tools/cachemgr.cc

   1 /*
   2  * DEBUG: section --    CGI Cache Manager
   3  * AUTHOR: Duane Wessels
   4  *
   5  * SQUID Web Proxy Cache          http://www.squid-cache.org/
   6  * ----------------------------------------------------------
   7  *
   8  *  Squid is the result of efforts by numerous individuals from
   9  *  the Internet community; see the CONTRIBUTORS file for full
  10  *  details.   Many organizations have provided support for Squid's
  11  *  development; see the SPONSORS file for full details.  Squid is
  12  *  Copyrighted (C) 2001 by the Regents of the University of
  13  *  California; see the COPYRIGHT file for full details.  Squid
  14  *  incorporates software developed and/or copyrighted by other
  15  *  sources; see the CREDITS file for full details.
  16  *
  17  *  This program is free software; you can redistribute it and/or modify
  18  *  it under the terms of the GNU General Public License as published by
  19  *  the Free Software Foundation; either version 2 of the License, or
  20  *  (at your option) any later version.
  21  *
  22  *  This program is distributed in the hope that it will be useful,
  23  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  24  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  25  *  GNU General Public License for more details.
  26  *
  27  *  You should have received a copy of the GNU General Public License
  28  *  along with this program; if not, write to the Free Software
  29  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
  30  *
  31  */
  32
  33 #include "config.h"
  34 #include "base64.h"
  35 #include "getfullhostname.h"
  36 #include "html_quote.h"
  37 #include "ip/Address.h"
  38 #include "rfc1123.h"
  39 #include "rfc1738.h"
  40 #include "util.h"
  41
  42 #if HAVE_UNISTD_H
  43 #include <unistd.h>
  44 #endif
  45 #if HAVE_STDIO_H
  46 #include <stdio.h>
  47 #endif
  48 #if HAVE_CTYPE_H
  49 #include <ctype.h>
  50 #endif
  51 #if HAVE_ERRNO_H
  52 #include <errno.h>
  53 #endif
  54 #if HAVE_FCNTL_H
  55 #include <fcntl.h>
  56 #endif
  57 #if HAVE_GRP_H
  58 #include <grp.h>
  59 #endif
  60 #if HAVE_GNUMALLOC_H
  61 #include <gnumalloc.h>
  62 #elif HAVE_MALLOC_H
  63 #include <malloc.h>
  64 #endif
  65 #if HAVE_MEMORY_H
  66 #include <memory.h>
  67 #endif
  68 #if HAVE_NETDB_H
  69 #include <netdb.h>
  70 #endif
  71 #if HAVE_PWD_H
  72 #include <pwd.h>
  73 #endif
  74 #if HAVE_SIGNAL_H
  75 #include <signal.h>
  76 #endif
  77 #if HAVE_TIME_H
  78 #include <time.h>
  79 #endif
  80 #if HAVE_SYS_PARAM_H
  81 #include <sys/param.h>
  82 #endif
  83 #if HAVE_SYS_SOCKET_H
  84 #include <sys/socket.h>
  85 #endif
  86 #if HAVE_NETINET_IN_H
  87 #include <netinet/in.h>
  88 #endif
  89 #if HAVE_ARPA_INET_H
  90 #include <arpa/inet.h>
  91 #endif
  92 #if HAVE_SYS_STAT_H
  93 #include <sys/stat.h>
  94 #endif
  95 #if HAVE_SYS_UN_H
  96 #include <sys/un.h>
  97 #endif
  98 #if HAVE_SYS_WAIT_H
  99 #include <sys/wait.h>
 100 #endif
 101 #if HAVE_LIBC_H
 102 #include <libc.h>
 103 #endif
 104 #if HAVE_STRING_H
 105 #include <string.h>
 106 #endif
 107 #if HAVE_STRINGS_H
 108 #include <strings.h>
 109 #endif
 110 #if HAVE_BSTRING_H
 111 #include <bstring.h>
 112 #endif
 113 #if HAVE_CRYPT_H
 114 #include <crypt.h>
 115 #endif
 116 #if HAVE_FNMATCH_H
 117 extern "C" {
 118 #include <fnmatch.h>
 119 }
 120 #endif
 121
 122
 123 #ifndef DEFAULT_CACHEMGR_CONFIG
 124 #define DEFAULT_CACHEMGR_CONFIG "/etc/squid/cachemgr.conf"
 125 #endif
 126
 127 typedef struct {
 128     char *server;
 129     char *hostname;
 130     int port;
 131     char *action;
 132     char *user_name;
 133     char *passwd;
 134     char *pub_auth;
 135     char *workers;
 136     char *processes;
 137 } cachemgr_request;
 138
 139 /*
 140  * Static variables and constants
 141  */
 142 static const time_t passwd_ttl = 60 * 60 * 3;   /* in sec */
 143 static const char *script_name = "/cgi-bin/cachemgr.cgi";
 144 static const char *progname = NULL;
 145 static time_t now;
 146
 147 /*
 148  * Function prototypes
 149  */
 150 static const char *safe_str(const char *str);
 151 static const char *xstrtok(char **str, char del);
 152 static void print_trailer(void);
 153 static void auth_html(const char *host, int port, const char *user_name);
 154 static void error_html(const char *msg);
 155 static char *menu_url(cachemgr_request * req, const char *action);
 156 static int parse_status_line(const char *sline, const char **statusStr);
 157 static cachemgr_request *read_request(void);
 158 static char *read_get_request(void);
