pi-hole/FTL
1
0
Fork 0
mirror of https://github.com/pi-hole/FTL.git synced 2024-10-26 16:52:18 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

Apply and update Pi-hole patches

Browse Source 
Signed-off-by: DL6ER <dl6er@dl6er.de>
This commit is contained in:
DL6ER
2024-08-15 20:33:42 +02:00
parent 07561835f0
commit ce62ddc936
13 changed files with 150 additions and 136 deletions
Download Patch File Download Diff File Expand all files Collapse all files
patch/civetweb.sh
+12 -2
View File
@@ -1,13 +1,23 @@
#!/bin/sh
set -e
echo "Applying patches for civetweb"
echo "Applying patch 0001-add-pihole-mods.patch"
patch -p1 < patch/civetweb/0001-add-pihole-mods.patch
patch -p1 < patch/civetweb/0001-Add-NO_DLOPEN-option-to-civetweb-s-LUA-routines.patch
echo "Applying patch 0001-Always-Kepler-syntax-for-Lua-server-pages.patch"
patch -p1 < patch/civetweb/0001-Always-Kepler-syntax-for-Lua-server-pages.patch
echo "Applying patch 0001-Add-FTL-URI-rewriting-changes-to-CivetWeb.patch"
patch -p1 < patch/civetweb/0001-Add-FTL-URI-rewriting-changes-to-CivetWeb.patch
echo "Applying patch 0001-Add-mbedTLS-debug-logging-hook.patch"
patch -p1 < patch/civetweb/0001-Add-mbedTLS-debug-logging-hook.patch
echo "Applying patch 0001-Add-Register-CSRF-token-in-conn-request_info.patch"
patch -p1 < patch/civetweb/0001-Register-CSRF-token-in-conn-request_info.patch
echo "Applying patch 0001-Log-debug-messages-to-webserver.log-when-debug.webse.patch"
patch -p1 < patch/civetweb/0001-Log-debug-messages-to-webserver.log-when-debug.webse.patch
patch -p1 < patch/civetweb/0001-Allow-extended-ASCII-characters-in-URIs.patch
echo "ALL PATCHES APPLIED OKAY"
patch/civetweb/0001-Add-FTL-URI-rewriting-changes-to-CivetWeb.patch
+8 -8
View File
@@ -14,14 +14,14 @@ index 0d293f1f..44f6cf3d 100644
--- a/src/webserver/civetweb/civetweb.c
+++ b/src/webserver/civetweb/civetweb.c
@@ -7754,6 +7754,8 @@ interpret_uri(struct mg_connection *conn, /* in/out: request (must be valid) */
mg_snprintf(
conn, &truncated, filename, filename_buf_len - 1, "%s%s", root, uri);
roots[i],
uri);
+ FTL_rewrite_pattern(filename, filename_buf_len - 1, root, uri);
+ FTL_rewrite_pattern(filename, filename_buf_len - 1);
+
if (truncated) {
goto interpret_cleanup;
}
if (truncated) {
goto interpret_cleanup;
}
diff --git a/src/webserver/civetweb/civetweb.h b/src/webserver/civetweb/civetweb.h
index e71dfedc..2ad76693 100644
--- a/src/webserver/civetweb/civetweb.h
@@ -30,8 +30,8 @@ index e71dfedc..2ad76693 100644
int status, const char* mime_type,
long long content_length);
+void FTL_rewrite_pattern(char *filename, size_t filename_buf_len,
+ const char *root, const char *uri);
+void FTL_rewrite_pattern(char *filename, unsigned long filename_buf_len);
+
+
// Buffer used for additional "Set-Cookie" headers
#define PIHOLE_HEADERS_MAXLEN 1024
patch/civetweb/0001-Add-NO_DLOPEN-option-to-civetweb-s-LUA-routines.patch
-35
View File
@@ -1,35 +0,0 @@
