@synopackageland/cli 0.14.1 → 0.15.1

package/assets/go/daemon/process_linux_test.go

@@ -1,161 +0,0 @@
-//go:build linux
-
-package main
-
-import (
-	"encoding/json"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strconv"
-	"sync"
-	"syscall"
-	"testing"
-	"time"
-)
-
-func waitDead(t *testing.T, pid int, birth string) {
-	t.Helper()
-	until := time.Now().Add(3 * time.Second)
-	for time.Now().Before(until) {
-		if !recordedChildAlive(pid, birth) {
-			return
-		}
-		time.Sleep(20 * time.Millisecond)
-	}
-	t.Fatalf("PID %d remained alive", pid)
-}
-func readFixtureRecord(t *testing.T, data string) record {
-	t.Helper()
-	raw, err := os.ReadFile(filepath.Join(data, "daemon/daemon.pid"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	var r record
-	if err := json.Unmarshal(raw, &r); err != nil {
-		t.Fatal(err)
-	}
-	return r
-}
-
-func TestLinuxSupervisorDeathAndConcurrentStart(t *testing.T) {
-	control, dest, data := fixture(t, "normal")
-	var wg sync.WaitGroup
-	results := make(chan int, 6)
-	for i := 0; i < 6; i++ {
-		wg.Add(1)
-		go func() { defer wg.Done(); rc, _ := runControl(control, "start", dest, data); results <- rc }()
-	}
-	wg.Wait()
-	close(results)
-	for rc := range results {
-		if rc != 0 {
-			t.Fatalf("concurrent start: %d", rc)
-		}
-	}
-	r := readFixtureRecord(t, data)
-	if err := syscall.Kill(r.Supervisor, syscall.SIGKILL); err != nil {
-		t.Fatal(err)
-	}
-	waitDead(t, r.Child, r.Birth)
-	if rc, out := runControl(control, "status", dest, data); rc != 1 {
-		t.Fatalf("lost-supervisor status: %d %s", rc, out)
-	}
-	if rc, out := runControl(control, "stop", dest, data); rc != 0 {
-		t.Fatalf("retire dead child: %d %s", rc, out)
-	}
-	if rc, out := runControl(control, "start", dest, data); rc != 0 {
-		t.Fatalf("restart after death: %d %s", rc, out)
-	}
-	if r2 := readFixtureRecord(t, data); r2.Child == r.Child {
-		t.Fatal("did not start fresh child")
-	}
-}
-
-func TestLinuxInventoryNeverSignalsForeignPID(t *testing.T) {
-	control, dest, data := fixture(t, "normal")
-	if rc, out := runControl(control, "start", dest, data); rc != 0 {
-		t.Fatalf("start: %d %s", rc, out)
-	}
-	r := readFixtureRecord(t, data)
-	if rc, out := runControl(control, "stop", dest, data); rc != 0 {
-		t.Fatalf("stop: %d %s", rc, out)
-	}
-	foreign := exec.Command("/bin/sleep", "30")
-	if err := foreign.Start(); err != nil {
-		t.Fatal(err)
-	}
-	defer func() { foreign.Process.Kill(); foreign.Wait() }()
-	r.Supervisor = foreign.Process.Pid
-	r.Child = foreign.Process.Pid
-	r.Birth = processBirth(r.Child)
-	raw, _ := json.Marshal(r)
-	path := filepath.Join(data, "daemon/daemon.pid")
-	if err := os.WriteFile(path, raw, 0600); err != nil {
-		t.Fatal(err)
-	}
-	if os.Geteuid() == 0 {
-		os.Chown(path, 65534, 65534)
-	}
-	for _, action := range []string{"stop", "start", "restart"} {
-		if rc, out := runControl(control, action, dest, data); rc != 1 {
-			t.Fatalf("%s accepted live unwitnessed PID: %d %s", action, rc, out)
-		}
-		if !recordedChildAlive(r.Child, r.Birth) {
-			t.Fatal("signalled inventory PID")
-		}
-	}
-	// A reused numeric PID with a different birth can be retired without killing it.
-	r.Birth = "1"
-	raw, _ = json.Marshal(r)
-	os.WriteFile(path, raw, 0600)
-	if rc, out := runControl(control, "stop", dest, data); rc != 0 {
-		t.Fatalf("retire reused PID: %d %s", rc, out)
-	}
-	if !recordedChildAlive(foreign.Process.Pid, processBirth(foreign.Process.Pid)) {
-		t.Fatal("killed reused PID")
-	}
-}
-
-func TestLinuxChildSelfExitAndDeadlines(t *testing.T) {
-	control, dest, data := fixture(t, "normal")
-	if rc, out := runControl(control, "start", dest, data); rc != 0 {
-		t.Fatalf("start: %d %s", rc, out)
-	}
-	r := readFixtureRecord(t, data)
-	if err := syscall.Kill(r.Child, syscall.SIGTERM); err != nil {
-		t.Fatal(err)
-	}
-	waitDead(t, r.Child, r.Birth)
-	time.Sleep(100 * time.Millisecond)
-	if rc, out := runControl(control, "status", dest, data); rc != 1 {
-		t.Fatalf("self exit: %d %s", rc, out)
-	}
-	control, dest, data = fixture(t, "ignore")
-	if rc, out := runControl(control, "start", dest, data); rc != 0 {
-		t.Fatalf("start: %d %s", rc, out)
-	}
-	r = readFixtureRecord(t, data)
-	began := time.Now()
-	if rc, out := runControl(control, "stop", dest, data); rc != 0 {
-		t.Fatalf("stop: %d %s", rc, out)
-	}
-	if elapsed := time.Since(began); elapsed < time.Second || elapsed > 3*time.Second {
-		t.Fatalf("stop deadline: %s", elapsed)
-	}
-	waitDead(t, r.Child, r.Birth)
-}
-
-func TestParseLinuxProcBirth(t *testing.T) {
-	fields := []string{"S", "1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "1234"}
-	raw := "42 (a ) tricky name)"
-	for _, f := range fields {
-		raw += " " + f
-	}
-	if birth, alive := parseBirth(raw); birth != "1234" || !alive {
-		t.Fatal(birth, alive)
-	}
-	if recordedChildAlive(os.Getpid(), strconv.Itoa(os.Getpid())) {
-		t.Fatal("different process birth matched")
-	}
-}

