tools/cachemgr.cc

   1 /*
   2  * DEBUG: section 0     CGI Cache Manager
   3  * AUTHOR: Duane Wessels
   4  *
   5  * SQUID Web Proxy Cache          http://www.squid-cache.org/
   6  * ----------------------------------------------------------
   7  *
   8  *  Squid is the result of efforts by numerous individuals from
   9  *  the Internet community; see the CONTRIBUTORS file for full
  10  *  details.   Many organizations have provided support for Squid's
  11  *  development; see the SPONSORS file for full details.  Squid is
  12  *  Copyrighted (C) 2001 by the Regents of the University of
  13  *  California; see the COPYRIGHT file for full details.  Squid
  14  *  incorporates software developed and/or copyrighted by other
  15  *  sources; see the CREDITS file for full details.
  16  *
  17  *  This program is free software; you can redistribute it and/or modify
  18  *  it under the terms of the GNU General Public License as published by
  19  *  the Free Software Foundation; either version 2 of the License, or
  20  *  (at your option) any later version.
  21  *
  22  *  This program is distributed in the hope that it will be useful,
  23  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  24  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  25  *  GNU General Public License for more details.
  26  *
  27  *  You should have received a copy of the GNU General Public License
  28  *  along with this program; if not, write to the Free Software
  29  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
  30  *
  31  */
  32
  33 #include "config.h"
  34
  35 #if HAVE_UNISTD_H
  36 #include <unistd.h>
  37 #endif
  38 #if HAVE_STDLIB_H
  39 #include <stdlib.h>
  40 #endif
  41 #if HAVE_STDIO_H
  42 #include <stdio.h>
  43 #endif
  44 #if HAVE_SYS_TYPES_H
  45 #include <sys/types.h>
  46 #endif
  47 #if HAVE_CTYPE_H
  48 #include <ctype.h>
  49 #endif
  50 #if HAVE_ERRNO_H
  51 #include <errno.h>
  52 #endif
  53 #if HAVE_FCNTL_H
  54 #include <fcntl.h>
  55 #endif
  56 #if HAVE_GRP_H
  57 #include <grp.h>
  58 #endif
  59 #if HAVE_GNUMALLOC_H
  60 #include <gnumalloc.h>
  61 #elif HAVE_MALLOC_H
  62 #include <malloc.h>
  63 #endif
  64 #if HAVE_MEMORY_H
  65 #include <memory.h>
  66 #endif
  67 #if HAVE_NETDB_H && !defined(_SQUID_NETDB_H_)   /* protect NEXTSTEP */
  68 #define _SQUID_NETDB_H_
  69 #include <netdb.h>
  70 #endif
  71 #if HAVE_PWD_H
  72 #include <pwd.h>
  73 #endif
  74 #if HAVE_SIGNAL_H
  75 #include <signal.h>
  76 #endif
  77 #if HAVE_TIME_H
  78 #include <time.h>
  79 #endif
  80 #if HAVE_SYS_PARAM_H
  81 #include <sys/param.h>
  82 #endif
  83 #if HAVE_SYS_TIME_H
  84 #include <sys/time.h>
  85 #endif
  86 #if HAVE_SYS_RESOURCE_H
  87 #include <sys/resource.h>       /* needs sys/time.h above it */
  88 #endif
  89 #if HAVE_SYS_SOCKET_H
  90 #include <sys/socket.h>
  91 #endif
  92 #if HAVE_NETINET_IN_H
  93 #include <netinet/in.h>
  94 #endif
  95 #if HAVE_ARPA_INET_H
  96 #include <arpa/inet.h>
  97 #endif
  98 #if HAVE_SYS_STAT_H
  99 #include <sys/stat.h>
 100 #endif
 101 #if HAVE_SYS_UN_H
 102 #include <sys/un.h>
 103 #endif
 104 #if HAVE_SYS_WAIT_H
 105 #include <sys/wait.h>
 106 #endif
 107 #if HAVE_LIBC_H
 108 #include <libc.h>
 109 #endif
 110 #if HAVE_STRING_H
 111 #include <string.h>
 112 #endif
 113 #if HAVE_STRINGS_H
 114 #include <strings.h>
 115 #endif
 116 #if HAVE_BSTRING_H
 117 #include <bstring.h>
 118 #endif
 119 #if HAVE_CRYPT_H
 120 #include <crypt.h>
 121 #endif
 122 #if HAVE_SYS_SELECT_H
 123 #include <sys/select.h>
 124 #endif
 125 #if HAVE_FNMATCH_H
 126 extern "C"
 127 {
 128 #include <fnmatch.h>
 129 }
 130 #endif
 131
 132 #include "util.h"
 133 #include "ip/IpAddress.h"
 134 #include "getfullhostname.h"
 135
 136 #ifndef DEFAULT_CACHEMGR_CONFIG
 137 #define DEFAULT_CACHEMGR_CONFIG "/etc/squid/cachemgr.conf"
 138 #endif
 139
 140 typedef struct {
 141     char *server;
 142     char *hostname;
 143     int port;
 144     char *action;
 145     char *user_name;
 146     char *passwd;
 147     char *pub_auth;
 148 } cachemgr_request;
 149
 150 /*
 151  * Debugging macros (info goes to error_log on your web server)
 152  * Note: do not run cache manager with non zero debugging level
 153  *       if you do not debug, it may write a lot of [sensitive]
 154  *       information to your error log.
