tools/cachemgr.cc

   1 /*
   2  * DEBUG: section --    CGI Cache Manager
   3  * AUTHOR: Duane Wessels
   4  *
   5  * SQUID Web Proxy Cache          http://www.squid-cache.org/
   6  * ----------------------------------------------------------
   7  *
   8  *  Squid is the result of efforts by numerous individuals from
   9  *  the Internet community; see the CONTRIBUTORS file for full
  10  *  details.   Many organizations have provided support for Squid's
  11  *  development; see the SPONSORS file for full details.  Squid is
  12  *  Copyrighted (C) 2001 by the Regents of the University of
  13  *  California; see the COPYRIGHT file for full details.  Squid
  14  *  incorporates software developed and/or copyrighted by other
  15  *  sources; see the CREDITS file for full details.
  16  *
  17  *  This program is free software; you can redistribute it and/or modify
  18  *  it under the terms of the GNU General Public License as published by
  19  *  the Free Software Foundation; either version 2 of the License, or
  20  *  (at your option) any later version.
  21  *
  22  *  This program is distributed in the hope that it will be useful,
  23  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  24  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  25  *  GNU General Public License for more details.
  26  *
  27  *  You should have received a copy of the GNU General Public License
  28  *  along with this program; if not, write to the Free Software
  29  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
  30  *
  31  */
  32
  33 #include "squid.h"
  34 #include "base64.h"
  35 #include "getfullhostname.h"
  36 #include "html_quote.h"
  37 #include "ip/Address.h"
  38 #include "rfc1123.h"
  39 #include "rfc1738.h"
  40 #include "util.h"
  41
  42 #if HAVE_UNISTD_H
  43 #include <unistd.h>
  44 #endif
  45 #if HAVE_STDIO_H
  46 #include <stdio.h>
  47 #endif
  48 #if HAVE_CTYPE_H
  49 #include <ctype.h>
  50 #endif
  51 #if HAVE_ERRNO_H
  52 #include <errno.h>
  53 #endif
  54 #if HAVE_FCNTL_H
  55 #include <fcntl.h>
  56 #endif
  57 #if HAVE_GRP_H
  58 #include <grp.h>
  59 #endif
  60 #if HAVE_GNUMALLOC_H
  61 #include <gnumalloc.h>
  62 #elif HAVE_MALLOC_H
  63 #include <malloc.h>
  64 #endif
  65 #if HAVE_MEMORY_H
  66 #include <memory.h>
  67 #endif
  68 #if HAVE_NETDB_H
  69 #include <netdb.h>
  70 #endif
  71 #if HAVE_PWD_H
  72 #include <pwd.h>
  73 #endif
  74 #if HAVE_SIGNAL_H
  75 #include <signal.h>
  76 #endif
  77 #if HAVE_TIME_H
  78 #include <time.h>
  79 #endif
  80 #if HAVE_SYS_PARAM_H
  81 #include <sys/param.h>
  82 #endif
  83 #if HAVE_SYS_SOCKET_H
  84 #include <sys/socket.h>
  85 #endif
  86 #if HAVE_NETINET_IN_H
  87 #include <netinet/in.h>
  88 #endif
  89 #if HAVE_ARPA_INET_H
  90 #include <arpa/inet.h>
  91 #endif
  92 #if HAVE_SYS_STAT_H
  93 #include <sys/stat.h>
  94 #endif
  95 #if HAVE_SYS_UN_H
  96 #include <sys/un.h>
  97 #endif
  98 #if HAVE_SYS_WAIT_H
  99 #include <sys/wait.h>
 100 #endif
 101 #if HAVE_LIBC_H
 102 #include <libc.h>
 103 #endif
 104 #if HAVE_STRING_H
 105 #include <string.h>
 106 #endif
 107 #if HAVE_STRINGS_H
 108 #include <strings.h>
 109 #endif
 110 #if HAVE_BSTRING_H
 111 #include <bstring.h>
 112 #endif
 113 #if HAVE_CRYPT_H
 114 #include <crypt.h>
 115 #endif
 116 #if HAVE_FNMATCH_H
 117 extern "C" {
 118 #include <fnmatch.h>
 119 }
 120 #endif
 121
 122 #ifndef DEFAULT_CACHEMGR_CONFIG
 123 #define DEFAULT_CACHEMGR_CONFIG "/etc/squid/cachemgr.conf"
 124 #endif
 125
 126 typedef struct {
 127     char *server;
 128     char *hostname;
 129     int port;
 130     char *action;
 131     char *user_name;
 132     char *passwd;
 133     char *pub_auth;
 134     char *workers;
 135     char *processes;
 136 } cachemgr_request;
 137
 138 /*
 139  * Static variables and constants
 140  */
 141 static const time_t passwd_ttl = 60 * 60 * 3;   /* in sec */
 142 static const char *script_name = "/cgi-bin/cachemgr.cgi";
 143 static const char *progname = NULL;
 144 static time_t now;
 145
 146 /*
 147  * Function prototypes
 148  */
 149 static const char *safe_str(const char *str);
 150 static const char *xstrtok(char **str, char del);
 151 static void print_trailer(void);
 152 static void auth_html(const char *host, int port, const char *user_name);
 153 static void error_html(const char *msg);
 154 static char *menu_url(cachemgr_request * req, const char *action);
 155 static int parse_status_line(const char *sline, const char **statusStr);
 156 static cachemgr_request *read_request(void);
 157 static char *read_get_request(void);
 158 static char *read_post_request(void);
 159
 160 static void make_pub_auth(cachemgr_request * req);
 161 static void decode_pub_auth(cachemgr_request * req);
 162 static void reset_auth(cachemgr_request * req);
 163 static const char *make_auth_header(const cachemgr_request * req);
 164
 165 static int check_target_acl(const char *hostname, int port);
