if HAVE_NETINET_IN_H
  95 #include <netinet/in.h>
  96 #endif
  97 #if HAVE_ARPA_INET_H
  98 #include <arpa/inet.h>
  99 #endif
 100 #if HAVE_SYS_STAT_H
 101 #include <sys/stat.h>
 102 #endif
 103 #if HAVE_SYS_UN_H
 104 #include <sys/un.h>
 105 #endif
 106 #if HAVE_SYS_WAIT_H
 107 #include <sys/wait.h>
 108 #endif
 109 #if HAVE_LIBC_H
 110 #include <libc.h>
 111 #endif
 112 #if HAVE_STRING_H
 113 #include <string.h>
 114 #endif
 115 #if HAVE_STRINGS_H
 116 #include <strings.h>
 117 #endif
 118 #if HAVE_BSTRING_H
 119 #include <bstring.h>
 120 #endif
 121 #if HAVE_CRYPT_H
 122 #include <crypt.h>
 123 #endif
 124 #if HAVE_SYS_SELECT_H
 125 #include <sys/select.h>
 126 #endif
 127 #if HAVE_FNMATCH_H
 128 extern "C"
 129 {
 130 #include <fnmatch.h>
 131 }
 132 #endif
 133
 134 #include "assert.h"
 135 #include "util.h"
 136 #include "IPAddress.h"
 137 #include "getfullhostname.h"
 138
 139 #ifndef DEFAULT_CACHEMGR_CONFIG
 140 #define DEFAULT_CACHEMGR_CONFIG "/etc/squid/cachemgr.conf"
 141 #endif
 142
 143 typedef struct {
 144     char *server;
 145     char *hostname;
 146     int port;
 147     char *action;
 148     char *user_name;
 149     char *passwd;
 150     char *pub_auth;
 151 } cachemgr_request;
 152
 153 /*
 154  * Debugging macros (info goes to error_log on your web server)
 155  * Note: do not run cache manager with non zero debugging level
 156  *       if you do not debug, it may write a lot of [sensitive]
 157  *       information to your error log.
 158  */
 159
 160 /* debugging level 0 (disabled) - 3 (max) */
 161 #define DEBUG_LEVEL 0
 162 #define debug(level) if ((level) <= DEBUG_LEVEL && DEBUG_LEVEL > 0)
 163
 164 /*
 165  * Static variables and constants
 166  */
 167 static const time_t passwd_ttl = 60 * 60 * 3;   /* in sec */
 168 static const char *script_name = "/cgi-bin/cachemgr.cgi";
 169 static const char *progname = NULL;
 170 static time_t now;
 171
 172 /*
 173  * Function prototypes
 174  */
 175 #define safe_free(str) { if (str) { xfree(str); (str) = NULL; } }
 176 static const char *safe_str(const char *str);
 177 static const char *xstrtok(char **str, char del);
 178 static void print_trailer(void);
 179 static void auth_html(const char *host, int port, const char *user_name);
 180 static void error_html(const char *msg);
 181 static char *menu_url(cachemgr_request * req, const char *action);
 182 static int parse_status_line(const char *sline, const char **statusStr);
 183 static cachemgr_request *read_request(void);
 184 static char *read_get_request(void);
 185 static char *read_post_request(void);
 186
 187 static void make_pub_auth(cachemgr_request * req);
 188 static void decode_pub_auth(cachemgr_request * req);
 189 static void reset_auth(cachemgr_request * req);
 190 static const char *make_auth_header(const cachemgr_request * req);
 191
 192 static int check_target_acl(const char *hostname, int port);
 193
 194 #ifdef _SQUID_MSWIN_
 195 static int s_iInitCount = 0;
 196
 197 int Win32SockInit(void)
 198 {
 199     int iVersionRequested;
 200     WSADATA wsaData;
 201     int err;
 202
 203     if (s_iInitCount > 0) {
 204         s_iInitCount++;
 205         return (0);
 206     } else if (s_iInitCount < 0)
 207         return (s_iInitCount);
 208
 209     /* s_iInitCount == 0. Do the initailization */
 210     iVersionRequested = MAKEWORD(2, 0);
 211
 212     err = WSAStartup((WORD) iVersionRequested, &wsaData);
 213
 214     if (err) {
 215         s_iInitCount = -1;
 216         return (s_iInitCount);
 217     }
 218
 219     if (LOBYTE(wsaData.wVersion) != 2 ||
 220             HIBYTE(wsaData.wVersion) != 0) {
 221         s_iInitCount = -2;
 222         WSACleanup();
 223         return (s_iInitCount);
 224     }
 225
 226     s_iInitCount++;
 227     return (s_iInitCount);
 228 }
 229
 230 void Win32SockCleanup(void)
 231 {
 232     if (--s_iInitCount == 0)
 233         WSACleanup();
 234
 235     return;
 236 }
 237
 238 #endif /* ifdef _SQUID_MSWIN_ */
 239
 240 static const char *
 241 safe_str(const char *str)
 242 {
 243     return str ? str : "";
 244 }
 245
 246 /* relaxed number format */
 247 static int
 248 is_number(const char *str)