 155  */
 156
 157 /* debugging level 0 (disabled) - 3 (max) */
 158 #define DEBUG_LEVEL 0
 159 #define debug(level) if ((level) <= DEBUG_LEVEL && DEBUG_LEVEL > 0)
 160
 161 /*
 162  * Static variables and constants
 163  */
 164 static const time_t passwd_ttl = 60 * 60 * 3;   /* in sec */
 165 static const char *script_name = "/cgi-bin/cachemgr.cgi";
 166 static const char *progname = NULL;
 167 static time_t now;
 168
 169 /*
 170  * Function prototypes
 171  */
 172 #define safe_free(str) { if (str) { xfree(str); (str) = NULL; } }
 173 static const char *safe_str(const char *str);
 174 static const char *xstrtok(char **str, char del);
 175 static void print_trailer(void);
 176 static void auth_html(const char *host, int port, const char *user_name);
 177 static void error_html(const char *msg);
 178 static char *menu_url(cachemgr_request * req, const char *action);
 179 static int parse_status_line(const char *sline, const char **statusStr);
 180 static cachemgr_request *read_request(void);
 181 static char *read_get_request(void);
 182 static char *read_post_request(void);
 183
 184 static void make_pub_auth(cachemgr_request * req);
 185 static void decode_pub_auth(cachemgr_request * req);
 186 static void reset_auth(cachemgr_request * req);
 187 static const char *make_auth_header(const cachemgr_request * req);
 188
 189 static int check_target_acl(const char *hostname, int port);
 190
 191 #ifdef _SQUID_MSWIN_
 192 static int s_iInitCount = 0;
 193
 194 int Win32SockInit(void)
 195 {
 196     int iVersionRequested;
 197     WSADATA wsaData;
 198     int err;
 199
 200     if (s_iInitCount > 0) {
 201         s_iInitCount++;
 202         return (0);
 203     } else if (s_iInitCount < 0)
 204         return (s_iInitCount);
 205
 206     /* s_iInitCount == 0. Do the initailization */
 207     iVersionRequested = MAKEWORD(2, 0);
 208
 209     err = WSAStartup((WORD) iVersionRequested, &wsaData);
 210
 211     if (err) {
 212         s_iInitCount = -1;
 213         return (s_iInitCount);
 214     }
 215
 216     if (LOBYTE(wsaData.wVersion) != 2 ||
 217             HIBYTE(wsaData.wVersion) != 0) {
 218         s_iInitCount = -2;
 219         WSACleanup();
 220         return (s_iInitCount);
 221     }
 222
 223     s_iInitCount++;
 224     return (s_iInitCount);
 225 }
 226
 227 void Win32SockCleanup(void)
 228 {
 229     if (--s_iInitCount == 0)
 230         WSACleanup();
 231
 232     return;
 233 }
 234
 235 #endif /* ifdef _SQUID_MSWIN_ */
 236
 237 static const char *
 238 safe_str(const char *str)
 239 {
 240     return str ? str : "";
 241 }
 242
 243 /* relaxed number format */
 244 static int
 245 is_number(const char *str)
 246 {
 247     return strspn(str, "\t -+01234567890./\n") == strlen(str);
 248 }
 249
 250 static const char *
 251 xstrtok(char **str, char del)
 252 {
 253     if (*str) {
 254         char *p = strchr(*str, del);
 255         char *tok = *str;
 256         int len;
 257
 258         if (p) {
 259             *str = p + 1;
 260             *p = '\0';
 261         } else
 262             *str = NULL;
 263
 264         /* trim */
 265         len = strlen(tok);
 266
 267         while (len && xisspace(tok[len - 1]))
 268             tok[--len] = '\0';
 269
 270         while (xisspace(*tok))
 271             tok++;
 272
 273         return tok;
 274     } else
 275         return "";
 276 }
 277
 278 static void
 279 print_trailer(void)
 280 {
 281     printf("<HR noshade size=\"1px\">\n");
 282     printf("<ADDRESS>\n");
 283     printf("Generated %s, by %s/%s@%s\n",
 284            mkrfc1123(now), progname, VERSION, getfullhostname());
 285     printf("</ADDRESS></BODY></HTML>\n");
 286 }
 287
 288 static void
 289 auth_html(const char *host, int port, const char *user_name)
 290 {
 291     FILE *fp;
 292     int need_host = 1;
 293
 294     if (!user_name)
 295         user_name = "";
 296
 297     if (!host || !strlen(host))
 298         host = "";
 299
 300     printf("Content-Type: text/html\r\n\r\n");
 301
 302     printf("<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01 Transitional//EN\" \"http://www.w3.org/TR/html4/loose.dtd\">\n");
 303
 304     printf("<HTML><HEAD><TITLE>Cache Manager Interface</TITLE>\n");
 305
 306     printf("<STYLE type=\"text/css\"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}--></STYLE></HEAD>\n");
 307
 308     printf("<BODY><H1>Cache Manager Interface</H1>\n");
 309
 310     printf("<P>This is a WWW interface to the instrumentation interface\n");
 311
 312     printf("for the Squid object cache.</P>\n");
 313
 314     printf("<HR noshade size=\"1px\">\n");
 315
 316     printf("<FORM METHOD=\"POST\" ACTION=\"%s\">\n", script_name);
 317
 318     printf("<TABLE BORDER=\"0\" CELLPADDING=\"10\" CELLSPACING=\"1\">\n");
 319
 320
 321     fp = fopen("cachemgr.conf", "r");