 166
 167 #if _SQUID_WINDOWS_
 168 static int s_iInitCount = 0;
 169
 170 int Win32SockInit(void)
 171 {
 172     int iVersionRequested;
 173     WSADATA wsaData;
 174     int err;
 175
 176     if (s_iInitCount > 0) {
 177         ++s_iInitCount;
 178         return (0);
 179     } else if (s_iInitCount < 0)
 180         return (s_iInitCount);
 181
 182     /* s_iInitCount == 0. Do the initailization */
 183     iVersionRequested = MAKEWORD(2, 0);
 184
 185     err = WSAStartup((WORD) iVersionRequested, &wsaData);
 186
 187     if (err) {
 188         s_iInitCount = -1;
 189         return (s_iInitCount);
 190     }
 191
 192     if (LOBYTE(wsaData.wVersion) != 2 ||
 193             HIBYTE(wsaData.wVersion) != 0) {
 194         s_iInitCount = -2;
 195         WSACleanup();
 196         return (s_iInitCount);
 197     }
 198
 199     ++s_iInitCount;
 200     return (s_iInitCount);
 201 }
 202
 203 void Win32SockCleanup(void)
 204 {
 205     if (--s_iInitCount == 0)
 206         WSACleanup();
 207
 208     return;
 209 }
 210
 211 #endif
 212
 213 static const char *
 214 safe_str(const char *str)
 215 {
 216     return str ? str : "";
 217 }
 218
 219 /* relaxed number format */
 220 static int
 221 is_number(const char *str)
 222 {
 223     return strspn(str, "\t -+01234567890./\n") == strlen(str);
 224 }
 225
 226 static const char *
 227 xstrtok(char **str, char del)
 228 {
 229     if (*str) {
 230         char *p = strchr(*str, del);
 231         char *tok = *str;
 232         int len;
 233
 234         if (p) {
 235             *str = p + 1;
 236             *p = '\0';
 237         } else
 238             *str = NULL;
 239
 240         /* trim */
 241         len = strlen(tok);
 242
 243         while (len && xisspace(tok[len - 1]))
 244             tok[--len] = '\0';
 245
 246         while (xisspace(*tok))
 247             ++tok;
 248
 249         return tok;
 250     } else
 251         return "";
 252 }
 253
 254 static void
 255 print_trailer(void)
 256 {
 257     printf("<HR noshade size=\"1px\">\n");
 258     printf("<ADDRESS>\n");
 259     printf("Generated %s, by %s/%s@%s\n",
 260            mkrfc1123(now), progname, VERSION, getfullhostname());
 261     printf("</ADDRESS></BODY></HTML>\n");
 262 }
 263
 264 static void
 265 auth_html(const char *host, int port, const char *user_name)
 266 {
 267     FILE *fp;
 268     int need_host = 1;
 269
 270     if (!user_name)
 271         user_name = "";
 272
 273     if (!host || !strlen(host))
 274         host = "";
 275
 276     fp = fopen("cachemgr.conf", "r");
 277
 278     if (fp == NULL)
 279         fp = fopen(DEFAULT_CACHEMGR_CONFIG, "r");
 280
 281     if (fp == NULL)
 282         printf("X-Error: message=\"Unable to open config %s\"", DEFAULT_CACHEMGR_CONFIG);
 283
 284     printf("Content-Type: text/html\r\n\r\n");
 285
 286     printf("<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01 Transitional//EN\" \"http://www.w3.org/TR/html4/loose.dtd\">\n");
 287
 288     printf("<HTML><HEAD><TITLE>Cache Manager Interface</TITLE>\n");
 289
 290     printf("<STYLE type=\"text/css\"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}--></STYLE>\n");
 291
 292     printf("<script type=\"text/javascript\">\n");
 293     printf("function TS(t, s) {\n");
 294     printf(" var x = new XMLHttpRequest();\n");
 295     printf(" x.open('GET', 'http' + s + '://' + t + '/squid-internal-mgr/', true);\n");
 296     printf(" x.onreadystatechange=function() {\n");
 297     printf("  if (x.readyState==4) {\n");
 298     printf("   if ((x.status>=200 && x.status <= 299) || x.status==401) {\n");
 299     printf("    var v = x.getResponseHeader('Server');\n");
 300     printf("    if (v.substring(0,8) == 'squid/3.' && (v[8]=='H' || parseInt(v.substring(8)) >= 2)) {\n");
 301     printf("     var d = document.getElementById('H' + s + 'mgr');\n");
 302     printf("     if (d.innerHTML == '') d.innerHTML = '<h2>HTTP' + (s=='s'?'S':'') + ' Managed Proxies</h2>';\n");
 303     printf("     d.innerHTML = d.innerHTML + '<p>Host: <a href=\"http' + s + '://' + t + '/squid-internal-mgr/\">' + t + '</a></p>';\n");
 304     printf(" }}}}\n");
 305     printf(" x.send(null);\n");
 306     printf("}\n");
 307     printf("</script>\n");
 308
 309     printf("</HEAD>\n");
 310
 311     printf("<BODY><H1>Cache Manager Interface</H1>\n");
 312
 313     printf("<P>This is a WWW interface to the instrumentation interface\n");
 314
 315     printf("for the Squid object cache.</P>\n");
 316
 317     printf("<HR noshade size=\"1px\">\n");
 318
 319     printf("<div id=\"Hsmgr\"></div>\n");
 320     printf("<div id=\"Hmgr\"></div>\n");
 321     printf("<div id=\"Cmgr\">\n");
 322     printf("<h2>CGI Managed Proxies</h2>\n");
 323     printf("<FORM METHOD=\"POST\" ACTION=\"%s\">\n", script_name);
 324
 325     printf("<TABLE BORDER=\"0\" CELLPADDING=\"10\" CELLSPACING=\"1\">\n");
 326
