2
# Copyright (C) 2007-2008 The University of Melbourne
4
# This program is free software; you can redistribute it and/or modify
5
# it under the terms of the GNU General Public License as published by
6
# the Free Software Foundation; either version 2 of the License, or
7
# (at your option) any later version.
9
# This program is distributed in the hope that it will be useful,
10
# but WITHOUT ANY WARRANTY; without even the implied warranty of
11
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12
# GNU General Public License for more details.
14
# You should have received a copy of the GNU General Public License
15
# along with this program; if not, write to the Free Software
16
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
22
# Runs a student script in a safe execution environment.
25
from ivle import studpath
26
from ivle.util import IVLEError, IVLEJailError, split_path
35
# TODO: Make progressive output work
36
# Question: Will having a large buffer size stop progressive output from
37
# working on smaller output
39
CGI_BLOCK_SIZE = 65535
41
def interpret_file(req, owner, jail_dir, filename, interpreter, gentle=True):
42
"""Serves a file by interpreting it using one of IVLE's builtin
43
interpreters. All interpreters are intended to run in the user's jail. The
44
jail location is provided as an argument to the interpreter but it is up
45
to the individual interpreters to create the jail.
47
req: An IVLE request object.
48
owner: The user who owns the file being served.
49
jail_dir: Absolute path to the user's jail.
50
filename: Absolute filename within the user's jail.
51
interpreter: A function object to call.
53
# We can't test here whether or not the target file actually exists,
54
# because the apache user may not have permission. Instead we have to
55
# rely on the interpreter generating an error.
56
if filename.startswith(os.sep):
57
filename_abs = filename
58
filename_rel = filename[1:]
60
filename_abs = os.path.join(os.sep, filename)
61
filename_rel = filename
63
# (Note: files are executed by their owners, not the logged in user.
64
# This ensures users are responsible for their own programs and also
65
# allows them to be executed by the public).
67
# Split up req.path again, this time with respect to the jail
68
(working_dir, _) = os.path.split(filename_abs)
69
# jail_dir is the absolute jail directory.
70
# path is the filename relative to the user's jail.
71
# working_dir is the directory containing the file relative to the user's
73
# (Note that paths "relative" to the jail actually begin with a '/' as
74
# they are absolute in the jailspace)
76
return interpreter(owner.unixid, jail_dir, working_dir, filename_abs, req,
80
"""Stores flags regarding the state of reading CGI output.
81
If this is to be gentle, detection of invalid headers will result in an
83
def __init__(self, begentle=True):
84
self.gentle = begentle
85
self.started_cgi_body = False
86
self.got_cgi_headers = False
87
self.wrote_html_warning = False
89
self.headers = {} # Header names : values
91
def execute_cgi(interpreter, uid, jail_dir, working_dir, script_path,
94
trampoline: Full path on the local system to the CGI wrapper program
96
uid: User ID of the owner of the file.
97
jail_dir: Absolute path of owner's jail directory.
98
working_dir: Directory containing the script file relative to owner's
100
script_path: CGI script relative to the owner's jail.
101
req: IVLE request object.
103
The called CGI wrapper application shall be called using popen and receive
104
the HTTP body on stdin. It shall receive the CGI environment variables to
108
trampoline = os.path.join(req.config['paths']['lib'], 'trampoline')
110
# Support no-op trampoline runs.
111
if interpreter is None:
112
interpreter = '/bin/true'
118
# Get the student program's directory and execute it from that context.
119
(tramp_dir, _) = os.path.split(trampoline)
121
# TODO: Don't create a file if the body length is known to be 0
122
# Write the HTTP body to a temporary file so it can be passed as a *real*
125
body = req.read() if not noop else None
129
f.seek(0) # Rewind, for reading
131
# Set up the environment
132
# This automatically asks mod_python to load up the CGI variables into the
133
# environment (which is a good first approximation)
134
old_env = os.environ.copy()
135
for k in os.environ.keys():
137
for (k,v) in req.get_cgi_environ().items():
139
fixup_environ(req, script_path)
141
# usage: tramp uid jail_dir working_dir script_path
142
cmd_line = [trampoline, str(uid), req.config['paths']['jails']['mounts'],
143
req.config['paths']['jails']['src'],
144
req.config['paths']['jails']['template'],
145
jail_dir, working_dir, interpreter, script_path]
146
# Popen doesn't like unicode strings. It hateses them.
147
cmd_line = [(s.encode('utf-8') if isinstance(s, unicode) else s)
149
pid = subprocess.Popen(cmd_line,
150
stdin=f, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
153
# Restore the environment
154
for k in os.environ.keys():
156
for (k,v) in old_env.items():
159
# We don't want any output! Bail out after the process terminates.
164
# process_cgi_line: Reads a single line of CGI output and processes it.
165
# Prints to req, and also does fancy HTML warnings if Content-Type
167
cgiflags = CGIFlags(gentle)
169
# Read from the process's stdout into req
170
data = pid.stdout.read(CGI_BLOCK_SIZE)
172
process_cgi_output(req, data, cgiflags)
173
data = pid.stdout.read(CGI_BLOCK_SIZE)
175
# If we haven't processed headers yet, now is a good time
176
if not cgiflags.started_cgi_body:
177
process_cgi_output(req, '\n', cgiflags)
179
# If we wrote an HTML warning header, write the footer
180
if cgiflags.wrote_html_warning:
186
def process_cgi_output(req, data, cgiflags):
187
"""Processes a chunk of CGI output. data is a string of arbitrary length;
188
some arbitrary chunk of output written by the CGI script."""
