/usr/src/usr.sbin/httpd/server.c

Bug Summary

File:	src/usr.sbin/httpd/server.c
Warning:	line 449, column 3 Use of memory after it is freed
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name server.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/httpd/obj -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/usr.sbin/httpd -I /usr/src/usr.sbin/httpd/obj -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/httpd/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/usr.sbin/httpd/server.c
1/*	$OpenBSD: server.c,v 1.129 2023/11/08 19:19:10 millert Exp $	*/

3/*
* Copyright (c) 2006 - 2015 Reyk Floeter <reyk@openbsd.org>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/

19#include <sys/types.h>
20#include <sys/queue.h>
21#include <sys/time.h>
22#include <sys/stat.h>
23#include <sys/socket.h>
24#include <sys/uio.h>
25#include <sys/tree.h>

27#include <netinet/in.h>
28#include <netinet/tcp.h>
29#include <arpa/inet.h>

31#include <stdio.h>
32#include <stdlib.h>
33#include <stdarg.h>
34#include <limits.h>
35#include <errno(*__errno()).h>
36#include <fcntl.h>
37#include <string.h>
38#include <syslog.h>
39#include <unistd.h>
40#include <event.h>
41#include <imsg.h>
42#include <tls.h>
43#include <vis.h>

45#include "httpd.h"

47#define MINIMUM(a, b)(((a) < (b)) ? (a) : (b))	(((a) < (b)) ? (a) : (b))

49int		 server_dispatch_parent(int, struct privsep_proc *,
    struct imsg *);
51int		 server_dispatch_logger(int, struct privsep_proc *,
    struct imsg *);
53void		 server_shutdown(void);

55void		 server_init(struct privsep *, struct privsep_proc *p, void *);
56void		 server_launch(void);
57int		 server_socket(struct sockaddr_storage *, in_port_t,
    struct server_config *, int, int);
59int		 server_socket_listen(struct sockaddr_storage *, in_port_t,
    struct server_config *);
61struct server	*server_byid(uint32_t);

63int		 server_tls_init(struct server *);
64void		 server_tls_readcb(int, short, void *);
65void		 server_tls_writecb(int, short, void *);
66void		 server_tls_handshake(int, short, void *);

68void		 server_accept(int, short, void *);
69void		 server_input(struct client *);
70void		 server_inflight_dec(struct client *, const char *);

72extern void	 bufferevent_read_pressure_cb(struct evbuffer *, size_t,
    size_t, void *);

75volatile int server_clients;
76volatile int server_inflight = 0;
77uint32_t server_cltid;

79static struct privsep_proc procs[] = {
{ "parent",	PROC_PARENT,	server_dispatch_parent },
{ "logger",	PROC_LOGGER,	server_dispatch_logger }
82};

84void
85server(struct privsep *ps, struct privsep_proc *p)
86{
proc_run(ps, p, procs, nitems(procs)(sizeof((procs)) / sizeof((procs)[0])), server_init, NULL((void *)0));
server_http();
89}

91void
92server_shutdown(void)
93{
config_purge(httpd_env, CONFIG_ALL0xff);
usleep(200);	/* XXX server needs to shutdown last */
96}

98int
99server_privinit(struct server *srv)
100{
struct server	*s;

if (srv->srv_conf.flags & SRVFLAG_LOCATION0x00000020)
return (0);

log_debug("%s: adding server %s", __func__, srv->srv_conf.name);

/*
* There's no need to open a new socket if a server with the
* same address already exists.
*/
TAILQ_FOREACH(s, httpd_env->sc_servers, srv_entry)for((s) = ((httpd_env->sc_servers)->tqh_first); (s) != (
(void *)0); (s) = ((s)->srv_entry.tqe_next)) {
if (s != srv && s->srv_s != -1 &&
    s->srv_conf.port == srv->srv_conf.port &&
    sockaddr_cmp((struct sockaddr *)&s->srv_conf.ss,
    (struct sockaddr *)&srv->srv_conf.ss,
    s->srv_conf.prefixlen) == 0)
	return (0);
}