 249 {
 250     return strspn(str, "\t -+01234567890./\n") == strlen(str);
 251 }
 252
 253 static const char *
 254 xstrtok(char **str, char del)
 255 {
 256     if (*str) {
 257         char *p = strchr(*str, del);
 258         char *tok = *str;
 259         int len;
 260
 261         if (p) {
 262             *str = p + 1;
 263             *p = '\0';
 264         } else
 265             *str = NULL;
 266
 267         /* trim */
 268         len = strlen(tok);
 269
 270         while (len && xisspace(tok[len - 1]))
 271             tok[--len] = '\0';
 272
 273         while (xisspace(*tok))
 274             tok++;
 275
 276         return tok;
 277     } else
 278         return "";
 279 }
 280
 281 static void
 282 print_trailer(void)
 283 {
 284     printf("<HR noshade size=\"1px\">\n");
 285     printf("<ADDRESS>\n");
 286     printf("Generated %s, by %s/%s@%s\n",
 287            mkrfc1123(now), progname, VERSION, getfullhostname());
 288     printf("</ADDRESS></BODY></HTML>\n");
 289 }
 290
 291 static void
 292 auth_html(const char *host, int port, const char *user_name)
 293 {
 294     FILE *fp;
 295     int need_host = 1;
 296
 297     if (!user_name)
 298         user_name = "";
 299
 300     if (!host || !strlen(host))
 301         host = "";
 302
 303     printf("Content-Type: text/html\r\n\r\n");
 304
 305     printf("<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01 Transitional//EN\" \"http://www.w3.org/TR/html4/loose.dtd\">\n");
 306
 307     printf("<HTML><HEAD><TITLE>Cache Manager Interface</TITLE>\n");
 308
 309     printf("<STYLE type=\"text/css\"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}--></STYLE></HEAD>\n");
 310
 311     printf("<BODY><H1>Cache Manager Interface</H1>\n");
 312
 313     printf("<P>This is a WWW interface to the instrumentation interface\n");
 314
 315     printf("for the Squid object cache.</P>\n");
 316
 317     printf("<HR noshade size=\"1px\">\n");
 318
 319     printf("<FORM METHOD=\"POST\" ACTION=\"%s\">\n", script_name);
 320
 321     printf("<TABLE BORDER=\"0\" CELLPADDING=\"10\" CELLSPACING=\"1\">\n");
 322
 323
 324     fp = fopen("cachemgr.conf", "r");
 325
 326     if (fp == NULL)
 327         fp = fopen(DEFAULT_CACHEMGR_CONFIG, "r");
 328
 329     if (fp != NULL) {
 330         int servers = 0;
 331         char config_line[BUFSIZ];
 332
 333         while (fgets(config_line, BUFSIZ, fp)) {
 334             char *server, *comment;
 335             strtok(config_line, "\r\n");
 336
 337             if (config_line[0] == '#')
 338                 continue;
 339
 340             if (config_line[0] == '\0')
 341                 continue;
 342
 343             if ((server = strtok(config_line, " \t")) == NULL)
 344                 continue;
 345
 346             if (strchr(server, '*') || strchr(server, '[') || strchr(server, '?')) {
 347                 need_host = -1;
 348                 continue;
 349             }
 350
 351             comment = strtok(NULL, "");
 352
 353             if (comment)
 354                 while (*comment == ' ' || *comment == '\t')
 355                     comment++;
 356
 357             if (!comment || !*comment)
 358                 comment = server;
 359
 360             if (!servers) {
 361                 printf("<TR><TH ALIGN=\"left\">Cache Server:</TH><TD><SELECT NAME=\"server\">\n");
 362             }
 363
 364             printf("<OPTION VALUE=\"%s\"%s>%s</OPTION>\n", server, (servers || *host) ? "" : " SELECTED", comment);
 365             servers++;
 366         }
 367
 368         if (servers) {
 369             if (need_host == 1 && !*host)
 370                 need_host = 0;
 371
 372             if (need_host)
 373                 printf("<OPTION VALUE=\"\"%s>Other</OPTION>\n", (*host) ? " SELECTED" : "");
 374
 375             printf("</SELECT></TR>\n");
 376         }
 377
 378         fclose(fp);
 379     }
 380
 381     if (need_host) {
 382         if (need_host == 1 && !*host)
 383             host = "localhost";
 384
 385         printf("<TR><TH ALIGN=\"left\">Cache Host:</TH><TD><INPUT NAME=\"host\" ");
 386
 387         printf("size=\"30\" VALUE=\"%s\"></TD></TR>\n", host);