package/assets/go/daemon/process_other.go

@@ -1,14 +0,0 @@
-//go:build !linux
-
-package main
-
-import (
-	"net"
-	"syscall"
-)
-
-// Host-only tests exercise lifecycle/quoting; published controllers target Linux.
-func childAttributes() *syscall.SysProcAttr     { return &syscall.SysProcAttr{} }
-func processBirth(int) string                   { return "host-fixture" }
-func recordedChildAlive(pid int, _ string) bool { return syscall.Kill(pid, 0) == nil }
-func checkPeer(*net.UnixConn, int) error        { return nil }

package/assets/go/daemon/testdata/child.go

@@ -1,44 +0,0 @@
-// Linux/host fixture: a foreground process; never installed on a NAS.
-package main
-
-import (
-	"encoding/json"
-	"os"
-	"os/signal"
-	"syscall"
-	"time"
-)
-
-func main() {
-	if len(os.Args) > 1 {
-		switch os.Args[1] {
-		case "cleanup":
-			os.Exit(0)
-		case "cleanup-slow":
-			time.Sleep(2500 * time.Millisecond)
-			os.Exit(0)
-		case "cleanup-fail":
-			os.Exit(2)
-		case "cleanup-hang":
-			signal.Ignore(syscall.SIGTERM, syscall.SIGINT)
-			for {
-				time.Sleep(time.Second)
-			}
-		}
-	}
-	if os.Getenv("APP_MODE") == "exit" {
-		os.Exit(2)
-	}
-	raw, _ := json.Marshal(map[string]any{"uid": os.Geteuid(), "args": os.Args[1:], "env": os.Environ()})
-	fmtOutput := append(raw, '\n')
-	os.Stdout.Write(fmtOutput)
-	if os.Getenv("APP_MODE") == "ignore" {
-		signal.Ignore(syscall.SIGTERM, syscall.SIGINT)
-		for {
-			time.Sleep(time.Second)
-		}
-	}
-	c := make(chan os.Signal, 1)
-	signal.Notify(c, syscall.SIGTERM, syscall.SIGINT)
-	<-c
-}