 159 static char *read_post_request(void);
 160
 161 static void make_pub_auth(cachemgr_request * req);
 162 static void decode_pub_auth(cachemgr_request * req);
 163 static void reset_auth(cachemgr_request * req);
 164 static const char *make_auth_header(const cachemgr_request * req);
 165
 166 static int check_target_acl(const char *hostname, int port);
 167
 168 #ifdef _SQUID_MSWIN_
 169 static int s_iInitCount = 0;
 170
 171 int Win32SockInit(void)
 172 {
 173     int iVersionRequested;
 174     WSADATA wsaData;
 175     int err;
 176
 177     if (s_iInitCount > 0) {
 178         s_iInitCount++;
 179         return (0);
 180     } else if (s_iInitCount < 0)
 181         return (s_iInitCount);
 182
 183     /* s_iInitCount == 0. Do the initailization */
 184     iVersionRequested = MAKEWORD(2, 0);
 185
 186     err = WSAStartup((WORD) iVersionRequested, &wsaData);
 187
 188     if (err) {
 189         s_iInitCount = -1;
 190         return (s_iInitCount);
 191     }
 192
 193     if (LOBYTE(wsaData.wVersion) != 2 ||
 194             HIBYTE(wsaData.wVersion) != 0) {
 195         s_iInitCount = -2;
 196         WSACleanup();
 197         return (s_iInitCount);
 198     }
 199
 200     s_iInitCount++;
 201     return (s_iInitCount);
 202 }
 203
 204 void Win32SockCleanup(void)
 205 {
 206     if (--s_iInitCount == 0)
 207         WSACleanup();
 208
 209     return;
 210 }
 211
 212 #endif /* ifdef _SQUID_MSWIN_ */
 213
 214 static const char *
 215 safe_str(const char *str)
 216 {
 217     return str ? str : "";
 218 }
 219
 220 /* relaxed number format */
 221 static int
 222 is_number(const char *str)
 223 {
 224     return strspn(str, "\t -+01234567890./\n") == strlen(str);
 225 }
 226
 227 static const char *
 228 xstrtok(char **str, char del)
 229 {
 230     if (*str) {
 231         char *p = strchr(*str, del);
 232         char *tok = *str;
 233         int len;
 234
 235         if (p) {
 236             *str = p + 1;
 237             *p = '\0';
 238         } else
 239             *str = NULL;
 240
 241         /* trim */
 242         len = strlen(tok);
 243
 244         while (len && xisspace(tok[len - 1]))
 245             tok[--len] = '\0';
 246
 247         while (xisspace(*tok))
 248             tok++;
 249
 250         return tok;
 251     } else
 252         return "";
 253 }
 254
 255 static void
 256 print_trailer(void)
 257 {
 258     printf("<HR noshade size=\"1px\">\n");
 259     printf("<ADDRESS>\n");
 260     printf("Generated %s, by %s/%s@%s\n",
 261            mkrfc1123(now), progname, VERSION, getfullhostname());
 262     printf("</ADDRESS></BODY></HTML>\n");
 263 }
 264
 265 static void
 266 auth_html(const char *host, int port, const char *user_name)
 267 {
 268     FILE *fp;
 269     int need_host = 1;
 270
 271     if (!user_name)
 272         user_name = "";
 273
 274     if (!host || !strlen(host))
 275         host = "";
 276
 277     printf("Content-Type: text/html\r\n\r\n");
 278
 279     printf("<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01 Transitional//EN\" \"http://www.w3.org/TR/html4/loose.dtd\">\n");
 280
 281     printf("<HTML><HEAD><TITLE>Cache Manager Interface</TITLE>\n");
 282
 283     printf("<STYLE type=\"text/css\"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}--></STYLE></HEAD>\n");
 284
 285     printf("<BODY><H1>Cache Manager Interface</H1>\n");
 286
 287     printf("<P>This is a WWW interface to the instrumentation interface\n");
 288
 289     printf("for the Squid object cache.</P>\n");
 290
 291     printf("<HR noshade size=\"1px\">\n");
 292
 293     printf("<FORM METHOD=\"POST\" ACTION=\"%s\">\n", script_name);
 294
 295     printf("<TABLE BORDER=\"0\" CELLPADDING=\"10\" CELLSPACING=\"1\">\n");
 296
 297
 298     fp = fopen("cachemgr.conf", "r");
 299
 300     if (fp == NULL)
 301         fp = fopen(DEFAULT_CACHEMGR_CONFIG, "r");
 302
 303     if (fp != NULL) {
 304         int servers = 0;
 305         char config_line[BUFSIZ];
 306
 307         while (fgets(config_line, BUFSIZ, fp)) {
 308             char *server, *comment;
 309             strtok(config_line, "\r\n");
 310
 311             if (config_line[0] == '#')
 312                 continue;
 313
 314             if (config_line[0] == '\0')
 315                 continue;
 316
 317             if ((server = strtok(config_line, " \t")) == NULL)
 318                 continue;
 319
 320             if (strchr(server, '*') || strchr(server, '[') || strchr(server, '?')) {
 321                 need_host = -1;
 322                 continue;