From 1b81285fed48df6939d4b2569bba9e572f4c1137 Mon Sep 17 00:00:00 2001
From: DL6ER <dl6er@dl6er.de>
Date: Fri, 13 Jan 2023 21:37:31 +0100
Subject: [PATCH] Add NO_DLOPEN option to civetweb's LUA routines
Signed-off-by: DL6ER <dl6er@dl6er.de>
---
src/webserver/civetweb/mod_lua.inl | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/webserver/civetweb/mod_lua.inl b/src/webserver/civetweb/mod_lua.inl
index 5cc94318..59c4f2b3 100644
--- a/src/webserver/civetweb/mod_lua.inl
+++ b/src/webserver/civetweb/mod_lua.inl
@@ -3634,7 +3634,7 @@ lua_init_optional_libraries(void)
lua_shared_init();
/* UUID library */
-#if !defined(_WIN32)
+#if !defined(_WIN32) && !defined(NO_DLOPEN)
lib_handle_uuid = dlopen("libuuid.so", RTLD_LAZY);
pf_uuid_generate.p =
(lib_handle_uuid ? dlsym(lib_handle_uuid, "uuid_generate") : 0);
@@ -3648,7 +3648,7 @@ static void
lua_exit_optional_libraries(void)
{
/* UUID library */
-#if !defined(_WIN32)
+#if !defined(_WIN32) && !defined(NO_DLOPEN)
if (lib_handle_uuid) {
dlclose(lib_handle_uuid);
}
--
2.34.1
patch/civetweb/0001-Add-mbedTLS-debug-logging-hook.patch
+5 -5
View File
@@ -14,8 +14,8 @@ index 2ad76693..52724199 100644
--- a/src/webserver/civetweb/civetweb.h
+++ b/src/webserver/civetweb/civetweb.h
@@ -938,6 +938,10 @@ int my_send_http_error_headers(struct mg_connection *conn,
void FTL_rewrite_pattern(char *filename, size_t filename_buf_len,
const char *root, const char *uri);
void FTL_rewrite_pattern(char *filename, size_t filename_buf_len);
+#define MG_CONFIG_MBEDTLS_DEBUG 3
+void FTL_mbed_debug(void *user_param, int level, const char *file,
@@ -36,9 +36,9 @@ index e72685f4..00b9280a 100644
+ mbedtls_ssl_conf_dbg(conf, FTL_mbed_debug, NULL);
+ /****************************************************/
+
#ifdef MBEDTLS_SSL_PROTO_TLS1_3
psa_status_t status = psa_crypto_init();
if (status != PSA_SUCCESS) {
/* Initialize TLS key and cert */
mbedtls_pk_init(&ctx->pkey);
mbedtls_ctr_drbg_init(&ctx->ctr);
--
2.34.1
patch/civetweb/0001-Allow-extended-ASCII-characters-in-URIs.patch
-35
View File
@@ -1,35 +0,0 @@
From ebb27741b10ed2eac51ac356708800ae96cdd17a Mon Sep 17 00:00:00 2001
From: DL6ER <dl6er@dl6er.de>
Date: Tue, 31 Oct 2023 08:35:31 +0100
Subject: [PATCH] Allow extended ASCII characters in URIs
Signed-off-by: DL6ER <dl6er@dl6er.de>
---
src/webserver/civetweb/civetweb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/webserver/civetweb/civetweb.c b/src/webserver/civetweb/civetweb.c
index 9b0c6308..5320c4d4 100644
--- a/src/webserver/civetweb/civetweb.c
+++ b/src/webserver/civetweb/civetweb.c
@@ -10734,7 +10734,7 @@ skip_to_end_of_word_and_terminate(char **ppw, int eol)
{
/* Forward until a space is found - use isgraph here */
/* See http://www.cplusplus.com/reference/cctype/ */
- while (isgraph((unsigned char)**ppw)) {
+ while ((unsigned char)**ppw > 127 || isgraph((unsigned char)**ppw)) {
(*ppw)++;
}
@@ -18473,7 +18473,7 @@ get_uri_type(const char *uri)
* and % encoded symbols.