/* Open listening socket in the privileged process */
if ((srv->srv_s = server_socket_listen(&srv->srv_conf.ss,
   srv->srv_conf.port, &srv->srv_conf)) == -1)
return (-1);

return (0);
127}

129int
130server_tls_cmp(struct server *s1, struct server *s2)
131{
struct server_config	*sc1, *sc2;

sc1 = &s1->srv_conf;
sc2 = &s2->srv_conf;

if (sc1->tls_flags != sc2->tls_flags)
return (-1);
if (sc1->tls_protocols != sc2->tls_protocols)
return (-1);
if (sc1->tls_ticket_lifetime != sc2->tls_ticket_lifetime)
return (-1);
if (strcmp(sc1->tls_ciphers, sc2->tls_ciphers) != 0)
return (-1);
if (strcmp(sc1->tls_dhe_params, sc2->tls_dhe_params) != 0)
return (-1);
if (strcmp(sc1->tls_ecdhe_curves, sc2->tls_ecdhe_curves) != 0)
return (-1);

return (0);
151}

153int
154server_tls_load_keypair(struct server *srv)
155{
if ((srv->srv_conf.flags & SRVFLAG_TLS0x00002000) == 0)
return (0);

if ((srv->srv_conf.tls_cert = tls_load_file(srv->srv_conf.tls_cert_file,
   &srv->srv_conf.tls_cert_len, NULL((void *)0))) == NULL((void *)0))
return (-1);
log_debug("%s: using certificate %s", __func__,
   srv->srv_conf.tls_cert_file);

/* XXX allow to specify password for encrypted key */
if ((srv->srv_conf.tls_key = tls_load_file(srv->srv_conf.tls_key_file,
   &srv->srv_conf.tls_key_len, NULL((void *)0))) == NULL((void *)0))
return (-1);
log_debug("%s: using private key %s", __func__,
   srv->srv_conf.tls_key_file);

return (0);
173}

175int
176server_tls_load_ocsp(struct server *srv)
177{
if ((srv->srv_conf.flags & SRVFLAG_TLS0x00002000) == 0)
return (0);

if (srv->srv_conf.tls_ocsp_staple_file == NULL((void *)0))
return (0);

if ((srv->srv_conf.tls_ocsp_staple = tls_load_file(
   srv->srv_conf.tls_ocsp_staple_file,
   &srv->srv_conf.tls_ocsp_staple_len, NULL((void *)0))) == NULL((void *)0)) {
log_warnx("%s: Failed to load ocsp staple from %s", __func__,
    srv->srv_conf.tls_ocsp_staple_file);
return (-1);
}

if (srv->srv_conf.tls_ocsp_staple_len == 0) {
log_warnx("%s: ignoring 0 length ocsp staple from %s", __func__,
    srv->srv_conf.tls_ocsp_staple_file);
return (0);
}

log_debug("%s: using ocsp staple from %s", __func__,
   srv->srv_conf.tls_ocsp_staple_file);

return (0);
202}

204int
205server_tls_load_ca(struct server *srv)
206{
if ((srv->srv_conf.tls_flags & TLSFLAG_CA0x01) == 0 ||
   srv->srv_conf.tls_ca_file == NULL((void *)0))
return (0);

if ((srv->srv_conf.tls_ca = tls_load_file(
   srv->srv_conf.tls_ca_file,
   &srv->srv_conf.tls_ca_len, NULL((void *)0))) == NULL((void *)0))
return (-1);
log_debug("%s: using ca cert(s) from %s", __func__,
   srv->srv_conf.tls_ca_file);

return (0);
219}

221int
222server_tls_load_crl(struct server *srv)
223{
if ((srv->srv_conf.tls_flags & TLSFLAG_CA0x01) == 0 ||
   srv->srv_conf.tls_crl_file == NULL((void *)0))
return (0);

if ((srv->srv_conf.tls_crl = tls_load_file(
   srv->srv_conf.tls_crl_file,
   &srv->srv_conf.tls_crl_len, NULL((void *)0))) == NULL((void *)0))
return (-1);
log_debug("%s: using crl(s) from %s", __func__,
   srv->srv_conf.tls_crl_file);