189
if cgiflags.started_cgi_body:
190
if cgiflags.wrote_html_warning:
191
# HTML escape text if wrote_html_warning
192
req.write(cgi.escape(data))
196
# Break data into lines of CGI header data.
197
linebuf = cgiflags.linebuf + data
198
# First see if we can split all header data
199
# We need to get the double CRLF- or LF-terminated headers, whichever
200
# is smaller, as either sequence may appear somewhere in the body.
201
usplit = linebuf.split('\n\n', 1)
202
wsplit = linebuf.split('\r\n\r\n', 1)
203
split = len(usplit[0]) > len(wsplit[0]) and wsplit or usplit
205
# Haven't seen all headers yet. Buffer and come back later.
206
cgiflags.linebuf = linebuf
211
cgiflags.linebuf = ""
212
cgiflags.started_cgi_body = True
213
# Process all the header lines
214
split = headers.split('\r\n', 1)
216
split = headers.split('\n', 1)
218
process_cgi_header_line(req, split[0], cgiflags)
219
if len(split) == 1: break
221
if cgiflags.wrote_html_warning:
222
# We're done with headers. Treat the rest as data.
223
data = headers + '\n' + data
225
split = headers.split('\r\n', 1)
227
split = headers.split('\n', 1)
229
# Is this an internal IVLE error condition?
230
hs = cgiflags.headers
231
if 'X-IVLE-Error-Type' in hs:
232
t = hs['X-IVLE-Error-Type']
233
if t == IVLEError.__name__:
234
raise IVLEError(int(hs['X-IVLE-Error-Code']),
235
hs['X-IVLE-Error-Message'])
238
raise IVLEJailError(hs['X-IVLE-Error-Type'],
239
hs['X-IVLE-Error-Message'],
240
hs['X-IVLE-Error-Info'])
242
raise IVLEError(500, 'bad error headers written by CGI')
244
# Check to make sure the required headers were written
245
if cgiflags.wrote_html_warning or not cgiflags.gentle:
246
# We already reported an error, that's enough
248
elif "Content-Type" in cgiflags.headers:
250
elif "Location" in cgiflags.headers:
251
if ("Status" in cgiflags.headers and req.status >= 300
252
and req.status < 400):
255
message = """You did not write a valid status code for
256
the given location. To make a redirect, you may wish to try:</p>
257
<pre style="margin-left: 1em">Status: 302 Found
258
Location: <redirect address></pre>"""
259
write_html_warning(req, message)
260
cgiflags.wrote_html_warning = True
262
message = """You did not print a Content-Type header.
263
CGI requires that you print a "Content-Type". You may wish to try:</p>
264
<pre style="margin-left: 1em">Content-Type: text/html</pre>"""
265
write_html_warning(req, message)
266
cgiflags.wrote_html_warning = True
268
# Call myself to flush out the extra bit of data we read
269
process_cgi_output(req, data, cgiflags)
271
def process_cgi_header_line(req, line, cgiflags):
272
"""Process a line of CGI header data. line is a string representing a
273
complete line of text, stripped and without the newline.
276
name, value = line.split(':', 1)
278
# No colon. The user did not write valid headers.
279
# If we are being gentle, we want to help the user understand what
280
# went wrong. Otherwise, just admit we screwed up.
282
if not cgiflags.gentle:
283
message = """An unexpected server error has occured."""
285
elif len(cgiflags.headers) == 0:
286
# First line was not a header line. We can assume this is not
288
message = """You did not print a CGI header.
289
CGI requires that you print a "Content-Type". You may wish to try:</p>
290
<pre style="margin-left: 1em">Content-Type: text/html</pre>"""
292
# They printed some header at least, but there was an invalid
294
message = """You printed an invalid CGI header. You need to leave
295
a blank line after the headers, before writing the page contents."""
296
write_html_warning(req, message, warning=warning)
297
cgiflags.wrote_html_warning = True
298
# Handle the rest of this line as normal data
299
process_cgi_output(req, line + '\n', cgiflags)
303
value = value.strip()
304
if name == "Content-Type":
305
req.content_type = value
306
elif name == "Location":
308
elif name == "Status":
309
# Must be an integer, followed by a space, and then the status line
310
# which we ignore (seems like Apache has no way to send a custom
313
req.status = int(value.split(' ', 1)[0])
315
if not cgiflags.gentle:
316
# This isn't user code, so it should be good.
317
# Get us out of here!
319
message = """The "Status" CGI header was invalid. You need to
320
print a number followed by a message, such as "302 Found"."""