*/
for (i = 0; uri[i] != 0; i++) {
- if (uri[i] < 33) {
+ if ((unsigned char)uri[i] < 33) {
/* control characters and spaces are invalid */
return 0;
}
--
2.34.1
patch/civetweb/0001-Log-debug-messages-to-webserver.log-when-debug.webse.patch
-22
View File
@@ -27,28 +27,6 @@ index 3df8eab9..9b0c6308 100644
#endif /* DEBUG */
#endif /* DEBUG_TRACE */
diff --git a/src/webserver/civetweb/mod_mbedtls.inl b/src/webserver/civetweb/mod_mbedtls.inl
index 00b9280a..6a450ba3 100644
--- a/src/webserver/civetweb/mod_mbedtls.inl
+++ b/src/webserver/civetweb/mod_mbedtls.inl
@@ -213,7 +213,7 @@ mbed_ssl_accept(mbedtls_ssl_context **ssl,
return -1;
}
- DEBUG_TRACE("TLS connection %p accepted, state: %d", ssl, (*ssl)->state);
+ DEBUG_TRACE("TLS connection %p accepted, state: %d", ssl, (*ssl)->MBEDTLS_PRIVATE(state));
return 0;
}
@@ -239,7 +239,7 @@ mbed_ssl_handshake(mbedtls_ssl_context *ssl)
}
}
- DEBUG_TRACE("TLS handshake rc: %d, state: %d", rc, ssl->state);
+ DEBUG_TRACE("TLS handshake rc: %d, state: %d", rc, ssl->MBEDTLS_PRIVATE(state));
return rc;
}
--
2.34.1
patch/civetweb/0001-Register-CSRF-token-in-conn-request_info.patch
+6 -6
View File
@@ -6,9 +6,9 @@ Subject: [PATCH] Register CSRF token and is_authenticated boolean in conn->reque
Signed-off-by: DL6ER <dl6er@dl6er.de>
---
src/webserver/civetweb/civetweb.c | 3 +++
src/webserver/civetweb/civetweb.h | 2 ++
src/webserver/civetweb/mod_lua.inl | 3 +++
3 files changed, 8 insertions(+)
src/webserver/civetweb/civetweb.h | 3 +++
src/webserver/civetweb/mod_lua.inl | 4 ++++
3 files changed, 10 insertions(+)
diff --git a/src/webserver/civetweb/civetweb.c b/src/webserver/civetweb/civetweb.c
index 233b342a..f44b17ba 100644
@@ -20,7 +20,6 @@ index 233b342a..f44b17ba 100644
+ /* Pi-hole addition */
+ memset(conn->request_info.csrf_token, 0, sizeof(conn->request_info.csrf_token));
+ reg_boolean(L, "is_authenticated", conn->request_info.is_authenticated != 0);
+
#if defined(USE_SERVER_STATS)
conn->processing_time = 0;
@@ -29,7 +28,7 @@ diff --git a/src/webserver/civetweb/civetweb.h b/src/webserver/civetweb/civetweb
index 5b3d596b..291ef683 100644
--- a/src/webserver/civetweb/civetweb.h
+++ b/src/webserver/civetweb/civetweb.h
@@ -183,6 +183,8 @@ struct mg_request_info {
@@ -183,6 +183,9 @@ struct mg_request_info {
const char *acceptedWebSocketSubprotocol; /* websocket subprotocol,
* accepted during handshake */
@@ -43,13 +42,14 @@ diff --git a/src/webserver/civetweb/mod_lua.inl b/src/webserver/civetweb/mod_lua
index e9a13835..92066b3f 100644
--- a/src/webserver/civetweb/mod_lua.inl
+++ b/src/webserver/civetweb/mod_lua.inl
@@ -2603,6 +2603,9 @@ prepare_lua_request_info_inner(const struct mg_connection *conn, lua_State *L)
@@ -2603,6 +2603,10 @@ prepare_lua_request_info_inner(const struct mg_connection *conn, lua_State *L)
reg_string(L, "finger", conn->request_info.client_cert->finger);
lua_rawset(L, -3);
}
+
+ /* Pi-hole addition */
+ reg_string(L, "csrf_token", conn->request_info.csrf_token);
+ reg_boolean(L, "is_authenticated", conn->request_info.is_authenticated != 0);
}
src/webserver/civetweb/civetweb.c
+58 -2
View File
@@ -239,9 +239,10 @@ static void DEBUG_TRACE_FUNC(const char *func,
#endif
#else
#include "log.h"
#define DEBUG_TRACE(fmt, ...) \
do { \
} while (0)
if(debug_flags[DEBUG_WEBSERVER]) {\
log_web("DEBUG: " fmt " (%s:%d)", ##__VA_ARGS__, short_path(__FILE__), __LINE__); }
#endif /* DEBUG */
#endif /* DEBUG_TRACE */