 323             }
 324
 325             comment = strtok(NULL, "");
 326
 327             if (comment)
 328                 while (*comment == ' ' || *comment == '\t')
 329                     comment++;
 330
 331             if (!comment || !*comment)
 332                 comment = server;
 333
 334             if (!servers) {
 335                 printf("<TR><TH ALIGN=\"left\">Cache Server:</TH><TD><SELECT NAME=\"server\">\n");
 336             }
 337
 338             printf("<OPTION VALUE=\"%s\"%s>%s</OPTION>\n", server, (servers || *host) ? "" : " SELECTED", comment);
 339             servers++;
 340         }
 341
 342         if (servers) {
 343             if (need_host == 1 && !*host)
 344                 need_host = 0;
 345
 346             if (need_host)
 347                 printf("<OPTION VALUE=\"\"%s>Other</OPTION>\n", (*host) ? " SELECTED" : "");
 348
 349             printf("</SELECT></TR>\n");
 350         }
 351
 352         fclose(fp);
 353     }
 354
 355     if (need_host) {
 356         if (need_host == 1 && !*host)
 357             host = "localhost";
 358
 359         printf("<TR><TH ALIGN=\"left\">Cache Host:</TH><TD><INPUT NAME=\"host\" ");
 360
 361         printf("size=\"30\" VALUE=\"%s\"></TD></TR>\n", host);
 362
 363         printf("<TR><TH ALIGN=\"left\">Cache Port:</TH><TD><INPUT NAME=\"port\" ");
 364
 365         printf("size=\"30\" VALUE=\"%d\"></TD></TR>\n", port);
 366     }
 367
 368     printf("<TR><TH ALIGN=\"left\">Manager name:</TH><TD><INPUT NAME=\"user_name\" ");
 369
 370     printf("size=\"30\" VALUE=\"%s\"></TD></TR>\n", user_name);
 371
 372     printf("<TR><TH ALIGN=\"left\">Password:</TH><TD><INPUT TYPE=\"password\" NAME=\"passwd\" ");
 373
 374     printf("size=\"30\" VALUE=\"\"></TD></TR>\n");
 375
 376     printf("</TABLE><BR CLEAR=\"all\">\n");
 377
 378     printf("<INPUT TYPE=\"submit\" VALUE=\"Continue...\">\n");
 379
 380     printf("</FORM>\n");
 381
 382     print_trailer();
 383 }
 384
 385 static void
 386 error_html(const char *msg)
 387 {
 388     printf("Content-Type: text/html\r\n\r\n");
 389     printf("<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01 Transitional//EN\" \"http://www.w3.org/TR/html4/loose.dtd\">\n");
 390     printf("<HTML><HEAD><TITLE>Cache Manager Error</TITLE>\n");
 391     printf("<STYLE type=\"text/css\"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}--></STYLE></HEAD>\n");
 392     printf("<BODY><H1>Cache Manager Error</H1>\n");
 393     printf("<P>\n%s</P>\n", html_quote(msg));
 394     print_trailer();
 395 }
 396
 397 /* returns http status extracted from status line or -1 on parsing failure */
 398 static int
 399 parse_status_line(const char *sline, const char **statusStr)
 400 {
 401     const char *sp = strchr(sline, ' ');
 402
 403     if (statusStr)
 404         *statusStr = NULL;
 405
 406     if (strncasecmp(sline, "HTTP/", 5) || !sp)
 407         return -1;
 408
 409     while (xisspace(*++sp));
 410     if (!xisdigit(*sp))
 411         return -1;
 412
 413     if (statusStr)
 414         *statusStr = sp;
 415
 416     return atoi(sp);
 417 }
 418
 419 static char *
 420 menu_url(cachemgr_request * req, const char *action)
 421 {
 422     static char url[1024];
 423     snprintf(url, sizeof(url), "%s?host=%s&port=%d&user_name=%s&operation=%s&auth=%s",
 424              script_name,
 425              req->hostname,
 426              req->port,
 427              safe_str(req->user_name),
 428              action,
 429              safe_str(req->pub_auth));
 430     return url;
 431 }
 432
 433 static const char *
 434 munge_menu_line(const char *buf, cachemgr_request * req)
 435 {
 436     char *x;
 437     const char *a;
 438     const char *d;
 439     const char *p;
 440     char *a_url;
 441     char *buf_copy;
 442     static char html[2 * 1024];
 443
 444     if (strlen(buf) < 1)
 445         return buf;
 446
 447     if (*buf != ' ')
 448         return buf;
 449
 450     buf_copy = x = xstrdup(buf);
 451
 452     a = xstrtok(&x, '\t');
 453
 454     d = xstrtok(&x, '\t');
 455
 456     p = xstrtok(&x, '\t');
 457
 458     a_url = xstrdup(menu_url(req, a));
 459
 460     /* no reason to give a url for a disabled action */
 461     if (!strcmp(p, "disabled"))
 462         snprintf(html, sizeof(html), "<LI type=\"circle\">%s (disabled)<A HREF=\"%s\">.</A>\n", d, a_url);
 463     else
 464         /* disable a hidden action (requires a password, but password is not in squid.conf) */
 465         if (!strcmp(p, "hidden"))
