aboutsummaryrefslogtreecommitdiff
path: root/net/cgi-io
Commit message (Collapse)AuthorAge
* treewide: refresh hashes after move to use ZSTD as defaultRobert Marko2024-04-07
| | | | | | | | With the recent move to using ZSTD as the default compression format for packaging git repo clones we must refresh all of the hashes for the packages feed as well. Signed-off-by: Robert Marko <robimarko@gmail.com>
* cgi-io: Fix PKG_MIRROR_HASH after APK changesHannu Nyman2024-04-03
| | | | | | | Adjust PKG_MIRROR_HASH to the filename change due to APK preparations. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* cgi-io: update to latest Git HEADJo-Philipp Wich2022-08-10
| | | | | | 901b0f0 main: fix two one-byte overreads in header_value() Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* cgi-io: update to latest Git HEADJo-Philipp Wich2021-09-08
| | | | | | | | 98cef9d Retry splice() syscall on EINTR Fixes: https://github.com/openwrt/luci/issues/5342 Fixes: https://bugs.openwrt.org/index.php?do=details&task_id=4006 Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* treewide: back to cmake.mkRosen Penev2021-06-12
| | | | | | Ninja was merged to base and therefore we can now use normal cmake.mk Signed-off-by: Rosen Penev <rosenp@gmail.com>
* treewide: build CMake projects with NinjaRosen Penev2021-03-27
| | | | | | | | | | | | | | | | | | | | faster to compile. A small selection of packages was tested going from: Executed in 696.30 secs fish external usr time 82.98 mins 395.00 micros 82.98 mins sys time 9.02 mins 0.00 micros 9.02 mins to: Executed in 592.20 secs fish external usr time 84.84 mins 361.00 micros 84.84 mins sys time 8.85 mins 57.00 micros 8.85 mins Tested by running make -j 12 and wiping staging/build_dir/target_x Signed-off-by: Rosen Penev <rosenp@gmail.com>
* cgi-io: update to version 2020-10-27Petr Štetiar2020-10-27
| | | | | | | | | | | | | | | | | | | | Contains following list of changes: ab4c3471b261 tests: add cram based unit tests 7b4e3241e1bd tests: add cgi-io built with clang sanitizers 21831f45d16d Disable session ACLs during unit testing 2f525417b5df Add initial GitLab CI support 57f1c4f18cb6 Add .gitignore 09f9ac5066ee Fix off-by-one in postdecode_fields ed8ce0d5d28b Add fuzzing of utility functions a61581819800 Add fuzzing of multipart_parser 6b0615b728ed Refactor utility functions into static library a0ed2c9a7a72 Fix clang compiler errors 232659da19a4 Fix possible NULL dereference 8e5719b37a67 Fix warnings reported by clang-10 static analyzer b99aa8a64cca Remove Makefile Signed-off-by: Petr Štetiar <ynezz@true.cz>
* cgi-io: move into out of tree projectPetr Štetiar2020-10-11
| | | | | | | | | | No functional changes, just moved the sources into out of tree project[1] so it's going to be easier to do CI with unit testing, fuzzing etc. 1. https://git.openwrt.org/?p=project/cgi-io.git;a=shortlog Signed-off-by: Petr Štetiar <ynezz@true.cz>
* cgi-io: fix compilation against uClibcJo-Philipp Wich2020-02-27
| | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* cgi-io: use O_TMPFILE for uploads and attempt to directly link target fileJo-Philipp Wich2020-02-22
| | | | | | | | | | | | Create an anonymous inode in /tmp using O_TMPFILE and attempt to link the file in place using linkat(). Only fall back to the old file copy when linking the tempfile fails. Avoids double memory use if both the temporary upload file and the destination file are located in /tmp. Ref: https://github.com/openwrt/luci/issues/3654 Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* cgi-io: use dynamic memory for post decoding, support proc filesJo-Philipp Wich2020-02-13
| | | | | | | | | | Allocate dynamic buffer memory for decoding post data and allow post requsts up to 128KB compared to the previos 1KB limit. Also support downloading /proc and /sys files by falling back to chunked transfer encoding when the file size cannot be determined. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* cgi-io: close pipe descriptors earlyJo-Philipp Wich2019-12-18
