xref: /netbsd/libexec/httpd/cgi-bozo.c (revision 12a6844d)
1 /*	$NetBSD: cgi-bozo.c,v 1.35 2016/04/24 18:24:47 christos Exp $	*/
2 
3 /*	$eterna: cgi-bozo.c,v 1.40 2011/11/18 09:21:15 mrg Exp $	*/
4 
5 /*
6  * Copyright (c) 1997-2015 Matthew R. Green
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer and
16  *    dedication in the documentation and/or other materials provided
17  *    with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
20  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
21  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
22  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
23  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
24  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
25  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
26  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
27  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  */
32 
33 /* this code implements CGI/1.2 for bozohttpd */
34 
35 #ifndef NO_CGIBIN_SUPPORT
36 
37 #include <sys/param.h>
38 #include <sys/socket.h>
39 
40 #include <ctype.h>
41 #include <errno.h>
42 #include <paths.h>
43 #include <signal.h>
44 #include <stdlib.h>
45 #include <string.h>
46 #include <syslog.h>
47 #include <unistd.h>
48 
49 #include <netinet/in.h>
50 
51 #include "bozohttpd.h"
52 
53 #define CGIBIN_PREFIX		"cgi-bin/"
54 #define CGIBIN_PREFIX_LEN	(sizeof(CGIBIN_PREFIX)-1)
55 
56 #ifndef USE_ARG
57 #define USE_ARG(x)	/*LINTED*/(void)&(x)
58 #endif
59 
60 /*
61  * given the file name, return a CGI interpreter
62  */
63 static const char *
64 content_cgihandler(bozohttpd_t *httpd, bozo_httpreq_t *request,
65 		const char *file)
66 {
67 	bozo_content_map_t	*map;
68 
69 	USE_ARG(request);
70 	debug((httpd, DEBUG_FAT, "content_cgihandler: trying file %s", file));
71 	map = bozo_match_content_map(httpd, file, 0);
72 	if (map)
73 		return map->cgihandler;
74 	return NULL;
75 }
76 
77 static int
78 parse_header(bozo_httpreq_t *request, const char *str, ssize_t len,
79 	     char **hdr_str, char **hdr_val)
80 {
81 	struct	bozohttpd_t *httpd = request->hr_httpd;
82 	char	*name, *value;
83 
84 	/* if the string passed is zero-length bail out */
85 	if (*str == '\0')
86 		return -1;
87 
88 	value = bozostrdup(httpd, request, str);
89 
90 	/* locate the ':' separator in the header/value */
91 	name = bozostrnsep(&value, ":", &len);
92 
93 	if (NULL == name || -1 == len) {
94 		free(value);
95 		return -1;
96 	}
97 
98 	/* skip leading space/tab */
99 	while (*value == ' ' || *value == '\t')
100 		len--, value++;
101 
102 	*hdr_str = name;
103 	*hdr_val = value;
104 
105 	return 0;
106 }
107 
108 /*
109  * handle parsing a CGI header output, transposing a Status: header
110  * into the HTTP reply (ie, instead of "200 OK").
111  */
112 static void
113 finish_cgi_output(bozohttpd_t *httpd, bozo_httpreq_t *request, int in, int nph)
114 {
115 	char	buf[BOZO_WRSZ];
116 	char	*str;
117 	ssize_t	len;
118 	ssize_t rbytes;
119 	SIMPLEQ_HEAD(, bozoheaders)	headers;
120 	bozoheaders_t *hdr, *nhdr;
121 	int	write_header, nheaders = 0;
122 
123 	/* much of this code is like bozo_read_request()'s header loop. */
124 	SIMPLEQ_INIT(&headers);
125 	write_header = nph == 0;
126 	/* was read(2) here - XXX - agc */
127 	while (nph == 0 &&
128 		(str = bozodgetln(httpd, in, &len, bozo_read)) != NULL) {
129 		char	*hdr_name, *hdr_value;
130 
131 		if (parse_header(request, str, len, &hdr_name, &hdr_value))
132 			break;
133 
134 		/*
135 		 * The CGI 1.{1,2} spec both say that if the cgi program
136 		 * returns a `Status:' header field then the server MUST
137 		 * return it in the response.  If the cgi program does
138 		 * not return any `Status:' header then the server should
139 		 * respond with 200 OK.
140 		 * XXX The CGI 1.1 and 1.2 specification differ slightly on
141 		 * this in that v1.2 says that the script MUST NOT return a
142 		 * `Status:' header if it is returning a `Location:' header.