return (0);
236}

238int
239server_tls_init(struct server *srv)
240{
struct server_config *srv_conf;

if ((srv->srv_conf.flags & SRVFLAG_TLS0x00002000) == 0)
return (0);

log_debug("%s: setting up tls for %s", __func__, srv->srv_conf.name);

if ((srv->srv_tls_config = tls_config_new()) == NULL((void *)0)) {
log_warnx("%s: failed to get tls config", __func__);
return (-1);
}
if ((srv->srv_tls_ctx = tls_server()) == NULL((void *)0)) {
log_warnx("%s: failed to get tls server", __func__);
return (-1);
}

if (tls_config_set_protocols(srv->srv_tls_config,
   srv->srv_conf.tls_protocols) != 0) {
log_warnx("%s: failed to set tls protocols: %s",
    __func__, tls_config_error(srv->srv_tls_config));
return (-1);
}
if (tls_config_set_ciphers(srv->srv_tls_config,
   srv->srv_conf.tls_ciphers) != 0) {
log_warnx("%s: failed to set tls ciphers: %s",
    __func__, tls_config_error(srv->srv_tls_config));
return (-1);
}
if (tls_config_set_dheparams(srv->srv_tls_config,
   srv->srv_conf.tls_dhe_params) != 0) {
log_warnx("%s: failed to set tls dhe params: %s",
    __func__, tls_config_error(srv->srv_tls_config));
return (-1);
}
if (tls_config_set_ecdhecurves(srv->srv_tls_config,
   srv->srv_conf.tls_ecdhe_curves) != 0) {
log_warnx("%s: failed to set tls ecdhe curves: %s",
    __func__, tls_config_error(srv->srv_tls_config));
return (-1);
}

if (tls_config_set_keypair_ocsp_mem(srv->srv_tls_config,
   srv->srv_conf.tls_cert, srv->srv_conf.tls_cert_len,
   srv->srv_conf.tls_key, srv->srv_conf.tls_key_len,
   srv->srv_conf.tls_ocsp_staple,
   srv->srv_conf.tls_ocsp_staple_len) != 0) {
log_warnx("%s: failed to set tls certificate/key: %s",
    __func__, tls_config_error(srv->srv_tls_config));
return (-1);
}

if (srv->srv_conf.tls_ca != NULL((void *)0)) {
if (tls_config_set_ca_mem(srv->srv_tls_config,
    srv->srv_conf.tls_ca, srv->srv_conf.tls_ca_len) != 0) {
	log_warnx("%s: failed to add ca cert(s)", __func__);
	return (-1);
}
if (tls_config_set_crl_mem(srv->srv_tls_config,
    srv->srv_conf.tls_crl, srv->srv_conf.tls_crl_len) != 0) {
	log_warnx("%s: failed to add crl(s)", __func__);
	return (-1);
}
if (srv->srv_conf.tls_flags & TLSFLAG_OPTIONAL0x04)
	tls_config_verify_client_optional(srv->srv_tls_config);
else
	tls_config_verify_client(srv->srv_tls_config);
}

TAILQ_FOREACH(srv_conf, &srv->srv_hosts, entry)for((srv_conf) = ((&srv->srv_hosts)->tqh_first); (srv_conf
) != ((void *)0); (srv_conf) = ((srv_conf)->entry.tqe_next
)) {
if (srv_conf->tls_cert == NULL((void *)0) || srv_conf->tls_key == NULL((void *)0))
	continue;
log_debug("%s: adding keypair for server %s", __func__,
    srv->srv_conf.name);
if (tls_config_add_keypair_ocsp_mem(srv->srv_tls_config,
    srv_conf->tls_cert, srv_conf->tls_cert_len,
    srv_conf->tls_key, srv_conf->tls_key_len,
    srv_conf->tls_ocsp_staple,
    srv_conf->tls_ocsp_staple_len) != 0) {
	log_warnx("%s: failed to add tls keypair", __func__);
	return (-1);
}
}