 322
 323     if (fp == NULL)
 324         fp = fopen(DEFAULT_CACHEMGR_CONFIG, "r");
 325
 326     if (fp != NULL) {
 327         int servers = 0;
 328         char config_line[BUFSIZ];
 329
 330         while (fgets(config_line, BUFSIZ, fp)) {
 331             char *server, *comment;
 332             strtok(config_line, "\r\n");
 333
 334             if (config_line[0] == '#')
 335                 continue;
 336
 337             if (config_line[0] == '\0')
 338                 continue;
 339
 340             if ((server = strtok(config_line, " \t")) == NULL)
 341                 continue;
 342
 343             if (strchr(server, '*') || strchr(server, '[') || strchr(server, '?')) {
 344                 need_host = -1;
 345                 continue;
 346             }
 347
 348             comment = strtok(NULL, "");
 349
 350             if (comment)
 351                 while (*comment == ' ' || *comment == '\t')
 352                     comment++;
 353
 354             if (!comment || !*comment)
 355                 comment = server;
 356
 357             if (!servers) {
 358                 printf("<TR><TH ALIGN=\"left\">Cache Server:</TH><TD><SELECT NAME=\"server\">\n");
 359             }
 360
 361             printf("<OPTION VALUE=\"%s\"%s>%s</OPTION>\n", server, (servers || *host) ? "" : " SELECTED", comment);
 362             servers++;
 363         }
 364
 365         if (servers) {
 366             if (need_host == 1 && !*host)
 367                 need_host = 0;
 368
 369             if (need_host)
 370                 printf("<OPTION VALUE=\"\"%s>Other</OPTION>\n", (*host) ? " SELECTED" : "");
 371
 372             printf("</SELECT></TR>\n");
 373         }
 374
 375         fclose(fp);
 376     }
 377
 378     if (need_host) {
 379         if (need_host == 1 && !*host)
 380             host = "localhost";
 381
 382         printf("<TR><TH ALIGN=\"left\">Cache Host:</TH><TD><INPUT NAME=\"host\" ");
 383
 384         printf("size=\"30\" VALUE=\"%s\"></TD></TR>\n", host);
 385
 386         printf("<TR><TH ALIGN=\"left\">Cache Port:</TH><TD><INPUT NAME=\"port\" ");
 387
 388         printf("size=\"30\" VALUE=\"%d\"></TD></TR>\n", port);
 389     }
 390
 391     printf("<TR><TH ALIGN=\"left\">Manager name:</TH><TD><INPUT NAME=\"user_name\" ");
 392
 393     printf("size=\"30\" VALUE=\"%s\"></TD></TR>\n", user_name);
 394
 395     printf("<TR><TH ALIGN=\"left\">Password:</TH><TD><INPUT TYPE=\"password\" NAME=\"passwd\" ");
 396
 397     printf("size=\"30\" VALUE=\"\"></TD></TR>\n");
 398
 399     printf("</TABLE><BR CLEAR=\"all\">\n");
 400
 401     printf("<INPUT TYPE=\"submit\" VALUE=\"Continue...\">\n");
 402
 403     printf("</FORM>\n");
 404
 405     print_trailer();
 406 }
 407
 408 static void
 409 error_html(const char *msg)
 410 {
 411     printf("Content-Type: text/html\r\n\r\n");
 412     printf("<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01 Transitional//EN\" \"http://www.w3.org/TR/html4/loose.dtd\">\n");
 413     printf("<HTML><HEAD><TITLE>Cache Manager Error</TITLE>\n");
 414     printf("<STYLE type=\"text/css\"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}--></STYLE></HEAD>\n");
 415     printf("<BODY><H1>Cache Manager Error</H1>\n");
 416     printf("<P>\n%s</P>\n", html_quote(msg));
 417     print_trailer();
 418 }
 419
 420 /* returns http status extracted from status line or -1 on parsing failure */
 421 static int
 422 parse_status_line(const char *sline, const char **statusStr)
 423 {
 424     const char *sp = strchr(sline, ' ');
 425
 426     if (statusStr)
 427         *statusStr = NULL;
 428
 429     if (strncasecmp(sline, "HTTP/", 5) || !sp)
 430         return -1;
 431
 432     while (xisspace(*++sp));
 433     if (!xisdigit(*sp))
 434         return -1;
 435
 436     if (statusStr)
 437         *statusStr = sp;
 438
 439     return atoi(sp);
 440 }
 441
 442 static char *
 443 menu_url(cachemgr_request * req, const char *action)
 444 {
 445     static char url[1024];
 446     snprintf(url, sizeof(url), "%s?host=%s&port=%d&user_name=%s&operation=%s&auth=%s",
 447              script_name,
 448              req->hostname,
 449              req->port,
 450              safe_str(req->user_name),
 451              action,
 452              safe_str(req->pub_auth));
 453     return url;
 454 }
 455
 456 static const char *
 457 munge_menu_line(const char *buf, cachemgr_request * req)
 458 {
 459     char *x;
 460     const char *a;
 461     const char *d;
 462     const char *p;
 463     char *a_url;
 464     char *buf_copy;
 465     static char html[2 * 1024];
 466
 467     if (strlen(buf) < 1)
 468         return buf;
 469
 470     if (*buf != ' ')
 471         return buf;
 472
 473     buf_copy = x = xstrdup(buf);
 474
 475     a = xstrtok(&x, '\t');
 476
 477     d = xstrtok(&x, '\t');