143 		 * For compatibility we are going with the CGI 1.1 behavior.
144 		 */
145 		if (strcasecmp(hdr_name, "status") == 0) {
146 			debug((httpd, DEBUG_OBESE,
147 				"bozo_process_cgi:  writing HTTP header "
148 				"from status %s ..", hdr_value));
149 			bozo_printf(httpd, "%s %s\r\n", request->hr_proto,
150 					hdr_value);
151 			bozo_flush(httpd, stdout);
152 			write_header = 0;
153 			free(hdr_name);
154 			break;
155 		}
156 
157 		hdr = bozomalloc(httpd, sizeof *hdr);
158 		hdr->h_header = hdr_name;
159 		hdr->h_value = hdr_value;
160 		SIMPLEQ_INSERT_TAIL(&headers, hdr, h_next);
161 		nheaders++;
162 	}
163 
164 	if (write_header) {
165 		debug((httpd, DEBUG_OBESE,
166 			"bozo_process_cgi:  writing HTTP header .."));
167 		bozo_printf(httpd,
168 			"%s 200 OK\r\n", request->hr_proto);
169 		bozo_flush(httpd, stdout);
170 	}
171 
172 	if (nheaders) {
173 		debug((httpd, DEBUG_OBESE,
174 			"bozo_process_cgi:  writing delayed HTTP headers .."));
175 		SIMPLEQ_FOREACH_SAFE(hdr, &headers, h_next, nhdr) {
176 			bozo_printf(httpd, "%s: %s\r\n", hdr->h_header,
177 					hdr->h_value);
178 			free(hdr->h_header);
179 			free(hdr);
180 		}
181 		bozo_printf(httpd, "\r\n");
182 		bozo_flush(httpd, stdout);
183 	}
184 
185 	/* XXX we should have some goo that times us out
186 	 */
187 	while ((rbytes = read(in, buf, sizeof buf)) > 0) {
188 		ssize_t wbytes;
189 		char *bp = buf;
190 
191 		while (rbytes) {
192 			wbytes = bozo_write(httpd, STDOUT_FILENO, buf,
193 						(size_t)rbytes);
194 			if (wbytes > 0) {
195 				rbytes -= wbytes;
196 				bp += wbytes;
197 			} else
198 				bozoerr(httpd, 1,
199 					"cgi output write failed: %s",
200 					strerror(errno));
201 		}
202 	}
203 }
204 
205 static void
206 append_index_html(bozohttpd_t *httpd, char **url)
207 {
208 	*url = bozorealloc(httpd, *url,
209 			strlen(*url) + strlen(httpd->index_html) + 1);
210 	strcat(*url, httpd->index_html);
211 	debug((httpd, DEBUG_NORMAL,
212 		"append_index_html: url adjusted to `%s'", *url));
213 }
214 
215 /* This function parse search-string according to section 4.4 of RFC3875 */
216 static char **
217 parse_search_string(bozo_httpreq_t *request, const char *query, size_t *args_len)
218 {
219 	struct	bozohttpd_t *httpd = request->hr_httpd;
220 	size_t i;
221 	char *s, *str, **args;
222 
223 	*args_len = 0;
224 
225 	/* URI MUST not contain any unencoded '=' - RFC3875, section 4.4 */
226 	if (strchr(query, '=')) {
227 		return NULL;
228 	}
229 
230 	str = bozostrdup(httpd, request, query);
231 
232 	/*
233 	 * there's no more arguments than '+' chars in the query string as it's
234 	 * the separator
235 	 */
236 	*args_len = 1;
237 	/* count '+' in str */
238 	for (s = str; (s = strchr(s, '+')); (*args_len)++);
239 
240 	args = bozomalloc(httpd, sizeof(*args) * (*args_len + 1));
241 
242 	args[0] = str;
243 	args[*args_len] = NULL;
244 	for (s = str, i = 0; (s = strchr(s, '+'));) {
245 		*s = '\0';
246 		s++;
247 		args[i++] = s;
248 	}
249 
250 	/*
251 	 * check if search-strings are valid:
252 	 *
253 	 * RFC3875, section 4.4:
254 	 *
255 	 * search-string = search-word *( "+" search-word )
256 	 * search-word   = 1*schar
257 	 * schar		 = unreserved | escaped | xreserved
