passenger 5.1.12 → 5.2.0

data/src/agent/Core/SpawningKit/Config.h

@@ -28,9 +28,12 @@
 
 #include <boost/function.hpp>
 #include <boost/make_shared.hpp>
+#include <boost/thread.hpp>
 #include <string>
 #include <cstddef>
 
+#include <jsoncpp/json.h>
+
 #include <ResourceLocator.h>
 #include <RandomGenerator.h>
 #include <Exceptions.h>
@@ -59,9 +62,11 @@ typedef boost::function<void (const char *data, unsigned int size)> OutputHandle
 struct Config {
 	// Used by error pages and hooks.
 	ResourceLocator *resourceLocator;
-	const VariantMap *agentsOptions;
 	ErrorHandler errorHandler;
 
+	boost::mutex agentConfigSyncher;
+	Json::Value agentConfig;
+
 	// Used for Union Station logging.
 	UnionStation::ContextPtr unionStationContext;
 
@@ -82,7 +87,6 @@ struct Config {
 
 	Config()
 		: resourceLocator(NULL),
-		  agentsOptions(NULL),
 		  errorHandler(NULL),
 		  concurrency(1),
 		  spawnerCreationSleepTime(0),

data/src/agent/Core/SpawningKit/Spawner.h

@@ -774,51 +774,6 @@ protected:
 		assert(info.appRootPathsInsideChroot.back() == info.appRootInsideChroot);
 	}
 
-#ifdef false
-	void inferApplicationInfo(SpawnPreparationInfo &info) const {
-		info.codeRevision = readFromRevisionFile(info);
-		if (info.codeRevision.empty()) {
-			info.codeRevision = inferCodeRevisionFromCapistranoSymlink(info);
-		}
-	}
-
-	string readFromRevisionFile(const SpawnPreparationInfo &info) const {
-		string filename = info.appRoot + "/REVISION";
-		try {
-			if (fileExists(filename)) {
-				return strip(readAll(filename));
-			}
-		} catch (const SystemException &e) {
-			P_WARN("Cannot access " << filename << ": " << e.what());
-		}
-		return string();
-	}
-
-	string inferCodeRevisionFromCapistranoSymlink(const SpawnPreparationInfo &info) const {
-		if (extractBaseName(info.appRoot) == "current") {
-			char buf[PATH_MAX + 1];
-			ssize_t ret;
-
-			do {
-				ret = readlink(info.appRoot.c_str(), buf, PATH_MAX);
-			} while (ret == -1 && errno == EINTR);
-			if (ret == -1) {
-				if (errno == EINVAL) {
-					return string();
-				} else {
-					int e = errno;
-					P_WARN("Cannot read symlink " << info.appRoot << ": " << strerror(e));
-				}
-			}
-
-			buf[ret] = '\0';
-			return extractBaseName(buf);
-		} else {
-			return string();
-		}
-	}
-#endif
-
 	bool shouldLoadShellEnvvars(const Options &options, const SpawnPreparationInfo &preparation) const {
 		if (options.loadShellEnvvars) {
 			string shellName = extractBaseName(preparation.userSwitching.shell);

data/src/agent/Core/SpawningKit/UserSwitchingRules.h

@@ -36,6 +36,7 @@
 #include <oxt/system_calls.hpp>
 #include <Exceptions.h>
 #include <Utils.h>
+#include <FileTools/PathManip.h>
 #include <Core/SpawningKit/Options.h>
 