 478
 479     p = xstrtok(&x, '\t');
 480
 481     a_url = xstrdup(menu_url(req, a));
 482
 483     /* no reason to give a url for a disabled action */
 484     if (!strcmp(p, "disabled"))
 485         snprintf(html, sizeof(html), "<LI type=\"circle\">%s (disabled)<A HREF=\"%s\">.</A>\n", d, a_url);
 486     else
 487         /* disable a hidden action (requires a password, but password is not in squid.conf) */
 488         if (!strcmp(p, "hidden"))
 489             snprintf(html, sizeof(html), "<LI type=\"circle\">%s (hidden)<A HREF=\"%s\">.</A>\n", d, a_url);
 490         else
 491             /* disable link if authentication is required and we have no password */
 492             if (!strcmp(p, "protected") && !req->passwd)
 493                 snprintf(html, sizeof(html), "<LI type=\"circle\">%s (requires <a href=\"%s\">authentication</a>)<A HREF=\"%s\">.</A>\n",
 494                          d, menu_url(req, "authenticate"), a_url);
 495             else
 496                 /* highlight protected but probably available entries */
 497                 if (!strcmp(p, "protected"))
 498                     snprintf(html, sizeof(html), "<LI type=\"square\"><A HREF=\"%s\"><font color=\"#FF0000\">%s</font></A>\n",
 499                              a_url, d);
 500
 501     /* public entry or unknown type of protection */
 502                 else
 503                     snprintf(html, sizeof(html), "<LI type=\"disk\"><A HREF=\"%s\">%s</A>\n", a_url, d);
 504
 505     xfree(a_url);
 506
 507     xfree(buf_copy);
 508
 509     return html;
 510 }
 511
 512 static const char *
 513 munge_other_line(const char *buf, cachemgr_request * req)
 514 {
 515     static const char *ttags[] = {"td", "th"};
 516
 517     static char html[4096];
 518     static int table_line_num = 0;
 519     static int next_is_header = 0;
 520     int is_header = 0;
 521     const char *ttag;
 522     char *buf_copy;
 523     char *x, *p;
 524     int l = 0;
 525     /* does it look like a table? */
 526
 527     if (!strchr(buf, '\t') || *buf == '\t') {
 528         /* nope, just text */
 529         snprintf(html, sizeof(html), "%s%s",
 530                  table_line_num ? "</table>\n<pre>" : "", html_quote(buf));
 531         table_line_num = 0;
 532         return html;
 533     }
 534
 535     /* start html table */
 536     if (!table_line_num) {
 537         l += snprintf(html + l, sizeof(html) - l, "</pre><table cellpadding=\"2\" cellspacing=\"1\">\n");
 538         next_is_header = 0;
 539     }
 540
 541     /* remove '\n' */
 542     is_header = (!table_line_num || next_is_header) && !strchr(buf, ':') && !is_number(buf);
 543
 544     ttag = ttags[is_header];
 545
 546     /* record starts */
 547     l += snprintf(html + l, sizeof(html) - l, "<tr>");
 548
 549     /* substitute '\t' */
 550     buf_copy = x = xstrdup(buf);
 551
 552     if ((p = strchr(x, '\n')))
 553         *p = '\0';
 554
 555     while (x && strlen(x)) {
 556         int column_span = 1;
 557         const char *cell = xstrtok(&x, '\t');
 558
 559         while (x && *x == '\t') {
 560             column_span++;
 561             x++;
 562         }
 563
 564         l += snprintf(html + l, sizeof(html) - l, "<%s colspan=\"%d\" align=\"%s\">%s</%s>",
 565                       ttag, column_span,
 566                       is_header ? "center" : is_number(cell) ? "right" : "left",
 567                       html_quote(cell), ttag);
 568     }
 569
 570     xfree(buf_copy);
 571     /* record ends */
 572     l += snprintf(html + l, sizeof(html) - l, "</tr>\n");
 573     next_is_header = is_header && strstr(buf, "\t\t");
 574     table_line_num++;
 575     return html;
 576 }
 577
 578 static const char *
 579 munge_action_line(const char *_buf, cachemgr_request * req)
 580 {
 581     static char html[2 * 1024];
 582     char *buf = xstrdup(_buf);
 583     char *x = buf;
 584     const char *action, *description;
 585     char *p;
 586
 587     if ((p = strchr(x, '\n')))
 588         *p = '\0';
 589     action = xstrtok(&x, '\t');
 590     description = xstrtok(&x, '\t');
 591     if (!description)
 592         description = action;
 593     if (!action)
 594         return "";
 595     snprintf(html, sizeof(html), " <a href=\"%s\">%s</a>", menu_url(req, action), description);
 596     return html;
 597 }
 598
 599 static int
 600 read_reply(int s, cachemgr_request * req)
 601 {
 602     char buf[4 * 1024];
 603 #ifdef _SQUID_MSWIN_
 604
 605     int reply;
 606     char *tmpfile = tempnam(NULL, "tmp0000");
 607     FILE *fp = fopen(tmpfile, "w+");
 608 #else
 609
 610     FILE *fp = fdopen(s, "r");
 611 #endif
 612     /* interpretation states */
 613     enum {
 614         isStatusLine, isHeaders, isActions, isBodyStart, isBody, isForward, isEof, isForwardEof, isSuccess, isError
