#!/usr/bin/perl -T

#----------------------------------------------------------------------
# ACME client written with process isolation and minimal privileges in mind
# (webserver component)
# Copyright © 2015,2016 Guilhem Moulin <guilhem@fripost.org>
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
#----------------------------------------------------------------------

use strict;
use warnings;

# Usage: webserver FD
#
# fdopen(3) the file descriptor FD (corresponding to a listening
# socket), then keep accept(2)'ing connections and consider each
# connection as the verification of an ACME challenge, i.e., serve the
# requested challenge token.
#
# NOTE: one needs to chdir(2) to an appropriate ACME challenge directory
# before running this program, since challenge tokens are (on purpose)
# only looked for in the current directory.
#
# NOTE: one should run this program as an unprivileged user:group such
# as "www-data:www-data"; bind(2)'ing to a privileged port such as 80 is
# not a problem since FD can be bound as root prior to the execve(2).

use Errno 'EINTR';
use Socket qw/AF_UNIX AF_INET AF_INET6/;

# Untaint and fdopen(3) the listening socket
(shift @ARGV // die) =~ /\A(\d+)\z/ or die;
open my $S, '+<&=', $1 or die "fdopen $1: $!";
my $ROOT = '/.well-known/acme-challenge';

close STDIN  or die "close: $!";
close STDOUT or die "close: $!";

sub info($$$) {
    my ($sockaddr, $msg, $req) = @_;
    $req =~ s/\r\n\z// if defined $req;

    # get a string representation of the peer's address
    my $fam = Socket::sockaddr_family($sockaddr);
    my $peer;

    if ($fam == AF_UNIX) {
        $peer = Socket::unpack_sockaddr_un($sockaddr);
    } else {
        my (undef, $ip) =
            $fam == AF_INET  ? Socket::unpack_sockaddr_in($sockaddr)  :
            $fam == AF_INET6 ? Socket::unpack_sockaddr_in6($sockaddr) :
            die;
        $peer = Socket::inet_ntop($fam, $ip);
    }

    $msg .= " from [$peer]" if defined $peer and $peer ne '';
    $msg .= ": $req"        if defined $req;

    print STDERR $msg, "\n";
}

while (1) {
    my $sockaddr = accept(my $conn, $S) or do {
        next if $! == EINTR; # try again if accept(2) was interrupted by a signal
        die "accept: $!";
    };
    my $req = $conn->getline();
    info($sockaddr, "[$$] Incoming connection", $req) if $ENV{DEBUG};
    next unless defined $req;

    if ($req !~ s/\A(GET|HEAD) (.*) HTTP\/(1\.[01])\r\n\z/$2/) {
        info($sockaddr, "Error: Bad request", $req);
        next;
    }
    my ($method, $proto) = ($1, $3);

    # Consume (and ignore) the headers
    while (defined (my $h = $conn->getline())) { last if $h eq "\r\n" };

    my ($status_line, $content_type, $content);
    if ($req =~ /\A\Q$ROOT\E\/([A-Za-z0-9_\-]+)\z/ and
            ! -l $1 and -f _) { # reuse previous stat structure and save a syscall
        # XXX calling lstat(2) before open(2) is racy; if O_NOFOLLOW was
        # exposed to perl we would instead use it and later fstat(2) the
        # file descriptor
        if (open my $fh, '<', $1) { # only open files in the cwd
            ($status_line, $content_type) = ('200 OK', 'application/jose+json');
            $content = do { local $/ = undef; $fh->getline() };
            $fh->close() or die "close: $!";
        }
        else {
            $status_line = '403 Forbidden';
        }
    }

    $conn->print( "HTTP/$proto ", ($status_line // '404 Not Found'), "\r\n" );
    $conn->print( "Content-Type: $content_type\r\n" ) if defined $content_type;
    $conn->print( "Content-Length: ".length($content)."\r\n" ) if defined $content;
    $conn->print( "Connection: close\r\n" );
    $conn->print( "\r\n" );
    $conn->print( $content ) if defined $content and $method eq 'GET';

    $conn->close() or die "close: $!";
}