 namespace Passenger {

data/src/agent/Shared/ApiAccountUtils.h

@@ -0,0 +1,318 @@
+/*
+ *  Phusion Passenger - https://www.phusionpassenger.com/
+ *  Copyright (c) 2015-2017 Phusion Holding B.V.
+ *
+ *  "Passenger", "Phusion Passenger" and "Union Station" are registered
+ *  trademarks of Phusion Holding B.V.
+ *
+ *  Permission is hereby granted, free of charge, to any person obtaining a copy
+ *  of this software and associated documentation files (the "Software"), to deal
+ *  in the Software without restriction, including without limitation the rights
+ *  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ *  copies of the Software, and to permit persons to whom the Software is
+ *  furnished to do so, subject to the following conditions:
+ *
+ *  The above copyright notice and this permission notice shall be included in
+ *  all copies or substantial portions of the Software.
+ *
+ *  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ *  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ *  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ *  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ *  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ *  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ *  THE SOFTWARE.
+ */
+#ifndef _PASSENGER_API_ACCOUNT_UTILS_H_
+#define _PASSENGER_API_ACCOUNT_UTILS_H_
+
+#include <vector>
+#include <string>
+#include <cstddef>
+
+#include <oxt/macros.hpp>
+#include <boost/config.hpp>
+
+#include <ConfigKit/ConfigKit.h>
+#include <Exceptions.h>
+#include <StaticString.h>
+#include <FileTools/PathManip.h>
+#include <Utils.h>
+#include <Utils/StrIntUtils.h>
+
+namespace Passenger {
+namespace ApiAccountUtils { // Avoid conflict with classes of the same name in ApiServerUtils.h, until we've migrated everything
+
+using namespace std;
+
+
+/*
+ * This file implements handling of API accounts.
+ *
+ * The various PassengerAgent ApiServers can be accessed through HTTP sockets.
+ * Authenticating and authorizating clients is handled through API accounts.
+ * Each ApiServer embeds an API account database. Each account contains a
+ * username, password and a privilege level.
+ *
+ * The API account and the API account database are represented by the
+ * `ApiAccount` and `ApiAccountDatabase` classes, respectively. Both of them
+ * are supposed to be used in an immutable manner.
+ *
+ * Users can specify API accounts in two formats:
+ *
+ *  1. Through a JSON array:
+ *
+ *       [
+ *         {
+ *           "username": "foo",
+ *
+ *           // One of these must exist:
+ *           "password": "bar",
+ *           "password_file": "/filename"
+ *
+ *           "level": "readonly" | "full"   // Optional; "full" is defeault
+ *         },
+ *         ...
+ *       ]
+ *
+ *  2. Through a list of description strings, each in the form of:
+ *
+ *       [LEVEL]:USERNAME:PASSWORDFILE
+ *
+ *     LEVEL is one of:
+ *
+ *       readonly    Read-only access
+ *       full        Full access (default)
+ *
+ *
+ * This file contains three functions for operating on input supplied in
+ * one of the two formats (scroll down for descriptions):
+ *
+ *  - validateAuthorizationsField() -- checks whether a JSON array conforms to the above format.
+ *  - normalizeApiAccountJson() -- normalizes an item in the JSON array into a consistent format.
+ *  - parseApiAccountDescription() -- parses a description string into a JSON object.
+ *
+ * An authorizations JSON array is considered *valid* if it passes `validateAuthorizationsField()`.
+ * An authorization JSON object is considered *normalized* if it conforms to the output format
+ * generated by `normalizeApiAccountJson()`.
+ *
+ * Valid and normalized are orthogonal concepts. One does not imply the other.
+ */
+
+
+inline Json::Value parseApiAccountDescription(const StaticString &description);
+
+
+/**
+ * Checks whether an authorization JSON array conforms to the specified format.
+ *
+ * A JSON array that passes this function is *valid*, although not necessarily *normalized*.
+ */
+static void
+validateAuthorizationsField(const string &key, const ConfigKit::Store &config,
+	vector<ConfigKit::Error> &outputErrors)
+{
+	typedef ConfigKit::Error Error;
+
+	if (config[key].isNull()) {
+		return;
+	}
+
+	const Json::Value authorizations = config[key];
+	Json::Value::const_iterator it, end = authorizations.end();
+	vector<ConfigKit::Error> errors;
+
+	for (it = authorizations.begin(); it != end; it++) {
+		const Json::Value &auth = *it;
+
+		if (auth.isString()) {
+			try {
+				parseApiAccountDescription(auth.asString());
+			} catch (const ArgumentException &e) {
+				errors.push_back(Error("'{{" + key + "}}' contains an invalid authorization description ("
+					+ auth.asString() + "): " + e.what()));
+			}
+		} else if (auth.isObject()) {
+			if (auth.isMember("username")) {
+				if (!auth["username"].isString()) {
+					errors.push_back(Error("All usernames in '{{" + key + "}}' must be strings"));
+				} else if (auth["username"].asString() == "api") {