 388
 389         printf("<TR><TH ALIGN=\"left\">Cache Port:</TH><TD><INPUT NAME=\"port\" ");
 390
 391         printf("size=\"30\" VALUE=\"%d\"></TD></TR>\n", port);
 392     }
 393
 394     printf("<TR><TH ALIGN=\"left\">Manager name:</TH><TD><INPUT NAME=\"user_name\" ");
 395
 396     printf("size=\"30\" VALUE=\"%s\"></TD></TR>\n", user_name);
 397
 398     printf("<TR><TH ALIGN=\"left\">Password:</TH><TD><INPUT TYPE=\"password\" NAME=\"passwd\" ");
 399
 400     printf("size=\"30\" VALUE=\"\"></TD></TR>\n");
 401
 402     printf("</TABLE><BR CLEAR=\"all\">\n");
 403
 404     printf("<INPUT TYPE=\"submit\" VALUE=\"Continue...\">\n");
 405
 406     printf("</FORM>\n");
 407
 408     print_trailer();
 409 }
 410
 411 static void
 412 error_html(const char *msg)
 413 {
 414     printf("Content-Type: text/html\r\n\r\n");
 415     printf("<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01 Transitional//EN\" \"http://www.w3.org/TR/html4/loose.dtd\">\n");
 416     printf("<HTML><HEAD><TITLE>Cache Manager Error</TITLE>\n");
 417     printf("<STYLE type=\"text/css\"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}--></STYLE></HEAD>\n");
 418     printf("<BODY><H1>Cache Manager Error</H1>\n");
 419     printf("<P>\n%s</P>\n", html_quote(msg));
 420     print_trailer();
 421 }
 422
 423 /* returns http status extracted from status line or -1 on parsing failure */
 424 static int
 425 parse_status_line(const char *sline, const char **statusStr)
 426 {
 427     const char *sp = strchr(sline, ' ');
 428
 429     if (statusStr)
 430         *statusStr = NULL;
 431
 432     if (strncasecmp(sline, "HTTP/", 5) || !sp)
 433         return -1;
 434
 435     while (xisspace(*++sp));
 436     if (!xisdigit(*sp))
 437         return -1;
 438
 439     if (statusStr)
 440         *statusStr = sp;
 441
 442     return atoi(sp);
 443 }
 444
 445 static char *
 446 menu_url(cachemgr_request * req, const char *action)
 447 {
 448     static char url[1024];
 449     snprintf(url, sizeof(url), "%s?host=%s&port=%d&user_name=%s&operation=%s&auth=%s",
 450              script_name,
 451              req->hostname,
 452              req->port,
 453              safe_str(req->user_name),
 454              action,
 455              safe_str(req->pub_auth));
 456     return url;
 457 }
 458
 459 static const char *
 460 munge_menu_line(const char *buf, cachemgr_request * req)
 461 {
 462     char *x;
 463     const char *a;
 464     const char *d;
 465     const char *p;
 466     char *a_url;
 467     char *buf_copy;
 468     static char html[2 * 1024];
 469
 470     if (strlen(buf) < 1)
 471         return buf;
 472
 473     if (*buf != ' ')
 474         return buf;
 475
 476     buf_copy = x = xstrdup(buf);
 477
 478     a = xstrtok(&x, '\t');
 479
 480     d = xstrtok(&x, '\t');
 481
 482     p = xstrtok(&x, '\t');
 483
 484     a_url = xstrdup(menu_url(req, a));
 485
 486     /* no reason to give a url for a disabled action */
 487     if (!strcmp(p, "disabled"))
 488         snprintf(html, sizeof(html), "<LI type=\"circle\">%s (disabled)<A HREF=\"%s\">.</A>\n", d, a_url);
 489     else
 490         /* disable a hidden action (requires a password, but password is not in squid.conf) */
 491         if (!strcmp(p, "hidden"))
 492             snprintf(html, sizeof(html), "<LI type=\"circle\">%s (hidden)<A HREF=\"%s\">.</A>\n", d, a_url);
 493         else
 494             /* disable link if authentication is required and we have no password */
 495             if (!strcmp(p, "protected") && !req->passwd)
 496                 snprintf(html, sizeof(html), "<LI type=\"circle\">%s (requires <a href=\"%s\">authentication</a>)<A HREF=\"%s\">.</A>\n",
 497                          d, menu_url(req, "authenticate"), a_url);
 498             else
 499                 /* highlight protected but probably available entries */
 500                 if (!strcmp(p, "protected"))
 501                     snprintf(html, sizeof(html), "<LI type=\"square\"><A HREF=\"%s\"><font color=\"#FF0000\">%s</font></A>\n",
 502                              a_url, d);
 503
 504     /* public entry or unknown type of protection */