/* set common session ID among all processes */
if (tls_config_set_session_id(srv->srv_tls_config,
   httpd_env->sc_tls_sid, sizeof(httpd_env->sc_tls_sid)) == -1) {
log_warnx("%s: could not set the TLS session ID: %s",
    __func__, tls_config_error(srv->srv_tls_config));
return (-1);
}

/* ticket support */
if (srv->srv_conf.tls_ticket_lifetime) {
if (tls_config_set_session_lifetime(srv->srv_tls_config,
    srv->srv_conf.tls_ticket_lifetime) == -1) {
	log_warnx("%s: could not set the TLS session lifetime: "
	    "%s", __func__,
	    tls_config_error(srv->srv_tls_config));
	return (-1);
}
tls_config_add_ticket_key(srv->srv_tls_config,
    srv->srv_conf.tls_ticket_key.tt_keyrev,
    srv->srv_conf.tls_ticket_key.tt_key,
    sizeof(srv->srv_conf.tls_ticket_key.tt_key));
explicit_bzero(&srv->srv_conf.tls_ticket_key,
    sizeof(srv->srv_conf.tls_ticket_key));
}

if (tls_configure(srv->srv_tls_ctx, srv->srv_tls_config) != 0) {
log_warnx("%s: failed to configure tls - %s", __func__,
    tls_error(srv->srv_tls_ctx));
return (-1);
}

/* We're now done with the public/private key & ca/crl... */
tls_config_clear_keys(srv->srv_tls_config);
freezero(srv->srv_conf.tls_cert, srv->srv_conf.tls_cert_len);
freezero(srv->srv_conf.tls_key, srv->srv_conf.tls_key_len);
free(srv->srv_conf.tls_ca);
free(srv->srv_conf.tls_crl);
srv->srv_conf.tls_ca = NULL((void *)0);
srv->srv_conf.tls_cert = NULL((void *)0);
srv->srv_conf.tls_crl = NULL((void *)0);
srv->srv_conf.tls_key = NULL((void *)0);
srv->srv_conf.tls_ca_len = 0;
srv->srv_conf.tls_cert_len = 0;
srv->srv_conf.tls_crl_len = 0;
srv->srv_conf.tls_key_len = 0;

return (0);
371}

373void
374server_generate_ticket_key(struct server_config *srv_conf)
375{
struct server_tls_ticket *key = &srv_conf->tls_ticket_key;

key->tt_id = srv_conf->id;
key->tt_keyrev = arc4random();
arc4random_buf(key->tt_key, sizeof(key->tt_key));
381}

383void
384server_init(struct privsep *ps, struct privsep_proc *p, void *arg)
385{
server_http();

if (config_init(ps->ps_env) == -1)
fatal("failed to initialize configuration");

/* We use a custom shutdown callback */
p->p_shutdown = server_shutdown;

/* Unlimited file descriptors (use system limits) */
socket_rlimit(-1);

if (pledge("stdio rpath inet unix recvfd", NULL((void *)0)) == -1)
fatal("pledge");

400#if 0
/* Schedule statistics timer */
evtimer_set(&ps->ps_env->sc_statev, server_statistics, NULL)event_set(&ps->ps_env->sc_statev, -1, 0, server_statistics
, ((void *)0));
memcpy(&tv, &ps->ps_env->sc_statinterval, sizeof(tv));
evtimer_add(&ps->ps_env->sc_statev, &tv)event_add(&ps->ps_env->sc_statev, &tv);
405#endif
406}

408void
409server_launch(void)
410{
struct server		*srv;

TAILQ_FOREACH(srv, httpd_env->sc_servers, srv_entry)for((srv) = ((httpd_env->sc_servers)->tqh_first); (srv)
 != ((void *)0); (srv) = ((srv)->srv_entry.tqe_next)) {
log_debug("%s: configuring server %s", __func__,
    srv->srv_conf.name);

server_tls_init(srv);
server_http_init(srv);

log_debug("%s: running server %s", __func__,
    srv->srv_conf.name);

event_set(&srv->srv_ev, srv->srv_s, EV_READ0x02,
    server_accept, srv);
event_add(&srv->srv_ev, NULL((void *)0));
evtimer_set(&srv->srv_evt, server_accept, srv)event_set(&srv->srv_evt, -1, 0, server_accept, srv);
}
428}