package/assets/go/gateway/auth.go

@@ -1,101 +0,0 @@
-package main
-
-// DSM runs a package's CGI as the package account and forwards the browser's
-// cookies. The authenticator hands only the session carriers (cookie,
-// SynoToken, client address) to DSM's own authenticate.cgi, which prints the
-// signed-in user name, then resolves local groups or directory groups through DSM NSS.
-// It never parses the session cookie or trusts a user name from the request.
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net"
-	"net/http"
-	"net/url"
-	"os/exec"
-	"regexp"
-	"strings"
-	"time"
-)
-
-// authenticateCGI is DSM's session check for third-party CGIs.
-const authenticateCGI = "/usr/syno/synoman/webman/modules/authenticate.cgi"
-
-var errNoSession = errors.New("no valid DSM session")
-
-type identity struct {
-	User   string
-	Groups []string
-}
-
-type authenticator interface {
-	Authenticate(r *http.Request) (identity, error)
-}
-
-type dsmAuthenticator struct {
-	groupFile       string
-	passwdFile      string
-	directoryGroups func(context.Context, string) ([]string, error)
-	timeout         time.Duration
-	run             func(ctx context.Context, path string, env []string) ([]byte, error)
-}
-
-func newDSMAuthenticator() *dsmAuthenticator {
-	return &dsmAuthenticator{groupFile: "/etc/group", passwdFile: "/etc/passwd", timeout: 10 * time.Second, run: runCGI, directoryGroups: (directoryLookup{timeout: 2 * time.Second, run: runDirectoryCommand}).groups}
-}
-
-var userName = regexp.MustCompile(`^[A-Za-z0-9._@\\-]{1,193}$`)
-
-func (a *dsmAuthenticator) Authenticate(r *http.Request) (identity, error) {
-	cookie := r.Header.Get("Cookie")
-	if cookie == "" {
-		return identity{}, errNoSession
-	}
-	ctx, cancel := context.WithTimeout(r.Context(), a.timeout)
-	defer cancel()
-	out, err := a.run(ctx, authenticateCGI, sessionEnv(r, cookie))
-	var exit interface{ ExitCode() int }
-	if errors.As(err, &exit) {
-		return identity{}, errNoSession
-	}
-	if err != nil {
-		return identity{}, fmt.Errorf("run %s: %w", authenticateCGI, err)
-	}
-	user := strings.TrimSpace(string(out))
-	if !userName.MatchString(user) {
-		return identity{}, errNoSession
-	}
-	groups, err := a.groupsOf(ctx, user)
-	if err != nil {
-		return identity{}, err
-	}
-	return identity{User: user, Groups: groups}, nil
-}
-
-// sessionEnv is the complete environment authenticate.cgi sees: nothing from
-// this process and no request header besides the session carriers.
-func sessionEnv(r *http.Request, cookie string) []string {
-	token := r.Header.Get("X-SYNO-TOKEN")
-	if token == "" {
-		// A navigation or iframe cannot send the header; DSM's front end appends ?SynoToken= instead.
-		token = r.URL.Query().Get("SynoToken")
-	}
-	host, _, err := net.SplitHostPort(r.RemoteAddr)
-	if err != nil {
-		host = r.RemoteAddr
-	}
-	return []string{
-		"REQUEST_METHOD=GET",
-		"HTTP_COOKIE=" + cookie,
-		"HTTP_X_SYNO_TOKEN=" + token,
-		"QUERY_STRING=SynoToken=" + url.QueryEscape(token),
-		"REMOTE_ADDR=" + host,
-	}
-}
-
-func runCGI(ctx context.Context, path string, env []string) ([]byte, error) {
-	cmd := exec.CommandContext(ctx, path)
-	cmd.Env = env
-	return cmd.Output()
-}