258 	 * xreserved	 = ";" | "/" | "?" | ":" | "@" | "&" | "=" | "," |
259 	 *		   "$"
260 	 *
261 	 * section 2.3:
262 	 *
263 	 * hex	      = digit | "A" | "B" | "C" | "D" | "E" | "F" | "a" |
264 	 *		"b" | "c" | "d" | "e" | "f"
265 	 * escaped    = "%" hex hex
266 	 * unreserved = alpha | digit | mark
267 	 * mark	      = "-" | "_" | "." | "!" | "~" | "*" | "'" | "(" | ")"
268 	 *
269 	 * section 2.2:
270 	 *
271 	 * alpha	= lowalpha | hialpha
272 	 * lowalpha	= "a" | "b" | "c" | "d" | "e" | "f" | "g" | "h" |
273 	 *		  "i" | "j" | "k" | "l" | "m" | "n" | "o" | "p" |
274 	 *		  "q" | "r" | "s" | "t" | "u" | "v" | "w" | "x" |
275 	 *		  "y" | "z"
276 	 * hialpha	= "A" | "B" | "C" | "D" | "E" | "F" | "G" | "H" |
277 	 *		  "I" | "J" | "K" | "L" | "M" | "N" | "O" | "P" |
278 	 *		  "Q" | "R" | "S" | "T" | "U" | "V" | "W" | "X" |
279 	 *	          "Y" | "Z"
280 	 * digit        = "0" | "1" | "2" | "3" | "4" | "5" | "6" | "7" |
281 	 *		  "8" | "9"
282 	 */
283 #define	UNRESERVED_CHAR	"-_.!~*'()"
284 #define	XRESERVED_CHAR	";/?:@&=,$"
285 
286 	for (i = 0; i < *args_len; i++) {
287 		s = args[i];
288 		/* search-word MUST have at least one schar */
289 		if (*s == '\0')
290 			goto parse_err;
291 		while(*s) {
292 			/* check if it's unreserved */
293 			if (isalpha((int)*s) || isdigit((int)*s) ||
294 			    strchr(UNRESERVED_CHAR, *s)) {
295 				s++;
296 				continue;
297 			}
298 
299 			/* check if it's escaped */
300 			if (*s == '%') {
301 				if (s[1] == '\0' || s[2] == '\0')
302 					goto parse_err;
303 				if (!isxdigit((int)s[1]) ||
304 				    !isxdigit((int)s[2]))
305 					goto parse_err;
306 				s += 3;
307 				continue;
308 			}
309 
310 			/* check if it's xreserved */
311 
312 			if (strchr(XRESERVED_CHAR, *s)) {
313 				s++;
314 				continue;
315 			}
316 
317 			goto parse_err;
318 		}
319 	}
320 
321 	/* decode percent encoding */
322 	for (i = 0; i < *args_len; i++) {
323 		if (bozo_decode_url_percent(request, args[i]))
324 			goto parse_err;
325 	}
326 
327 	/* allocate each arg separately */
328 	for (i = 0; i < *args_len; i++)
329 		args[i] = bozostrdup(httpd, request, args[i]);
330 	free(str);
331 
332 	return args;
333 
334 parse_err:
335 
336 	free (str);
337 	free (*args);
338 	free(args);
339 	*args_len = 0;
340 
341 	return NULL;
342 
343 }
344 
345 void
346 bozo_cgi_setbin(bozohttpd_t *httpd, const char *path)
347 {
348 	httpd->cgibin = bozostrdup(httpd, NULL, path);
349 	debug((httpd, DEBUG_OBESE, "cgibin (cgi-bin directory) is %s",
350 		httpd->cgibin));
351 }
352 
353 /* help build up the environ pointer */
354 void
355 bozo_setenv(bozohttpd_t *httpd, const char *env, const char *val,
356 		char **envp)
357 {
358 	char *s1 = bozomalloc(httpd, strlen(env) + strlen(val) + 2);
359 
360 	strcpy(s1, env);
361 	strcat(s1, "=");
362 	strcat(s1, val);
363 	debug((httpd, DEBUG_OBESE, "bozo_setenv: %s", s1));
364 	*envp = s1;
365 }
366 
367 /*
368  * Checks if the request has asked for a cgi-bin.  Should only be called if
369  * cgibin is set.  If it starts CGIBIN_PREFIX or has a ncontent handler,
370  * process the cgi, otherwise just return.  Returns 0 if it did not handle
371  * the request.