 327     if (fp != NULL) {
 328         int servers = 0;
 329         char config_line[BUFSIZ];
 330
 331         while (fgets(config_line, BUFSIZ, fp)) {
 332             char *server, *comment;
 333             strtok(config_line, "\r\n");
 334
 335             if (config_line[0] == '#')
 336                 continue;
 337
 338             if (config_line[0] == '\0')
 339                 continue;
 340
 341             if ((server = strtok(config_line, " \t")) == NULL)
 342                 continue;
 343
 344             if (strchr(server, '*') || strchr(server, '[') || strchr(server, '?')) {
 345                 need_host = -1;
 346                 continue;
 347             }
 348
 349             comment = strtok(NULL, "");
 350
 351             if (comment)
 352                 while (*comment == ' ' || *comment == '\t')
 353                     ++comment;
 354
 355             if (!comment || !*comment)
 356                 comment = server;
 357
 358             if (!servers)
 359                 printf("<TR><TH ALIGN=\"left\">Cache Server:</TH><TD><SELECT id=\"server\" NAME=\"server\">\n");
 360
 361             printf("<OPTION VALUE=\"%s\"%s>%s</OPTION>\n", server, (servers || *host) ? "" : " SELECTED", comment);
 362             ++servers;
 363         }
 364
 365         if (servers) {
 366             if (need_host == 1 && !*host)
 367                 need_host = 0;
 368
 369             if (need_host)
 370                 printf("<OPTION VALUE=\"\"%s>Other</OPTION>\n", (*host) ? " SELECTED" : "");
 371
 372             printf("</SELECT></TR>\n");
 373         }
 374
 375         fclose(fp);
 376     }
 377
 378     if (need_host) {
 379         if (need_host == 1 && !*host)
 380             host = "localhost";
 381
 382         printf("<TR><TH ALIGN=\"left\">Cache Host:</TH><TD><INPUT NAME=\"host\" ");
 383
 384         printf("size=\"30\" VALUE=\"%s\"></TD></TR>\n", host);
 385
 386         printf("<TR><TH ALIGN=\"left\">Cache Port:</TH><TD><INPUT NAME=\"port\" ");
 387
 388         printf("size=\"30\" VALUE=\"%d\"></TD></TR>\n", port);
 389     }
 390
 391     printf("<TR><TH ALIGN=\"left\">Manager name:</TH><TD><INPUT NAME=\"user_name\" ");
 392
 393     printf("size=\"30\" VALUE=\"%s\"></TD></TR>\n", user_name);
 394
 395     printf("<TR><TH ALIGN=\"left\">Password:</TH><TD><INPUT TYPE=\"password\" NAME=\"passwd\" ");
 396
 397     printf("size=\"30\" VALUE=\"\"></TD></TR>\n");
 398
 399     printf("</TABLE><BR CLEAR=\"all\">\n");
 400
 401     printf("<INPUT TYPE=\"submit\" VALUE=\"Continue...\">\n");
 402
 403     printf("</FORM></div>\n");
 404
 405     printf("<script type=\"text/javascript\">\n");
 406     printf("var s = document.getElementById(\"server\");\n");
 407     printf("for (var i = 0; i < s.childElementCount; i++) {\n");
 408     printf(" TS(s.children[i].value, '');\n");
 409     printf(" TS(s.children[i].value, 's');\n");
 410     printf("}</script>\n");
 411
 412     print_trailer();
 413 }
 414
 415 static void
 416 error_html(const char *msg)
 417 {
 418     printf("Content-Type: text/html\r\n\r\n");
 419     printf("<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01 Transitional//EN\" \"http://www.w3.org/TR/html4/loose.dtd\">\n");
 420     printf("<HTML><HEAD><TITLE>Cache Manager Error</TITLE>\n");
 421     printf("<STYLE type=\"text/css\"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}--></STYLE></HEAD>\n");
 422     printf("<BODY><H1>Cache Manager Error</H1>\n");
 423     printf("<P>\n%s</P>\n", html_quote(msg));
 424     print_trailer();
 425 }
 426
 427 /* returns http status extracted from status line or -1 on parsing failure */
 428 static int
 429 parse_status_line(const char *sline, const char **statusStr)
 430 {
 431     const char *sp = strchr(sline, ' ');
 432
 433     if (statusStr)
 434         *statusStr = NULL;
 435
 436     if (strncasecmp(sline, "HTTP/", 5) || !sp)
 437         return -1;
 438
 439     while (xisspace(*++sp));
 440     if (!xisdigit(*sp))
 441         return -1;
 442
 443     if (statusStr)
 444         *statusStr = sp;
 445
 446     return atoi(sp);
 447 }
 448
 449 static char *
 450 menu_url(cachemgr_request * req, const char *action)
 451 {
 452     static char url[1024];
 453     snprintf(url, sizeof(url), "%s?host=%s&port=%d&user_name=%s&operation=%s&auth=%s",
 454              script_name,
 455              req->hostname,
 456              req->port,
 457              safe_str(req->user_name),
 458              action,
 459              safe_str(req->pub_auth));
 460     return url;
 461 }
 462
 463 static const char *
 464 munge_menu_line(const char *buf, cachemgr_request * req)
 465 {
 466     char *x;
 467     const char *a;
 468     const char *d;
 469     const char *p;
 470     char *a_url;
 471     char *buf_copy;
 472     static char html[2 * 1024];
 473
 474     if (strlen(buf) < 1)
 475         return buf;
 476
 477     if (*buf != ' ')