 615     } istate = isStatusLine;
 616     int parse_menu = 0;
 617     const char *action = req->action;
 618     const char *statusStr = NULL;
 619     int status = -1;
 620
 621     if (0 == strlen(req->action))
 622         parse_menu = 1;
 623     else if (0 == strcasecmp(req->action, "menu"))
 624         parse_menu = 1;
 625
 626     if (fp == NULL) {
 627 #ifdef _SQUID_MSWIN_
 628         perror(tmpfile);
 629         xfree(tmpfile);
 630 #else
 631
 632         perror("fdopen");
 633 #endif
 634
 635         close(s);
 636         return 1;
 637     }
 638
 639 #ifdef _SQUID_MSWIN_
 640
 641     while ((reply=recv(s, buf , sizeof(buf), 0)) > 0)
 642         fwrite(buf, 1, reply, fp);
 643
 644     rewind(fp);
 645
 646 #endif
 647
 648     if (parse_menu)
 649         action = "menu";
 650
 651     /* read reply interpreting one line at a time depending on state */
 652     while (istate < isEof) {
 653         if (!fgets(buf, sizeof(buf), fp))
 654             istate = istate == isForward ? isForwardEof : isEof;
 655
 656         switch (istate) {
 657
 658         case isStatusLine:
 659             /* get HTTP status */
 660             /* uncomment the following if you want to debug headers */
 661             /* fputs("\r\n\r\n", stdout); */
 662             status = parse_status_line(buf, &statusStr);
 663             istate = status == 200 ? isHeaders : isForward;
 664             /* if cache asks for authentication, we have to reset our info */
 665
 666             if (status == 401 || status == 407) {
 667                 reset_auth(req);
 668                 status = 403;   /* Forbiden, see comments in case isForward: */
 669             }
 670
 671             /* this is a way to pass HTTP status to the Web server */
 672             if (statusStr)
 673                 printf("Status: %d %s", status, statusStr);     /* statusStr has '\n' */
 674
 675             break;
 676
 677         case isHeaders:
 678             /* forward header field */
 679             if (!strcmp(buf, "\r\n")) {         /* end of headers */
 680                 fputs("Content-Type: text/html\r\n", stdout);   /* add our type */
 681                 istate = isBodyStart;
 682             }
 683
 684             if (strncasecmp(buf, "Content-Type:", 13))  /* filter out their type */
 685                 fputs(buf, stdout);
 686
 687             break;
 688
 689         case isBodyStart:
 690             printf("<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01 Transitional//EN\" \"http://www.w3.org/TR/html4/loose.dtd\">\n");
 691
 692             printf("<HTML><HEAD><TITLE>CacheMgr@%s: %s</TITLE>\n",
 693                    req->hostname, action);
 694
 695             printf("<STYLE type=\"text/css\"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}TABLE{background-color:#333333;border:0pt;padding:0pt}TH,TD{background-color:#ffffff;white-space:nowrap}--></STYLE>\n");
 696
 697             printf("</HEAD><BODY>\n");
 698
 699             if (parse_menu) {
 700                 printf("<H2><a href=\"%s\">Cache Manager</a> menu for %s:</H2>",
 701                        menu_url(req, "authenticate"), req->hostname);
 702                 printf("<UL>\n");
 703             } else {
 704                 printf("<P><A HREF=\"%s\">%s</A>\n<HR noshade size=\"1px\">\n",
 705                        menu_url(req, "menu"), "Cache Manager menu");
 706                 printf("<PRE>\n");
 707             }
 708
 709             istate = isActions;
 710             /* yes, fall through, we do not want to loose the first line */
 711
 712         case isActions:
 713             if (strncmp(buf, "action:", 7) == 0) {
 714                 fputs(" ", stdout);
 715                 fputs(munge_action_line(buf + 7, req), stdout);
 716                 break;
 717             }
 718             if (parse_menu) {
 719                 printf("<UL>\n");
 720             } else {
 721                 printf("<HR noshade size=\"1px\">\n");
 722                 printf("<PRE>\n");
 723             }
 724
 725             istate = isBody;
 726             /* yes, fall through, we do not want to loose the first line */
 727
 728         case isBody:
 729             /* interpret [and reformat] cache response */
 730
 731             if (parse_menu)
 732                 fputs(munge_menu_line(buf, req), stdout);
 733             else
 734                 fputs(munge_other_line(buf, req), stdout);
 735
 736             break;
 737
 738         case isForward:
 739             /* forward: no modifications allowed */
 740             /*
 741              * Note: we currently do not know any way to get browser.reply to
 742              * 401 to .cgi because web server filters out all auth info. Thus we
 743              * disable authentication headers for now.