| | | | | | | | | In the command read side, close the superfluous write end of the pipe early to ensure that EOF is reliably detected. Without that change, splice calls to read from the pipe will occasionally hang until the CGI process is eventually killed due to timeout. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* cgi-io: implement exec actionJo-Philipp Wich2019-12-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Implement a new "cgi-exec" applet which allows to invoke remote commands and stream their stdandard output back to the client via HTTP. This is needed in cases where large amounts of data or binary encoded contents such as tar archives need to be transferred, which are unsuitable to be transported via ubus directly. The exec call is guarded by the same ACL semantics as rpcd's file plugin, means in order to be able to execute a command remotely, the ubus session identified by the given session ID must have read access to the "exec" function of the "cgi-io" scope and an explicit "exec" permission rule for the invoked command in the "file" scope. In order to initiate a transfer, a POST request in x-www-form-urlencoded format must be sent to the applet, with one field "sessionid" holding the login session and another field "command" specifiying the commandline to invoke. Further optional fields are "filename" which - if present - will cause the download applet to set a Content-Dispostition header and "mimetype" which allows to let the applet respond with a specific type instead of the default "application/octet-stream". Below is an example for the required ACL rules to grant exec access to both the "date" and "iptables" commands. The "date" rule specifies the base name of the executable and thus allows invocation with arbitrary parameters while the latter "iptables" rule merely allows one specific set of arguments which must appear exactly in the given order. ubus call session grant '{ "ubus_rpc_session": "...", "scope": "cgi-io", "objects": [ [ "exec", "read" ] ] }' ubus call session grant '{ "ubus_rpc_session": "...", "scope": "file", "objects": [ [ "/bin/date", "exec" ], [ "/usr/sbin/iptables -n -v -L", "exec" ] ] }' Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* cgi-io: iron out extra compiler warningsPetr Štetiar2019-10-11
| | | | | | | | | | | | Fixes following errors: main.c:458:37: error: comparison of integer expressions of different signedness: ‘int’ and ‘size_t’ {aka ‘long unsigned int’} [-Werror=sign-compare] main.c:463:17: error: comparison of integer expressions of different signedness: ‘int’ and ‘long unsigned int’ [-Werror=sign-compare] main.c:518:35: error: comparison of integer expressions of different signedness: ‘ssize_t’ {aka ‘long int’} and ‘size_t’ {aka ‘long unsigned int’} [-Werror=sign-compare] main.c:157:3: error: ignoring return value of ‘read’, declared with attribute warn_unused_result [-Werror=unused-result] main.c:763:3: error: ignoring return value of ‘chdir’, declared with attribute warn_unused_result [-Werror=unused-result] Signed-off-by: Petr Štetiar <ynezz@true.cz>
* cgi-io: cmake: enable extra compiler warningsPetr Štetiar2019-10-11
| | | | | | Spotting issues during compilation is cheaper. Signed-off-by: Petr Štetiar <ynezz@true.cz>
* cgi-io: cmake: fix libraries lookupPetr Štetiar2019-10-11
| | | | | | In order to make it compile properly in more environments. Signed-off-by: Petr Štetiar <ynezz@true.cz>
* cgi-io: fix read after end errorsAnsuel Smith2019-10-10
| | | | | | | | Currently cgi-io try to read data after the data ended. - Adds "-" to whitelist char - In main_upload is tried to consume the buffer while it's already readed by the while loop before Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
* cgi-io: use splice() to stream backup archiveJo-Philipp Wich2019-09-13
| | | | | | This improves the I/O performance when outputting large backups. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* cgi-io: pass appropriate HTTP error codes to failure()Jo-Philipp Wich2019-09-13
| | | | | | | Instead of always replying with a generic 500 internal server error code, use more appropriate codes such as 403 to indicate denied permissions. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* cgi-io: add download operationJo-Philipp Wich2019-09-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a new `cgi-download` applet which allows to retrieve the contents of regular files or block devices. In order to initiate a transfer, a POST request in x-www-form-urlencoded format must be sent to the applet, with one field "sessionid" holding the login session and another field "path" containing the file path to download. Further optional fields are "filename" which - if present - will cause the download applet to set a Content-Dispostition header and "mimetype" which allows to let the applet respond with a specific type instead of the default "application/octet-stream". Below is an example for the required acl rules to grant download access to files or block devices: ubus call session grant '{ "ubus_rpc_session": "...", "scope": "cgi-io", "objects": [ [ "download", "read" ] ] }' ubus call session grant '{ "ubus_rpc_session": "...", "scope": "file", "objects": [ [ "/etc/config/*", "read" ], [ "/dev/mtdblock*", "read" ] ] }' Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* cgi-io: use different acl scopes for path and command permissionsJo-Philipp Wich2019-09-13
