#include <u.h>#include <libc.h>#include <ctype.h>#include <bio.h>#include <regexp.h>#include <fcall.h>#include "httpd.h"#include "httpsrv.h" static	Hio		*hout;static	Hio		houtb;static	HConnect	*connect;static	int		vermaj, gidwidth, uidwidth, lenwidth, devwidth;static	Biobuf		*aio, *dio; typedef struct Search Search;struct Search{	char	*f[10];	int	nf;	char	*g[10];}; static intparsesearch(Search *s, char *p){	char *e;	int i; 	memset(s, 0, sizeof *s);	s->nf = getfields(p, s->f, nelem(s->f), 0, "&");	for(i = 0; i < s->nf; i++){		if(e = strchr(s->f[i], '=')){			*e = 0;			s->g[i] = hurlunesc(connect, e + 1);		}	}	return 0;} char*findsearch(Search *s, char *p){	int i; 	for(i = 0; i < s->nf; i++)		if(!strcmp(s->f[i], p))			return s->g[i]? s->g[i]: "";	return "";} static voiddoctype(void){	hprint(hout, "<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\"\n");	hprint(hout, "    \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">\n");} voiderror(char *title, char *fmt, ...){	va_list arg;	char buf[1024], *out; 	va_start(arg, fmt);	out = vseprint(buf, buf+sizeof(buf), fmt, arg);	va_end(arg);	*out = 0; 	hprint(hout, "%s 404 %s\r\n", hversion, title);	hprint(hout, "Date: %D\r\n", time(nil));	hprint(hout, "Server: Plan9\r\n");	hprint(hout, "Content-type: text/html\r\n");	hprint(hout, "\r\n");	doctype();	hprint(hout, "<html xmlns=\"http://www.w3.org/1999/xhtml\">\n");	hprint(hout, "<head><title>%s</title></head>\n", title);	hprint(hout, "<body>\n");	hprint(hout, "<h1>%s</h1>\n", title);	hprint(hout, "%s\n", buf);	hprint(hout, "</body>\n");	hprint(hout, "</html>\n");	hflush(hout);	writelog(connect, "Reply: 404\nReason: %s\n", title);	exits(nil);} /* * Are we actually allowed to look in here? * * Rules: *	1) If neither allowed nor denied files exist, access is granted. *	2) If allowed exists and denied does not, dir *must* be in allowed *	   for access to be granted, otherwise, access is denied. *	3) If denied exists and allowed does not, dir *must not* be in *	   denied for access to be granted, otherwise, access is enied. *	4) If both exist, okay if either (a) file is not in denied, or *	   (b) in denied and in allowed.  Otherwise, access is denied. */static Reprog *getre(Biobuf *buf){	Reprog	*re;	char	*p, *t;	char	*bbuf;	int	n; 	if (buf == nil)		return(nil);	for ( ; ; free(p)) {		p = Brdstr(buf, '\n', 0);		if (p == nil)			return(nil);		t = strchr(p, '#');		if (t != nil)			*t = '\0';		t = p + strlen(p);		while (--t > p && isspace(*t))			*t = '\0';		n = strlen(p);		if (n == 0)			continue; 		/* root the regular expresssion */		bbuf = malloc(n+2);		if(bbuf == nil)			sysfatal("out of memory");		bbuf[0] = '^';		strcpy(bbuf+1, p);		re = regcomp(bbuf);		free(bbuf); 		if (re == nil)			continue;		free(p);		return(re);	}} static intallowed(char *dir){	Reprog	*re;	int	okay;	Resub	match; 	if (strcmp(dir, "..") == 0 || strncmp(dir, "../", 3) == 0)		return(0);	if (aio == nil)		return(0);	if (aio != nil)		Bseek(aio, 0, 0);	if (dio != nil)		Bseek(dio, 