 744              */
 745             if (!strncasecmp(buf, "WWW-Authenticate:", 17) || !strncasecmp(buf, "Proxy-Authenticate:", 19));    /* skip */
 746             else
 747                 fputs(buf, stdout);
 748
 749             break;
 750
 751         case isEof:
 752             /* print trailers */
 753             if (parse_menu)
 754                 printf("</UL>\n");
 755             else
 756                 printf("</table></PRE>\n");
 757
 758             print_trailer();
 759
 760             istate = isSuccess;
 761
 762             break;
 763
 764         case isForwardEof:
 765             /* indicate that we finished processing an "error" sequence */
 766             istate = isError;
 767
 768             break;
 769
 770         default:
 771             printf("%s: internal bug: invalid state reached: %d", script_name, istate);
 772
 773             istate = isError;
 774         }
 775     }
 776
 777     fclose(fp);
 778 #ifdef _SQUID_MSWIN_
 779
 780     remove(tmpfile);
 781     xfree(tmpfile);
 782     close(s);
 783
 784 #endif
 785
 786     return 0;
 787 }
 788
 789 static int
 790 process_request(cachemgr_request * req)
 791 {
 792
 793     char ipbuf[MAX_IPSTRLEN];
 794     struct addrinfo *AI = NULL;
 795     IpAddress S;
 796     int s;
 797     int l;
 798
 799     static char buf[2 * 1024];
 800
 801     if (req == NULL) {
 802         auth_html(CACHEMGR_HOSTNAME, CACHE_HTTP_PORT, "");
 803         return 1;
 804     }
 805
 806     if (req->hostname == NULL) {
 807         req->hostname = xstrdup(CACHEMGR_HOSTNAME);
 808     }
 809
 810     if (req->port == 0) {
 811         req->port = CACHE_HTTP_PORT;
 812     }
 813
 814     if (req->action == NULL) {
 815         req->action = xstrdup("");
 816     }
 817
 818     if (strcmp(req->action, "authenticate") == 0) {
 819         auth_html(req->hostname, req->port, req->user_name);
 820         return 0;
 821     }
 822
 823     if (!check_target_acl(req->hostname, req->port)) {
 824         snprintf(buf, 1024, "target %s:%d not allowed in cachemgr.conf\n", req->hostname, req->port);
 825         error_html(buf);
 826         return 1;
 827     }
 828
 829     S = *gethostbyname(req->hostname);
 830
 831     if ( !S.IsAnyAddr() ) {
 832         (void) 0;
 833     } else if ( S = req->hostname)
 834         (void) 0;
 835     else {
 836         snprintf(buf, 1024, "Unknown host: %s\n", req->hostname);
 837         error_html(buf);
 838         return 1;
 839     }
 840
 841     S.SetPort(req->port);
 842
 843     S.GetAddrInfo(AI);
 844
 845 #if USE_IPV6
 846     if ((s = socket( AI->ai_family, SOCK_STREAM, 0)) < 0) {
 847 #else
 848     if ((s = socket(PF_INET, SOCK_STREAM, 0)) < 0) {
 849 #endif
 850         snprintf(buf, 1024, "socket: %s\n", xstrerror());
 851         error_html(buf);
 852         return 1;
 853     }
 854
 855     if (connect(s, AI->ai_addr, AI->ai_addrlen) < 0) {
 856         snprintf(buf, 1024, "connect %s: %s\n",
 857                  S.ToURL(ipbuf,MAX_IPSTRLEN),
 858                  xstrerror());
 859         error_html(buf);
 860         S.FreeAddrInfo(AI);
 861         return 1;
 862     }
 863
 864     S.FreeAddrInfo(AI);
 865
 866     l = snprintf(buf, sizeof(buf),
 867                  "GET cache_object://%s/%s HTTP/1.0\r\n"
 868                  "Accept: */*\r\n"
 869                  "%s"                   /* Authentication info or nothing */
 870                  "\r\n",
 871                  req->hostname,
 872                  req->action,
 873                  make_auth_header(req));
 874     write(s, buf, l);
 875     debug(1) fprintf(stderr, "wrote request: '%s'\n", buf);
 876     return read_reply(s, req);
 877 }
 878
 879 int
 880 main(int argc, char *argv[]) {
 881     char *s;
 882     cachemgr_request *req;
 883
 884     now = time(NULL);