 466             snprintf(html, sizeof(html), "<LI type=\"circle\">%s (hidden)<A HREF=\"%s\">.</A>\n", d, a_url);
 467         else
 468             /* disable link if authentication is required and we have no password */
 469             if (!strcmp(p, "protected") && !req->passwd)
 470                 snprintf(html, sizeof(html), "<LI type=\"circle\">%s (requires <a href=\"%s\">authentication</a>)<A HREF=\"%s\">.</A>\n",
 471                          d, menu_url(req, "authenticate"), a_url);
 472             else
 473                 /* highlight protected but probably available entries */
 474                 if (!strcmp(p, "protected"))
 475                     snprintf(html, sizeof(html), "<LI type=\"square\"><A HREF=\"%s\"><font color=\"#FF0000\">%s</font></A>\n",
 476                              a_url, d);
 477
 478     /* public entry or unknown type of protection */
 479                 else
 480                     snprintf(html, sizeof(html), "<LI type=\"disk\"><A HREF=\"%s\">%s</A>\n", a_url, d);
 481
 482     xfree(a_url);
 483
 484     xfree(buf_copy);
 485
 486     return html;
 487 }
 488
 489 static const char *
 490 munge_other_line(const char *buf, cachemgr_request * req)
 491 {
 492     static const char *ttags[] = {"td", "th"};
 493
 494     static char html[4096];
 495     static int table_line_num = 0;
 496     static int next_is_header = 0;
 497     int is_header = 0;
 498     const char *ttag;
 499     char *buf_copy;
 500     char *x, *p;
 501     int l = 0;
 502     /* does it look like a table? */
 503
 504     if (!strchr(buf, '\t') || *buf == '\t') {
 505         /* nope, just text */
 506         snprintf(html, sizeof(html), "%s%s",
 507                  table_line_num ? "</table>\n<pre>" : "", html_quote(buf));
 508         table_line_num = 0;
 509         return html;
 510     }
 511
 512     /* start html table */
 513     if (!table_line_num) {
 514         l += snprintf(html + l, sizeof(html) - l, "</pre><table cellpadding=\"2\" cellspacing=\"1\">\n");
 515         next_is_header = 0;
 516     }
 517
 518     /* remove '\n' */
 519     is_header = (!table_line_num || next_is_header) && !strchr(buf, ':') && !is_number(buf);
 520
 521     ttag = ttags[is_header];
 522
 523     /* record starts */
 524     l += snprintf(html + l, sizeof(html) - l, "<tr>");
 525
 526     /* substitute '\t' */
 527     buf_copy = x = xstrdup(buf);
 528
 529     if ((p = strchr(x, '\n')))
 530         *p = '\0';
 531
 532     while (x && strlen(x)) {
 533         int column_span = 1;
 534         const char *cell = xstrtok(&x, '\t');
 535
 536         while (x && *x == '\t') {
 537             column_span++;
 538             x++;
 539         }
 540
 541         l += snprintf(html + l, sizeof(html) - l, "<%s colspan=\"%d\" align=\"%s\">%s</%s>",
 542                       ttag, column_span,
 543                       is_header ? "center" : is_number(cell) ? "right" : "left",
 544                       html_quote(cell), ttag);
 545     }
 546
 547     xfree(buf_copy);
 548     /* record ends */
 549     snprintf(html + l, sizeof(html) - l, "</tr>\n");
 550     next_is_header = is_header && strstr(buf, "\t\t");
 551     table_line_num++;
 552     return html;
 553 }
 554
 555 static const char *
 556 munge_action_line(const char *_buf, cachemgr_request * req)
 557 {
 558     static char html[2 * 1024];
 559     char *buf = xstrdup(_buf);
 560     char *x = buf;
 561     const char *action, *description;
 562     char *p;
 563
 564     if ((p = strchr(x, '\n')))
 565         *p = '\0';
 566     action = xstrtok(&x, '\t');
 567     description = xstrtok(&x, '\t');
 568     if (!description)
 569         description = action;
 570     if (!action)
 571         return "";
 572     snprintf(html, sizeof(html), " <a href=\"%s\">%s</a>", menu_url(req, action), description);
 573     return html;
 574 }
 575
 576 static int
 577 read_reply(int s, cachemgr_request * req)
 578 {
 579     char buf[4 * 1024];
 580 #ifdef _SQUID_MSWIN_
 581
 582     int reply;
 583     char *tmpfile = tempnam(NULL, "tmp0000");
 584     FILE *fp = fopen(tmpfile, "w+");
 585 #else
 586
 587     FILE *fp = fdopen(s, "r");
 588 #endif
 589     /* interpretation states */
 590     enum {
 591         isStatusLine, isHeaders, isActions, isBodyStart, isBody, isForward, isEof, isForwardEof, isSuccess, isError
 592     } istate = isStatusLine;
 593     int parse_menu = 0;
 594     const char *action = req->action;
 595     const char *statusStr = NULL;
 596     int status = -1;
 597
 598     if (0 == strlen(req->action))
 599         parse_menu = 1;
