2
# Copyright (C) 2007-2008 The University of Melbourne
4
# This program is free software; you can redistribute it and/or modify
5
# it under the terms of the GNU General Public License as published by
6
# the Free Software Foundation; either version 2 of the License, or
7
# (at your option) any later version.
9
# This program is distributed in the hope that it will be useful,
10
# but WITHOUT ANY WARRANTY; without even the implied warranty of
11
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12
# GNU General Public License for more details.
14
# You should have received a copy of the GNU General Public License
15
# along with this program; if not, write to the Free Software
16
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
22
# Runs a student script in a safe execution environment.
25
from ivle import studpath
26
from ivle.util import IVLEJailError, split_path
35
# TODO: Make progressive output work
36
# Question: Will having a large buffer size stop progressive output from
37
# working on smaller output
39
CGI_BLOCK_SIZE = 65535
40
PATH = "/usr/local/bin:/usr/bin:/bin"
42
def interpret_file(req, owner, jail_dir, filename, interpreter, gentle=True):
43
"""Serves a file by interpreting it using one of IVLE's builtin
44
interpreters. All interpreters are intended to run in the user's jail. The
45
jail location is provided as an argument to the interpreter but it is up
46
to the individual interpreters to create the jail.
48
req: An IVLE request object.
49
owner: The user who owns the file being served.
50
jail_dir: Absolute path to the user's jail.
51
filename: Absolute filename within the user's jail.
52
interpreter: A function object to call.
54
# We can't test here whether or not the target file actually exists,
55
# because the apache user may not have permission. Instead we have to
56
# rely on the interpreter generating an error.
57
if filename.startswith(os.sep):
58
filename_abs = filename
59
filename_rel = filename[1:]
61
filename_abs = os.path.join(os.sep, filename)
62
filename_rel = filename
64
# (Note: files are executed by their owners, not the logged in user.
65
# This ensures users are responsible for their own programs and also
66
# allows them to be executed by the public).
68
# Split up req.path again, this time with respect to the jail
69
(working_dir, _) = os.path.split(filename_abs)
70
# jail_dir is the absolute jail directory.
71
# path is the filename relative to the user's jail.
72
# working_dir is the directory containing the file relative to the user's
74
# (Note that paths "relative" to the jail actually begin with a '/' as
75
# they are absolute in the jailspace)
77
return interpreter(owner, jail_dir, working_dir, filename_abs, req,
81
"""Stores flags regarding the state of reading CGI output.
82
If this is to be gentle, detection of invalid headers will result in an
84
def __init__(self, begentle=True):
85
self.gentle = begentle
86
self.started_cgi_body = False
87
self.got_cgi_headers = False
88
self.wrote_html_warning = False
90
self.headers = {} # Header names : values
92
def execute_cgi(interpreter, owner, jail_dir, working_dir, script_path,
95
trampoline: Full path on the local system to the CGI wrapper program
97
owner: User object of the owner of the file.
98
jail_dir: Absolute path of owner's jail directory.
99
working_dir: Directory containing the script file relative to owner's
101
script_path: CGI script relative to the owner's jail.
102
req: IVLE request object.
104
The called CGI wrapper application shall be called using popen and receive
105
the HTTP body on stdin. It shall receive the CGI environment variables to
109
trampoline = os.path.join(req.config['paths']['lib'], 'trampoline')
111
# Support no-op trampoline runs.
112
if interpreter is None:
113
interpreter = '/bin/true'
119
# Get the student program's directory and execute it from that context.
120
(tramp_dir, _) = os.path.split(trampoline)
122
# TODO: Don't create a file if the body length is known to be 0
123
# Write the HTTP body to a temporary file so it can be passed as a *real*
126
body = req.read() if not noop else None
130
f.seek(0) # Rewind, for reading
132
# Set up the environment
133
environ = cgi_environ(req, script_path, owner)
135
# usage: tramp uid jail_dir working_dir script_path
136
cmd_line = [trampoline, str(owner.unixid),
137
req.config['paths']['jails']['mounts'],
138
req.config['paths']['jails']['src'],
139
req.config['paths']['jails']['template'],
140
jail_dir, working_dir, interpreter, script_path]
