index : cgit

/*
 * The two backends behind a cgit filter and the plumbing that hands stdout to
 * whichever one is open. An exec filter forks a program and feeds it the page
 * through a pipe, while a Lua filter runs a script inside cgit and feeds it
 * the page through a write that has been interposed in front of libc's. A
 * cgitrc command picks its backend with an exec or lua prefix, and a command
 * with no prefix is taken as a program to run.
 */

#include "cgit.h"
#include "filter.h"
#include "html.h"
#include "shared.h"
#ifndef NO_LUA
#include <dlfcn.h>
#include <lua.h>
#include <lualib.h>
#include <lauxlib.h>
#endif

// Exit status of a child that could not run the filter, the shell's own value
// for a command not found.
#define EXEC_FAILED 127

// The exec filter holding stdout, for cgit_abort_filters to take it back.
static struct cgit_exec_filter *running_exec;

/*
 * Each of these returns its argument untouched when the syscall it wraps
 * succeeded, and dies with the message and errno otherwise.
 */
static int die_unless_zero(int result, const char *msg)
{
	if (result != 0)
		die_errno("%s", msg);
	return result;
}

static int die_unless_positive(int result, const char *msg)
{
	if (result <= 0)
		die_errno("%s", msg);
	return result;
}

static int die_unless_non_negative(int result, const char *msg)
{
	if (result < 0)
		die_errno("%s", msg);
	return result;
}

static int open_exec_filter(struct cgit_filter *base, va_list ap)
{
	struct cgit_exec_filter *filter = (struct cgit_exec_filter *)base;
	int pipefd[2];
	int i;

	for (i = 0; i < filter->base.argument_count; i++)
		filter->argv[i + 1] = va_arg(ap, char *);

	filter->old_stdout = die_unless_positive(dup(STDOUT_FILENO), "Unable to duplicate stdout");
	// The child keeps the page's stdout, but not the descriptor the parent
	// needs it back from.
	fcntl(filter->old_stdout, F_SETFD, FD_CLOEXEC);
	die_unless_zero(pipe(pipefd), "Unable to create pipe to subprocess");
	filter->pid = die_unless_non_negative(fork(), "Unable to create subprocess");
	if (filter->pid == 0) {
		close(pipefd[1]);
		if (dup2(pipefd[0], STDIN_FILENO) < 0)
			_exit(EXEC_FAILED);
		// cgit ignores SIGPIPE and the disposition survives exec, so a
		// filter that writes to a closed pipe would otherwise carry on.
		signal(SIGPIPE, SIG_DFL);
		// execvp leaves argv alone, but its prototype predates const.
		execvp(filter->cmd, (char *const *)filter->argv);
		// The child shares the parent's page buffer, cache lock and exit
		// handlers, so it must not die through them.
		fprintf(stderr, "[cgit] Unable to exec filter %s: %s\n", filter->cmd, strerror(errno));
		_exit(EXEC_FAILED);
	}
	close(pipefd[0]);
	die_unless_non_negative(dup2(pipefd[1], STDOUT_FILENO), "Unable to use pipe as stdout");
	close(pipefd[1]);
	running_exec = filter;
	return 0;
}

static int close_exec_filter(struct cgit_filter *base)
{
	struct cgit_exec_filter *filter = (struct cgit_exec_filter *)base;
	int exit_status = 0;

	running_exec = NULL;
	die_unless_non_negative(dup2(filter->old_stdout, STDOUT_FILENO), "Unable to restore stdout");
	close(filter->old_stdout);
	waitpid(filter->pid, &exit_status, 0);
	if (!WIFEXITED(exit_status))
		die("Subprocess %s exited abnormally", filter->cmd);
	if (WEXITSTATUS(exit_status) == EXEC_FAILED)
		die("Unable to run filter %s", filter->cmd);
	return WEXITSTATUS(exit_status);
}

static void fprintf_exec_filter(struct cgit_filter *base, FILE *f, const char *prefix)
{
	struct cgit_exec_filter *filter = (struct cgit_exec_filter *)base;

	fprintf(f, "%sexec:%s\n", prefix, filter->cmd);
}

static void cleanup_exec_filter(struct cgit_filter *base)
{
	struct cgit_exec_filter *filter = (struct cgit_exec_filter *)base;