 600     else if (0 == strcasecmp(req->action, "menu"))
 601         parse_menu = 1;
 602
 603     if (fp == NULL) {
 604 #ifdef _SQUID_MSWIN_
 605         perror(tmpfile);
 606         xfree(tmpfile);
 607 #else
 608
 609         perror("fdopen");
 610 #endif
 611
 612         close(s);
 613         return 1;
 614     }
 615
 616 #ifdef _SQUID_MSWIN_
 617
 618     while ((reply=recv(s, buf , sizeof(buf), 0)) > 0)
 619         fwrite(buf, 1, reply, fp);
 620
 621     rewind(fp);
 622
 623 #endif
 624
 625     if (parse_menu)
 626         action = "menu";
 627
 628     /* read reply interpreting one line at a time depending on state */
 629     while (istate < isEof) {
 630         if (!fgets(buf, sizeof(buf), fp))
 631             istate = istate == isForward ? isForwardEof : isEof;
 632
 633         switch (istate) {
 634
 635         case isStatusLine:
 636             /* get HTTP status */
 637             /* uncomment the following if you want to debug headers */
 638             /* fputs("\r\n\r\n", stdout); */
 639             status = parse_status_line(buf, &statusStr);
 640             istate = status == 200 ? isHeaders : isForward;
 641             /* if cache asks for authentication, we have to reset our info */
 642
 643             if (status == 401 || status == 407) {
 644                 reset_auth(req);
 645                 status = 403;   /* Forbiden, see comments in case isForward: */
 646             }
 647
 648             /* this is a way to pass HTTP status to the Web server */
 649             if (statusStr)
 650                 printf("Status: %d %s", status, statusStr);     /* statusStr has '\n' */
 651
 652             break;
 653
 654         case isHeaders:
 655             /* forward header field */
 656             if (!strcmp(buf, "\r\n")) {         /* end of headers */
 657                 fputs("Content-Type: text/html\r\n", stdout);   /* add our type */
 658                 istate = isBodyStart;
 659             }
 660
 661             if (strncasecmp(buf, "Content-Type:", 13))  /* filter out their type */
 662                 fputs(buf, stdout);
 663
 664             break;
 665
 666         case isBodyStart:
 667             printf("<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01 Transitional//EN\" \"http://www.w3.org/TR/html4/loose.dtd\">\n");
 668
 669             printf("<HTML><HEAD><TITLE>CacheMgr@%s: %s</TITLE>\n",
 670                    req->hostname, action);
 671
 672             printf("<STYLE type=\"text/css\"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}TABLE{background-color:#333333;border:0pt;padding:0pt}TH,TD{background-color:#ffffff;white-space:nowrap}--></STYLE>\n");
 673
 674             printf("</HEAD><BODY>\n");
 675
 676             if (parse_menu) {
 677                 printf("<H2><a href=\"%s\">Cache Manager</a> menu for %s:</H2>",
 678                        menu_url(req, "authenticate"), req->hostname);
 679                 printf("<UL>\n");
 680             } else {
 681                 printf("<P><A HREF=\"%s\">%s</A>\n<HR noshade size=\"1px\">\n",
 682                        menu_url(req, "menu"), "Cache Manager menu");
 683                 printf("<PRE>\n");
 684             }
 685
 686             istate = isActions;
 687             /* yes, fall through, we do not want to loose the first line */
 688
 689         case isActions:
 690             if (strncmp(buf, "action:", 7) == 0) {
 691                 fputs(" ", stdout);
 692                 fputs(munge_action_line(buf + 7, req), stdout);
 693                 break;
 694             }
 695             if (parse_menu) {
 696                 printf("<UL>\n");
 697             } else {
 698                 printf("<HR noshade size=\"1px\">\n");
 699                 printf("<PRE>\n");
 700             }
 701
 702             istate = isBody;
 703             /* yes, fall through, we do not want to loose the first line */
 704
 705         case isBody:
 706             /* interpret [and reformat] cache response */
 707
 708             if (parse_menu)
 709                 fputs(munge_menu_line(buf, req), stdout);
 710             else
 711                 fputs(munge_other_line(buf, req), stdout);
 712
 713             break;
 714
 715         case isForward:
 716             /* forward: no modifications allowed */
 717             /*
 718              * Note: we currently do not know any way to get browser.reply to
 719              * 401 to .cgi because web server filters out all auth info. Thus we
 720              * disable authentication headers for now.