 885 #ifdef _SQUID_MSWIN_
 886
 887     Win32SockInit();
 888     atexit(Win32SockCleanup);
 889     _setmode( _fileno( stdin ), _O_BINARY );
 890     _setmode( _fileno( stdout ), _O_BINARY );
 891     _fmode = _O_BINARY;
 892
 893     if ((s = strrchr(argv[0], '\\')))
 894 #else
 895
 896     if ((s = strrchr(argv[0], '/')))
 897 #endif
 898
 899         progname = xstrdup(s + 1);
 900     else
 901         progname = xstrdup(argv[0]);
 902
 903     if ((s = getenv("SCRIPT_NAME")) != NULL)
 904         script_name = xstrdup(s);
 905
 906     req = read_request();
 907
 908     return process_request(req);
 909 }
 910
 911 static char *
 912 read_post_request(void) {
 913     char *s;
 914     char *buf;
 915     int len;
 916
 917     if ((s = getenv("REQUEST_METHOD")) == NULL)
 918         return NULL;
 919
 920     if (0 != strcasecmp(s, "POST"))
 921         return NULL;
 922
 923     if ((s = getenv("CONTENT_LENGTH")) == NULL)
 924         return NULL;
 925
 926     if ((len = atoi(s)) <= 0)
 927         return NULL;
 928
 929     buf = (char *)xmalloc(len + 1);
 930
 931     fread(buf, len, 1, stdin);
 932
 933     buf[len] = '\0';
 934
 935     return buf;
 936 }
 937
 938 static char *
 939 read_get_request(void) {
 940     char *s;
 941
 942     if ((s = getenv("QUERY_STRING")) == NULL)
 943         return NULL;
 944
 945     return xstrdup(s);
 946 }
 947
 948 static cachemgr_request *
 949 read_request(void) {
 950     char *buf;
 951
 952     cachemgr_request *req;
 953     char *s;
 954     char *t;
 955     char *q;
 956
 957     if ((buf = read_post_request()) != NULL)
 958         (void) 0;
 959     else if ((buf = read_get_request()) != NULL)
 960         (void) 0;
 961     else
 962         return NULL;
 963
 964 #ifdef _SQUID_MSWIN_
 965
 966     if (strlen(buf) == 0 || strlen(buf) == 4000)
 967 #else
 968
 969     if (strlen(buf) == 0)
 970 #endif
 971     {
 972         free(buf);
 973         return NULL;
 974     }
 975
 976     req = (cachemgr_request *)xcalloc(1, sizeof(cachemgr_request));
 977
 978     for (s = strtok(buf, "&"); s != NULL; s = strtok(NULL, "&")) {
 979         t = xstrdup(s);
 980
 981         if ((q = strchr(t, '=')) == NULL)
 982             continue;
 983
 984         *q++ = '\0';
 985
 986         rfc1738_unescape(t);
 987
 988         rfc1738_unescape(q);
 989
 990         if (0 == strcasecmp(t, "server") && strlen(q))
 991             req->server = xstrdup(q);
 992         else if (0 == strcasecmp(t, "host") && strlen(q))
 993             req->hostname = xstrdup(q);
 994         else if (0 == strcasecmp(t, "port") && strlen(q))
 995             req->port = atoi(q);
 996         else if (0 == strcasecmp(t, "user_name") && strlen(q))
 997             req->user_name = xstrdup(q);
 998         else if (0 == strcasecmp(t, "passwd") && strlen(q))
 999             req->passwd = xstrdup(q);
1000         else if (0 == strcasecmp(t, "auth") && strlen(q))
1001             req->pub_auth = xstrdup(q), decode_pub_auth(req);
1002         else if (0 == strcasecmp(t, "operation"))
1003             req->action = xstrdup(q);
1004     }
1005
1006     if (req->server && !req->hostname) {
1007         char *p;
1008         req->hostname = strtok(req->server, ":");
1009
1010         if ((p = strtok(NULL, ":")))
1011             req->port = atoi(p);
1012     }
1013
1014     make_pub_auth(req);
1015     debug(1) fprintf(stderr, "cmgr: got req: host: '%s' port: %d uname: '%s' passwd: '%s' auth: '%s' oper: '%s'\n",
1016                      safe_str(req->hostname), req->port, safe_str(req->user_name), safe_str(req->passwd), safe_str(req->pub_auth), safe_str(req->action));
1017     return req;
1018 }
1019
1020
1021 /* Routines to support authentication */
1022
1023 /*
1024  * Encodes auth info into a "public" form.
1025  * Currently no powerful encryption is used.