@@ -4186,6 +4187,14 @@ send_additional_header(struct mg_connection *conn)
if (header && header[0]) {
mg_response_header_add_lines(conn, header);
}
/*************** Pi-hole modification ****************/
if (pi_hole_extra_headers[0] != '\0') {
mg_response_header_add_lines(conn, pi_hole_extra_headers);
// Invalidate extra headers after having sent them to avoid repetitions
pi_hole_extra_headers[0] = '\0';
}
/*****************************************************/
}
@@ -4641,6 +4650,48 @@ mg_send_http_error_impl(struct mg_connection *conn,
}
/************************************** Pi-hole method **************************************/
CIVETWEB_API int
my_send_http_error_headers(struct mg_connection *conn,
int status, const char* mime_type,
long long content_length)
{
if ((mime_type == NULL) || (*mime_type == 0)) {
/* No content type defined: default to text/html */
mime_type = "text/html";
}
mg_response_header_start(conn, status);
send_no_cache_header(conn);
send_additional_header(conn);
mg_response_header_add(conn, "Content-Type", mime_type, -1);
if (content_length < 0) {
/* Size not known. Use chunked encoding (HTTP/1.x) */
if (conn->protocol_type == PROTOCOL_TYPE_HTTP1) {
/* Only HTTP/1.x defines "chunked" encoding, HTTP/2 does not*/
mg_response_header_add(conn, "Transfer-Encoding", "chunked", -1);
}
} else {
char len[32];
int trunc = 0;
mg_snprintf(conn,
&trunc,
len,
sizeof(len),
"%" UINT64_FMT,
(uint64_t)content_length);
if (!trunc) {
/* Since 32 bytes is enough to hold any 64 bit decimal number,
* !trunc is always true */
mg_response_header_add(conn, "Content-Length", len, -1);
}
}
mg_response_header_send(conn);
return 0;
}
/********************************************************************************************/
CIVETWEB_API int
mg_send_http_error(struct mg_connection *conn, int status, const char *fmt, ...)
{
@@ -7887,6 +7938,8 @@ interpret_uri(struct mg_connection *conn, /* in/out: request (must be valid) */
roots[i],
uri);
FTL_rewrite_pattern(filename, filename_buf_len - 1);
if (truncated) {
goto interpret_cleanup;
}
@@ -17995,6 +18048,9 @@ reset_per_request_attributes(struct mg_connection *conn)
}
conn->request_info.local_uri = NULL;
/* Pi-hole addition */
memset(conn->request_info.csrf_token, 0, sizeof(conn->request_info.csrf_token));
#if defined(USE_SERVER_STATS)
conn->processing_time = 0;
#endif
src/webserver/civetweb/civetweb.h
+20
View File
@@ -183,6 +183,9 @@ struct mg_request_info {
const char *acceptedWebSocketSubprotocol; /* websocket subprotocol,
* accepted during handshake */
/* Pi-hole modification */
char csrf_token[32];
int is_authenticated;
};
@@ -928,6 +931,23 @@ CIVETWEB_API int mg_send_http_error(struct mg_connection *conn,
PRINTF_FORMAT_STRING(const char *fmt),
...) PRINTF_ARGS(3, 4);
/************************************** Pi-hole method **************************************/
int my_send_http_error_headers(struct mg_connection *conn,
int status, const char* mime_type,
long long content_length);
void FTL_rewrite_pattern(char *filename, unsigned long filename_buf_len);
#define MG_CONFIG_MBEDTLS_DEBUG 3
void FTL_mbed_debug(void *user_param, int level, const char *file,
int line, const char *message);
// Buffer used for additional "Set-Cookie" headers
#define PIHOLE_HEADERS_MAXLEN 1024
extern char pi_hole_extra_headers[PIHOLE_HEADERS_MAXLEN];
/********************************************************************************************/
/* Send "HTTP 200 OK" response header.