 478         return buf;
 479
 480     buf_copy = x = xstrdup(buf);
 481
 482     a = xstrtok(&x, '\t');
 483
 484     d = xstrtok(&x, '\t');
 485
 486     p = xstrtok(&x, '\t');
 487
 488     a_url = xstrdup(menu_url(req, a));
 489
 490     /* no reason to give a url for a disabled action */
 491     if (!strcmp(p, "disabled"))
 492         snprintf(html, sizeof(html), "<LI type=\"circle\">%s (disabled)<A HREF=\"%s\">.</A>\n", d, a_url);
 493     else
 494         /* disable a hidden action (requires a password, but password is not in squid.conf) */
 495         if (!strcmp(p, "hidden"))
 496             snprintf(html, sizeof(html), "<LI type=\"circle\">%s (hidden)<A HREF=\"%s\">.</A>\n", d, a_url);
 497         else
 498             /* disable link if authentication is required and we have no password */
 499             if (!strcmp(p, "protected") && !req->passwd)
 500                 snprintf(html, sizeof(html), "<LI type=\"circle\">%s (requires <a href=\"%s\">authentication</a>)<A HREF=\"%s\">.</A>\n",
 501                          d, menu_url(req, "authenticate"), a_url);
 502             else
 503                 /* highlight protected but probably available entries */
 504                 if (!strcmp(p, "protected"))
 505                     snprintf(html, sizeof(html), "<LI type=\"square\"><A HREF=\"%s\"><font color=\"#FF0000\">%s</font></A>\n",
 506                              a_url, d);
 507
 508     /* public entry or unknown type of protection */
 509                 else
 510                     snprintf(html, sizeof(html), "<LI type=\"disk\"><A HREF=\"%s\">%s</A>\n", a_url, d);
 511
 512     xfree(a_url);
 513
 514     xfree(buf_copy);
 515
 516     return html;
 517 }
 518
 519 static const char *
 520 munge_other_line(const char *buf, cachemgr_request * req)
 521 {
 522     static const char *ttags[] = {"td", "th"};
 523
 524     static char html[4096];
 525     static int table_line_num = 0;
 526     static int next_is_header = 0;
 527     int is_header = 0;
 528     const char *ttag;
 529     char *buf_copy;
 530     char *x, *p;
 531     int l = 0;
 532     /* does it look like a table? */
 533
 534     if (!strchr(buf, '\t') || *buf == '\t') {
 535         /* nope, just text */
 536         snprintf(html, sizeof(html), "%s%s",
 537                  table_line_num ? "</table>\n<pre>" : "", html_quote(buf));
 538         table_line_num = 0;
 539         return html;
 540     }
 541
 542     /* start html table */
 543     if (!table_line_num) {
 544         l += snprintf(html + l, sizeof(html) - l, "</pre><table cellpadding=\"2\" cellspacing=\"1\">\n");
 545         next_is_header = 0;
 546     }
 547
 548     /* remove '\n' */
 549     is_header = (!table_line_num || next_is_header) && !strchr(buf, ':') && !is_number(buf);
 550
 551     ttag = ttags[is_header];
 552
 553     /* record starts */
 554     l += snprintf(html + l, sizeof(html) - l, "<tr>");
 555
 556     /* substitute '\t' */
 557     buf_copy = x = xstrdup(buf);
 558
 559     if ((p = strchr(x, '\n')))
 560         *p = '\0';
 561
 562     while (x && strlen(x)) {
 563         int column_span = 1;
 564         const char *cell = xstrtok(&x, '\t');
 565
 566         while (x && *x == '\t') {
 567             ++column_span;
 568             ++x;
 569         }
 570
 571         l += snprintf(html + l, sizeof(html) - l, "<%s colspan=\"%d\" align=\"%s\">%s</%s>",
 572                       ttag, column_span,
 573                       is_header ? "center" : is_number(cell) ? "right" : "left",
 574                       html_quote(cell), ttag);
 575     }
 576
 577     xfree(buf_copy);
 578     /* record ends */
 579     snprintf(html + l, sizeof(html) - l, "</tr>\n");
 580     next_is_header = is_header && strstr(buf, "\t\t");
 581     ++table_line_num;
 582     return html;
 583 }
 584
 585 static const char *
 586 munge_action_line(const char *_buf, cachemgr_request * req)
 587 {
 588     static char html[2 * 1024];
 589     char *buf = xstrdup(_buf);
 590     char *x = buf;
 591     const char *action, *description;
 592     char *p;
 593
 594     if ((p = strchr(x, '\n')))
 595         *p = '\0';
 596     action = xstrtok(&x, '\t');
 597     if (!action) {
 598         xfree(buf);
 599         return "";
 600     }
 601     description = xstrtok(&x, '\t');
 602     if (!description)
 603         description = action;
 604     snprintf(html, sizeof(html), " <a href=\"%s\">%s</a>", menu_url(req, action), description);
 605     xfree(buf);
 606     return html;
 607 }
 608
 609 static int
 610 read_reply(int s, cachemgr_request * req)
 611 {
 612     char buf[4 * 1024];
 613 #if _SQUID_WINDOWS_
 614
 615     int reply;
 616     char *tmpfile = tempnam(NULL, "tmp0000");
 617     FILE *fp = fopen(tmpfile, "w+");
 618 #else
 619
 620     FILE *fp = fdopen(s, "r");
 621 #endif
 622     /* interpretation states */
 623     enum {