	free(filter->argv);
	filter->argv = NULL;
	free((char *)filter->cmd);
	filter->cmd = NULL;
}

static struct cgit_filter *new_exec_filter(const char *cmd, int argument_count)
{
	struct cgit_exec_filter *filter;

	filter = xmalloc(sizeof(*filter));
	cgit_exec_filter_init(filter, cgit_strdup_first_line(cmd), NULL);
	filter->base.argument_count = argument_count;
	// argv is the command, then a slot per argument, then the NULL that
	// execvp needs to find the end.
	filter->argv = xcalloc(2 + argument_count, sizeof(char *));
	filter->argv[0] = filter->cmd;
	return &filter->base;
}

void cgit_exec_filter_init(struct cgit_exec_filter *filter, const char *cmd, const char **argv)
{
	memset(filter, 0, sizeof(*filter));
	filter->base.open = open_exec_filter;
	filter->base.close = close_exec_filter;
	filter->base.fprintfp = fprintf_exec_filter;
	filter->base.cleanup = cleanup_exec_filter;
	filter->cmd = cmd;
	filter->argv = argv;
}

#ifndef NO_LUA
struct lua_filter {
	struct cgit_filter base;
	char *script_file;
	lua_State *lua_state;
};

typedef ssize_t (*filter_write_fn)(struct cgit_filter *base, const void *buf, size_t count);

static ssize_t (*libc_write)(int fd, const void *buf, size_t count);
static filter_write_fn filter_write = NULL;
static struct cgit_filter *current_write_filter = NULL;

void cgit_init_filters(void)
{
	void *symbol = dlsym(RTLD_NEXT, "write");

	if (!symbol)
		die("Unable to find libc's write function");
	// ISO C cannot convert an object pointer to a function pointer, while
	// POSIX guarantees the two share a representation, so the bytes are
	// copied across instead.
	memcpy(&libc_write, &symbol, sizeof(libc_write));
}

/*
 * Interposing on write is what lets a Lua filter see output produced by code
 * that has no idea a filter is running.
 */
ssize_t write(int fd, const void *buf, size_t count)
{
	// Git can write before cmd_main reaches cgit_init_filters, to a trace
	// target for one, so libc's write may still need looking up here.
	if (!libc_write)
		cgit_init_filters();
	if (fd != STDOUT_FILENO || !filter_write)
		return libc_write(fd, buf, count);
	return filter_write(current_write_filter, buf, count);
}

static inline void hook_write(struct cgit_filter *filter, filter_write_fn write_fn)
{
	// Filters cannot nest, because there is one stdout and one hook, so a
	// second one would strand the first.
	assert(!filter_write);
	assert(!current_write_filter);
	current_write_filter = filter;
	filter_write = write_fn;
}

static inline void unhook_write(void)
{
	assert(filter_write);
	assert(current_write_filter);
	filter_write = NULL;
	current_write_filter = NULL;
}

static NORETURN void die_lua_error(struct lua_filter *filter)
{
	lua_State *lua_state = filter->lua_state;
	const char *message = lua_tostring(lua_state, -1);

	// A script may raise any value, and only a string or a number has text
	// of its own, so anything else is named by its type, as lua.c does.
	if (!message)
		message = lua_pushfstring(lua_state, "(error object is a %s value)",
			luaL_typename(lua_state, -1));
	// The error page goes out through stdout, which may still be hooked
	// to the very filter that failed, so the hook comes off first or the
	// page would be fed back into the broken filter.
	if (filter_write)
		unhook_write();
	die("Lua error in %s: %s", filter->script_file, message);
}

static ssize_t write_lua_filter(struct cgit_filter *base, const void *buf, size_t count)
{
	struct lua_filter *filter = (struct lua_filter *)base;

	lua_getglobal(filter->lua_state, "filter_write");
	lua_pushlstring(filter->lua_state, buf, count);
	if (lua_pcall(filter->lua_state, 1, 0, 0))
		die_lua_error(filter);
	return count;
}