* After calling this function, use mg_write or mg_send_chunk to send the
src/webserver/civetweb/handle_form.inl
+16 -16
View File
@@ -188,7 +188,7 @@ mg_handle_form_request(struct mg_connection *conn,
char path[512];
char buf[MG_BUF_LEN]; /* Must not be smaller than ~900 */
int field_storage;
int buf_fill = 0;
size_t buf_fill = 0;
int r;
int field_count = 0;
struct mg_file fstore = STRUCT_FILE_INITIALIZER;
@@ -397,10 +397,10 @@ mg_handle_form_request(struct mg_connection *conn,
int end_of_key_value_pair_found = 0;
int get_block;
if ((size_t)buf_fill < (sizeof(buf) - 1)) {
if (buf_fill < (sizeof(buf) - 1)) {
size_t to_read = sizeof(buf) - 1 - (size_t)buf_fill;
r = mg_read(conn, buf + (size_t)buf_fill, to_read);
size_t to_read = sizeof(buf) - 1 - buf_fill;
r = mg_read(conn, buf + buf_fill, to_read);
if ((r < 0) || ((r == 0) && all_data_read)) {
/* read error */
return -1;
@@ -529,11 +529,11 @@ mg_handle_form_request(struct mg_connection *conn,
buf + (size_t)used,
sizeof(buf) - (size_t)used);
next = buf;
buf_fill -= (int)used;
if ((size_t)buf_fill < (sizeof(buf) - 1)) {
buf_fill -= used;
if (buf_fill < (sizeof(buf) - 1)) {
size_t to_read = sizeof(buf) - 1 - (size_t)buf_fill;
r = mg_read(conn, buf + (size_t)buf_fill, to_read);
size_t to_read = sizeof(buf) - 1 - buf_fill;
r = mg_read(conn, buf + buf_fill, to_read);
if ((r < 0) || ((r == 0) && all_data_read)) {
#if !defined(NO_FILESYSTEMS)
/* read error */
@@ -592,7 +592,7 @@ mg_handle_form_request(struct mg_connection *conn,
/* Proceed to next entry */
used = next - buf;
memmove(buf, buf + (size_t)used, sizeof(buf) - (size_t)used);
buf_fill -= (int)used;
buf_fill -= used;
}
return field_count;
@@ -682,12 +682,12 @@ mg_handle_form_request(struct mg_connection *conn,
for (part_no = 0;; part_no++) {
size_t towrite, fnlen, n;
int get_block;
size_t to_read = sizeof(buf) - 1 - (size_t)buf_fill;
size_t to_read = sizeof(buf) - 1 - buf_fill;
/* Unused without filesystems */
(void)n;
r = mg_read(conn, buf + (size_t)buf_fill, to_read);
r = mg_read(conn, buf + buf_fill, to_read);
if ((r < 0) || ((r == 0) && all_data_read)) {
/* read error */
mg_free(boundary);
@@ -1001,12 +1001,12 @@ mg_handle_form_request(struct mg_connection *conn,
#endif /* NO_FILESYSTEMS */
memmove(buf, hend + towrite, bl + 4);
buf_fill = (int)(bl + 4);
buf_fill = bl + 4;
hend = buf;
/* Read new data */
to_read = sizeof(buf) - 1 - (size_t)buf_fill;
r = mg_read(conn, buf + (size_t)buf_fill, to_read);
to_read = sizeof(buf) - 1 - buf_fill;
r = mg_read(conn, buf + buf_fill, to_read);
if ((r < 0) || ((r == 0) && all_data_read)) {
#if !defined(NO_FILESYSTEMS)
/* read error */
