shurl

shurl.c (6035B)

---

 /* 
  * Copyright (c) 2023 Santtu Lakkala
  * 
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
  * in the Software without restriction, including without limitation the rights
  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  * copies of the Software, and to permit persons to whom the Software is
  * furnished to do so, subject to the following conditions:
  * 
  * The above copyright notice and this permission notice shall be included in all
  * copies or substantial portions of the Software.
  * 
  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
  */
 #define _POSIX_C_SOURCE 200809L
 
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <stdbool.h>
 #include <unistd.h>
 #include <time.h>
 
 static const char *dir = "/var/shurl";
 #define RAND_TOKEN_LEN 4
 static const int rand_token_retry = 6;
 static const char allowed[] = "."
 	"0123456789_-"
 	"abcdefghijklmnopqrstuvwxyz"
 	"ABCDEFGHIJKLMNOPQRSTUVWXYZ";
 
 static const char *rand_token(void)
 {
 	static bool inited = false;
 	static char buffer[RAND_TOKEN_LEN + 1] = { 0 };
 	int i;
 
 	if (!inited) {
 		struct timespec ts;
 		if (clock_gettime(CLOCK_MONOTONIC, &ts))
 			return NULL;
 		srand(ts.tv_sec ^ ts.tv_nsec);
 		inited = true;
 	}
 
 	for (i = 0; i < RAND_TOKEN_LEN; i++)
 		buffer[i] = allowed[rand() % (sizeof(allowed) - 1 - !i) + !i];
 
 	return buffer;
 }
 
 static int hv(char c)
 {
 	static char lookup[0x100] = {
 		['0'] = 1, ['1'] = 2, ['2'] = 3, ['3'] = 4, ['4'] = 5,
 	       	['5'] = 6, ['6'] = 7, ['7'] = 8, ['8'] = 9, ['9'] = 10,
 	       	['A'] = 11, ['B'] = 12, ['C'] = 13,
 	       	['D'] = 14, ['E'] = 15, ['F'] = 16,
 	       	['a'] = 11, ['b'] = 12, ['c'] = 13,
 	       	['d'] = 14, ['e'] = 15, ['f'] = 16,
 	};
 
 	return lookup[(unsigned char)c] - 1;
 }
 
 static int hvs(const char *s) {
 	int v = hv(*s);
 	if (v < 0)
 		return -1;
 	v = (v << 4) | hv(s[1]);
 	if (v < 0)
 		return -1;
 	return v;
 }
 
 static void qs_foreach(char *in,
 		       bool (*cb)(const char *key, const char *value,
 				  void *data),
 		       void *data)
 {
 	char *w;
 	char *r;
 
 	char *key = in;
 	char *value = NULL;
 
 	for (r = in, w = in; *r; r++) {
 		if (*r == '+') {
 			*w++ = ' ';
 		} else if (*r == '%') {
 			int v = hvs(r + 1);
 			if (v < 0)
 				break;
 			*w++ = v;
 			r += 2;
 		} else if (*r == '=') {
 			*w++ = '\0';
 			value = w;
 		} else if (*r == '&') {
 			*w++ = '\0';
 			if (cb(key, value, data))
 				return;
 			key = w;
 			value = NULL;
 		} else if (*r == ' ' || *r == '\n' || *r == '\r') {
 			/* Nom nom nom */
 		} else {
 			*w++ = *r;
 		}
 	}
 
 	*w = '\0';
 	cb(key, value, data);
 }
 
 static void groan(int code, const char *msg)
 {
 	printf("Status: %d %s\nContent-type: text/plain\n\n%s\n",
 	       code, msg, msg);
 	exit(0);
 }
 
 static int subdir(int fd, const char *name)
 {
 	int sub;
 
 	if (fd < 0)
 		return fd;
 
 	sub = openat(fd, name, O_DIRECTORY | O_RDONLY);
 	close(fd);
 
 	return sub;
 }
 
 static bool check_token(const char *s)
 {
 	return !s[strspn(s, allowed)] && s[0] != '.';
 }
 
 static void handle_get(int fd)
 {
 	const char *pi = getenv("PATH_INFO");
 	char buffer[4096];
 
 	if (!pi)
 		groan(404, "Not Found");
 
 	if (*pi == '/')
 		pi++;
 
 	if (!check_token(pi))
 		groan(404, "Not Found");
 
 	if (readlinkat(fd, pi, buffer, sizeof(buffer)) < 0) {
 		if (errno == ENOENT)
 			groan(404, "Not Found");
 		groan(500, "Internal server error");
 	}
 
 	printf("Status: 302 Found\nLocation: %s\n\n", buffer);
 }
 
 struct post_data {
 	const char *uri;
 	const char *token;
 };
 
 static bool handle_post_qs(const char *key, const char *value, void *data)
 {
 	struct post_data *d = data;
 
 	if (!strcmp(key, "uri"))
 		d->uri = value;
 	else if (!strcmp(key, "token"))
 		d->token = value;
 	else
 		return false;
 
 	return d->uri && d->token;
 }
 
 static void handle_post(int fd)
 {
 	char buffer[4096];
 	int flags;
 	int r;
 	struct post_data data = { 0 };
 
 	if ((flags = fcntl(STDIN_FILENO, F_GETFL, 0)) < 0 ||
 	    fcntl(STDIN_FILENO, F_SETFL, flags | O_NONBLOCK))
 		groan(500, "Internal server error");
 
 	r = read(STDIN_FILENO, buffer, sizeof(buffer));
 	if (r < 0)
 		groan(500, "Internal server error");
 	if (r == sizeof(buffer))
 		groan(413, "Payload too large");
 	buffer[r] = '\0';
 
 	qs_foreach(buffer, handle_post_qs, &data);
 
 	if (!data.uri)
 		groan(400, "Bad request");
 
 	if (data.token) {
 		if (!check_token(data.token))
 			groan(400, "Bad request");
 		if (symlinkat(data.uri, fd, data.token)) {
 			if (errno == EEXIST)
 				groan(409, "Conflict");
 			groan(500, "Internal server error");
 		}
 	} else {
 		int i;
 
 		for (i = 0; i < rand_token_retry; i++) {
 			data.token = rand_token();
 			if (!symlinkat(data.uri, fd, data.token))
 				break;
 			if (errno == EEXIST)
 				continue;
 			groan(500, "Internal server error");
 		}
 
 		if (i == rand_token_retry)
 			groan(500, "Internal server error");
 
 	}
 
 	printf("Content-type: text/plain\n\n%s\n", data.token);
 }
 
 int main(int argc, char **argv)
 {
 	const char *mtd = getenv("REQUEST_METHOD");
 	const char *host = getenv("HTTP_HOST");
 
 	int dfd = open(dir, O_DIRECTORY | O_RDONLY);
 
 	(void)argc;
 	(void)argv;
 
 	srand(time(NULL));
 
 	if (dfd < 0 || !mtd || !host)
 		groan(500, "Internal server error");
 
 	dfd = subdir(dfd, host);
 	if (dfd < 0)
 		groan(500, "Internal server error");
 
 	if (!strcmp(mtd, "POST")) {
 		char *user = getenv("REMOTE_USER");
 		if (!user || strcmp(user, host))
 			groan(403, "Forbidden");
 		handle_post(dfd);
 	} else if (!strcmp(mtd, "GET")) {
 		handle_get(dfd);
 	} else {
 		groan(405, "Method not allowed");
 	}
 
 	close(dfd);
 
 	return 0;
 }