430void
431server_purge(struct server *srv)
432{
struct client		*clt;
struct server_config	*srv_conf;

/* shutdown and remove server */
if (event_initialized(&srv->srv_ev)((&srv->srv_ev)->ev_flags & 0x80))
1
Assuming the condition is false→
2
←
Taking false branch→
event_del(&srv->srv_ev);
if (evtimer_initialized(&srv->srv_evt)((&srv->srv_evt)->ev_flags & 0x80))
3
←
Assuming the condition is false→
4
←
Taking false branch→
evtimer_del(&srv->srv_evt)event_del(&srv->srv_evt);

if (srv->srv_s != -1)
5
←
Assuming the condition is false→
6
←
Taking false branch→
close(srv->srv_s);
TAILQ_REMOVE(httpd_env->sc_servers, srv, srv_entry)do { if (((srv)->srv_entry.tqe_next) != ((void *)0)) (srv)
->srv_entry.tqe_next->srv_entry.tqe_prev = (srv)->srv_entry
.tqe_prev; else (httpd_env->sc_servers)->tqh_last = (srv
)->srv_entry.tqe_prev; *(srv)->srv_entry.tqe_prev = (srv
)->srv_entry.tqe_next; ; ; } while (0);
7
←
Assuming field 'tqe_next' is equal to null→
8
←
Taking false branch→
9
←
Loop condition is false.  Exiting loop→

/* cleanup sessions */
while ((clt =
10
←
Assuming the condition is true→
11
←
Loop condition is true.  Entering loop body→
37
←
Loop condition is true.  Entering loop body→
   SPLAY_ROOT(&srv->srv_clients)(&srv->srv_clients)->sph_root) != NULL((void *)0))
server_close(clt, NULL((void *)0));
12
←
Calling 'server_close'→
36
←
Returning; memory was released via 1st parameter→
38
←
Use of memory after it is freed

/* cleanup hosts */
while ((srv_conf =
   TAILQ_FIRST(&srv->srv_hosts)((&srv->srv_hosts)->tqh_first)) != NULL((void *)0)) {
TAILQ_REMOVE(&srv->srv_hosts, srv_conf, entry)do { if (((srv_conf)->entry.tqe_next) != ((void *)0)) (srv_conf
)->entry.tqe_next->entry.tqe_prev = (srv_conf)->entry
.tqe_prev; else (&srv->srv_hosts)->tqh_last = (srv_conf
)->entry.tqe_prev; *(srv_conf)->entry.tqe_prev = (srv_conf
)->entry.tqe_next; ; ; } while (0);

/* It might point to our own "default" entry */
if (srv_conf != &srv->srv_conf) {
	serverconfig_free(srv_conf);
	free(srv_conf);
}
}

tls_config_free(srv->srv_tls_config);
tls_free(srv->srv_tls_ctx);

free(srv);
467}

469void
470serverconfig_free(struct server_config *srv_conf)
471{
struct fastcgi_param	*param, *tparam;

free(srv_conf->return_uri);
free(srv_conf->tls_ca_file);
free(srv_conf->tls_ca);
free(srv_conf->tls_cert_file);
free(srv_conf->tls_crl_file);
free(srv_conf->tls_crl);
free(srv_conf->tls_key_file);
free(srv_conf->tls_ocsp_staple_file);
free(srv_conf->tls_ocsp_staple);
freezero(srv_conf->tls_cert, srv_conf->tls_cert_len);
freezero(srv_conf->tls_key, srv_conf->tls_key_len);

TAILQ_FOREACH_SAFE(param, &srv_conf->fcgiparams, entry, tparam)for ((param) = ((&srv_conf->fcgiparams)->tqh_first)
; (param) != ((void *)0) && ((tparam) = ((param)->
entry.tqe_next), 1); (param) = (tparam))
free(param);
488}