package/assets/go/gateway/auth_test.go

@@ -1,216 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"slices"
-	"strings"
-	"testing"
-)
-
-const groupFile = `root:x:0:
-users:x:100:
-administrators:x:101:admin,alice
-staff:x:1030:alice,carol
-http:x:1023:
-`
-
-// DSM keeps no member list for users: the group is every local account's primary group.
-const passwdFile = `root:x:0:0::/root:/bin/sh
-alice:x:1001:100::/var/services/homes/alice:/sbin/nologin
-bob:x:1002:100::/var/services/homes/bob:/sbin/nologin
-carol:x:1003:100::/var/services/homes/carol:/sbin/nologin
-dave:x:1004:1030::/var/services/homes/dave:/sbin/nologin
-`
-
-type fakeRunner struct {
-	out  string
-	err  error
-	env  []string
-	path string
-}
-
-func (f *fakeRunner) run(_ context.Context, path string, env []string) ([]byte, error) {
-	f.path, f.env = path, env
-	return []byte(f.out), f.err
-}
-
-type exitError struct{}
-
-func (*exitError) Error() string { return "exit status 1" }
-func (*exitError) ExitCode() int { return 1 }
-
-func newTestAuth(t *testing.T, runner *fakeRunner) *dsmAuthenticator {
-	t.Helper()
-	dir := t.TempDir()
-	groups, passwd := filepath.Join(dir, "group"), filepath.Join(dir, "passwd")
-	for path, content := range map[string]string{groups: groupFile, passwd: passwdFile} {
-		if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-	a := newDSMAuthenticator()
-	a.groupFile, a.passwdFile = groups, passwd
-	a.run = runner.run
-	return a
-}
-
-func sessionRequest() *http.Request {
-	r := httptest.NewRequest(http.MethodGet, "/webman/3rdparty/App/cgi/gateway.cgi/", nil)
-	r.RemoteAddr = "192.0.2.7:51234"
-	r.Header.Set("Cookie", "id=abc; did=xyz")
-	r.Header.Set("X-SYNO-TOKEN", "tok+en/=")
-	r.Header.Set("User-Agent", "should-not-pass")
-	return r
-}
-
-func TestUserAndGroupsComeFromAuthenticateCGIAndGroupFile(t *testing.T) {
-	runner := &fakeRunner{out: "alice\n"}
-	id, err := newTestAuth(t, runner).Authenticate(sessionRequest())
-	if err != nil || id.User != "alice" {
-		t.Fatalf("got %+v, %v", id, err)
-	}
-	if want := []string{"users", "administrators", "staff"}; !slices.Equal(id.Groups, want) {
-		t.Errorf("groups = %v, want %v", id.Groups, want)
-	}
-	if runner.path != authenticateCGI {
-		t.Errorf("ran %q", runner.path)
-	}
-}
-
-func TestOrdinaryUserHasNoAdministratorsGroup(t *testing.T) {
-	id, err := newTestAuth(t, &fakeRunner{out: "bob\n"}).Authenticate(sessionRequest())
-	if err != nil || id.User != "bob" || slices.Contains(id.Groups, "administrators") {
-		t.Fatalf("got %+v, %v", id, err)
-	}
-}
-
-func TestPrimaryGroupCountsAsMembershipEvenWithoutAMemberListEntry(t *testing.T) {
-	id, err := newTestAuth(t, &fakeRunner{out: "bob\n"}).Authenticate(sessionRequest())
-	if err != nil || !slices.Equal(id.Groups, []string{"users"}) {
-		t.Fatalf("got %+v, %v", id, err)
-	}
-}
-
-func TestPrimaryGroupIsNotDuplicatedWhenAlsoListedAsMember(t *testing.T) {
-	a := newTestAuth(t, &fakeRunner{out: "dave"})
-	if err := os.WriteFile(a.groupFile, []byte("staff:x:1030:dave\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	id, _ := a.Authenticate(sessionRequest())
-	if !slices.Equal(id.Groups, []string{"staff"}) {
-		t.Fatalf("groups = %v", id.Groups)
-	}
-}
-
-func TestMissingPasswdFileFailsClosedWithoutBeingNoSession(t *testing.T) {
-	a := newTestAuth(t, &fakeRunner{out: "bob"})
-	a.passwdFile = filepath.Join(t.TempDir(), "absent")
