shellweb

#!/bin/ksh

set -e

verbose=false
auth_enabled=false
proxy_mode=false
content_range=(false 0 0 0)
nc=$(command -v nc.openbsd || command -v nc || { echo nc not found; exit 1; })

if [ `id -u` = 0 ]; then
	root=/var/www
	port=80
else
	root=~/www
	port=$((13000 + `id -u`))
fi

usage() {
	echo "usage: ${0##*/} [-v] [-a authfile] [-d rootdir] [-p port] [-r proxy_spec]" >&2
	exit 1
}

while getopts "a:d:p:r:v" OPT; do case $OPT in
	a)      auth_file=$OPTARG; auth_enabled=true;;
	d)      root=$OPTARG;;
	p)      port=$OPTARG;;
	v)      verbose=true;;
	r)	proxy_spec=$OPTARG; proxy_mode=true;;
	*)      usage;;
esac; done
shift $((OPTIND - 1))

# readlink -f is not portable (at least macOS lacks it), so do our best
rl_path=$(command -v readlink)
rl_can_f=$(readlink -f / >/dev/null 2>&1 && echo true || echo false)
if $verbose; then
	echo "root directory is $root" >&2
	if $rl_can_f; then
		rl() { "$rl_path" -f -- "$1"; }
	else
		rl() { "$rl_path" -- "$1" || printf %s "$1"; }
	fi
else
	if $rl_can_f; then
		rl() { "$rl_path" -f -- "$1" 2>/dev/null; }
	else
		rl() { "$rl_path" -- "$1" 2>/dev/null || printf %s "$1"; }
	fi
fi

if $auth_enabled; then
	authfile=$(rl "$authfile")
	if ! [ -r "$authfile" -a -f "$authfile" ]; then
		echo "could not read file '$authfile'" >&2
		exit 1
	fi
fi

decode_base64() {
	printf "%s\n" "$1" | openssl enc -base64 -d
}

authenticate() {
	typeset decoded user password

	decoded="$(decode_base64 "$1")"
	user="$(printf "%s\n" "$decoded" | cut -f1 -d:)"
	password="$(printf "%s\n" "$decoded" | cut -f2 -d:)"

	while read -r data1 data2; do
		if [[ $user == $data1 && $password == $data2 ]]; then
			$verbose && echo "logged in as $user" >&2
			return 0
		fi
	done < "$auth_file"
	false
}

error_page_base="HTML&CSS/err"

generate_error_page() {
  error_page="${error_page_base}${1}.html"
  if [ ! -e "$error_page" ]; then
    sed -e "s/error_code_text/$1 $2/g; s/error_code/$1/g" "HTML&CSS/template.html" >"$error_page"
  fi
  $verbose && printf "error page: %s\n" "$error_page" >&2
}

# It's okay to call this routine multiple times, see $sent
senderr() {
	$sent && return 0

	typeset text
	case $1 in
	400)    text="Bad request";;
	401)    text="Unauthorized";;
	403)    text="Not allowed";;
	404)    text="Not found";;
	*)      text="Server error"; set -- 500;;
	esac

	sent=true
	printf "HTTP/1.0 %s %s\r\n" "$1" "$text"
	printf "Date: %s\r\n" "$(env LC_ALL=en_US.UTF-8 date)"
	printf "Connection: close\r\n"
	if [[ $1 == 401 ]]; then
		printf "WWW-Authenticate: Basic realm=ShellWeb\r\n"
	fi
	printf "\r\n"

	generate_error_page "$1" "$text"

	keep_conn=false
}

validate_and_send() {
	if [ x"${1#/}" = x"$1" ]; then
		senderr 400
		return
	fi

	typeset path="${root}$1"
	if [ -h "$path" ]; then
		sym_link "$path"
		return
	fi

	path=$(rl "$path" || true)
	  if [ -z "$path" ]; then
		# hard symlink error: cycle or smth. like that
		senderr 404
	elif [ "x${path#$root}" = "x${path}" ]; then
		$verbose && echo "resulting path lies outside $root: $path" >&2
		senderr 403
	elif ! [ -e "$path" ]; then
		senderr 404
	elif ! [ -r "$path" ]; then
		$verbose && echo "resulting path $path is not readable" >&2
		senderr 403
	elif [ -d "$path" ]; then
		index "$1"
	elif [[ "$1" == *.cgi* ]]; then
		cgi "$1"
	else
		sendfile "$1"
	fi
}

sym_link() {
	typeset path=$(rl "$1" || true)
	if [ "x${path#$root}" = "x${path}" ]; then
		senderr 404
		return
	fi

	sent=true
	printf "HTTP/1.1 301 Moved Permanently\r\n"
	printf "Date: %s\r\n" "$(env LC_ALL=en_US.UTF-8 date)"
	printf "Location: \r\n" "${path#$root}"
	printf "Content-Length: 0\r\n"
	printf "Content-Type: text/html\r\n"
	printf "\r\n"
}