 624         isStatusLine, isHeaders, isActions, isBodyStart, isBody, isForward, isEof, isForwardEof, isSuccess, isError
 625     } istate = isStatusLine;
 626     int parse_menu = 0;
 627     const char *action = req->action;
 628     const char *statusStr = NULL;
 629     int status = -1;
 630
 631     if (0 == strlen(req->action))
 632         parse_menu = 1;
 633     else if (0 == strcasecmp(req->action, "menu"))
 634         parse_menu = 1;
 635
 636     if (fp == NULL) {
 637 #if _SQUID_WINDOWS_
 638         perror(tmpfile);
 639         xfree(tmpfile);
 640 #else
 641
 642         perror("fdopen");
 643 #endif
 644
 645         close(s);
 646         return 1;
 647     }
 648
 649 #if _SQUID_WINDOWS_
 650
 651     while ((reply=recv(s, buf , sizeof(buf), 0)) > 0)
 652         fwrite(buf, 1, reply, fp);
 653
 654     rewind(fp);
 655
 656 #endif
 657
 658     if (parse_menu)
 659         action = "menu";
 660
 661     /* read reply interpreting one line at a time depending on state */
 662     while (istate < isEof) {
 663         if (!fgets(buf, sizeof(buf), fp))
 664             istate = istate == isForward ? isForwardEof : isEof;
 665
 666         switch (istate) {
 667
 668         case isStatusLine:
 669             /* get HTTP status */
 670             /* uncomment the following if you want to debug headers */
 671             /* fputs("\r\n\r\n", stdout); */
 672             status = parse_status_line(buf, &statusStr);
 673             istate = status == 200 ? isHeaders : isForward;
 674             /* if cache asks for authentication, we have to reset our info */
 675
 676             if (status == 401 || status == 407) {
 677                 reset_auth(req);
 678                 status = 403;   /* Forbiden, see comments in case isForward: */
 679             }
 680
 681             /* this is a way to pass HTTP status to the Web server */
 682             if (statusStr)
 683                 printf("Status: %d %s", status, statusStr);     /* statusStr has '\n' */
 684
 685             break;
 686
 687         case isHeaders:
 688             /* forward header field */
 689             if (!strcmp(buf, "\r\n")) {         /* end of headers */
 690                 fputs("Content-Type: text/html\r\n", stdout);   /* add our type */
 691                 istate = isBodyStart;
 692             }
 693
 694             if (strncasecmp(buf, "Content-Type:", 13))  /* filter out their type */
 695                 fputs(buf, stdout);
 696
 697             break;
 698
 699         case isBodyStart:
 700             printf("<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01 Transitional//EN\" \"http://www.w3.org/TR/html4/loose.dtd\">\n");
 701
 702             printf("<HTML><HEAD><TITLE>CacheMgr@%s: %s</TITLE>\n",
 703                    req->hostname, action);
 704
 705             printf("<STYLE type=\"text/css\"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}TABLE{background-color:#333333;border:0pt;padding:0pt}TH,TD{background-color:#ffffff;white-space:nowrap}--></STYLE>\n");
 706
 707             printf("</HEAD><BODY>\n");
 708
 709             if (parse_menu) {
 710                 printf("<H2><a href=\"%s\">Cache Manager</a> menu for %s:</H2>",
 711                        menu_url(req, "authenticate"), req->hostname);
 712                 printf("<UL>\n");
 713             } else {
 714                 printf("<P><A HREF=\"%s\">%s</A>\n<HR noshade size=\"1px\">\n",
 715                        menu_url(req, "menu"), "Cache Manager menu");
 716                 printf("<PRE>\n");
 717             }
 718
 719             istate = isActions;
 720             /* yes, fall through, we do not want to loose the first line */
 721
 722         case isActions:
 723             if (strncmp(buf, "action:", 7) == 0) {
 724                 fputs(" ", stdout);
 725                 fputs(munge_action_line(buf + 7, req), stdout);
 726                 break;
 727             }
 728             if (parse_menu) {
 729                 printf("<UL>\n");
 730             } else {
 731                 printf("<HR noshade size=\"1px\">\n");
 732                 printf("<PRE>\n");
 733             }
 734
 735             istate = isBody;
 736             /* yes, fall through, we do not want to loose the first line */
 737
 738         case isBody:
 739             /* interpret [and reformat] cache response */
 740
 741             if (parse_menu)
 742                 fputs(munge_menu_line(buf, req), stdout);
 743             else
 744                 fputs(munge_other_line(buf, req), stdout);
 745
 746             break;
 747
 748         case isForward:
 749             /* forward: no modifications allowed */
 750             /*
 751              * Note: we currently do not know any way to get browser.reply to
 752              * 401 to .cgi because web server filters out all auth info. Thus we
 753              * disable authentication headers for now.