 505                 else
 506                     snprintf(html, sizeof(html), "<LI type=\"disk\"><A HREF=\"%s\">%s</A>\n", a_url, d);
 507
 508     xfree(a_url);
 509
 510     xfree(buf_copy);
 511
 512     return html;
 513 }
 514
 515 static const char *
 516 munge_other_line(const char *buf, cachemgr_request * req)
 517 {
 518     static const char *ttags[] = {"td", "th"};
 519
 520     static char html[4096];
 521     static int table_line_num = 0;
 522     static int next_is_header = 0;
 523     int is_header = 0;
 524     const char *ttag;
 525     char *buf_copy;
 526     char *x, *p;
 527     int l = 0;
 528     /* does it look like a table? */
 529
 530     if (!strchr(buf, '\t') || *buf == '\t') {
 531         /* nope, just text */
 532         snprintf(html, sizeof(html), "%s%s",
 533                  table_line_num ? "</table>\n<pre>" : "", html_quote(buf));
 534         table_line_num = 0;
 535         return html;
 536     }
 537
 538     /* start html table */
 539     if (!table_line_num) {
 540         l += snprintf(html + l, sizeof(html) - l, "</pre><table cellpadding=\"2\" cellspacing=\"1\">\n");
 541         next_is_header = 0;
 542     }
 543
 544     /* remove '\n' */
 545     is_header = (!table_line_num || next_is_header) && !strchr(buf, ':') && !is_number(buf);
 546
 547     ttag = ttags[is_header];
 548
 549     /* record starts */
 550     l += snprintf(html + l, sizeof(html) - l, "<tr>");
 551
 552     /* substitute '\t' */
 553     buf_copy = x = xstrdup(buf);
 554
 555     if ((p = strchr(x, '\n')))
 556         *p = '\0';
 557
 558     while (x && strlen(x)) {
 559         int column_span = 1;
 560         const char *cell = xstrtok(&x, '\t');
 561
 562         while (x && *x == '\t') {
 563             column_span++;
 564             x++;
 565         }
 566
 567         l += snprintf(html + l, sizeof(html) - l, "<%s colspan=\"%d\" align=\"%s\">%s</%s>",
 568                       ttag, column_span,
 569                       is_header ? "center" : is_number(cell) ? "right" : "left",
 570                       html_quote(cell), ttag);
 571     }
 572
 573     xfree(buf_copy);
 574     /* record ends */
 575     l += snprintf(html + l, sizeof(html) - l, "</tr>\n");
 576     next_is_header = is_header && strstr(buf, "\t\t");
 577     table_line_num++;
 578     return html;
 579 }
 580
 581 static const char *
 582 munge_action_line(const char *_buf, cachemgr_request * req)
 583 {
 584     static char html[2 * 1024];
 585     char *buf = xstrdup(_buf);
 586     char *x = buf;
 587     const char *action, *description;
 588     char *p;
 589
 590     if ((p = strchr(x, '\n')))
 591         *p = '\0';
 592     action = xstrtok(&x, '\t');
 593     description = xstrtok(&x, '\t');
 594     if (!description)
 595         description = action;
 596     if (!action)
 597         return "";
 598     snprintf(html, sizeof(html), " <a href=\"%s\">%s</a>", menu_url(req, action), description);
 599     return html;
 600 }
 601
 602 static int
 603 read_reply(int s, cachemgr_request * req)
 604 {
 605     char buf[4 * 1024];
 606 #ifdef _SQUID_MSWIN_
 607
 608     int reply;
 609     char *tmpfile = tempnam(NULL, "tmp0000");
 610     FILE *fp = fopen(tmpfile, "w+");
 611 #else
 612
 613     FILE *fp = fdopen(s, "r");
 614 #endif
 615     /* interpretation states */
 616     enum {
 617         isStatusLine, isHeaders, isActions, isBodyStart, isBody, isForward, isEof, isForwardEof, isSuccess, isError
 618     } istate = isStatusLine;
 619     int parse_menu = 0;
 620     const char *action = req->action;
 621     const char *statusStr = NULL;
 622     int status = -1;
 623
 624     if (0 == strlen(req->action))
 625         parse_menu = 1;
 626     else if (0 == strcasecmp(req->action, "menu"))
 627         parse_menu = 1;
 628
 629     if (fp == NULL) {
 630 #ifdef _SQUID_MSWIN_
 631         perror(tmpfile);
 632         xfree(tmpfile);
 633 #else
 634
 635         perror("fdopen");
 636 #endif
 637
 638         close(s);
 639         return 1;
 640     }
 641
 642 #ifdef _SQUID_MSWIN_
 643
 644     while ((reply=recv(s, buf , sizeof(buf), 0)) > 0)
