Original release 20160919

[fex.git] / bin / fexsrv

diff --git a/bin/fexsrv b/bin/fexsrv
index 6a3e80e73641aa0c91eaf2e2d66bd127177fb6f6..2843167ad78c4327b0806e8a9d626b71e667750b 100755 (executable)
--- a/bin/fexsrv
+++ b/bin/fexsrv
@@ -15,6 +15,7 @@ BEGIN {
   # stunnel workaround
   $SIG{CHLD} = "DEFAULT";
   $ENV{PERLINIT} = q{
   # stunnel workaround
   $SIG{CHLD} = "DEFAULT";
   $ENV{PERLINIT} = q{

+    $ENV{LC_ALL} = 'en_US.UTF-8';

     unshift @INC,(getpwuid($<))[7].'/perl';
     # web error handler
     $SIG{__DIE__} = $SIG{__WARN__} = sub {
     unshift @INC,(getpwuid($<))[7].'/perl';
     # web error handler
     $SIG{__DIE__} = $SIG{__WARN__} = sub {


@@ -91,8 +92,8 @@ foreach my $lib (
 
 # import from fex.pp
 our ($hostname,$debug,$timeout,$max_error,$max_error_handler);
 
 # import from fex.pp
 our ($hostname,$debug,$timeout,$max_error,$max_error_handler);

-our ($spooldir,@logdir,$docdir,$xkeydir,$lockdir);
-our ($force_https,$default_locale,$bs,$MB,$adlm);
+our ($spooldir,@logdir,$docdir,$xkeydir,$akeydir,$lockdir);
+our ($force_https,$default_locale,$bs,$MB,$adlm,@forbidden_user_agents);

 our (@locales);
 
 # load common code (local config: $FEXHOME/lib/fex.ph)
 our (@locales);
 
 # load common code (local config: $FEXHOME/lib/fex.ph)


@@ -144,7 +145,7 @@ else {
   if ($ssl_ra) {
     $ENV{PROTO} = 'https';
     $ENV{REMOTE_ADDR} = $ra = $ssl_ra;
   if ($ssl_ra) {
     $ENV{PROTO} = 'https';
     $ENV{REMOTE_ADDR} = $ra = $ssl_ra;

-    if ($ssl_ra =~ /\w:\w/) {
+    if ($ssl_ra =~ /[\w:]:\w/) {

       # ($rh) = `host $ssl_ra 2>/dev/null` =~ /name pointer (.+)\.$/;
       $^W = 0; eval 'use Socket6'; $^W = 1;
       http_error(503) if $@;
       # ($rh) = `host $ssl_ra 2>/dev/null` =~ /name pointer (.+)\.$/;
       $^W = 0; eval 'use Socket6'; $^W = 1;
       http_error(503) if $@;


@@ -247,15 +248,16 @@ REQUEST: while (*STDIN) {
       http_error(413);
     }
 
       http_error(413);
     }
 

-    if (/^(GET \/|X-Forwarded-For|User-Agent)/i) {
+    if (/^(GET \/|\S*Forwarded|\S*Client-IP|\S*Coming-From|User-Agent)/i) {

       $hid .= $_."\n";
     }
 
     # reverse-proxy?
       $hid .= $_."\n";
     }
 
     # reverse-proxy?

+    # (only IPv4 support!)

     if ($reverse_proxy_ip and $reverse_proxy_ip eq $ra and
     if ($reverse_proxy_ip and $reverse_proxy_ip eq $ra and

-       /^X-Forwarded-For: ([\d.]+)/
+       /^\S*(Forwarded|Client-IP|Coming-From)\S*: ([\da-f:.]+)/i

     ) {
     ) {

-      $ENV{REMOTE_ADDR} = $ra = $1;
+      $ENV{REMOTE_ADDR} = $ra = $2;

       $ENV{REMOTE_HOST} = $rh = gethostbyaddr(inet_aton($ra),AF_INET) || '';
       $ENV{HTTP_HOST} = $hostname;
       if ($ENV{PROTO} eq 'https') { $port = 443 }
       $ENV{REMOTE_HOST} = $rh = gethostbyaddr(inet_aton($ra),AF_INET) || '';
       $ENV{HTTP_HOST} = $hostname;
       if ($ENV{PROTO} eq 'https') { $port = 443 }