| | | | | | | | | | | | | | | | | | | | | | | | | Use the `cgi-io` scope to check for permission to execute the requested command (`upload`, `backup`) and the `file` scope to check path permissions. The reasoning of this change is that `cgi-io` is usually used in conjunction with `rpcd-mod-file` to transfer large file data out of band and `rpcd-mod-file` already uses the `file` scope to manage file path access permissions. After this change, both `rpc-mod-file` and `cgi-io` can share the same path acl rules. Write access to a path can be granted by using an ubus call in the following form: ubus call session grant '{ "ubus_rpc_session": "...", "scope": "file", "objects": [ [ "/var/lib/uploads/*", "write" ] ] }' Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* treewide: Change .*GPL.*+ licenses to SPDX compatible identifierSven Eckelmann2019-09-10
| | | | | | | | The CONTRIBUTING.md requests an (or multiple) SPDX identifier for GPL licenses. But a lot of packages did use a different, non-SPDX style with a "+" at the end instead of "-or-later". Signed-off-by: Sven Eckelmann <sven@narfation.org>
* cgi-io: require whitelisting upload locationsJo-Philipp Wich2019-08-30
| | | | | | | | | | | | | | | | | | | | Introduce further ACL checks to verify that the request-supplied upload location may be written to. This prevents overwriting things like /bin/busybox and allows to confine uploads to specific directories. To setup the required ACLs, the following ubus command may be used on the command line: ubus call session grant '{ "ubus_rpc_session": "d41d8cd98f00b204e9800998ecf8427e", "scope": "cgi-io", "objects": [ [ "/etc/certificates/*", "write" ], [ "/var/uploads/*", "write" ] ] }' Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* cgi-io: Fix bugJianhui Zhao2019-05-30
| | | | | | The installation name is inconsistent with the code Signed-off-by: Jianhui Zhao <jianhuizhao329@gmail.com>
* cgi-io: support SHA256 checksums for file uploadsJo-Philipp Wich2017-11-13
| | | | | | | | | | | | Report SHA256 checksums in addition to the MD5 ones to make cgi-io suitable for sysupgrade image verification. Also allow stat(), md5sum and/or sha256sum to fail and respond with a JSON null value instead, leaving it to the frontend to handle errors as needed. Fixes #4790. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* cgi-io: fix stray semicolonJo-Philipp Wich2017-08-18
| | | | | | | | | | | | | | | | | Remove an improperly placed semicolon in order to solve the following compiler error: .../main.c:144:3: error: this 'if' clause does not guard... [-Werror=misleading-indentation] if (execl("/bin/busybox", "/bin/busybox", "md5sum", file, NULL)); ^~ .../main.c:145:4: note: ...this statement, but the latter is misleadingly indented as if it were guarded by the 'if' return NULL; ^~~~~~ cc1: all warnings being treated as errors Fixes #4723. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* cgi-io: merge changes from luci2-io-helperDaniel Golle2017-06-19
| | | | | | | | | | | | | luci2-io-helper: bugfix buckup script read timeout Reading files from stdin will block for ever. The uhttpd is killing the backup process after script_timeout. Switching read to non blocking mode and add a waitpid for the slave process does not end in a script_timeout anymore. Signed-off-by: Florian Eckert <Eckert.Florian@googlemail.com> Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* cgi-io: Find and search for libubus.hFlorian Fainelli2017-06-18
| | | | | | | | | | | | | Fixes build errors with external toolchains: [ 33%] Building C object CMakeFiles/cgi-io.dir/main.c.o /home/florian/dev/openwrt/trunk/build_dir/target-mipsel-unknown-linux-gnu_glibc/cgi-io/main.c:30:21: fatal error: libubus.h: No such file or directory #include <libubus.h> ^ compilation terminated. Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
* treewide: replace my defunct email addressJo-Philipp Wich2016-06-07
| | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* cgi-io: add a small helper cgi that can be used by RPCD based UIsJohn Crispin2015-10-02
Signed-off-by: John Crispin <blogic@openwrt.org>
Powered by cgit, Themed by Ted Yin.