141
# Popen doesn't like unicode strings. It hateses them.
142
cmd_line = [(s.encode('utf-8') if isinstance(s, unicode) else s)
144
pid = subprocess.Popen(cmd_line,
145
stdin=f, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
146
cwd=tramp_dir, env=environ)
148
# We don't want any output! Bail out after the process terminates.
153
# process_cgi_line: Reads a single line of CGI output and processes it.
154
# Prints to req, and also does fancy HTML warnings if Content-Type
156
cgiflags = CGIFlags(gentle)
158
# Read from the process's stdout into req
159
data = pid.stdout.read(CGI_BLOCK_SIZE)
161
process_cgi_output(req, data, cgiflags)
162
data = pid.stdout.read(CGI_BLOCK_SIZE)
164
# If we haven't processed headers yet, now is a good time
165
if not cgiflags.started_cgi_body:
166
process_cgi_output(req, '\n', cgiflags)
168
# If we wrote an HTML warning header, write the footer
169
if cgiflags.wrote_html_warning:
175
def process_cgi_output(req, data, cgiflags):
176
"""Processes a chunk of CGI output. data is a string of arbitrary length;
177
some arbitrary chunk of output written by the CGI script."""
178
if cgiflags.started_cgi_body:
179
if cgiflags.wrote_html_warning:
180
# HTML escape text if wrote_html_warning
181
req.write(cgi.escape(data))
185
# Break data into lines of CGI header data.
186
linebuf = cgiflags.linebuf + data
187
# First see if we can split all header data
188
# We need to get the double CRLF- or LF-terminated headers, whichever
189
# is smaller, as either sequence may appear somewhere in the body.
190
usplit = linebuf.split('\n\n', 1)
191
wsplit = linebuf.split('\r\n\r\n', 1)
192
split = len(usplit[0]) > len(wsplit[0]) and wsplit or usplit
194
# Haven't seen all headers yet. Buffer and come back later.
195
cgiflags.linebuf = linebuf
200
cgiflags.linebuf = ""
201
cgiflags.started_cgi_body = True
202
# Process all the header lines
203
split = headers.split('\r\n', 1)
205
split = headers.split('\n', 1)
207
process_cgi_header_line(req, split[0], cgiflags)
208
if len(split) == 1: break
210
if cgiflags.wrote_html_warning:
211
# We're done with headers. Treat the rest as data.
212
data = headers + '\n' + data
214
split = headers.split('\r\n', 1)
216
split = headers.split('\n', 1)
218
# If not executing in gentle mode (which presents CGI violations
219
# to users nicely), check if this an internal IVLE error
221
if not cgiflags.gentle:
222
hs = cgiflags.headers
223
if 'X-IVLE-Error-Type' in hs:
225
raise IVLEJailError(hs['X-IVLE-Error-Type'],
226
hs['X-IVLE-Error-Message'],
227
hs['X-IVLE-Error-Info'])
229
raise AssertionError("Bad error headers written by CGI.")
231
# Check to make sure the required headers were written
232
if cgiflags.wrote_html_warning or not cgiflags.gentle:
233
# We already reported an error, that's enough
235
elif "Content-Type" in cgiflags.headers:
237
elif "Location" in cgiflags.headers:
238
if ("Status" in cgiflags.headers and req.status >= 300
239
and req.status < 400):
242
message = """You did not write a valid status code for
243
the given location. To make a redirect, you may wish to try:</p>
244
<pre style="margin-left: 1em">Status: 302 Found
245
Location: <redirect address></pre>"""
246
write_html_warning(req, message)
247
cgiflags.wrote_html_warning = True
249
message = """You did not print a Content-Type header.