@@ -1025,7 +1025,7 @@ mg_handle_form_request(struct mg_connection *conn,
/* buf_fill is at least 8 here */
/* Find boundary */
next = search_boundary(buf, (size_t)buf_fill, boundary, bl);
next = search_boundary(buf, buf_fill, boundary, bl);
if (!next && (r == 0)) {
/* incomplete request */
@@ -1100,7 +1100,7 @@ mg_handle_form_request(struct mg_connection *conn,
if (next) {
used = next - buf + 2;
memmove(buf, buf + (size_t)used, sizeof(buf) - (size_t)used);
buf_fill -= (int)used;
buf_fill -= used;
} else {
buf_fill = 0;
}
src/webserver/civetweb/mod_lua.inl
+7 -4
View File
@@ -2606,6 +2606,10 @@ prepare_lua_request_info_inner(const struct mg_connection *conn, lua_State *L)
reg_string(L, "finger", conn->request_info.client_cert->finger);
lua_rawset(L, -3);
}
/* Pi-hole addition */
reg_string(L, "csrf_token", conn->request_info.csrf_token);
reg_boolean(L, "is_authenticated", conn->request_info.is_authenticated != 0);
}
@@ -3226,10 +3230,9 @@ handle_lsp_request(struct mg_connection *conn,
* "<?" which means "classic CivetWeb Syntax".
*
*/
run_lsp = run_lsp_civetweb;
if ((addr[0] == '<') && (addr[1] != '?')) {
run_lsp = run_lsp_kepler;
}
// Pi-hole change: Always use Kepler syntax, ignore rules above
run_lsp = run_lsp_kepler;
/* We're not sending HTTP headers here, Lua page must do it. */
error =
src/webserver/civetweb/mod_mbedtls.inl
+16
View File
@@ -83,11 +83,27 @@ mbed_sslctx_init(SSL_CTX *ctx, const char *crt)
mbedtls_ssl_conf_dbg(conf, mbed_debug, (void *)ctx);
#endif
/****************** Pi-hole change ******************/
mbedtls_ssl_conf_dbg(conf, FTL_mbed_debug, NULL);
/****************************************************/
/* Initialize TLS key and cert */
mbedtls_pk_init(&ctx->pkey);
mbedtls_ctr_drbg_init(&ctx->ctr);
mbedtls_x509_crt_init(&ctx->cert);
#ifdef MBEDTLS_PSA_CRYPTO_C
/* Initialize PSA crypto (mandatory with TLS 1.3)
* This must be done before calling any other PSA Crypto
* functions or they will fail with PSA_ERROR_BAD_STATE
*/
const psa_status_t status = psa_crypto_init();
if (status != PSA_SUCCESS) {
DEBUG_TRACE("Failed to initialize PSA crypto, returned %d\n", (int) status);
return -1;
}
#endif
rc = mbedtls_ctr_drbg_seed(&ctx->ctr,
mbedtls_entropy_func,
&ctx->entropy,
src/webserver/webserver.c
+2 -1
View File
@@ -565,8 +565,9 @@ static char *append_to_path(char *path, const char *append)
return new_path;
}
void FTL_rewrite_pattern(char *filename, size_t filename_buf_len)
void FTL_rewrite_pattern(char *filename, unsigned long filename_buf_len)
{
log_debug(DEBUG_API, "Rewriting filename: %s", filename);
const bool trailing_slash = filename[strlen(filename) - 1] == '/';
char *filename_lp = NULL;