 645         fwrite(buf, 1, reply, fp);
 646
 647     rewind(fp);
 648
 649 #endif
 650
 651     if (parse_menu)
 652         action = "menu";
 653
 654     /* read reply interpreting one line at a time depending on state */
 655     while (istate < isEof) {
 656         if (!fgets(buf, sizeof(buf), fp))
 657             istate = istate == isForward ? isForwardEof : isEof;
 658
 659         switch (istate) {
 660
 661         case isStatusLine:
 662             /* get HTTP status */
 663             /* uncomment the following if you want to debug headers */
 664             /* fputs("\r\n\r\n", stdout); */
 665             status = parse_status_line(buf, &statusStr);
 666             istate = status == 200 ? isHeaders : isForward;
 667             /* if cache asks for authentication, we have to reset our info */
 668
 669             if (status == 401 || status == 407) {
 670                 reset_auth(req);
 671                 status = 403;   /* Forbiden, see comments in case isForward: */
 672             }
 673
 674             /* this is a way to pass HTTP status to the Web server */
 675             if (statusStr)
 676                 printf("Status: %d %s", status, statusStr);     /* statusStr has '\n' */
 677
 678             break;
 679
 680         case isHeaders:
 681             /* forward header field */
 682             if (!strcmp(buf, "\r\n")) {         /* end of headers */
 683                 fputs("Content-Type: text/html\r\n", stdout);   /* add our type */
 684                 istate = isBodyStart;
 685             }
 686
 687             if (strncasecmp(buf, "Content-Type:", 13))  /* filter out their type */
 688                 fputs(buf, stdout);
 689
 690             break;
 691
 692         case isBodyStart:
 693             printf("<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01 Transitional//EN\" \"http://www.w3.org/TR/html4/loose.dtd\">\n");
 694
 695             printf("<HTML><HEAD><TITLE>CacheMgr@%s: %s</TITLE>\n",
 696                    req->hostname, action);
 697
 698             printf("<STYLE type=\"text/css\"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}TABLE{background-color:#333333;border:0pt;padding:0pt}TH,TD{background-color:#ffffff;white-space:nowrap}--></STYLE>\n");
 699
 700             printf("</HEAD><BODY>\n");
 701
 702             if (parse_menu) {
 703                 printf("<H2><a href=\"%s\">Cache Manager</a> menu for %s:</H2>",
 704                        menu_url(req, "authenticate"), req->hostname);
 705                 printf("<UL>\n");
 706             } else {
 707                 printf("<P><A HREF=\"%s\">%s</A>\n<HR noshade size=\"1px\">\n",
 708                        menu_url(req, "menu"), "Cache Manager menu");
 709                 printf("<PRE>\n");
 710             }
 711
 712             istate = isActions;
 713             /* yes, fall through, we do not want to loose the first line */
 714
 715         case isActions:
 716             if (strncmp(buf, "action:", 7) == 0) {
 717                 fputs(" ", stdout);
 718                 fputs(munge_action_line(buf + 7, req), stdout);
 719                 break;
 720             }
 721             if (parse_menu) {
 722                 printf("<UL>\n");
 723             } else {
 724                 printf("<HR noshade size=\"1px\">\n");
 725                 printf("<PRE>\n");
 726             }
 727
 728             istate = isBody;
 729             /* yes, fall through, we do not want to loose the first line */
 730
 731         case isBody:
 732             /* interpret [and reformat] cache response */
 733
 734             if (parse_menu)
 735                 fputs(munge_menu_line(buf, req), stdout);
 736             else
 737                 fputs(munge_other_line(buf, req), stdout);
 738
 739             break;
 740
 741         case isForward:
 742             /* forward: no modifications allowed */
 743             /*
 744              * Note: we currently do not know any way to get browser.reply to
 745              * 401 to .cgi because web server filters out all auth info. Thus we
 746              * disable authentication headers for now.