490void
491serverconfig_reset(struct server_config *srv_conf)
492{
srv_conf->auth = NULL((void *)0);
srv_conf->return_uri = NULL((void *)0);
srv_conf->tls_ca = NULL((void *)0);
srv_conf->tls_ca_file = NULL((void *)0);
srv_conf->tls_cert = NULL((void *)0);
srv_conf->tls_cert_file = NULL((void *)0);
srv_conf->tls_crl = NULL((void *)0);
srv_conf->tls_crl_file = NULL((void *)0);
srv_conf->tls_key = NULL((void *)0);
srv_conf->tls_key_file = NULL((void *)0);
srv_conf->tls_ocsp_staple = NULL((void *)0);
srv_conf->tls_ocsp_staple_file = NULL((void *)0);
TAILQ_INIT(&srv_conf->fcgiparams)do { (&srv_conf->fcgiparams)->tqh_first = ((void *)
0); (&srv_conf->fcgiparams)->tqh_last = &(&
srv_conf->fcgiparams)->tqh_first; } while (0);
506}

508struct server *
509server_byaddr(struct sockaddr *addr, in_port_t port)
510{
struct server	*srv;

TAILQ_FOREACH(srv, httpd_env->sc_servers, srv_entry)for((srv) = ((httpd_env->sc_servers)->tqh_first); (srv)
 != ((void *)0); (srv) = ((srv)->srv_entry.tqe_next)) {
if (port == srv->srv_conf.port &&
    sockaddr_cmp((struct sockaddr *)&srv->srv_conf.ss,
    addr, srv->srv_conf.prefixlen) == 0)
	return (srv);
}

return (NULL((void *)0));
521}

523struct server_config *
524serverconfig_byid(uint32_t id)
525{
struct server		*srv;
struct server_config	*srv_conf;

TAILQ_FOREACH(srv, httpd_env->sc_servers, srv_entry)for((srv) = ((httpd_env->sc_servers)->tqh_first); (srv)
 != ((void *)0); (srv) = ((srv)->srv_entry.tqe_next)) {
if (srv->srv_conf.id == id)
	return (&srv->srv_conf);
TAILQ_FOREACH(srv_conf, &srv->srv_hosts, entry)for((srv_conf) = ((&srv->srv_hosts)->tqh_first); (srv_conf
) != ((void *)0); (srv_conf) = ((srv_conf)->entry.tqe_next
)) {
	if (srv_conf->id == id)
		return (srv_conf);
}
}

return (NULL((void *)0));
539}

541struct server *
542server_byid(uint32_t id)
543{
struct server	*srv;

TAILQ_FOREACH(srv, httpd_env->sc_servers, srv_entry)for((srv) = ((httpd_env->sc_servers)->tqh_first); (srv)
 != ((void *)0); (srv) = ((srv)->srv_entry.tqe_next)) {
if (srv->srv_conf.id == id)
	return (srv);
}
return (NULL((void *)0));
551}

553int
554server_foreach(int (*srv_cb)(struct server *,
  struct server_config *, void *), void *arg)
556{
struct server		*srv;
struct server_config	*srv_conf;

TAILQ_FOREACH(srv, httpd_env->sc_servers, srv_entry)for((srv) = ((httpd_env->sc_servers)->tqh_first); (srv)
 != ((void *)0); (srv) = ((srv)->srv_entry.tqe_next)) {
if ((srv_cb)(srv, &srv->srv_conf, arg) == -1)
	return (-1);
TAILQ_FOREACH(srv_conf, &srv->srv_hosts, entry)for((srv_conf) = ((&srv->srv_hosts)->tqh_first); (srv_conf
) != ((void *)0); (srv_conf) = ((srv_conf)->entry.tqe_next
)) {
	if ((srv_cb)(srv, srv_conf, arg) == -1)
		return (-1);
}
}

return (0);
570}

572struct server *
573server_match(struct server *s2, int match_name)
574{
struct server	*s1;