 721              */
 722             if (!strncasecmp(buf, "WWW-Authenticate:", 17) || !strncasecmp(buf, "Proxy-Authenticate:", 19));    /* skip */
 723             else
 724                 fputs(buf, stdout);
 725
 726             break;
 727
 728         case isEof:
 729             /* print trailers */
 730             if (parse_menu)
 731                 printf("</UL>\n");
 732             else
 733                 printf("</table></PRE>\n");
 734
 735             print_trailer();
 736
 737             istate = isSuccess;
 738
 739             break;
 740
 741         case isForwardEof:
 742             /* indicate that we finished processing an "error" sequence */
 743             istate = isError;
 744
 745             break;
 746
 747         default:
 748             printf("%s: internal bug: invalid state reached: %d", script_name, istate);
 749
 750             istate = isError;
 751         }
 752     }
 753
 754     fclose(fp);
 755 #ifdef _SQUID_MSWIN_
 756
 757     remove(tmpfile);
 758     xfree(tmpfile);
 759     close(s);
 760
 761 #endif
 762
 763     return 0;
 764 }
 765
 766 static int
 767 process_request(cachemgr_request * req)
 768 {
 769
 770     char ipbuf[MAX_IPSTRLEN];
 771     struct addrinfo *AI = NULL;
 772     Ip::Address S;
 773     int s;
 774     int l;
 775
 776     static char buf[2 * 1024];
 777
 778     if (req == NULL) {
 779         auth_html(CACHEMGR_HOSTNAME, CACHE_HTTP_PORT, "");
 780         return 1;
 781     }
 782
 783     if (req->hostname == NULL) {
 784         req->hostname = xstrdup(CACHEMGR_HOSTNAME);
 785     }
 786
 787     if (req->port == 0) {
 788         req->port = CACHE_HTTP_PORT;
 789     }
 790
 791     if (req->action == NULL) {
 792         req->action = xstrdup("");
 793     }
 794
 795     if (strcmp(req->action, "authenticate") == 0) {
 796         auth_html(req->hostname, req->port, req->user_name);
 797         return 0;
 798     }
 799
 800     if (!check_target_acl(req->hostname, req->port)) {
 801         snprintf(buf, 1024, "target %s:%d not allowed in cachemgr.conf\n", req->hostname, req->port);
 802         error_html(buf);
 803         return 1;
 804     }
 805
 806     S = *gethostbyname(req->hostname);
 807
 808     if ( !S.IsAnyAddr() ) {
 809         (void) 0;
 810     } else if ((S = req->hostname))
 811         (void) 0;
 812     else {
 813         snprintf(buf, 1024, "Unknown host: %s\n", req->hostname);
 814         error_html(buf);
 815         return 1;
 816     }
 817
 818     S.SetPort(req->port);
 819
 820     S.GetAddrInfo(AI);
 821
 822 #if USE_IPV6
 823     if ((s = socket( AI->ai_family, SOCK_STREAM, 0)) < 0) {
 824 #else
 825     if ((s = socket(PF_INET, SOCK_STREAM, 0)) < 0) {
 826 #endif
 827         snprintf(buf, 1024, "socket: %s\n", xstrerror());
 828         error_html(buf);
 829         return 1;
 830     }
 831
 832     if (connect(s, AI->ai_addr, AI->ai_addrlen) < 0) {
 833         snprintf(buf, 1024, "connect %s: %s\n",
 834                  S.ToURL(ipbuf,MAX_IPSTRLEN),
 835                  xstrerror());
 836         error_html(buf);
 837         S.FreeAddrInfo(AI);
 838         return 1;
 839     }
 840
 841     S.FreeAddrInfo(AI);
 842
 843     l = snprintf(buf, sizeof(buf),
 844                  "GET cache_object://%s/%s%s%s HTTP/1.0\r\n"
 845                  "User-Agent: cachemgr.cgi/%s\r\n"
 846                  "Accept: */*\r\n"
 847                  "%s"                   /* Authentication info or nothing */
 848                  "\r\n",
 849                  req->hostname,
 850                  req->action,
 851                  req->workers? "?workers=" : (req->processes ? "?processes=" : ""),
 852                  req->workers? req->workers : (req->processes ? req->processes: ""),
 853                  VERSION,
 854                  make_auth_header(req));
 855     if (write(s, buf, l) < 0) {
 856         fprintf(stderr,"ERROR: (%d) writing request: '%s'\n", errno, buf);
 857     } else {
 858         debug("wrote request: '%s'\n", buf);
 859     }
 860     return read_reply(s, req);
 861 }
 862
 863 int
 864 main(int argc, char *argv[])
 865 {
 866     char *s;
 867     cachemgr_request *req;
 868
 869     now = time(NULL);
 870 #ifdef _SQUID_MSWIN_
 871
 872     Win32SockInit();
 873     atexit(Win32SockCleanup);
 874     _setmode( _fileno( stdin ), _O_BINARY );
 875     _setmode( _fileno( stdout ), _O_BINARY );
 876     _fmode = _O_BINARY;
 877
 878     if ((s = strrchr(argv[0], '\\')))
 879 #else
 880
 881     if ((s = strrchr(argv[0], '/')))
 882 #endif
 883
 884         progname = xstrdup(s + 1);
 885     else
 886         progname = xstrdup(argv[0]);
 887
 888     if ((s = getenv("SCRIPT_NAME")) != NULL)
 889         script_name = xstrdup(s);
 890
 891     char **args = argv;
 892     while (argc > 1 && args[1][0] == '-') {
 893 //        const char *value = "";
 894         char option = args[1][1];
 895         switch (option) {
 896         case 'd':
 897             debug_enabled = 1;
 898             break;
 899         default:
 900 #if 0 // unused for now.