/*
 * Output a script asks for belongs on the page, not back in its own filter,
 * so the hook comes off around the call. The zero returned is Lua's count
 * of values pushed, not a success code.
 */
static inline int emit_unfiltered(lua_State *lua_state, void (*emit)(const char *text))
{
	const char *text;
	filter_write_fn saved_write;
	struct cgit_filter *saved_filter;

	text = lua_tostring(lua_state, 1);
	if (!text)
		return 0;

	// A script that writes while it is still loading runs before cgit has
	// hooked stdout for it, so there is no hook to take off.
	saved_write = filter_write;
	saved_filter = current_write_filter;
	if (saved_write)
		unhook_write();
	emit(text);
	// emit leaves bytes in the html buffer, so empty it while the hook is
	// still off. Re-hooking first would send the page's own bytes back into
	// the filter.
	html_flush();
	if (saved_write)
		hook_write(saved_filter, saved_write);

	return 0;
}

static int script_html(lua_State *lua_state)
{
	return emit_unfiltered(lua_state, html);
}

static int script_html_txt(lua_State *lua_state)
{
	return emit_unfiltered(lua_state, html_txt);
}

static int script_html_attr(lua_State *lua_state)
{
	return emit_unfiltered(lua_state, html_attr);
}

static int script_html_url_path(lua_State *lua_state)
{
	return emit_unfiltered(lua_state, html_url_path);
}

static int script_html_url_arg(lua_State *lua_state)
{
	return emit_unfiltered(lua_state, html_url_arg);
}

static int script_html_include(lua_State *lua_state)
{
	return emit_unfiltered(lua_state, html_include);
}

static const struct {
	const char *name;
	lua_CFunction fn;
} script_globals[] = {
	{ "html", script_html },
	{ "html_txt", script_html_txt },
	{ "html_attr", script_html_attr },
	{ "html_url_path", script_html_url_path },
	{ "html_url_arg", script_html_url_arg },
	{ "html_include", script_html_include },
};

static void init_lua_filter(struct lua_filter *filter)
{
	size_t i;

	if (filter->lua_state)
		return;

	// A new state fails only when memory has run out, which cgit answers by
	// dying wherever else it allocates.
	filter->lua_state = luaL_newstate();
	if (!filter->lua_state)
		die("Unable to create a Lua state for %s", filter->script_file);

	luaL_openlibs(filter->lua_state);

	for (i = 0; i < ARRAY_SIZE(script_globals); i++) {
		lua_pushcfunction(filter->lua_state, script_globals[i].fn);
		lua_setglobal(filter->lua_state, script_globals[i].name);
	}

	if (luaL_dofile(filter->lua_state, filter->script_file))
		die_lua_error(filter);
}

static int open_lua_filter(struct cgit_filter *base, va_list ap)
{
	struct lua_filter *filter = (struct lua_filter *)base;
	int i;

	init_lua_filter(filter);
	hook_write(base, write_lua_filter);

	lua_getglobal(filter->lua_state, "filter_open");
	for (i = 0; i < filter->base.argument_count; ++i)
		lua_pushstring(filter->lua_state, va_arg(ap, char *));
	if (lua_pcall(filter->lua_state, filter->base.argument_count, 0, 0))
		die_lua_error(filter);
	return 0;
}

static int close_lua_filter(struct cgit_filter *base)
{
	struct lua_filter *filter = (struct lua_filter *)base;
	int ret;

	lua_getglobal(filter->lua_state, "filter_close");
	if (lua_pcall(filter->lua_state, 0, 1, 0))
		die_lua_error(filter);
	ret = (int)lua_tointeger(filter->lua_state, -1);
	lua_pop(filter->lua_state, 1);

	unhook_write();
	return ret;
}

static void fprintf_lua_filter(struct cgit_filter *base, FILE *f, const char *prefix)
{
	struct lua_filter *filter = (struct lua_filter *)base;
	fprintf(f, "%slua:%s\n", prefix, filter->script_file);
}

static void cleanup_lua_filter(struct cgit_filter *base)
{
	struct lua_filter *filter = (struct lua_filter *)base;

	if (filter->lua_state) {
		lua_close(filter->lua_state);
		filter->lua_state = NULL;
	}
	free(filter->script_file);
	filter->script_file = NULL;
}