/* Attempt to find matching server. */
TAILQ_FOREACH(s1, httpd_env->sc_servers, srv_entry)for((s1) = ((httpd_env->sc_servers)->tqh_first); (s1) !=
 ((void *)0); (s1) = ((s1)->srv_entry.tqe_next)) {
if ((s1->srv_conf.flags & SRVFLAG_LOCATION0x00000020) != 0)
	continue;
if (match_name) {
	if (strcmp(s1->srv_conf.name, s2->srv_conf.name) != 0)
		continue;
}
if (s1->srv_conf.port != s2->srv_conf.port)
	continue;
if (sockaddr_cmp(
    (struct sockaddr *)&s1->srv_conf.ss,
    (struct sockaddr *)&s2->srv_conf.ss,
    s1->srv_conf.prefixlen) != 0)
	continue;

return (s1);
}

return (NULL((void *)0));
597}

599int
600server_socket_af(struct sockaddr_storage *ss, in_port_t port)
601{
switch (ss->ss_family) {
case AF_INET2:
((struct sockaddr_in *)ss)->sin_port = port;
((struct sockaddr_in *)ss)->sin_len =
    sizeof(struct sockaddr_in);
break;
case AF_INET624:
((struct sockaddr_in6 *)ss)->sin6_port = port;
((struct sockaddr_in6 *)ss)->sin6_len =
    sizeof(struct sockaddr_in6);
break;
default:
return (-1);
}

return (0);
618}

620in_port_t
621server_socket_getport(struct sockaddr_storage *ss)
622{
switch (ss->ss_family) {
case AF_INET2:
return (((struct sockaddr_in *)ss)->sin_port);
case AF_INET624:
return (((struct sockaddr_in6 *)ss)->sin6_port);
default:
return (0);
}

/* NOTREACHED */
return (0);
634}

636int
637server_socket(struct sockaddr_storage *ss, in_port_t port,
  struct server_config *srv_conf, int fd, int reuseport)
639{
struct linger	lng;
int		s = -1, val;

if (server_socket_af(ss, port) == -1)
goto bad;

s = fd == -1 ? socket(ss->ss_family, SOCK_STREAM1 | SOCK_NONBLOCK0x4000,
   IPPROTO_TCP6) : fd;
if (s == -1)
goto bad;

/*
* Socket options
*/
memset(&lng, 0, sizeof(lng));
if (setsockopt(s, SOL_SOCKET0xffff, SO_LINGER0x0080, &lng, sizeof(lng)) == -1)
goto bad;
if (reuseport) {
val = 1;
if (setsockopt(s, SOL_SOCKET0xffff, SO_REUSEPORT0x0200, &val,
    sizeof(int)) == -1)
	goto bad;
}
if (srv_conf->tcpflags & TCPFLAG_BUFSIZ0x10) {
val = srv_conf->tcpbufsiz;
if (setsockopt(s, SOL_SOCKET0xffff, SO_RCVBUF0x1002,
    &val, sizeof(val)) == -1)
	goto bad;
val = srv_conf->tcpbufsiz;
if (setsockopt(s, SOL_SOCKET0xffff, SO_SNDBUF0x1001,
    &val, sizeof(val)) == -1)
	goto bad;
}

/*
* IP options
*/
if (srv_conf->tcpflags & TCPFLAG_IPTTL0x20) {
val = (int)srv_conf->tcpipttl;
switch (ss->ss_family) {
case AF_INET2:
	if (setsockopt(s, IPPROTO_IP0, IP_TTL4,
	    &val, sizeof(val)) == -1)
		goto bad;
	break;
case AF_INET624:
	if (setsockopt(s, IPPROTO_IPV641, IPV6_UNICAST_HOPS4,
	    &val, sizeof(val)) == -1)
		goto bad;
	break;
}
}
if (srv_conf->tcpflags & TCPFLAG_IPMINTTL0x40) {
val = (int)srv_conf->tcpipminttl;
switch (ss->ss_family) {
case AF_INET2:
	if (setsockopt(s, IPPROTO_IP0, IP_MINTTL32,
	    &val, sizeof(val)) == -1)
		goto bad;
	break;
case AF_INET624:
	if (setsockopt(s, IPPROTO_IPV641, IPV6_MINHOPCOUNT65,
	    &val, sizeof(val)) == -1)
		goto bad;
	break;
}
}