372  */
373 int
374 bozo_process_cgi(bozo_httpreq_t *request)
375 {
376 	bozohttpd_t *httpd = request->hr_httpd;
377 	char	buf[BOZO_WRSZ];
378 	char	date[40];
379 	bozoheaders_t *headp;
380 	const char *type, *clen, *info, *cgihandler;
381 	char	*query, *s, *t, *path, *env, *command, *file, *url;
382 	char	**envp, **curenvp, **argv, **search_string_argv = NULL;
383 	char	*uri;
384 	size_t	i, len, search_string_argc = 0;
385 	ssize_t rbytes;
386 	pid_t	pid;
387 	int	envpsize, ix, nph;
388 	int	sv[2];
389 
390 	if (!httpd->cgibin && !httpd->process_cgi)
391 		return 0;
392 
393 #ifndef NO_USER_SUPPORT
394 	if (request->hr_user && !httpd->enable_cgi_users)
395 		return 0;
396 #endif /* !NO_USER_SUPPORT */
397 
398 	if (request->hr_oldfile && strcmp(request->hr_oldfile, "/") != 0)
399 		uri = request->hr_oldfile;
400 	else
401 		uri = request->hr_file;
402 
403 	if (uri[0] == '/')
404 		file = bozostrdup(httpd, request, uri);
405 	else
406 		bozoasprintf(httpd, &file, "/%s", uri);
407 
408 	if (request->hr_query && strlen(request->hr_query))
409 		query = bozostrdup(httpd, request, request->hr_query);
410 	else
411 		query = NULL;
412 
413 	bozoasprintf(httpd, &url, "%s%s%s",
414 		     file,
415 		     query ? "?" : "",
416 		     query ? query : "");
417 	debug((httpd, DEBUG_NORMAL, "bozo_process_cgi: url `%s'", url));
418 
419 	path = NULL;
420 	envp = NULL;
421 	cgihandler = NULL;
422 	command = NULL;
423 	info = NULL;
424 
425 	len = strlen(url);
426 
427 	if (bozo_auth_check(request, url + 1))
428 		goto out;
429 
430 	if (!httpd->cgibin ||
431 	    strncmp(url + 1, CGIBIN_PREFIX, CGIBIN_PREFIX_LEN) != 0) {
432 		cgihandler = content_cgihandler(httpd, request, file + 1);
433 		if (cgihandler == NULL) {
434 			debug((httpd, DEBUG_FAT,
435 				"bozo_process_cgi: no handler, returning"));
436 			goto out;
437 		}
438 		if (len == 0 || file[len - 1] == '/')
439 			append_index_html(httpd, &file);
440 		debug((httpd, DEBUG_NORMAL, "bozo_process_cgi: cgihandler `%s'",
441 		    cgihandler));
442 	} else if (len - 1 == CGIBIN_PREFIX_LEN)	/* url is "/cgi-bin/" */
443 		append_index_html(httpd, &file);
444 
445 	/* RFC3875  sect. 4.4. - search-string support */
446 	if (query != NULL) {
447 		search_string_argv = parse_search_string(request, query,
448 		    &search_string_argc);
449 	}
450 
451 	debug((httpd, DEBUG_NORMAL, "parse_search_string args no: %zu",
452 	    search_string_argc));
453 	for (i = 0; i < search_string_argc; i++) {
454 		debug((httpd, DEBUG_FAT,
455 		    "search_string[%zu]: `%s'", i, search_string_argv[i]));
456 	}
457 
458 	argv = bozomalloc(httpd, sizeof(*argv) * (3 + search_string_argc));
459 
460 	ix = 0;
461 	if (cgihandler) {
462 		command = file + 1;
463 		path = bozostrdup(httpd, request, cgihandler);
464 	} else {
465 		command = file + CGIBIN_PREFIX_LEN + 1;
466 		if ((s = strchr(command, '/')) != NULL) {
467 			info = bozostrdup(httpd, request, s);
468 			*s = '\0';
469 		}
470 		path = bozomalloc(httpd,
471 				strlen(httpd->cgibin) + 1 + strlen(command) + 1);
472 		strcpy(path, httpd->cgibin);
473 		strcat(path, "/");
474 		strcat(path, command);
475 	}
476 
477 	argv[ix++] = path;
478 
479 	/* copy search-string args */
480 	for (i = 0; i < search_string_argc; i++)
481 		argv[ix++] = search_string_argv[i];
482 
483 	argv[ix++] = NULL;
484 	nph = strncmp(command, "nph-", 4) == 0;
485 
486 	type = request->hr_content_type;