@@ -312,7 +314,7 @@ REQUEST: while (*STDIN) {
     }
   }
 
     }
   }
 

-  if ($request =~ /^OPTIONS FEX HTTP\/[\d\.]+$/i) {
+  if ($request =~ /^OPTIONS \/?FEX HTTP\/[\d\.]+$/i) {

     fexlog($connect,@log);
     nvt_print(
       "HTTP/1.1 201 OK",
     fexlog($connect,@log);
     nvt_print(
       "HTTP/1.1 201 OK",


@@ -367,6 +369,8 @@ REQUEST: while (*STDIN) {
     if ($uri =~ /\\|%5c/i) { badchar("\\") }
   }
 
     if ($uri =~ /\\|%5c/i) { badchar("\\") }
   }
 

+  my $fua = join('|',@forbidden_user_agents);
+

   while ($_ = shift @header) {
 
     # header inquisition!
   while ($_ = shift @header) {
 
     # header inquisition!


@@ -380,12 +384,8 @@ REQUEST: while (*STDIN) {
       exit;
     }
 
       exit;
     }
 

-    if ($header =~ /\nRange:/ and /^User-Agent: (FDM)/) {
-      disconnect($1,"499 Download Manager $1 Not Supported",30);
-    }
-
-    if (/^User-Agent: (Java\/[\d\.]+)/) {
-      disconnect($1,"499 User-Agent $1 Not Supported",30);
+    if ($fua and /^User-Agent: ($fua)/) {
+      disconnect($1,"499 User Agent $1 Not Supported",30);

     }
 
     if (/^Range:.*,/) {
     }
 
     if (/^Range:.*,/) {


@@ -435,7 +435,7 @@ REQUEST: while (*STDIN) {
     }
 
     # HTTP header ==> environment variables
     }
 
     # HTTP header ==> environment variables

-    if (/^([\w\-]+):\s*(.+)/s) {
+    if (/^([\w\-_]+):\s*(.+)/s) {

       $http_var = $1;
       $http_val = $2;
       $http_var =~ s/-/_/g;
       $http_var = $1;
       $http_val = $2;
       $http_var =~ s/-/_/g;


@@ -447,7 +447,10 @@ REQUEST: while (*STDIN) {
       } else {
         $http_val =~ s/\s+/ /g;
         if ($http_var =~ /^HTTP_(HOST|VERSION)$/) {
       } else {
         $http_val =~ s/\s+/ /g;
         if ($http_var =~ /^HTTP_(HOST|VERSION)$/) {

-          $http_var = 'X-'.$http_var;
+          $http_var = 'HTTP_X_'.$1;
+        } elsif ($http_var =~ /^PROXY/) {
+          # http://cert.at/warnings/all/20160718.html
+          $http_var = 'HTTP_X_'.$http_var;

         } elsif ($http_var !~ /^CONTENT_/) {
           $http_var = 'HTTP_'.$http_var;
         }
         } elsif ($http_var !~ /^CONTENT_/) {
           $http_var = 'HTTP_'.$http_var;
         }


@@ -499,6 +502,22 @@ REQUEST: while (*STDIN) {
     $ENV{LOCALE} = $locale = $default_locale;
   }
 
     $ENV{LOCALE} = $locale = $default_locale;
   }
 

+  # for dynamic HTML documents
+  if ($ENV{HTTP_COOKIE} =~ /akey=(\w+)/) {
+    my $akey = $1;
+    my ($user,$id);
+    if ($user = readlink "$akeydir/$akey") {
+      $user =~ s:.*/::;
+      $user = untaint($user);
+      if ($id = slurp("$spooldir/$user/@")) {
+        chomp $id;
+        $ENV{AKEY} = $akey;
+        $ENV{USER} = $user;
+        $ENV{ID}   = $id;
+      }
+    }
+  }
+

   # check for name based virtual host
   $vhost = vhost($ENV{'HTTP_HOST'});
 
   # check for name based virtual host
   $vhost = vhost($ENV{'HTTP_HOST'});
 


@@ -864,6 +883,7 @@ sub redirect {
       '</body></html>'
     ));
   }
       '</body></html>'
     ));
   }

+  fexlog($connect,@log,"REDIRECT $newurl");

   if ($rr =~ /^http/) {
     exit;
   } else {
   if ($rr =~ /^http/) {
     exit;
   } else {