run_cgi() (
	export SERVER_SOFTWARE="shellweb3"
	export SERVER_NAME=
	export GATEWAY_INTERFACE="CGI/1.1"
	export SERVER_PROTOCOL="HTTP/1.1"
	export SERVER_PORT="$port"

	export QUERY_STRING=$(printf "%s\n" "$1" | sed 's/^.*\?//')
	export PATH_INFO=$(printf "%s\n" "$1" | sed 's/^.*\.cgi.*\?//')
	export REQUEST_METHOD="GET"
	export SCRIPT_NAME=$(printf "%s\n" "$1" | sed 's/^\(.*.cgi\).*$/\1/')

	export PATH_TRANSLATED=
	export REMOTE_HOST=
	export REMOTE_ADDR=
	export AUTH_TYPE=
	export REMOTE_USER=
	export REMOTE_IDENT=
	export CONTENT_TYPE=
	export CONTENT_LENGTH=

	"${root}$SCRIPT_NAME"
)

cgi() {
	sent=true
	run_cgi
}

# It's okay to call this routine even after senderr(), see $sent
sendfile() {
	if [[ ${content_range[0]} == 'true' ]]; then
		range_handle_verify "$root/$1"
	fi
	$sent && return 0
	test -d "$1" && return 
	exec 3<"$root/$1" || { senderr 500; return 0; }
	typeset ct=$(file -bi "$root/$1") || { senderr 500; return 0; }
	typeset sz=$(ls -l "$root/$1" | awk '{print $5}') || { senderr 500; return 0; }
	sent=true
	printf "HTTP/1.1 200 OK\r\n"
	printf "Content-Type: %s\r\n"	"$ct"
	printf "Content-Length: %u\r\n"	"$sz"
	printf "Date: %s\r\n"		"$(env LC_ALL=en_US.UTF-8 date)"
	if [[ ${content_range[0]} == 'true' ]]; then
		printf "Content-Range: bytes ${content_range[1]}-${content_range[2]}/${content_range[3]}\r\n"
		printf "\r\n"
		range_sendfile "$root/$1"
	else
		printf "\r\n"
		cat <&3
		exec 3<&-
	fi
}

html_escape() {
	echo "$*" | sed -E \
		-e 's/&/\&amp;/g;' \
		-e 's/"/\&quot;/g;' \
		-e "s/'/\&#39;/g;" \
		-e 's/</\&lt;/g;' \
		-e 's/>/\&gt;/g;'
}

uri_escape() {
	echo "$*" | sed -E \
		-e 's/%/%25/g;' \
		-e 's/&/%26/g;' \
		-e 's/\?/%3f/g;' \
		-e 's/ /%20/g;'
}

html_link() {
	escaped=$(html_escape "$1")
	echo -n "<a href=\"$(uri_escape "$escaped")\">$escaped</a>"
}

format_file_size() {
	typeset sz=$1
	  if [ "$sz" -ge $((1024 * 1024 * 1024 * 1024 * 10)) ]; then
		sz="$((sz / (1024 * 1024 * 1024 * 1024) ))</td><td>TB"
	elif [ "$sz" -ge $((1024 * 1024 * 1024 * 10)) ]; then
		sz="$((sz / (1024 * 1024 * 1024) ))</td><td>GB"
	elif [ "$sz" -ge $((1024 * 1024 * 10)) ]; then
		sz="$((sz / (1024 * 1024) ))</td><td>MB"
	elif [ "$sz" -ge $((1024 * 10)) ]; then
		sz="$((sz / 1024))</td><td>KB"
	else
		sz="${sz}</td><td>B"
	fi
	echo "$sz"
}

file_info() {
	typeset fname="$1" date="$2" size="$3" type="$4"

	case $type in
	block|char|pipe|socket)	return;;
	esac

	echo -n "<tr><td class=\"fi type\">$(html_escape "$type")</td>"
	test "$type" = "dir" && fname="${fname}/"
	echo -n "<td class=\"fi fname\">$(html_link "$fname")</td>"
	echo -n "<td class=\"fi data\">$(html_escape "$date")</td>"
	echo -n "<td class=\"fi size\">$(format_file_size "$size")</td></tr>"
}

index() {

# to be put back instead of if..elif.. below when ksh bug fixed
if false; then
	case $(echo $mode | cut -c 1) in
	-) type=file;;
	b) type=block;;
	c) type=char;;
	d) type=dir;;
	l) type=link;;
	p) type=pipe;;
	s) type=socket;;
	*) type=unknown;;
	esac
fi