250
CGI requires that you print a "Content-Type". You may wish to try:</p>
251
<pre style="margin-left: 1em">Content-Type: text/html</pre>"""
252
write_html_warning(req, message)
253
cgiflags.wrote_html_warning = True
255
# Call myself to flush out the extra bit of data we read
256
process_cgi_output(req, data, cgiflags)
258
def process_cgi_header_line(req, line, cgiflags):
259
"""Process a line of CGI header data. line is a string representing a
260
complete line of text, stripped and without the newline.
263
name, value = line.split(':', 1)
265
# No colon. The user did not write valid headers.
266
# If we are being gentle, we want to help the user understand what
267
# went wrong. Otherwise, just admit we screwed up.
269
if not cgiflags.gentle:
270
message = """An unexpected server error has occured."""
272
elif len(cgiflags.headers) == 0:
273
# First line was not a header line. We can assume this is not
275
message = """You did not print a CGI header.
276
CGI requires that you print a "Content-Type". You may wish to try:</p>
277
<pre style="margin-left: 1em">Content-Type: text/html</pre>"""
279
# They printed some header at least, but there was an invalid
281
message = """You printed an invalid CGI header. You need to leave
282
a blank line after the headers, before writing the page contents."""
283
write_html_warning(req, message, warning=warning)
284
cgiflags.wrote_html_warning = True
285
# Handle the rest of this line as normal data
286
process_cgi_output(req, line + '\n', cgiflags)
289
# Check if CGI field-name is valid
290
CGI_SEPERATORS = set(['(', ')', '<', '>', '@', ',', ';', ':', '\\', '"',
291
'/', '[', ']', '?', '=', '{', '}', ' ', '\t'])
292
if any((char in CGI_SEPERATORS for char in name)):
294
if not cgiflags.gentle:
295
message = """An unexpected server error has occured."""
298
# Header contained illegal characters
299
message = """You printed an invalid CGI header. CGI header
300
field-names can not contain any of the following characters:
301
<code>( ) < > @ , ; : \\ " / [ ] ? = { } <em>SPACE
303
write_html_warning(req, message, warning=warning)
304
cgiflags.wrote_html_warning = True
305
# Handle the rest of this line as normal data
306
process_cgi_output(req, line + '\n', cgiflags)
310
value = value.strip()
311
if name == "Content-Type":
312
req.content_type = value
313
elif name == "Location":
315
elif name == "Status":
316
# Must be an integer, followed by a space, and then the status line
317
# which we ignore (seems like Apache has no way to send a custom
320
req.status = int(value.split(' ', 1)[0])
322
if not cgiflags.gentle:
323
# This isn't user code, so it should be good.
324
# Get us out of here!
326
message = """The "Status" CGI header was invalid. You need to
327
print a number followed by a message, such as "302 Found"."""
328
write_html_warning(req, message)
329
cgiflags.wrote_html_warning = True
330
# Handle the rest of this line as normal data
331
process_cgi_output(req, line + '\n', cgiflags)
333
# Generic HTTP header
334
# FIXME: Security risk letting users write arbitrary headers?
335
req.headers_out.add(name, value)
336
cgiflags.headers[name] = value # FIXME: Only the last header will end up here.
338
def write_html_warning(req, text, warning="Warning"):
339
"""Prints an HTML warning about invalid CGI interaction on the part of the
340
user. text may contain HTML markup."""
341
req.content_type = "text/html"
342
req.write("""<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
343
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
344
<html xmlns="http://www.w3.org/1999/xhtml">
346
<meta http-equiv="Content-Type"
347
content="text/html; charset=utf-8" />
349
<body style="margin: 0; padding: 0; font-family: sans-serif;">
350
<div style="background-color: #faa; border-bottom: 1px solid black;
352
<p><strong>%s</strong>: %s
354
<div style="margin: 8px;">
356
""" % (warning, text))
358
# Mapping of interpreter names (as given in conf/app/server.py) to
359
# interpreter functions.
361
interpreter_objects = {
363
: functools.partial(execute_cgi, "/usr/bin/python"),
365
: functools.partial(execute_cgi, None),
371
def cgi_environ(req, script_path, user):
372
"""Gets CGI variables from apache and makes a few changes for security and
375
Does not modify req, only reads it.