 901             if (strlen(args[1]) > 2) {
 902                 value = args[1] + 2;
 903             } else if (argc > 2) {
 904                 value = args[2];
 905                 args++;
 906                 argc--;
 907             } else
 908                 value = "";
 909 #endif
 910             break;
 911         }
 912         args++;
 913         argc--;
 914     }
 915
 916     req = read_request();
 917
 918     return process_request(req);
 919 }
 920
 921 static char *
 922 read_post_request(void)
 923 {
 924     char *s;
 925     char *buf;
 926     int len;
 927
 928     if ((s = getenv("REQUEST_METHOD")) == NULL)
 929         return NULL;
 930
 931     if (0 != strcasecmp(s, "POST"))
 932         return NULL;
 933
 934     if ((s = getenv("CONTENT_LENGTH")) == NULL)
 935         return NULL;
 936
 937     if ((len = atoi(s)) <= 0)
 938         return NULL;
 939
 940     buf = (char *)xmalloc(len + 1);
 941
 942     if (fread(buf, len, 1, stdin) == 0)
 943         return NULL;
 944
 945     buf[len] = '\0';
 946
 947     return buf;
 948 }
 949
 950 static char *
 951 read_get_request(void)
 952 {
 953     char *s;
 954
 955     if ((s = getenv("QUERY_STRING")) == NULL)
 956         return NULL;
 957
 958     return xstrdup(s);
 959 }
 960
 961 static cachemgr_request *
 962 read_request(void)
 963 {
 964     char *buf;
 965
 966     cachemgr_request *req;
 967     char *s;
 968     char *t;
 969     char *q;
 970
 971     if ((buf = read_post_request()) != NULL)
 972         (void) 0;
 973     else if ((buf = read_get_request()) != NULL)
 974         (void) 0;
 975     else
 976         return NULL;
 977
 978 #ifdef _SQUID_MSWIN_
 979
 980     if (strlen(buf) == 0 || strlen(buf) == 4000)
 981 #else
 982
 983     if (strlen(buf) == 0)
 984 #endif
 985     {
 986         xfree(buf);
 987         return NULL;
 988     }
 989
 990     req = (cachemgr_request *)xcalloc(1, sizeof(cachemgr_request));
 991
 992     for (s = strtok(buf, "&"); s != NULL; s = strtok(NULL, "&")) {
 993         t = xstrdup(s);
 994
 995         if ((q = strchr(t, '=')) == NULL)
 996             continue;
 997
 998         *q++ = '\0';
 999
1000         rfc1738_unescape(t);
1001
1002         rfc1738_unescape(q);
1003
1004         if (0 == strcasecmp(t, "server") && strlen(q))
1005             req->server = xstrdup(q);
1006         else if (0 == strcasecmp(t, "host") && strlen(q))
1007             req->hostname = xstrdup(q);
1008         else if (0 == strcasecmp(t, "port") && strlen(q))
1009             req->port = atoi(q);
1010         else if (0 == strcasecmp(t, "user_name") && strlen(q))
1011             req->user_name = xstrdup(q);
1012         else if (0 == strcasecmp(t, "passwd") && strlen(q))
1013             req->passwd = xstrdup(q);
1014         else if (0 == strcasecmp(t, "auth") && strlen(q))
1015             req->pub_auth = xstrdup(q), decode_pub_auth(req);
1016         else if (0 == strcasecmp(t, "operation"))
1017             req->action = xstrdup(q);
1018         else if (0 == strcasecmp(t, "workers") && strlen(q))
1019             req->workers = xstrdup(q);
1020         else if (0 == strcasecmp(t, "processes") && strlen(q))
1021             req->processes = xstrdup(q);
1022     }
1023
1024     if (req->server && !req->hostname) {
1025         char *p;
1026         req->hostname = strtok(req->server, ":");
1027
1028         if ((p = strtok(NULL, ":")))
1029             req->port = atoi(p);
1030     }
1031
1032     make_pub_auth(req);
1033     debug("cmgr: got req: host: '%s' port: %d uname: '%s' passwd: '%s' auth: '%s' oper: '%s' workers: '%s' processes: '%s'\n",
1034           safe_str(req->hostname), req->port, safe_str(req->user_name), safe_str(req->passwd), safe_str(req->pub_auth), safe_str(req->action), safe_str(req->workers), safe_str(req->processes));
1035     return req;
1036 }
1037
1038
1039 /* Routines to support authentication */
1040
1041 /*
1042  * Encodes auth info into a "public" form.
1043  * Currently no powerful encryption is used.