 754              */
 755             if (!strncasecmp(buf, "WWW-Authenticate:", 17) || !strncasecmp(buf, "Proxy-Authenticate:", 19));    /* skip */
 756             else
 757                 fputs(buf, stdout);
 758
 759             break;
 760
 761         case isEof:
 762             /* print trailers */
 763             if (parse_menu)
 764                 printf("</UL>\n");
 765             else
 766                 printf("</table></PRE>\n");
 767
 768             print_trailer();
 769
 770             istate = isSuccess;
 771
 772             break;
 773
 774         case isForwardEof:
 775             /* indicate that we finished processing an "error" sequence */
 776             istate = isError;
 777
 778             break;
 779
 780         default:
 781             printf("%s: internal bug: invalid state reached: %d", script_name, istate);
 782
 783             istate = isError;
 784         }
 785     }
 786
 787     fclose(fp);
 788 #if _SQUID_WINDOWS_
 789
 790     remove(tmpfile);
 791     xfree(tmpfile);
 792     close(s);
 793
 794 #endif
 795
 796     return 0;
 797 }
 798
 799 static int
 800 process_request(cachemgr_request * req)
 801 {
 802
 803     char ipbuf[MAX_IPSTRLEN];
 804     struct addrinfo *AI = NULL;
 805     Ip::Address S;
 806     int s;
 807     int l;
 808
 809     static char buf[2 * 1024];
 810
 811     if (req == NULL) {
 812         auth_html(CACHEMGR_HOSTNAME, CACHE_HTTP_PORT, "");
 813         return 1;
 814     }
 815
 816     if (req->hostname == NULL) {
 817         req->hostname = xstrdup(CACHEMGR_HOSTNAME);
 818     }
 819
 820     if (req->port == 0) {
 821         req->port = CACHE_HTTP_PORT;
 822     }
 823
 824     if (req->action == NULL) {
 825         req->action = xstrdup("");
 826     }
 827
 828     if (strcmp(req->action, "authenticate") == 0) {
 829         auth_html(req->hostname, req->port, req->user_name);
 830         return 0;
 831     }
 832
 833     if (!check_target_acl(req->hostname, req->port)) {
 834         snprintf(buf, sizeof(buf), "target %s:%d not allowed in cachemgr.conf\n", req->hostname, req->port);
 835         error_html(buf);
 836         return 1;
 837     }
 838
 839     S = *gethostbyname(req->hostname);
 840
 841     if ( !S.IsAnyAddr() ) {
 842         (void) 0;
 843     } else if ((S = req->hostname))
 844         (void) 0;
 845     else {
 846         snprintf(buf, sizeof(buf), "Unknown host: %s\n", req->hostname);
 847         error_html(buf);
 848         return 1;
 849     }
 850
 851     S.SetPort(req->port);
 852
 853     S.GetAddrInfo(AI);
 854
 855 #if USE_IPV6
 856     if ((s = socket( AI->ai_family, SOCK_STREAM, 0)) < 0) {
 857 #else
 858     if ((s = socket(PF_INET, SOCK_STREAM, 0)) < 0) {
 859 #endif
 860         snprintf(buf, sizeof(buf), "socket: %s\n", xstrerror());
 861         error_html(buf);
 862         S.FreeAddrInfo(AI);
 863         return 1;
 864     }
 865
 866     if (connect(s, AI->ai_addr, AI->ai_addrlen) < 0) {
 867         snprintf(buf, sizeof(buf), "connect %s: %s\n",
 868                  S.ToURL(ipbuf,MAX_IPSTRLEN),
 869                  xstrerror());
 870         error_html(buf);
 871         S.FreeAddrInfo(AI);
 872         close(s);
 873         return 1;
 874     }
 875
 876     S.FreeAddrInfo(AI);
 877
 878     l = snprintf(buf, sizeof(buf),
 879                  "GET cache_object://%s/%s%s%s HTTP/1.0\r\n"
 880                  "User-Agent: cachemgr.cgi/%s\r\n"
 881                  "Accept: */*\r\n"
 882                  "%s"                   /* Authentication info or nothing */
 883                  "\r\n",
 884                  req->hostname,
 885                  req->action,
 886                  req->workers? "?workers=" : (req->processes ? "?processes=" : ""),
 887                  req->workers? req->workers : (req->processes ? req->processes: ""),
 888                  VERSION,
 889                  make_auth_header(req));
 890     if (write(s, buf, l) < 0) {
 891         fprintf(stderr,"ERROR: (%d) writing request: '%s'\n", errno, buf);
 892     } else {
 893         debug("wrote request: '%s'\n", buf);
 894     }
 895     return read_reply(s, req);
 896 }
 897
 898 int
 899 main(int argc, char *argv[])
 900 {
 901     char *s;
 902     cachemgr_request *req;
 903
 904     now = time(NULL);
 905 #if _SQUID_WINDOWS_
 906
 907     Win32SockInit();
 908     atexit(Win32SockCleanup);
 909     _setmode( _fileno( stdin ), _O_BINARY );
 910     _setmode( _fileno( stdout ), _O_BINARY );
 911     _fmode = _O_BINARY;
 912
 913     if ((s = strrchr(argv[0], '\\')))
 914 #else
 915
 916     if ((s = strrchr(argv[0], '/')))
 917 #endif
 918
 919         progname = xstrdup(s + 1);
 920     else
 921         progname = xstrdup(argv[0]);
 922
 923     if ((s = getenv("SCRIPT_NAME")) != NULL)
 924         script_name = xstrdup(s);
 925
 926     char **args = argv;
 927     while (argc > 1 && args[1][0] == '-') {
 928 //        const char *value = "";
 929         char option = args[1][1];
 930         switch (option) {
 931         case 'd':
 932             debug_enabled = 1;
 933             break;
 934         default:
 935 #if 0 // unused for now.
 936             if (strlen(args[1]) > 2) {
 937                 value = args[1] + 2;
 938             } else if (argc > 2) {
 939                 value = args[2];
 940                 ++args;
 941                 --argc;
 942             } else
 943                 value = "";
 944 #endif
 945             break;
 946         }
 947         ++args;
 948         --argc;
 949     }
 950
 951     req = read_request();
 952
 953     return process_request(req);
 954 }
 955
 956 static char *
 957 read_post_request(void)
 958 {
 959     char *s;
 960
 961     if ((s = getenv("REQUEST_METHOD")) == NULL)
 962         return NULL;
 963
 964     if (0 != strcasecmp(s, "POST"))
 965         return NULL;
 966
 967     if ((s = getenv("CONTENT_LENGTH")) == NULL)
 968         return NULL;
 969
 970     if (*s == '-') // negative length content huh?