0, 0); 	/* if no deny list, assume everything is denied */	okay = (dio != nil); 	/* go through denials till we find a match */	while (okay && (re = getre(dio)) != nil) {		memset(&match, 0, sizeof(match));		okay = (regexec(re, dir, &match, 1) != 1);		free(re);	} 	/* go through accepts till we have a match */	if (aio == nil)		return(okay);	while (!okay && (re = getre(aio)) != nil) {		memset(&match, 0, sizeof(match));		okay = (regexec(re, dir, &match, 1) == 1);		free(re);	}	return(okay);} /* * Comparison routine for sorting the directory. */static intcompar(Dir *a, Dir *b){	return(strcmp(a->name, b->name));} /* * These is for formating; how wide are variable-length * fields? */static voidmaxwidths(Dir *dp, long n){	long	i;	char	scratch[64]; 	for (i = 0; i < n; i++) {		if (snprint(scratch, sizeof scratch, "%ud", dp[i].dev) > devwidth)			devwidth = strlen(scratch);		if (strlen(dp[i].uid) > uidwidth)			uidwidth = strlen(dp[i].uid);		if (strlen(dp[i].gid) > gidwidth)			gidwidth = strlen(dp[i].gid);		if (snprint(scratch, sizeof scratch, "%lld", dp[i].length) > lenwidth)			lenwidth = strlen(scratch);	}} /* * Do an actual directory listing. * asciitime is lifted directly out of ls. */char *asciitime(long l){	ulong clk;	static char buf[32];	char *t; 	clk = time(nil);	t = ctime(l);	/* 6 months in the past or a day in the future */	if(l<clk-180L*24*60*60 || clk+24L*60*60<l){		memmove(buf, t+4, 7);		/* month and day */		memmove(buf+7, t+23, 5);		/* year */	}else		memmove(buf, t+4, 12);		/* skip day of week */	buf[12] = 0;	return buf;} static char*nam(Search *s, char *f, char *e){	char *p;	static char buf[256]; 	p = findsearch(s, e);	snprint(buf, sizeof buf, "%s/%s", p, f);	cleanname(buf);	return buf;} static char*rnam(Search *s, char *f){	return nam(s, f, "d");} static char*deprefix(Search *, char *f){	return f;} static char*defix(Search *s, char *f){	char *p;	int l; 	p = findsearch(s, "p");	l = strlen(p);	if(cistrncmp(p, f, l) == 0)		f += l;	return f;} static char*fnam(Search *s, char *f){	char *p;	static char buf[256]; 	p = findsearch(s, "f");	snprint(buf, sizeof buf, "/%s/%s", p, defix(s, f));	cleanname(buf);	return buf;} static intsallowed(Search *s, char *p){	char buf[256]; 	snprint(buf, sizeof buf, "%s/%s", findsearch(s, "p"), p);	cleanname(buf);	return allowed(buf);} static voidrollup(Search *s, char *dir){	char *f[30], *r;	int nf, i; 	r = findsearch(s, "r");	if(cistrncmp(dir, r, strlen(r)) == 0)		dir += strlen(r); 	nf = getfields(dir, f, nelem(f), 0, "/");	hprint(hout, "<h1>");	if(nf <= 1){		hprint(hout, " . </h1>");		return;	}	hprint(hout, "<a href=\"%s%s\">%s</a>", r, rnam(s, f[0]), "."); 	for(i = 1; i < nf - 1; i++){		f[i][-1] = '/';		hprint(hout, " / ");		if(sallowed(s, dir))			hprint(hout, "<a href=\"%s%s\">%s</a>", r, rnam(s, dir), f[i]);		else			hprint(hout, "%s", f[i]);	}	f[i][-1] = '/';	hprint(hout, "/ %s</h1>", f[i]);} static voiddols(char *dir, Search *s){	char *f, *p, buf[256];	int i, n, fd;	Dir *d; 	/* expand "" to "."; ``dir+1'' access below depends on this */	cleanname(dir);	snprint(buf, sizeof buf, "%s/%s", findsearch(s, "p"), dir);	cleanname(buf);	if(!allowed(buf)) {		error("Permission denied", "<p>Cannot list directory %s: Access prohibited</p>", dir);		return;	}	fd = open(buf, OREAD);	if(fd < 0) {		error("Cannot read directory", "<p>Cannot read directory %s: %r</p>", dir);		return;	}	if (vermaj) {		hokheaders(connect);		hprint(hout, "Content-type: text/html\r\n");		hprint(hout, "\r\n");	}	doctype();	hprint(hout, "<html xmlns=\"http://www.w3.org/1999/xhtml\">\n");	hprint(hout, "<head><title>Index of %s</title></head>\n", dir);	hprint(hout, "<body>\n"); 	rollup(s, dir);	n = dirreadall(fd, &d);	close(fd);	maxwidths(d, n);	qsort(d, n, sizeof(Dir), (int (*)(void *, void *))compar);	hprint(hout, "<pre>\n");	for (i = 0; i < n; i++) {		f = smprint("%s/%s", dir, d[i].name);		cleanname(f);		if(d[i].mode & DMDIR) {			p = smprint("%s", rnam(s, f));			free(f);			f = p;		}else			p = fnam(s, f);		hprint(hout, "%M %C %*ud %-*s %-*s %*lld %s <a href=\"%s\">%s</a>\n",			d[i].mode, d[i].type,			devwidth, d[i].dev,			uidwidth, "none" /*d[i].uid*/,			gidwidth, "none" /*d[i].gid*/,			lenwidth, d[i].length,			asciitime(d[i].mtime), p, d[i].name);		free(f);	}	cleanname(f = smprint("%s/..", deprefix(s, dir)));	if(strcmp(f, "/") != 0 && sallowed(s, f))		hprint(hout, "\nGo to <a href=\"%s\">parent</a> directory\n", rnam(s, f));	else		hprint(hout, "\n");	free(f);	hprint(hout, "</pre>\n</body>\n</html>\n");	hflush(hout);	free(d);} /* * Handle unpacking the request in the URI and * invoking the actual handler. */static voiddosearch(char *search){	char *dir;	Search s; 	if(parsesearch(&s, search) == -1)		goto lose;	if(dir = findsearch(&s, "dir")){		dols(dir, &s);		return;	} 	/*	 * Otherwise, we've gotten an illegal request.	 * spit out a non-apologetic error.	 */lose:	search = hurlunesc(connect, search);	error("Bad directory listing request",	    "<p>Illegal formatted directory listing request:</p>\n"	    "<p>%H</p>", search);} voidmain(int argc, char **argv){	fmtinstall('H', httpfmt);	fmtinstall('U', hurlfmt);	fmtinstall('M', dirmodefmt); 	aio = Bopen("/sys/lib/webls.allowed", OREAD);	dio = Bopen("/sys/lib/webls.denied", OREAD); 	if(argc == 2){		hinit(&houtb, 1, Hwrite);		hout = &houtb;		dols(argv[1], nil);		exits(nil);	}	close(2); 	connect = init(argc, argv);	hout = &connect->hout;	vermaj = connect->req.vermaj;	if(hparseheaders(connect, HSTIMEOUT) < 0)		exits("failed"); 	if(strcmp(connect->req.meth, "GET") != 0 && strcmp(connect->req.meth, "HEAD") != 0){		hunallowed(connect, "GET, HEAD");		exits("not allowed");	}	if(connect->head.expectother || connect->head.expectcont){		hfail(connect, HExpectFail, nil);		exits("failed");	} 	bind("/usr/web", "/", MREPL); 	if(connect->req.search != nil)		dosearch(connect->req.search);	else		error("Bad argument", "<p>Need a search argument</p>");	hflush(hout);	writelog(connect, "200 sources %ld %ld\n", hout->seek, hout->seek);	exits(nil);}