+					errors.push_back(Error("'{{" + key + "}}' may not contain an 'api' username"));
+				}
+			} else {
+				errors.push_back(Error("All objects in '{{" + key + "}}' must contain the 'username' key"));
+			}
+
+			if (auth.isMember("password")) {
+				if (!auth["password"].isString()) {
+					errors.push_back(Error("All passwords in '{{" + key + "}}' must be strings"));
+				}
+				if (auth.isMember("password_file")) {
+					errors.push_back(Error("Entries in '{{" + key + "}}' must contain either the"
+						" 'password' or the 'password_file' field, but not both"));
+				}
+			} else if (auth.isMember("password_file")) {
+				if (!auth["password_file"].isString()) {
+					errors.push_back(Error("All 'password_file' fields in '{{" + key + "}}' must be strings"));
+				}
+			} else {
+				errors.push_back(Error("All objects in '{{" + key + "}}' must contain either the"
+					" 'password' or 'password_file' key"));
+			}
+
+			if (auth.isMember("level")) {
+				if (!auth["level"].isString() || (
+					auth["level"].asString() != "readonly"
+					&& auth["level"].asString() != "full"))
+				{
+					errors.push_back(Error("All 'level' fields in '{{" + key + "}}' must be either"
+						" 'readonly' or 'full'"));
+				}
+			}
+		} else {
+			errors.push_back(Error("'{{" + key + "}}' may only contain strings or objects"));
+		}
+	}
+
+	errors = ConfigKit::deduplicateErrors(errors);
+	outputErrors.insert(outputErrors.end(), errors.begin(), errors.end());
+}
+
+/**
+ * Given a *valid* authorizations JSON array, this function
+ * turns that array into a consistent format.
+ *
+ * For example it ensures that, if the "level" field does
+ * not exist, it is inserted with the default value.
+ */
+inline Json::Value
+normalizeApiAccountJson(const Json::Value &json) {
+	if (json.isString()) {
+		return parseApiAccountDescription(json.asString());
+	} else {
+		Json::Value doc = json;
+		if (json.isMember("password_file")) {
+			doc["password_file"] = absolutizePath(json["password_file"].asString());
+		}
+		if (!json.isMember("level")) {
+			doc["level"] = "full";
+		}
+		return doc;
+	}
+}
+
+inline Json::Value
+normalizeApiAccountsJson(const Json::Value &json) {
+	Json::Value doc = json;
+	Json::Value::iterator it, end = doc.end();
+	for (it = doc.begin(); it != end; it++) {
+		*it = normalizeApiAccountJson(*it);
+	}
+	return doc;
+}
+
+/**
+ * Parses an API account description string into a *valid* (but not necessarily
+ * *normalized*) JSON object.
+ *
+ * @throws ArgumentException One of the input arguments contains a disallowed value.
+ */
+inline Json::Value
+parseApiAccountDescription(const StaticString &description) {
+	Json::Value json;
+	vector<StaticString> args;
+
+	split(description, ':', args);
+
+	if (args.size() == 2) {
+		json["username"] = args[0].toString();
+		json["password_file"] = args[1].toString();
+		json["level"] = "full";
+	} else if (args.size() == 3) {
+		json["username"] = args[1].toString();
+		json["password_file"] = args[2].toString();
+		if (args[0] == "full" || args[0] == "readonly") {
+			json["level"] = args[0].toString();
+		} else {
+			throw ArgumentException("'level' field must be either 'full' or 'readonly'");
+		}
+	} else {
+		throw ArgumentException(string());
+	}
+
+	if (OXT_UNLIKELY(json["username"].asString() == "api")) {
+		throw ArgumentException("the username 'api' is not allowed");
+	}
+
+	return json;
+}
+
+struct ApiAccount {
+	string username;
+	string password;
+	bool readonly;
+
+	/**
+	 * Constructs an ApiAccount.
+	 *
+	 * @params doc An *normalized* authorization JSON object.
+	 */
+	ApiAccount(const Json::Value &doc) {
+		username = doc["username"].asString();
+		if (doc.isMember("password")) {
+			password = doc["password"].asString();
+		} else {
+			password = strip(readAll(doc["password_file"].asString()));
+		}
+		readonly = doc["level"].asString() == "readonly";
+	}
+};
+
+class ApiAccountDatabase {
+private:
+	vector<ApiAccount> database;
+
+public:
+	ApiAccountDatabase() { }
+
+	/**
+	 * Constructs an ApiAccountDatabase.
+	 *
+	 * @param authorizations A *normalized* JSON array of authorization objects.
+	 */
+	ApiAccountDatabase(const Json::Value &authorizations) {
+		database.reserve(authorizations.size());
+
+		Json::Value::const_iterator it, end = authorizations.end();
+		for (it = authorizations.begin(); it != end; it++) {
+			const Json::Value &auth = *it;
+			database.push_back(ApiAccount(auth));
+		}
+	}
+
+	bool empty() const {
+		return database.empty();
+	}
+
+	const ApiAccount *lookup(const StaticString &username) const {
+		vector<ApiAccount>::const_iterator it, end = database.end();
+
+		for (it = database.begin(); it != end; it++) {
+			if (it->username == username) {
+				return &(*it);
+			}
+		}
+
+		return NULL;
+	}
+
+	void swap(ApiAccountDatabase &other) BOOST_NOEXCEPT_OR_NOTHROW {
+		database.swap(other.database);
+	}
+};
+
+
+} // namespace ApiAccountUtils
+} // namespace Passenger
+
+#endif /* _PASSENGER_API_ACCOUNT_UTILS_H_*/