 747              */
 748             if (!strncasecmp(buf, "WWW-Authenticate:", 17) || !strncasecmp(buf, "Proxy-Authenticate:", 19));    /* skip */
 749             else
 750                 fputs(buf, stdout);
 751
 752             break;
 753
 754         case isEof:
 755             /* print trailers */
 756             if (parse_menu)
 757                 printf("</UL>\n");
 758             else
 759                 printf("</table></PRE>\n");
 760
 761             print_trailer();
 762
 763             istate = isSuccess;
 764
 765             break;
 766
 767         case isForwardEof:
 768             /* indicate that we finished processing an "error" sequence */
 769             istate = isError;
 770
 771             break;
 772
 773         default:
 774             printf("%s: internal bug: invalid state reached: %d", script_name, istate);
 775
 776             istate = isError;
 777         }
 778     }
 779
 780     fclose(fp);
 781 #ifdef _SQUID_MSWIN_
 782
 783     remove(tmpfile);
 784     xfree(tmpfile);
 785     close(s);
 786
 787 #endif
 788
 789     return 0;
 790 }
 791
 792 static int
 793 process_request(cachemgr_request * req)
 794 {
 795
 796     char ipbuf[MAX_IPSTRLEN];
 797     struct addrinfo *AI = NULL;
 798     IPAddress S;
 799     int s;
 800     int l;
 801
 802     static char buf[2 * 1024];
 803
 804     if (req == NULL) {
 805         auth_html(CACHEMGR_HOSTNAME, CACHE_HTTP_PORT, "");
 806         return 1;
 807     }
 808
 809     if (req->hostname == NULL) {
 810         req->hostname = xstrdup(CACHEMGR_HOSTNAME);
 811     }
 812
 813     if (req->port == 0) {
 814         req->port = CACHE_HTTP_PORT;
 815     }
 816
 817     if (req->action == NULL) {
 818         req->action = xstrdup("");
 819     }
 820
 821     if (strcmp(req->action, "authenticate") == 0) {
 822         auth_html(req->hostname, req->port, req->user_name);
 823         return 0;
 824     }
 825
 826     if (!check_target_acl(req->hostname, req->port)) {
 827         snprintf(buf, 1024, "target %s:%d not allowed in cachemgr.conf\n", req->hostname, req->port);
 828         error_html(buf);
 829         return 1;
 830     }
 831
 832     S = *gethostbyname(req->hostname);
 833
 834     if ( !S.IsAnyAddr() ) {
 835         (void) 0;
 836     } else if ( S = req->hostname)
 837         (void) 0;
 838     else {
 839         snprintf(buf, 1024, "Unknown host: %s\n", req->hostname);
 840         error_html(buf);
 841         return 1;
 842     }
 843
 844     S.SetPort(req->port);
 845
 846     S.GetAddrInfo(AI);
 847
 848 #if USE_IPV6
 849     if ((s = socket( AI->ai_family, SOCK_STREAM, 0)) < 0) {
 850 #else
 851     if ((s = socket(PF_INET, SOCK_STREAM, 0)) < 0) {
 852 #endif
 853         snprintf(buf, 1024, "socket: %s\n", xstrerror());
 854         error_html(buf);
 855         return 1;
 856     }
 857
 858     if (connect(s, AI->ai_addr, AI->ai_addrlen) < 0) {
 859         snprintf(buf, 1024, "connect %s: %s\n",
 860                  S.ToURL(ipbuf,MAX_IPSTRLEN),
 861                  xstrerror());
 862         error_html(buf);
 863         S.FreeAddrInfo(AI);
 864         return 1;
 865     }
 866
 867     S.FreeAddrInfo(AI);
 868
 869     l = snprintf(buf, sizeof(buf),
 870                  "GET cache_object://%s/%s HTTP/1.0\r\n"
 871                  "Accept: */*\r\n"
 872                  "%s"                   /* Authentication info or nothing */
 873                  "\r\n",
 874                  req->hostname,
 875                  req->action,
 876                  make_auth_header(req));
 877     write(s, buf, l);
 878     debug(1) fprintf(stderr, "wrote request: '%s'\n", buf);
 879     return read_reply(s, req);
 880 }
 881
 882 int
 883 main(int argc, char *argv[]) {
 884     char *s;
 885     cachemgr_request *req;
 886
 887     now = time(NULL);
 888 #ifdef _SQUID_MSWIN_
 889
 890     Win32SockInit();
 891     atexit(Win32SockCleanup);
 892     _setmode( _fileno( stdin ), _O_BINARY );
 893     _setmode( _fileno( stdout ), _O_BINARY );
 894     _fmode = _O_BINARY;
 895
 896     if ((s = strrchr(argv[0], '\\')))
 897 #else
 898
 899     if ((s = strrchr(argv[0], '/')))
 900 #endif
 901
 902         progname = xstrdup(s + 1);
 903     else
 904         progname = xstrdup(argv[0]);
 905
 906     if ((s = getenv("SCRIPT_NAME")) != NULL)
 907         script_name = xstrdup(s);