 971         return NULL;
 972
 973     uint64_t len;
 974
 975     char *endptr = s+ strlen(s);
 976     if ((len = strtoll(s, &endptr, 10)) <= 0)
 977         return NULL;
 978
 979     // limit the input to something reasonable.
 980     // 4KB should be enough for the GET/POST data length, but may be extended.
 981     size_t bufLen = (len < 4096 ? len : 4095);
 982     char *buf = (char *)xmalloc(bufLen + 1);
 983
 984     size_t readLen = fread(buf, 1, bufLen, stdin);
 985     if (readLen == 0) {
 986         xfree(buf);
 987         return NULL;
 988     }
 989     buf[readLen] = '\0';
 990     len -= readLen;
 991
 992     // purge the remainder of the request entity
 993     while (len > 0 && readLen) {
 994         char temp[65535];
 995         readLen = fread(temp, 1, 65535, stdin);
 996         len -= readLen;
 997     }
 998
 999     return buf;
1000 }
1001
1002 static char *
1003 read_get_request(void)
1004 {
1005     char *s;
1006
1007     if ((s = getenv("QUERY_STRING")) == NULL)
1008         return NULL;
1009
1010     return xstrdup(s);
1011 }
1012
1013 static cachemgr_request *
1014 read_request(void)
1015 {
1016     char *buf;
1017
1018     cachemgr_request *req;
1019     char *s;
1020     char *t;
1021     char *q;
1022
1023     if ((buf = read_post_request()) != NULL)
1024         (void) 0;
1025     else if ((buf = read_get_request()) != NULL)
1026         (void) 0;
1027     else
1028         return NULL;
1029
1030 #if _SQUID_WINDOWS_
1031
1032     if (strlen(buf) == 0 || strlen(buf) == 4000)
1033 #else
1034
1035     if (strlen(buf) == 0)
1036 #endif
1037     {
1038         xfree(buf);
1039         return NULL;
1040     }
1041
1042     req = (cachemgr_request *)xcalloc(1, sizeof(cachemgr_request));
1043
1044     for (s = strtok(buf, "&"); s != NULL; s = strtok(NULL, "&")) {
1045         t = xstrdup(s);
1046
1047         if ((q = strchr(t, '=')) == NULL)
1048             continue;
1049
1050         *q = '\0';
1051         ++q;
1052
1053         rfc1738_unescape(t);
1054
1055         rfc1738_unescape(q);
1056
1057         if (0 == strcmp(t, "server") && strlen(q))
1058             req->server = xstrdup(q);
1059         else if (0 == strcmp(t, "host") && strlen(q))
1060             req->hostname = xstrdup(q);
1061         else if (0 == strcmp(t, "port") && strlen(q))
1062             req->port = atoi(q);
1063         else if (0 == strcmp(t, "user_name") && strlen(q))
1064             req->user_name = xstrdup(q);
1065         else if (0 == strcmp(t, "passwd") && strlen(q))
1066             req->passwd = xstrdup(q);
1067         else if (0 == strcmp(t, "auth") && strlen(q))
1068             req->pub_auth = xstrdup(q), decode_pub_auth(req);
1069         else if (0 == strcmp(t, "operation"))
1070             req->action = xstrdup(q);
1071         else if (0 == strcmp(t, "workers") && strlen(q))
1072             req->workers = xstrdup(q);
1073         else if (0 == strcmp(t, "processes") && strlen(q))
1074             req->processes = xstrdup(q);
1075     }
1076
1077     if (req->server && !req->hostname) {
1078         char *p;
1079         req->hostname = strtok(req->server, ":");
1080
1081         if ((p = strtok(NULL, ":")))
1082             req->port = atoi(p);
1083     }
1084
1085     make_pub_auth(req);
1086     debug("cmgr: got req: host: '%s' port: %d uname: '%s' passwd: '%s' auth: '%s' oper: '%s' workers: '%s' processes: '%s'\n",
1087           safe_str(req->hostname), req->port, safe_str(req->user_name), safe_str(req->passwd), safe_str(req->pub_auth), safe_str(req->action), safe_str(req->workers), safe_str(req->processes));
1088     return req;
1089 }
1090
1091 /* Routines to support authentication */
1092
1093 /*
1094  * Encodes auth info into a "public" form.
1095  * Currently no powerful encryption is used.