1026  */
1027 static void
1028 make_pub_auth(cachemgr_request * req) {
1029     static char buf[1024];
1030     safe_free(req->pub_auth);
1031     debug(3) fprintf(stderr, "cmgr: encoding for pub...\n");
1032
1033     if (!req->passwd || !strlen(req->passwd))
1034         return;
1035
1036     /* host | time | user | passwd */
1037     snprintf(buf, sizeof(buf), "%s|%d|%s|%s",
1038              req->hostname,
1039              (int) now,
1040              req->user_name ? req->user_name : "",
1041              req->passwd);
1042
1043     debug(3) fprintf(stderr, "cmgr: pre-encoded for pub: %s\n", buf);
1044
1045     debug(3) fprintf(stderr, "cmgr: encoded: '%s'\n", base64_encode(buf));
1046
1047     req->pub_auth = xstrdup(base64_encode(buf));
1048 }
1049
1050 static void
1051 decode_pub_auth(cachemgr_request * req) {
1052     char *buf;
1053     const char *host_name;
1054     const char *time_str;
1055     const char *user_name;
1056     const char *passwd;
1057
1058     debug(2) fprintf(stderr, "cmgr: decoding pub: '%s'\n", safe_str(req->pub_auth));
1059     safe_free(req->passwd);
1060
1061     if (!req->pub_auth || strlen(req->pub_auth) < 4 + strlen(safe_str(req->hostname)))
1062         return;
1063
1064     buf = xstrdup(base64_decode(req->pub_auth));
1065
1066     debug(3) fprintf(stderr, "cmgr: length ok\n");
1067
1068     /* parse ( a lot of memory leaks, but that is cachemgr style :) */
1069     if ((host_name = strtok(buf, "|")) == NULL)
1070         return;
1071
1072     debug(3) fprintf(stderr, "cmgr: decoded host: '%s'\n", host_name);
1073
1074     if ((time_str = strtok(NULL, "|")) == NULL)
1075         return;
1076
1077     debug(3) fprintf(stderr, "cmgr: decoded time: '%s' (now: %d)\n", time_str, (int) now);
1078
1079     if ((user_name = strtok(NULL, "|")) == NULL)
1080         return;
1081
1082     debug(3) fprintf(stderr, "cmgr: decoded uname: '%s'\n", user_name);
1083
1084     if ((passwd = strtok(NULL, "|")) == NULL)
1085         return;
1086
1087     debug(2) fprintf(stderr, "cmgr: decoded passwd: '%s'\n", passwd);
1088
1089     /* verify freshness and validity */
1090     if (atoi(time_str) + passwd_ttl < now)
1091         return;
1092
1093     if (strcasecmp(host_name, req->hostname))
1094         return;
1095
1096     debug(1) fprintf(stderr, "cmgr: verified auth. info.\n");
1097
1098     /* ok, accept */
1099     xfree(req->user_name);
1100
1101     req->user_name = xstrdup(user_name);
1102
1103     req->passwd = xstrdup(passwd);
1104
1105     xfree(buf);
1106 }
1107
1108 static void
1109 reset_auth(cachemgr_request * req) {
1110     safe_free(req->passwd);
1111     safe_free(req->pub_auth);
1112 }
1113
1114 static const char *
1115 make_auth_header(const cachemgr_request * req) {
1116     static char buf[1024];
1117     size_t stringLength = 0;
1118     const char *str64;
1119
1120     if (!req->passwd)
1121         return "";
1122
1123     snprintf(buf, sizeof(buf), "%s:%s",
1124              req->user_name ? req->user_name : "",
1125              req->passwd);
1126
1127     str64 = base64_encode(buf);
1128
1129     stringLength += snprintf(buf, sizeof(buf), "Authorization: Basic %s\r\n", str64);
1130
1131     assert(stringLength < sizeof(buf));
1132
1133     stringLength += snprintf(&buf[stringLength], sizeof(buf) - stringLength,
1134                              "Proxy-Authorization: Basic %s\r\n", str64);
1135
1136     return buf;
1137 }
1138
1139 static int
1140 check_target_acl(const char *hostname, int port) {
1141     char config_line[BUFSIZ];
1142     FILE *fp = NULL;
1143     int ret = 0;
1144     fp = fopen("cachemgr.conf", "r");
1145
1146     if (fp == NULL)
1147         fp = fopen(DEFAULT_CACHEMGR_CONFIG, "r");
1148
1149     if (fp == NULL) {
1150 #ifdef CACHEMGR_HOSTNAME_DEFINED
1151
1152         if (strcmp(hostname, CACHEMGR_HOSTNAME) == 0 && port == CACHE_HTTP_PORT)
1153             return 1;
1154
1155 #else
1156
1157         if (strcmp(hostname, "localhost") == 0)
1158             return 1;
1159
1160         if (strcmp(hostname, getfullhostname()) == 0)
1161             return 1;
1162
1163 #endif
1164
1165         return 0;
1166     }
1167
1168     while (fgets(config_line, BUFSIZ, fp)) {
1169         char *token = NULL;
1170         strtok(config_line, " \r\n\t");
1171
1172         if (config_line[0] == '#')
1173             continue;
1174
1175         if (config_line[0] == '\0')
1176             continue;
1177
1178         if ((token = strtok(config_line, ":")) == NULL)
1179             continue;
1180
1181 #if HAVE_FNMATCH_H
1182
1183         if (fnmatch(token, hostname, 0) != 0)
1184             continue;
1185
1186 #else
1187
1188         if (strcmp(token, hostname) != 0)
1189             continue;
1190
1191 #endif
1192
1193         if ((token = strtok(NULL, ":")) != NULL) {
1194             int i;
1195
1196             if (strcmp(token, "*") == 0)
1197
1198                 ;   /* Wildcard port specification */
1199             else if (strcasecmp(token, "any") == 0)
1200
1201                 ;   /* Wildcard port specification */
1202             else if (sscanf(token, "%d", &i) != 1)
1203                 continue;
1204
1205             else if (i != port)
1206                 continue;
1207         } else if (port != CACHE_HTTP_PORT)
1208             continue;
1209
1210         ret = 1;
1211
1212         break;
1213     }
1214
1215     fclose(fp);
1216     return ret;
1217 }