 908
 909     req = read_request();
 910
 911     return process_request(req);
 912 }
 913
 914 static char *
 915 read_post_request(void) {
 916     char *s;
 917     char *buf;
 918     int len;
 919
 920     if ((s = getenv("REQUEST_METHOD")) == NULL)
 921         return NULL;
 922
 923     if (0 != strcasecmp(s, "POST"))
 924         return NULL;
 925
 926     if ((s = getenv("CONTENT_LENGTH")) == NULL)
 927         return NULL;
 928
 929     if ((len = atoi(s)) <= 0)
 930         return NULL;
 931
 932     buf = (char *)xmalloc(len + 1);
 933
 934     fread(buf, len, 1, stdin);
 935
 936     buf[len] = '\0';
 937
 938     return buf;
 939 }
 940
 941 static char *
 942 read_get_request(void) {
 943     char *s;
 944
 945     if ((s = getenv("QUERY_STRING")) == NULL)
 946         return NULL;
 947
 948     return xstrdup(s);
 949 }
 950
 951 static cachemgr_request *
 952 read_request(void) {
 953     char *buf;
 954
 955     cachemgr_request *req;
 956     char *s;
 957     char *t;
 958     char *q;
 959
 960     if ((buf = read_post_request()) != NULL)
 961         (void) 0;
 962     else if ((buf = read_get_request()) != NULL)
 963         (void) 0;
 964     else
 965         return NULL;
 966
 967 #ifdef _SQUID_MSWIN_
 968
 969     if (strlen(buf) == 0 || strlen(buf) == 4000)
 970 #else
 971
 972     if (strlen(buf) == 0)
 973 #endif
 974     {
 975         free(buf);
 976         return NULL;
 977     }
 978
 979     req = (cachemgr_request *)xcalloc(1, sizeof(cachemgr_request));
 980
 981     for (s = strtok(buf, "&"); s != NULL; s = strtok(NULL, "&")) {
 982         t = xstrdup(s);
 983
 984         if ((q = strchr(t, '=')) == NULL)
 985             continue;
 986
 987         *q++ = '\0';
 988
 989         rfc1738_unescape(t);
 990
 991         rfc1738_unescape(q);
 992
 993         if (0 == strcasecmp(t, "server") && strlen(q))
 994             req->server = xstrdup(q);
 995         else if (0 == strcasecmp(t, "host") && strlen(q))
 996             req->hostname = xstrdup(q);
 997         else if (0 == strcasecmp(t, "port") && strlen(q))
 998             req->port = atoi(q);
 999         else if (0 == strcasecmp(t, "user_name") && strlen(q))
1000             req->user_name = xstrdup(q);
1001         else if (0 == strcasecmp(t, "passwd") && strlen(q))
1002             req->passwd = xstrdup(q);
1003         else if (0 == strcasecmp(t, "auth") && strlen(q))
1004             req->pub_auth = xstrdup(q), decode_pub_auth(req);
1005         else if (0 == strcasecmp(t, "operation"))
1006             req->action = xstrdup(q);
1007     }
1008
1009     if (req->server && !req->hostname) {
1010         char *p;
1011         req->hostname = strtok(req->server, ":");
1012
1013         if ((p = strtok(NULL, ":")))
1014             req->port = atoi(p);
1015     }
1016
1017     make_pub_auth(req);
1018     debug(1) fprintf(stderr, "cmgr: got req: host: '%s' port: %d uname: '%s' passwd: '%s' auth: '%s' oper: '%s'\n",
1019                      safe_str(req->hostname), req->port, safe_str(req->user_name), safe_str(req->passwd), safe_str(req->pub_auth), safe_str(req->action));
1020     return req;
1021 }
1022
1023
1024 /* Routines to support authentication */
1025
1026 /*
1027  * Encodes auth info into a "public" form.
1028  * Currently no powerful encryption is used.
1029  */
1030 static void
1031 make_pub_auth(cachemgr_request * req) {
1032     static char buf[1024];
1033     safe_free(req->pub_auth);
1034     debug(3) fprintf(stderr, "cmgr: encoding for pub...\n");
1035
1036     if (!req->passwd || !strlen(req->passwd))
1037         return;
1038
1039     /* host | time | user | passwd */
1040     snprintf(buf, sizeof(buf), "%s|%d|%s|%s",
1041              req->hostname,
1042              (int) now,
1043              req->user_name ? req->user_name : "",
1044              req->passwd);
1045
1046     debug(3) fprintf(stderr, "cmgr: pre-encoded for pub: %s\n", buf);
1047
1048     debug(3) fprintf(stderr, "cmgr: encoded: '%s'\n", base64_encode(buf));
1049
1050     req->pub_auth = xstrdup(base64_encode(buf));
1051 }
1052
1053 static void
1054 decode_pub_auth(cachemgr_request * req) {
1055     char *buf;
1056     const char *host_name;
1057     const char *time_str;
1058     const char *user_name;
1059     const char *passwd;
1060
1061     debug(2) fprintf(stderr, "cmgr: decoding pub: '%s'\n", safe_str(req->pub_auth));