321
write_html_warning(req, message)
322
cgiflags.wrote_html_warning = True
323
# Handle the rest of this line as normal data
324
process_cgi_output(req, line + '\n', cgiflags)
326
# Generic HTTP header
327
# FIXME: Security risk letting users write arbitrary headers?
328
req.headers_out.add(name, value)
329
cgiflags.headers[name] = value # FIXME: Only the last header will end up here.
331
def write_html_warning(req, text, warning="Warning"):
332
"""Prints an HTML warning about invalid CGI interaction on the part of the
333
user. text may contain HTML markup."""
334
req.content_type = "text/html"
335
req.write("""<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
336
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
337
<html xmlns="http://www.w3.org/1999/xhtml">
339
<meta http-equiv="Content-Type"
340
content="text/html; charset=utf-8" />
342
<body style="margin: 0; padding: 0; font-family: sans-serif;">
343
<div style="background-color: #faa; border-bottom: 1px solid black;
345
<p><strong>%s</strong>: %s
347
<div style="margin: 8px;">
349
""" % (warning, text))
351
# Mapping of interpreter names (as given in conf/app/server.py) to
352
# interpreter functions.
354
interpreter_objects = {
356
: functools.partial(execute_cgi, "/usr/bin/python"),
358
: functools.partial(execute_cgi, None),
364
def fixup_environ(req, script_path):
365
"""Assuming os.environ has been written with the CGI variables from
366
apache, make a few changes for security and correctness.
368
Does not modify req, only reads it.
371
# Comments here are on the heavy side, explained carefully for security
372
# reasons. Please read carefully before making changes.
374
# Remove DOCUMENT_ROOT and SCRIPT_FILENAME. Not part of CGI spec and
375
# exposes unnecessary details about server.
377
del env['DOCUMENT_ROOT']
380
del env['SCRIPT_FILENAME']
383
# Remove PATH. The PATH here is the path on the server machine; not useful
384
# inside the jail. It may be a good idea to add another path, reflecting
385
# the inside of the jail, but not done at this stage.
390
# CGI specifies that REMOTE_HOST SHOULD be set, and MAY just be set to
391
# REMOTE_ADDR. Since Apache does not appear to set this, set it to
393
if 'REMOTE_HOST' not in env and 'REMOTE_ADDR' in env:
394
env['REMOTE_HOST'] = env['REMOTE_ADDR']
396
env['PATH_INFO'] = ''
397
del env['PATH_TRANSLATED']
399
normuri = os.path.normpath(req.uri)
400
env['SCRIPT_NAME'] = normuri
402
# SCRIPT_NAME is the path to the script WITHOUT PATH_INFO.
403
# We don't care about these if the script is null (ie. noop).
404
# XXX: We check for /home because we don't want to interfere with
405
# CGIRequest, which fileservice still uses.
406
if script_path and script_path.startswith('/home'):
407
normscript = os.path.normpath(script_path)
409
uri_into_jail = studpath.to_home_path(os.path.normpath(req.path))
411
# PATH_INFO is wrong because the script doesn't physically exist.
412
env['PATH_INFO'] = uri_into_jail[len(normscript):]
413
if len(env['PATH_INFO']) > 0:
414
env['SCRIPT_NAME'] = normuri[:-len(env['PATH_INFO'])]
416
# SERVER_SOFTWARE is actually not Apache but IVLE, since we are
417
# custom-making the CGI request.
418
env['SERVER_SOFTWARE'] = "IVLE/" + ivle.__version__
420
# Additional environment variables
421
username = split_path(req.path)[0]
422
env['HOME'] = os.path.join('/home', username)
424
class ExecutionError(Exception):
427
def execute_raw(config, user, jail_dir, working_dir, binary, args):
428
'''Execute a binary in a user's jail, returning the raw output.
430
The binary is executed in the given working directory with the given
431
args. A tuple of (stdout, stderr) is returned.
434
tramp = os.path.join(config['paths']['lib'], 'trampoline')
435
tramp_dir = os.path.split(tramp)[0]
437
# Fire up trampoline. Vroom, vroom.
438
cmd_line = [tramp, str(user.unixid), config['paths']['jails']['mounts'],
439
config['paths']['jails']['src'],
440
config['paths']['jails']['template'],
441
jail_dir, working_dir, binary] + args
442
# Popen doesn't like unicode strings. It hateses them.
443
cmd_line = [(s.encode('utf-8') if isinstance(s, unicode) else s)
445
proc = subprocess.Popen(cmd_line,
446
stdin=subprocess.PIPE, stdout=subprocess.PIPE,
447
stderr=subprocess.PIPE, cwd=tramp_dir, close_fds=True)
449
(stdout, stderr) = proc.communicate()
450
exitcode = proc.returncode
453
raise ExecutionError('subprocess ended with code %d, stderr %s' %
454
(exitcode, proc.stderr.read()))
455
return (stdout, stderr)
added
removed
ivle/interpret.py