378
# Comments here are on the heavy side, explained carefully for security
379
# reasons. Please read carefully before making changes.
381
# This automatically asks mod_python to load up the CGI variables into the
382
# environment (which is a good first approximation)
383
for (k,v) in req.get_cgi_environ().items():
386
# Remove DOCUMENT_ROOT and SCRIPT_FILENAME. Not part of CGI spec and
387
# exposes unnecessary details about server.
389
del env['DOCUMENT_ROOT']
392
del env['SCRIPT_FILENAME']
395
# Remove PATH. The PATH here is the path on the server machine; not useful
396
# inside the jail. It may be a good idea to add another path, reflecting
397
# the inside of the jail, but not done at this stage.
402
# CGI specifies that REMOTE_HOST SHOULD be set, and MAY just be set to
403
# REMOTE_ADDR. Since Apache does not appear to set this, set it to
405
if 'REMOTE_HOST' not in env and 'REMOTE_ADDR' in env:
406
env['REMOTE_HOST'] = env['REMOTE_ADDR']
408
env['PATH_INFO'] = ''
409
del env['PATH_TRANSLATED']
411
normuri = os.path.normpath(req.uri)
412
env['SCRIPT_NAME'] = normuri
414
# SCRIPT_NAME is the path to the script WITHOUT PATH_INFO.
415
# We don't care about these if the script is null (ie. noop).
416
# XXX: We check for /home because we don't want to interfere with
417
# CGIRequest, which fileservice still uses.
418
if script_path and script_path.startswith('/home'):
419
normscript = os.path.normpath(script_path)
421
uri_into_jail = studpath.to_home_path(os.path.normpath(req.path))
423
# PATH_INFO is wrong because the script doesn't physically exist.
424
env['PATH_INFO'] = uri_into_jail[len(normscript):]
425
if len(env['PATH_INFO']) > 0:
426
env['SCRIPT_NAME'] = normuri[:-len(env['PATH_INFO'])]
428
# SERVER_SOFTWARE is actually not Apache but IVLE, since we are
429
# custom-making the CGI request.
430
env['SERVER_SOFTWARE'] = "IVLE/" + ivle.__version__
432
# Additional environment variables
433
username = user.login
434
env['HOME'] = os.path.join('/home', username)
438
class ExecutionError(Exception):
441
def execute_raw(config, user, jail_dir, working_dir, binary, args):
442
'''Execute a binary in a user's jail, returning the raw output.
444
The binary is executed in the given working directory with the given
445
args. A tuple of (stdout, stderr) is returned.
448
tramp = os.path.join(config['paths']['lib'], 'trampoline')
449
tramp_dir = os.path.split(tramp)[0]
451
# Fire up trampoline. Vroom, vroom.
452
cmd_line = [tramp, str(user.unixid), config['paths']['jails']['mounts'],
453
config['paths']['jails']['src'],
454
config['paths']['jails']['template'],
455
jail_dir, working_dir, binary] + args
456
# Popen doesn't like unicode strings. It hateses them.
457
cmd_line = [(s.encode('utf-8') if isinstance(s, unicode) else s)
459
proc = subprocess.Popen(cmd_line,
460
stdin=subprocess.PIPE, stdout=subprocess.PIPE,
461
stderr=subprocess.PIPE, cwd=tramp_dir, close_fds=True,
462
env={'HOME': os.path.join('/home', user.login),
465
'LOGNAME': user.login})
467
(stdout, stderr) = proc.communicate()
468
exitcode = proc.returncode
471
raise ExecutionError('subprocess ended with code %d, stderr: "%s"' %
473
return (stdout, stderr)
added
removed
ivle/interpret.py