1062     safe_free(req->passwd);
1063
1064     if (!req->pub_auth || strlen(req->pub_auth) < 4 + strlen(safe_str(req->hostname)))
1065         return;
1066
1067     buf = xstrdup(base64_decode(req->pub_auth));
1068
1069     debug(3) fprintf(stderr, "cmgr: length ok\n");
1070
1071     /* parse ( a lot of memory leaks, but that is cachemgr style :) */
1072     if ((host_name = strtok(buf, "|")) == NULL)
1073         return;
1074
1075     debug(3) fprintf(stderr, "cmgr: decoded host: '%s'\n", host_name);
1076
1077     if ((time_str = strtok(NULL, "|")) == NULL)
1078         return;
1079
1080     debug(3) fprintf(stderr, "cmgr: decoded time: '%s' (now: %d)\n", time_str, (int) now);
1081
1082     if ((user_name = strtok(NULL, "|")) == NULL)
1083         return;
1084
1085     debug(3) fprintf(stderr, "cmgr: decoded uname: '%s'\n", user_name);
1086
1087     if ((passwd = strtok(NULL, "|")) == NULL)
1088         return;
1089
1090     debug(2) fprintf(stderr, "cmgr: decoded passwd: '%s'\n", passwd);
1091
1092     /* verify freshness and validity */
1093     if (atoi(time_str) + passwd_ttl < now)
1094         return;
1095
1096     if (strcasecmp(host_name, req->hostname))
1097         return;
1098
1099     debug(1) fprintf(stderr, "cmgr: verified auth. info.\n");
1100
1101     /* ok, accept */
1102     xfree(req->user_name);
1103
1104     req->user_name = xstrdup(user_name);
1105
1106     req->passwd = xstrdup(passwd);
1107
1108     xfree(buf);
1109 }
1110
1111 static void
1112 reset_auth(cachemgr_request * req) {
1113     safe_free(req->passwd);
1114     safe_free(req->pub_auth);
1115 }
1116
1117 static const char *
1118 make_auth_header(const cachemgr_request * req) {
1119     static char buf[1024];
1120     size_t stringLength = 0;
1121     const char *str64;
1122
1123     if (!req->passwd)
1124         return "";
1125
1126     snprintf(buf, sizeof(buf), "%s:%s",
1127              req->user_name ? req->user_name : "",
1128              req->passwd);
1129
1130     str64 = base64_encode(buf);
1131
1132     stringLength += snprintf(buf, sizeof(buf), "Authorization: Basic %s\r\n", str64);
1133
1134     assert(stringLength < sizeof(buf));
1135
1136     stringLength += snprintf(&buf[stringLength], sizeof(buf) - stringLength,
1137                              "Proxy-Authorization: Basic %s\r\n", str64);
1138
1139     return buf;
1140 }
1141
1142 static int
1143 check_target_acl(const char *hostname, int port) {
1144     char config_line[BUFSIZ];
1145     FILE *fp = NULL;
1146     int ret = 0;
1147     fp = fopen("cachemgr.conf", "r");
1148
1149     if (fp == NULL)
1150         fp = fopen(DEFAULT_CACHEMGR_CONFIG, "r");
1151
1152     if (fp == NULL) {
1153 #ifdef CACHEMGR_HOSTNAME_DEFINED
1154
1155         if (strcmp(hostname, CACHEMGR_HOSTNAME) == 0 && port == CACHE_HTTP_PORT)
1156             return 1;
1157
1158 #else
1159
1160         if (strcmp(hostname, "localhost") == 0)
1161             return 1;
1162
1163         if (strcmp(hostname, getfullhostname()) == 0)
1164             return 1;
1165
1166 #endif
1167
1168         return 0;
1169     }
1170
1171     while (fgets(config_line, BUFSIZ, fp)) {
1172         char *token = NULL;
1173         strtok(config_line, " \r\n\t");
1174
1175         if (config_line[0] == '#')
1176             continue;
1177
1178         if (config_line[0] == '\0')
1179             continue;
1180
1181         if ((token = strtok(config_line, ":")) == NULL)
1182             continue;
1183
1184 #if HAVE_FNMATCH_H
1185
1186         if (fnmatch(token, hostname, 0) != 0)
1187             continue;
1188
1189 #else
1190
1191         if (strcmp(token, hostname) != 0)
1192             continue;
1193
1194 #endif
1195
1196         if ((token = strtok(NULL, ":")) != NULL) {
1197             int i;
1198
1199             if (strcmp(token, "*") == 0)
1200
1201                 ;   /* Wildcard port specification */
1202             else if (strcasecmp(token, "any") == 0)
1203
1204                 ;   /* Wildcard port specification */
1205             else if (sscanf(token, "%d", &i) != 1)
1206                 continue;
1207
1208             else if (i != port)
1209                 continue;
1210         } else if (port != CACHE_HTTP_PORT)
1211             continue;
1212
1213         ret = 1;
1214
1215         break;
1216     }
1217
1218     fclose(fp);
1219     return ret;
1220 }