487 	clen = request->hr_content_length;
488 
489 	envpsize = 13 + request->hr_nheaders +
490 	    (info && *info ? 1 : 0) +
491 	    (query && *query ? 1 : 0) +
492 	    (type && *type ? 1 : 0) +
493 	    (clen && *clen ? 1 : 0) +
494 	    (request->hr_remotehost && *request->hr_remotehost ? 1 : 0) +
495 	    (request->hr_remoteaddr && *request->hr_remoteaddr ? 1 : 0) +
496 	    bozo_auth_cgi_count(request) +
497 	    (request->hr_serverport && *request->hr_serverport ? 1 : 0);
498 
499 	debug((httpd, DEBUG_FAT,
500 		"bozo_process_cgi: path `%s', cmd `%s', info `%s', "
501 		"query `%s', nph `%d', envpsize `%d'",
502 		path, command, strornull(info),
503 		strornull(query), nph, envpsize));
504 
505 	envp = bozomalloc(httpd, sizeof(*envp) * envpsize);
506 	for (ix = 0; ix < envpsize; ix++)
507 		envp[ix] = NULL;
508 	curenvp = envp;
509 
510 	SIMPLEQ_FOREACH(headp, &request->hr_headers, h_next) {
511 		const char *s2;
512 		env = bozomalloc(httpd, 6 + strlen(headp->h_header) + 1 +
513 		    strlen(headp->h_value));
514 
515 		t = env;
516 		strcpy(t, "HTTP_");
517 		t += strlen(t);
518 		for (s2 = headp->h_header; *s2; t++, s2++)
519 			if (islower((u_int)*s2))
520 				*t = toupper((u_int)*s2);
521 			else if (*s2 == '-')
522 				*t = '_';
523 			else
524 				*t = *s2;
525 		*t = '\0';
526 		debug((httpd, DEBUG_OBESE, "setting header %s as %s = %s",
527 		    headp->h_header, env, headp->h_value));
528 		bozo_setenv(httpd, env, headp->h_value, curenvp++);
529 		free(env);
530 	}
531 
532 #ifndef _PATH_DEFPATH
533 #define _PATH_DEFPATH "/usr/bin:/bin"
534 #endif
535 
536 	bozo_setenv(httpd, "PATH", _PATH_DEFPATH, curenvp++);
537 	bozo_setenv(httpd, "IFS", " \t\n", curenvp++);
538 	bozo_setenv(httpd, "SERVER_NAME", BOZOHOST(httpd,request), curenvp++);
539 	bozo_setenv(httpd, "GATEWAY_INTERFACE", "CGI/1.1", curenvp++);
540 	bozo_setenv(httpd, "SERVER_PROTOCOL", request->hr_proto, curenvp++);
541 	bozo_setenv(httpd, "REQUEST_METHOD", request->hr_methodstr, curenvp++);
542 	bozo_setenv(httpd, "SCRIPT_NAME", file, curenvp++);
543 	bozo_setenv(httpd, "SCRIPT_FILENAME", file + 1, curenvp++);
544 	bozo_setenv(httpd, "SERVER_SOFTWARE", httpd->server_software,
545 			curenvp++);
546 	bozo_setenv(httpd, "REQUEST_URI", uri, curenvp++);
547 	bozo_setenv(httpd, "DATE_GMT", bozo_http_date(date, sizeof(date)),
548 			curenvp++);
549 	/* RFC3875 section 4.1.7 says that QUERY_STRING MUST be defined. */
550 	if (query && *query)
551 		bozo_setenv(httpd, "QUERY_STRING", query, curenvp++);
552 	else
553 		bozo_setenv(httpd, "QUERY_STRING", "", curenvp++);
554 	if (info && *info)
555 		bozo_setenv(httpd, "PATH_INFO", info, curenvp++);
556 	if (type && *type)
557 		bozo_setenv(httpd, "CONTENT_TYPE", type, curenvp++);
558 	if (clen && *clen)
559 		bozo_setenv(httpd, "CONTENT_LENGTH", clen, curenvp++);
560 	if (request->hr_serverport && *request->hr_serverport)
561 		bozo_setenv(httpd, "SERVER_PORT", request->hr_serverport,
562 				curenvp++);
563 	if (request->hr_remotehost && *request->hr_remotehost)
564 		bozo_setenv(httpd, "REMOTE_HOST", request->hr_remotehost,
565 				curenvp++);
566 	if (request->hr_remoteaddr && *request->hr_remoteaddr)
567 		bozo_setenv(httpd, "REMOTE_ADDR", request->hr_remoteaddr,
568 				curenvp++);
569 	/*
570 	 * Apache does this when invoking content handlers, and PHP
571 	 * 5.3 requires it as a "security" measure.