-	if _, err := a.Authenticate(sessionRequest()); err == nil || errors.Is(err, errNoSession) {
-		t.Fatalf("err = %v", err)
-	}
-}
-
-func TestOnlySessionCarriersReachAuthenticateCGI(t *testing.T) {
-	runner := &fakeRunner{out: "alice"}
-	if _, err := newTestAuth(t, runner).Authenticate(sessionRequest()); err != nil {
-		t.Fatal(err)
-	}
-	want := []string{
-		"HTTP_COOKIE=id=abc; did=xyz",
-		"HTTP_X_SYNO_TOKEN=tok+en/=",
-		"QUERY_STRING=SynoToken=tok%2Ben%2F%3D",
-		"REMOTE_ADDR=192.0.2.7",
-		"REQUEST_METHOD=GET",
-	}
-	got := slices.Clone(runner.env)
-	slices.Sort(got)
-	if !slices.Equal(got, want) {
-		t.Fatalf("env = %q\nwant  %q", got, want)
-	}
-}
-
-func TestMissingCookieNeverRunsAuthenticateCGI(t *testing.T) {
-	runner := &fakeRunner{out: "alice"}
-	r := sessionRequest()
-	r.Header.Del("Cookie")
-	_, err := newTestAuth(t, runner).Authenticate(r)
-	if !errors.Is(err, errNoSession) || runner.path != "" {
-		t.Fatalf("err=%v ran=%q", err, runner.path)
-	}
-}
-
-func TestExpiredOrMalformedSessionsAreNoSession(t *testing.T) {
-	for name, runner := range map[string]*fakeRunner{
-		"expired session (exit status)": {err: &exitError{}},
-		"empty output":                  {out: "\n"},
-		"two lines":                     {out: "alice\nadmin\n"},
-		"html output":                   {out: "<html>login</html>"},
-		"overlong name":                 {out: strings.Repeat("a", 200)},
-		"space in name":                 {out: "alice admin"},
-	} {
-		t.Run(name, func(t *testing.T) {
-			_, err := newTestAuth(t, runner).Authenticate(sessionRequest())
-			if !errors.Is(err, errNoSession) {
-				t.Fatalf("err = %v", err)
-			}
-		})
-	}
-}
-
-func TestAuthenticateCGIThatCannotRunFailsClosedWithoutBeingNoSession(t *testing.T) {
-	_, err := newTestAuth(t, &fakeRunner{err: errors.New("fork/exec: no such file")}).Authenticate(sessionRequest())
-	if err == nil || errors.Is(err, errNoSession) {
-		t.Fatalf("err = %v", err)
-	}
-}
-
-func TestGroupMembershipIsReadFreshOnEveryRequest(t *testing.T) {
-	runner := &fakeRunner{out: "carol"}
-	a := newTestAuth(t, runner)
-	id, _ := a.Authenticate(sessionRequest())
-	if !slices.Equal(id.Groups, []string{"users", "staff"}) {
-		t.Fatalf("groups = %v", id.Groups)
-	}
-	if err := os.WriteFile(a.groupFile, []byte("users:x:100:\nstaff:x:1030:alice\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	id, _ = a.Authenticate(sessionRequest())
-	if !slices.Equal(id.Groups, []string{"users"}) {
-		t.Fatalf("groups after removal = %v", id.Groups)
-	}
-}
-
-func tokenEnv(t *testing.T, r *http.Request) []string {
-	t.Helper()
-	runner := &fakeRunner{out: "alice"}
-	if _, err := newTestAuth(t, runner).Authenticate(r); err != nil {
-		t.Fatal(err)
-	}
-	return runner.env
-}
-
-func TestQueryTokenIsUsedWhenHeaderIsEmpty(t *testing.T) {
-	r := sessionRequest()
-	r.Header.Del("X-SYNO-TOKEN")
-	r.URL.RawQuery = "a=b&SynoToken=q%2Btok"
-	env := tokenEnv(t, r)
-	for _, want := range []string{"HTTP_X_SYNO_TOKEN=q+tok", "QUERY_STRING=SynoToken=q%2Btok"} {
-		if !slices.Contains(env, want) {
-			t.Fatalf("env = %q, missing %q", env, want)
-		}
-	}
-}
-
-func TestHeaderTokenWinsOverQueryToken(t *testing.T) {
-	r := sessionRequest()
-	r.URL.RawQuery = "SynoToken=from-query"
-	env := tokenEnv(t, r)
-	if !slices.Contains(env, "HTTP_X_SYNO_TOKEN=tok+en/=") || slices.Contains(env, "QUERY_STRING=SynoToken=from-query") {
-		t.Fatalf("env = %q", env)
-	}
-}