	body=$(
cat <<EOF
<html>
<head>
	<title>Index of $(html_escape "$1")</title>
	<style type="text/css">
		.fi { padding-left: 0.5em; }
		.size { text-align: right; }
	</style>
</head>
<body>
<h1>Index of $(html_escape "$1")</h1><hr><table>
EOF
		if [ "X${1%/}" != X ]; then
			parent=${1%%*(/)}
			parent=${parent%/*}
			test -n "$parent" || parent=/
			echo "<a href=\"$parent\">../</a><br />"
		fi
		typeset mode links owner group size mon day time year name
		typeset type
		ls -lT "$root$1" | tail -n +2 | while read mode links owner group size mon day time year name; do
			  if [ "${mode#-}" != "$mode" ]; then	type=file
			elif [ "${mode#b}" != "$mode" ]; then	type=block
			elif [ "${mode#c}" != "$mode" ]; then	type=char
			elif [ "${mode#d}" != "$mode" ]; then	type=dir
			elif [ "${mode#l}" != "$mode" ]; then	type=link
			elif [ "${mode#p}" != "$mode" ]; then	type=pipe
			elif [ "${mode#s}" != "$mode" ]; then	type=socket
			else                                 	type=unknown
			fi
			file_info "$name" "${year}-${mon}-${day} $time" "$size" "${type}"
		done
		echo "</table><hr></body>"
		echo "</html>"
	)
	sz=$(printf "%s" "$body" | wc -c)
	
	printf "HTTP/1.1 200 OK\r\n"
	printf "Content-Type: text/html\r\n"
	printf "Content-Length: %u\r\n"		"$sz"
	printf "\r\n"
	printf "%s" "$body"
}

proxy() {
	proxy_port=${proxy_spec##*:}
	if [[ $proxy_port = "$proxy_spec" ]]; then
		proxy_port=80
	fi
	while read -p -r v; do
		if [[ $(printf %s "$v" | tr A-Z a-z) = "host:"* ]]; then
			printf "Host: ${proxy_spec}\r\n"
		elif [[ $v = $(printf "\r\n") ]]; then
			ip=$(fstat -p $ncpid | awk '$7 == "tcp" {print $11}' | sed '/^$/d')
			printf "X-Forwarded-For: ${ip}\r\n\r\n"
		else
			printf "$v\n"
		fi
	done | $nc ${proxy_spec%%:*} $proxy_port >&p
}

range_handle_verify() {
	content_range[3]=$(stat --printf="%s" "$1")
	if [[ ${content_range[3]} -ne 0 && ${content_range[1]} -ge 0 && ${content_range[2]} -le ${content_range[3]} ]]; then
		return 0
	else
		senderr 400
	fi
}

range_sendfile(){
	dd if="$1" ibs=1 skip=${content_range[1]} count=${content_range[2]} 2> /dev/null
}

NC_SERVER=$nc
if $verbose; then
	NC_SERVER="$NC_SERVER -v"
fi
NC_SERVER="$NC_SERVER -kl $port"

while true; do
	file=
	sent=false
	$NC_SERVER |&
	$verbose && echo "waiting for new connection on port $port" >&2
	ncpid=$!
	$proxy_mode && proxy
	auth_passed=false
	keep_conn=false
	while ! $proxy_mode &&  ! $sent && read -p v1 v2 v3; do
		header=$(echo "$v1" | tr A-Z a-z)
		if [ -z "$file" ]; then
			# parsing first line
			file=$v2
			[[ $v1 == GET ]] || senderr 400
			[[ $v3 == HTTP/1.0* ]] || [[ $v3 == HTTP/1.1* ]] || senderr 400
			[[ $v3 == HTTP/1.1* ]] && keep_conn=true

		# authentication handling
		elif $auth_enabled && [[ $header == "authorization:" ]]; then
			if [[ $v2 == "Basic" ]] && authenticate "$v3"; then
				auth_passed=true
			fi

		elif [[ $header == "connection:" && $v2 == $(printf "close\r") ]]; then
			keep_conn=false
		
		elif [[ $header == "range:" ]]; then
			content_range[0]='true'
			content_range[1]=$(echo "$v3" | awk -F '-' '{print $1}')
			content_range[2]=$(echo "$v3" | awk -F '-' '{print $2}' | sed 's/[^0-9]*//g')

		elif [[ $header = $(printf "\r\n") && -z $v2 ]]; then
			# empty line (end of headers)
			if [ -n "$file" ]; then
				if ! $auth_enabled || $auth_passed; then
					$verbose && echo "$file is requested" >&2
					validate_and_send "$file"
				else
					$verbose && echo "not authenticated" >&2
					senderr 401
				fi
			else
				senderr 400
			fi
			file=
			auth_passed=false
			if $keep_conn; then
				sent=false
			fi
		# else ignore all headers
		fi
	done >&p
	exec 3>&p && exec 3>&- && kill $ncpid
	wait
done