572 	 */
573 	if (cgihandler)
574 		bozo_setenv(httpd, "REDIRECT_STATUS", "200", curenvp++);
575 	bozo_auth_cgi_setenv(request, &curenvp);
576 
577 	debug((httpd, DEBUG_FAT, "bozo_process_cgi: going exec %s with args:",
578 	    path));
579 
580 	for (i = 0; argv[i] != NULL; i++) {
581 		debug((httpd, DEBUG_FAT, "bozo_process_cgi: argv[%zu] = `%s'",
582 		    i, argv[i]));
583 	}
584 
585 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, sv) == -1)
586 		bozoerr(httpd, 1, "child socketpair failed: %s",
587 				strerror(errno));
588 
589 	/*
590 	 * We create 2 procs: one to become the CGI, one read from
591 	 * the CGI and output to the network, and this parent will
592 	 * continue reading from the network and writing to the
593 	 * CGI procsss.
594 	 */
595 	switch (fork()) {
596 	case -1: /* eep, failure */
597 		bozoerr(httpd, 1, "child fork failed: %s", strerror(errno));
598 		/*NOTREACHED*/
599 	case 0:
600 		close(sv[0]);
601 		dup2(sv[1], STDIN_FILENO);
602 		dup2(sv[1], STDOUT_FILENO);
603 		close(2);
604 		close(sv[1]);
605 		closelog();
606 		bozo_daemon_closefds(httpd);
607 
608 		if (-1 == execve(path, argv, envp))
609 			bozoerr(httpd, 1, "child exec failed: %s: %s",
610 			      path, strerror(errno));
611 		/* NOT REACHED */
612 		bozoerr(httpd, 1, "child execve returned?!");
613 	}
614 
615 	free(query);
616 	free(file);
617 	free(url);
618 	for (i = 0; i < search_string_argc; i++)
619 		free(search_string_argv[i]);
620 	free(search_string_argv);
621 
622 	close(sv[1]);
623 
624 	/* parent: read from stdin (bozo_read()) write to sv[0] */
625 	/* child: read from sv[0] (bozo_write()) write to stdout */
626 	pid = fork();
627 	if (pid == -1)
628 		bozoerr(httpd, 1, "io child fork failed: %s", strerror(errno));
629 	else if (pid == 0) {
630 		/* child reader/writer */
631 		close(STDIN_FILENO);
632 		finish_cgi_output(httpd, request, sv[0], nph);
633 		/* if we're done output, our parent is useless... */
634 		kill(getppid(), SIGKILL);
635 		debug((httpd, DEBUG_FAT, "done processing cgi output"));
636 		_exit(0);
637 	}
638 	close(STDOUT_FILENO);
639 
640 	/* XXX we should have some goo that times us out
641 	 */
642 	while ((rbytes = bozo_read(httpd, STDIN_FILENO, buf, sizeof buf)) > 0) {
643 		ssize_t wbytes;
644 		char *bp = buf;
645 
646 		while (rbytes) {
647 			wbytes = write(sv[0], buf, (size_t)rbytes);
648 			if (wbytes > 0) {
649 				rbytes -= wbytes;
650 				bp += wbytes;
651 			} else
652 				bozoerr(httpd, 1, "write failed: %s",
653 					strerror(errno));
654 		}
655 	}
656 	debug((httpd, DEBUG_FAT, "done processing cgi input"));
657 	exit(0);
658 
659  out:
660 
661 	for (i = 0; i < search_string_argc; i++)
662 		free(search_string_argv[i]);
663 	free(search_string_argv);
664 	free(query);
665 	free(file);
666 	free(url);
667 	return 0;
668 }
669 
670 #ifndef NO_DYNAMIC_CONTENT
671 /* cgi maps are simple ".postfix /path/to/prog" */
672 void
673 bozo_add_content_map_cgi(bozohttpd_t *httpd, const char *arg,
674                          const char *cgihandler)
675 {
676 	bozo_content_map_t *map;
677 
678 	debug((httpd, DEBUG_NORMAL, "bozo_add_content_map_cgi: name %s cgi %s",
679 		arg, cgihandler));
680 
681 	httpd->process_cgi = 1;
682 
683 	map = bozo_get_content_map(httpd, arg);
684 	map->name = arg;
685 	map->type = map->encoding = map->encoding11 = NULL;
686 	map->cgihandler = cgihandler;
687 }
688 #endif /* NO_DYNAMIC_CONTENT */
689 
690 #endif /* NO_CGIBIN_SUPPORT */
691