package/assets/go/gateway/cgi.go

@@ -1,133 +0,0 @@
-package main
-
-import (
-	"bufio"
-	"bytes"
-	"errors"
-	"fmt"
-	"io"
-	"net"
-	"net/http"
-	"time"
-)
-
-// serveCGI answers one request the way net/http/cgi.Serve does: "Status:" and headers, a blank line, the body
-// on `out`. It is its own copy so that the reply can be hijacked: the handler then owns `in` and `out`, which
-// is how a WebSocket passes through DSM's CGI interface.
-func serveCGI(h http.Handler, req *http.Request, in io.Reader, out io.Writer) error {
-	if req.Body == nil {
-		req.Body = http.NoBody
-	}
-	rw := &cgiResponse{req: req, header: make(http.Header), in: in, out: out, bufw: bufio.NewWriter(out)}
-	h.ServeHTTP(rw, req)
-	if rw.hijacked {
-		return nil
-	}
-	rw.Write(nil) // make sure a reply is sent
-	return rw.bufw.Flush()
-}
-
-type cgiResponse struct {
-	req         *http.Request
-	header      http.Header
-	code        int
-	wroteHeader bool
-	wroteCGI    bool
-	hijacked    bool
-	in          io.Reader
-	out         io.Writer
-	bufw        *bufio.Writer
-}
-
-func (r *cgiResponse) Header() http.Header { return r.header }
-
-func (r *cgiResponse) Flush() {
-	if !r.hijacked {
-		r.bufw.Flush()
-	}
-}
-
-func (r *cgiResponse) WriteHeader(code int) {
-	if r.wroteHeader {
-		return
-	}
-	r.wroteHeader, r.code = true, code
-}
-
-func (r *cgiResponse) Write(p []byte) (int, error) {
-	if r.hijacked {
-		return 0, http.ErrHijacked
-	}
-	if !r.wroteHeader {
-		r.WriteHeader(http.StatusOK)
-	}
-	if !r.wroteCGI {
-		r.writeCGIHeader(p)
-	}
-	return r.bufw.Write(p)
-}
-
-// writeCGIHeader sends the header block; p, the first chunk of the body, is sniffed for a missing Content-Type.
-func (r *cgiResponse) writeCGIHeader(p []byte) {
-	r.wroteCGI = true
-	fmt.Fprintf(r.bufw, "Status: %d %s\r\n", r.code, http.StatusText(r.code))
-	if _, hasType := r.header["Content-Type"]; !hasType {
-		r.header.Set("Content-Type", http.DetectContentType(p))
-	}
-	r.header.Write(r.bufw)
-	r.bufw.WriteString("\r\n")
-	r.bufw.Flush()
-}
-
-// Hijack hands stdin and stdout to the handler. The first thing it writes is an HTTP/1.1 status line and
-// headers (that is what httputil.ReverseProxy writes for a 101); the CGI interface wants "Status: 101 ..."
-// there, so cgiConn rewrites the status line and leaves everything after the blank line alone.
-func (r *cgiResponse) Hijack() (net.Conn, *bufio.ReadWriter, error) {
-	if r.wroteHeader || r.wroteCGI || r.hijacked {
-		return nil, nil, errors.New("cgi: Hijack after the reply began")
-	}
-	r.hijacked = true
-	c := &cgiConn{in: r.in, out: r.out}
-	return c, bufio.NewReadWriter(bufio.NewReader(c), bufio.NewWriter(c)), nil
-}
-
-type cgiConn struct {
-	in       io.Reader
-	out      io.Writer
-	head     []byte // the header block, held back until it is complete
-	headSent bool
-}
-
-func (c *cgiConn) Read(p []byte) (int, error) { return c.in.Read(p) }
-
-func (c *cgiConn) Write(p []byte) (int, error) {
-	if c.headSent {
-		return c.out.Write(p)
-	}
-	c.head = append(c.head, p...)
-	end := bytes.Index(c.head, []byte("\r\n\r\n"))
-	if end < 0 {
-		return len(p), nil
-	}
-	c.headSent = true
-	statusLine, headers, _ := bytes.Cut(c.head[:end+4], []byte("\r\n"))
-	_, status, _ := bytes.Cut(statusLine, []byte(" ")) // "HTTP/1.1 101 Switching Protocols" -> "101 Switching Protocols"
-	rewritten := append(append([]byte("Status: "), status...), "\r\n"...)
-	rewritten = append(append(rewritten, headers...), c.head[end+4:]...)
-	if _, err := c.out.Write(rewritten); err != nil {
-		return 0, err
-	}
-	return len(p), nil
-}
-
-func (c *cgiConn) Close() error                     { return nil }
-func (c *cgiConn) LocalAddr() net.Addr              { return cgiAddr{} }
-func (c *cgiConn) RemoteAddr() net.Addr             { return cgiAddr{} }
-func (c *cgiConn) SetDeadline(time.Time) error      { return nil }
-func (c *cgiConn) SetReadDeadline(time.Time) error  { return nil }
-func (c *cgiConn) SetWriteDeadline(time.Time) error { return nil }
-
-type cgiAddr struct{}
-
-func (cgiAddr) Network() string { return "cgi" }
-func (cgiAddr) String() string  { return "cgi" }