static struct cgit_filter *new_lua_filter(const char *cmd, int argument_count)
{
	struct lua_filter *filter;

	filter = xcalloc(1, sizeof(*filter));
	filter->base.open = open_lua_filter;
	filter->base.close = close_lua_filter;
	filter->base.fprintfp = fprintf_lua_filter;
	filter->base.cleanup = cleanup_lua_filter;
	filter->base.argument_count = argument_count;
	filter->script_file = cgit_strdup_first_line(cmd);

	return &filter->base;
}
#else
void cgit_init_filters(void)
{
}
#endif

int cgit_open_filter(struct cgit_filter *filter, ...)
{
	int result;
	va_list ap;

	if (!filter)
		return 0;
	// Whatever is still buffered belongs to the page, not to the filter
	// that is about to take over stdout.
	html_flush();
	va_start(ap, filter);
	result = filter->open(filter, ap);
	va_end(ap);
	return result;
}

int cgit_close_filter(struct cgit_filter *filter)
{
	if (!filter)
		return 0;
	// Anything written while the filter was open is meant for it, so this
	// has to go out before the filter hands stdout back.
	html_flush();
	return filter->close(filter);
}

void cgit_fprintf_filter(struct cgit_filter *filter, FILE *f, const char *prefix)
{
	filter->fprintfp(filter, f, prefix);
}

static inline void cleanup_filter(struct cgit_filter *filter)
{
	if (filter && filter->cleanup)
		filter->cleanup(filter);
}

void cgit_cleanup_filters(void)
{
	int i;

	cleanup_filter(ctx.cfg.about_filter);
	cleanup_filter(ctx.cfg.commit_filter);
	cleanup_filter(ctx.cfg.source_filter);
	cleanup_filter(ctx.cfg.email_filter);
	cleanup_filter(ctx.cfg.trailer_filter);
	cleanup_filter(ctx.cfg.auth_filter);
	for (i = 0; i < cgit_repolist.count; ++i) {
		cleanup_filter(cgit_repolist.repos[i].about_filter);
		cleanup_filter(cgit_repolist.repos[i].commit_filter);
		cleanup_filter(cgit_repolist.repos[i].source_filter);
		cleanup_filter(cgit_repolist.repos[i].email_filter);
		cleanup_filter(cgit_repolist.repos[i].trailer_filter);
	}
}

/*
 * Take stdout back from a filter that holds it when a die lands, so the error
 * page reaches the visitor and not the filter. What the page had buffered for
 * the filter is dropped with it, since it was never meant to go out as it is.
 * An exec child sees the end of its input and exits on its own.
 */
void cgit_abort_filters(void)
{
	html_discard();
	if (running_exec) {
		dup2(running_exec->old_stdout, STDOUT_FILENO);
		close(running_exec->old_stdout);
		running_exec = NULL;
	}
#ifndef NO_LUA
	if (filter_write)
		unhook_write();
#endif
}

int cgit_filter_holds_stdout(void)
{
	return running_exec != NULL;
}

struct cgit_filter *cgit_new_filter(const char *cmd, filter_type filtertype)
{
	const char *colon, *arg;
	int argument_count;

	if (!cmd || !cmd[0])
		return NULL;

	switch (filtertype) {
	case AUTH:
		argument_count = 12;
		break;
	case EMAIL:
	case TRAILER:
		argument_count = 2;
		break;
	case ABOUT:
		argument_count = 3;
		break;
	case SOURCE:
		argument_count = 1;
		break;
	case COMMIT:
	default:
		argument_count = 0;
		break;
	}

	if (skip_prefix(cmd, "exec:", &arg))
		return new_exec_filter(arg, argument_count);
	if (skip_prefix(cmd, "lua:", &arg)) {
#ifdef NO_LUA
		die("Built without Lua, cannot run filter %s", cmd);
#else
		return new_lua_filter(arg, argument_count);
#endif
	}

	// A single letter before the colon is a Windows drive letter, not a
	// filter prefix.
	colon = strchr(cmd, ':');
	if (!colon || colon - cmd == 1)
		return new_exec_filter(cmd, argument_count);
	die("Invalid filter type: %.*s", (int)(colon - cmd), cmd);
}