1096  */
1097 static void
1098 make_pub_auth(cachemgr_request * req)
1099 {
1100     static char buf[1024];
1101     safe_free(req->pub_auth);
1102     debug("cmgr: encoding for pub...\n");
1103
1104     if (!req->passwd || !strlen(req->passwd))
1105         return;
1106
1107     /* host | time | user | passwd */
1108     const int bufLen = snprintf(buf, sizeof(buf), "%s|%d|%s|%s",
1109                                 req->hostname,
1110                                 (int) now,
1111                                 req->user_name ? req->user_name : "",
1112                                 req->passwd);
1113     debug("cmgr: pre-encoded for pub: %s\n", buf);
1114
1115     const int encodedLen = base64_encode_len(bufLen);
1116     req->pub_auth = (char *) xmalloc(encodedLen);
1117     base64_encode_str(req->pub_auth, encodedLen, buf, bufLen);
1118     debug("cmgr: encoded: '%s'\n", req->pub_auth);
1119 }
1120
1121 static void
1122 decode_pub_auth(cachemgr_request * req)
1123 {
1124     char *buf;
1125     const char *host_name;
1126     const char *time_str;
1127     const char *user_name;
1128     const char *passwd;
1129
1130     debug("cmgr: decoding pub: '%s'\n", safe_str(req->pub_auth));
1131     safe_free(req->passwd);
1132
1133     if (!req->pub_auth || strlen(req->pub_auth) < 4 + strlen(safe_str(req->hostname)))
1134         return;
1135
1136     const int decodedLen = base64_decode_len(req->pub_auth);
1137     buf = (char*)xmalloc(decodedLen);
1138     base64_decode(buf, decodedLen, req->pub_auth);
1139
1140     debug("cmgr: length ok\n");
1141
1142     /* parse ( a lot of memory leaks, but that is cachemgr style :) */
1143     if ((host_name = strtok(buf, "|")) == NULL) {
1144         xfree(buf);
1145         return;
1146     }
1147
1148     debug("cmgr: decoded host: '%s'\n", host_name);
1149
1150     if ((time_str = strtok(NULL, "|")) == NULL) {
1151         xfree(buf);
1152         return;
1153     }
1154
1155     debug("cmgr: decoded time: '%s' (now: %d)\n", time_str, (int) now);
1156
1157     if ((user_name = strtok(NULL, "|")) == NULL) {
1158         xfree(buf);
1159         return;
1160     }
1161
1162     debug("cmgr: decoded uname: '%s'\n", user_name);
1163
1164     if ((passwd = strtok(NULL, "|")) == NULL) {
1165         xfree(buf);
1166         return;
1167     }
1168
1169     debug("cmgr: decoded passwd: '%s'\n", passwd);
1170
1171     /* verify freshness and validity */
1172     if (atoi(time_str) + passwd_ttl < now) {
1173         xfree(buf);
1174         return;
1175     }
1176
1177     if (strcasecmp(host_name, req->hostname)) {
1178         xfree(buf);
1179         return;
1180     }
1181
1182     debug("cmgr: verified auth. info.\n");
1183
1184     /* ok, accept */
1185     safe_free(req->user_name);
1186
1187     req->user_name = xstrdup(user_name);
1188
1189     req->passwd = xstrdup(passwd);
1190
1191     xfree(buf);
1192 }
1193
1194 static void
1195 reset_auth(cachemgr_request * req)
1196 {
1197     safe_free(req->passwd);
1198     safe_free(req->pub_auth);
1199 }
1200
1201 static const char *
1202 make_auth_header(const cachemgr_request * req)
1203 {
1204     static char buf[1024];
1205     size_t stringLength = 0;
1206
1207     if (!req->passwd)
1208         return "";
1209
1210     int bufLen = snprintf(buf, sizeof(buf), "%s:%s",
1211                           req->user_name ? req->user_name : "",
1212                           req->passwd);
1213
1214     int encodedLen = base64_encode_len(bufLen);
1215     if (encodedLen <= 0)
1216         return "";
1217
1218     char *str64 = static_cast<char*>(xmalloc(encodedLen));
1219     base64_encode_str(str64, encodedLen, buf, bufLen);
1220
1221     stringLength += snprintf(buf, sizeof(buf), "Authorization: Basic %s\r\n", str64);
1222
1223     assert(stringLength < sizeof(buf));
1224
1225     snprintf(&buf[stringLength], sizeof(buf) - stringLength, "Proxy-Authorization: Basic %s\r\n", str64);
1226
1227     xfree(str64);
1228     return buf;
1229 }
1230
1231 static int
1232 check_target_acl(const char *hostname, int port)
1233 {
1234     char config_line[BUFSIZ];
1235     FILE *fp = NULL;
1236     int ret = 0;
1237     fp = fopen("cachemgr.conf", "r");
1238
1239     if (fp == NULL)
1240         fp = fopen(DEFAULT_CACHEMGR_CONFIG, "r");
1241
1242     if (fp == NULL) {
1243 #ifdef CACHEMGR_HOSTNAME_DEFINED
1244
1245         if (strcmp(hostname, CACHEMGR_HOSTNAME) == 0 && port == CACHE_HTTP_PORT)
1246             return 1;
1247
1248 #else
1249
1250         if (strcmp(hostname, "localhost") == 0)
1251             return 1;
1252
1253         if (strcmp(hostname, getfullhostname()) == 0)
1254             return 1;
1255
1256 #endif
1257
1258         return 0;
1259     }
1260
1261     while (fgets(config_line, BUFSIZ, fp)) {
1262         char *token = NULL;
1263         strtok(config_line, " \r\n\t");
1264
1265         if (config_line[0] == '#')
1266             continue;
1267
1268         if (config_line[0] == '\0')
1269             continue;
1270
1271         if ((token = strtok(config_line, ":")) == NULL)
1272             continue;
1273
1274 #if HAVE_FNMATCH_H
1275
1276         if (fnmatch(token, hostname, 0) != 0)
1277             continue;
1278
1279 #else
1280
1281         if (strcmp(token, hostname) != 0)
1282             continue;
1283
1284 #endif
1285
1286         if ((token = strtok(NULL, ":")) != NULL) {
1287             int i;
1288
1289             if (strcmp(token, "*") == 0)
1290
1291                 ;   /* Wildcard port specification */
1292             else if (strcmp(token, "any") == 0)
1293
1294                 ;   /* Wildcard port specification */
1295             else if (sscanf(token, "%d", &i) != 1)
1296                 continue;
1297
1298             else if (i != port)
1299                 continue;
1300         } else if (port != CACHE_HTTP_PORT)
1301             continue;
1302
1303         ret = 1;
1304
1305         break;
1306     }
1307
1308     fclose(fp);
1309     return ret;
1310 }