data/src/agent/Shared/ApiServerUtils.h

@@ -33,12 +33,6 @@
  *
  * This file consists of the following items.
  *
- * ## API accounts
- *
- * API servers can be password protected. They support multiple accounts,
- * each with its own privilege level. These accounts are represented by
- * ApiAccount, stored in ApiAccountDatabase objects.
- *
  * ## Authorization
  *
  * The authorizeXXX() family of functions implement authorization checking on a
@@ -94,102 +88,6 @@ using namespace std;
 inline string truncateApiKey(const StaticString &apiKey);
 
 
-/*******************************
- *
- * API accounts
- *
- *******************************/
-
-struct ApiAccount {
-	string username;
-	string password;
-	bool readonly;
-};
-
-class ApiAccountDatabase {
-private:
-	vector<ApiAccount> database;
-
-	bool levelDescriptionIsReadOnly(const StaticString &level) const {
-		if (level == "readonly") {
-			return true;
-		} else if (level == "full") {
-			return false;
-		} else {
-			throw ArgumentException("Invalid privilege level " + level);
-		}
-	}
-
-public:
-	/**
-	 * Add an account to the database with the given parameters.
-	 *
-	 * @throws ArgumentException One if the input arguments contain a disallowed value.
-	 */
-	void add(const string &username, const string &password, bool readonly) {
-		if (OXT_UNLIKELY(username == "api")) {
-			throw ArgumentException("It is not allowed to register an API account with username 'api'");
-		}
-
-		ApiAccount account;
-		account.username = username;
-		account.password = password;
-		account.readonly = readonly;
-		database.push_back(account);
-	}
-
-	/**
-	 * Add an account to the database. The account parameters are determined
-	 * by a description string in the form of [LEVEL]:USERNAME:PASSWORDFILE.
-	 * LEVEL is one of:
-	 *
-	 *   readonly    Read-only access
-     *   full        Full access (default)
-	 *
-	 * @throws ArgumentException One if the input arguments contain a disallowed value.
-	 */
-	void add(const StaticString &description) {
-		ApiAccount account;
-		vector<string> args;
-
-		split(description, ':', args);
-
-		if (args.size() == 2) {
-			account.username = args[0];
-			account.password = strip(readAll(args[1]));
-			account.readonly = false;
-		} else if (args.size() == 3) {
-			account.username = args[1];
-			account.password = strip(readAll(args[2]));
-			account.readonly = levelDescriptionIsReadOnly(args[0]);
-		} else {
-			throw ArgumentException("Invalid authorization description '" + description + "'");
-		}
-
-		if (OXT_UNLIKELY(account.username == "api")) {
-			throw ArgumentException("It is not allowed to register an API account with username 'api'");
-		}
-		database.push_back(account);
-	}
-
-	bool empty() const {
-		return database.empty();
-	}
-
-	const ApiAccount *lookup(const StaticString &username) const {
-		vector<ApiAccount>::const_iterator it, end = database.end();
-
-		for (it = database.begin(); it != end; it++) {
-			if (it->username == username) {
-				return &(*it);
-			}
-		}
-
-		return NULL;
-	}
-};
-
-
 /*******************************
  *
  * Authorization functions
@@ -268,7 +166,7 @@ authorize(ApiServer *server, Client *client, Request *req) {
 		}
 	}
 
-	if (server->apiAccountDatabase->empty()) {
+	if (server->getApiAccountDatabase().empty()) {
 		SKC_INFO_FROM_STATIC(server, client,
 			"Authenticated as administrator because API account database is empty");
 		auth.apiKey = ApplicationPool2::ApiKey::makeSuper();
@@ -289,7 +187,8 @@ authorize(ApiServer *server, Client *client, Request *req) {
 				auth.canModifyPool = true;
 			}
 		} else {
-			const ApiAccount *account = server->apiAccountDatabase->lookup(username);
+			const typename ApiServer::ApiAccount *account =
+				server->getApiAccountDatabase().lookup(username);
 			if (account != NULL && constantTimeCompare(password, account->password)) {
 				SKC_INFO_FROM_STATIC(server, client,
 					"Authenticated with administrator account: " << username);