1044  */
1045 static void
1046 make_pub_auth(cachemgr_request * req)
1047 {
1048     static char buf[1024];
1049     safe_free(req->pub_auth);
1050     debug("cmgr: encoding for pub...\n");
1051
1052     if (!req->passwd || !strlen(req->passwd))
1053         return;
1054
1055     /* host | time | user | passwd */
1056     const int bufLen = snprintf(buf, sizeof(buf), "%s|%d|%s|%s",
1057                                 req->hostname,
1058                                 (int) now,
1059                                 req->user_name ? req->user_name : "",
1060                                 req->passwd);
1061     debug("cmgr: pre-encoded for pub: %s\n", buf);
1062
1063     const int encodedLen = base64_encode_len(bufLen);
1064     req->pub_auth = (char *) xmalloc(encodedLen);
1065     base64_encode_str(req->pub_auth, encodedLen, buf, bufLen);
1066     debug("cmgr: encoded: '%s'\n", req->pub_auth);
1067 }
1068
1069 static void
1070 decode_pub_auth(cachemgr_request * req)
1071 {
1072     char *buf;
1073     const char *host_name;
1074     const char *time_str;
1075     const char *user_name;
1076     const char *passwd;
1077
1078     debug("cmgr: decoding pub: '%s'\n", safe_str(req->pub_auth));
1079     safe_free(req->passwd);
1080
1081     if (!req->pub_auth || strlen(req->pub_auth) < 4 + strlen(safe_str(req->hostname)))
1082         return;
1083
1084     const int decodedLen = base64_decode_len(req->pub_auth);
1085     buf = (char*)xmalloc(decodedLen);
1086     base64_decode(buf, decodedLen, req->pub_auth);
1087
1088     debug("cmgr: length ok\n");
1089
1090     /* parse ( a lot of memory leaks, but that is cachemgr style :) */
1091     if ((host_name = strtok(buf, "|")) == NULL)
1092         return;
1093
1094     debug("cmgr: decoded host: '%s'\n", host_name);
1095
1096     if ((time_str = strtok(NULL, "|")) == NULL)
1097         return;
1098
1099     debug("cmgr: decoded time: '%s' (now: %d)\n", time_str, (int) now);
1100
1101     if ((user_name = strtok(NULL, "|")) == NULL)
1102         return;
1103
1104     debug("cmgr: decoded uname: '%s'\n", user_name);
1105
1106     if ((passwd = strtok(NULL, "|")) == NULL)
1107         return;
1108
1109     debug("cmgr: decoded passwd: '%s'\n", passwd);
1110
1111     /* verify freshness and validity */
1112     if (atoi(time_str) + passwd_ttl < now)
1113         return;
1114
1115     if (strcasecmp(host_name, req->hostname))
1116         return;
1117
1118     debug("cmgr: verified auth. info.\n");
1119
1120     /* ok, accept */
1121     xfree(req->user_name);
1122
1123     req->user_name = xstrdup(user_name);
1124
1125     req->passwd = xstrdup(passwd);
1126
1127     xfree(buf);
1128 }
1129
1130 static void
1131 reset_auth(cachemgr_request * req)
1132 {
1133     safe_free(req->passwd);
1134     safe_free(req->pub_auth);
1135 }
1136
1137 static const char *
1138 make_auth_header(const cachemgr_request * req)
1139 {
1140     static char buf[1024];
1141     size_t stringLength = 0;
1142
1143     if (!req->passwd)
1144         return "";
1145
1146     int bufLen = snprintf(buf, sizeof(buf), "%s:%s",
1147                           req->user_name ? req->user_name : "",
1148                           req->passwd);
1149
1150     int encodedLen = base64_encode_len(bufLen);
1151     if (encodedLen <= 0)
1152         return "";
1153
1154     char *str64 = static_cast<char*>(xmalloc(encodedLen));
1155     base64_encode_str(str64, encodedLen, buf, bufLen);
1156
1157     stringLength += snprintf(buf, sizeof(buf), "Authorization: Basic %s\r\n", str64);
1158
1159     assert(stringLength < sizeof(buf));
1160
1161     snprintf(&buf[stringLength], sizeof(buf) - stringLength, "Proxy-Authorization: Basic %s\r\n", str64);
1162
1163     return buf;
1164 }
1165
1166 static int
1167 check_target_acl(const char *hostname, int port)
1168 {
1169     char config_line[BUFSIZ];
1170     FILE *fp = NULL;
1171     int ret = 0;
1172     fp = fopen("cachemgr.conf", "r");
1173
1174     if (fp == NULL)
1175         fp = fopen(DEFAULT_CACHEMGR_CONFIG, "r");
1176
1177     if (fp == NULL) {
1178 #ifdef CACHEMGR_HOSTNAME_DEFINED
1179
1180         if (strcmp(hostname, CACHEMGR_HOSTNAME) == 0 && port == CACHE_HTTP_PORT)
1181             return 1;
1182
1183 #else
1184
1185         if (strcmp(hostname, "localhost") == 0)
1186             return 1;
1187
1188         if (strcmp(hostname, getfullhostname()) == 0)
1189             return 1;
1190
1191 #endif
1192
1193         return 0;
1194     }
1195
1196     while (fgets(config_line, BUFSIZ, fp)) {
1197         char *token = NULL;
1198         strtok(config_line, " \r\n\t");
1199
1200         if (config_line[0] == '#')
1201             continue;
1202
1203         if (config_line[0] == '\0')
1204             continue;
1205
1206         if ((token = strtok(config_line, ":")) == NULL)
1207             continue;
1208
1209 #if HAVE_FNMATCH_H
1210
1211         if (fnmatch(token, hostname, 0) != 0)
1212             continue;
1213
1214 #else
1215
1216         if (strcmp(token, hostname) != 0)
1217             continue;
1218
1219 #endif
1220
1221         if ((token = strtok(NULL, ":")) != NULL) {
1222             int i;
1223
1224             if (strcmp(token, "*") == 0)
1225
1226                 ;   /* Wildcard port specification */
1227             else if (strcasecmp(token, "any") == 0)
1228
1229                 ;   /* Wildcard port specification */
1230             else if (sscanf(token, "%d", &i) != 1)
1231                 continue;
1232
1233             else if (i != port)
1234                 continue;
1235         } else if (port != CACHE_HTTP_PORT)
1236             continue;
1237
1238         ret = 1;
1239
1240         break;
1241     }
1242
1243     fclose(fp);
1244     return ret;
1245 }