/*
* TCP options
*/
if (srv_conf->tcpflags & (TCPFLAG_NODELAY0x01|TCPFLAG_NNODELAY0x02)) {
if (srv_conf->tcpflags & TCPFLAG_NNODELAY0x02)
	val = 0;
else
	val = 1;
if (setsockopt(s, IPPROTO_TCP6, TCP_NODELAY0x01,
    &val, sizeof(val)) == -1)
	goto bad;
}
if (srv_conf->tcpflags & (TCPFLAG_SACK0x04|TCPFLAG_NSACK0x08)) {
if (srv_conf->tcpflags & TCPFLAG_NSACK0x08)
	val = 0;
else
	val = 1;
if (setsockopt(s, IPPROTO_TCP6, TCP_SACK_ENABLE0x08,
    &val, sizeof(val)) == -1)
	goto bad;
}

return (s);

bad:
if (s != -1)
close(s);
return (-1);
736}

738int
739server_socket_listen(struct sockaddr_storage *ss, in_port_t port,
  struct server_config *srv_conf)
741{
int s;

if ((s = server_socket(ss, port, srv_conf, -1, 1)) == -1)
return (-1);

if (bind(s, (struct sockaddr *)ss, ss->ss_len) == -1)
goto bad;
if (listen(s, srv_conf->tcpbacklog) == -1)
goto bad;

return (s);

bad:
close(s);
return (-1);
757}

759int
760server_socket_connect(struct sockaddr_storage *ss, in_port_t port,
  struct server_config *srv_conf)
762{
int	s;

if ((s = server_socket(ss, port, srv_conf, -1, 0)) == -1)
return (-1);

if (connect(s, (struct sockaddr *)ss, ss->ss_len) == -1) {
if (errno(*__errno()) != EINPROGRESS36)
	goto bad;
}

return (s);

bad:
close(s);
return (-1);
778}

780void
781server_tls_readcb(int fd, short event, void *arg)
782{
struct bufferevent	*bufev = arg;
struct client		*clt = bufev->cbarg;
char			 rbuf[IBUF_READ_SIZE65535];
int			 what = EVBUFFER_READ0x01;
int			 howmuch = IBUF_READ_SIZE65535;
ssize_t			 ret;
size_t			 len;

if (event == EV_TIMEOUT0x01) {
what |= EVBUFFER_TIMEOUT0x40;
goto err;
}

if (bufev->wm_read.high != 0)
howmuch = MINIMUM(sizeof(rbuf), bufev->wm_read.high)(((sizeof(rbuf)) < (bufev->wm_read.high)) ? (sizeof(rbuf
)) : (bufev->wm_read.high));

ret = tls_read(clt->clt_tls_ctx, rbuf, howmuch);
if (ret == TLS_WANT_POLLIN-2 || ret == TLS_WANT_POLLOUT-3) {
goto retry;
} else if (ret == -1) {
what |= EVBUFFER_ERROR0x20;
goto err;
}
len = ret;

if (len == 0) {
what |= EVBUFFER_EOF0x10;
goto err;
}

if (evbuffer_add(bufev->input, rbuf, len) == -1) {
what |= EVBUFFER_ERROR0x20;
goto err;
}

server_bufferevent_add(&bufev->ev_read, bufev->timeout_read);

len = EVBUFFER_LENGTH(bufev->input)(bufev->input)->off;
if (bufev->wm_read.low != 0 && len < bufev->wm_read.low)
return;
if (bufev->wm_read.high != 0 && len > bufev->wm_read.high) {
struct evbuffer *buf = bufev->input;
event_del(&bufev->ev_read);
evbuffer_setcb(buf, bufferevent_read_pressure_cb, bufev);
return;
}

if (bufev->readcb != NULL((void *)0))
(*bufev->readcb)(bufev, bufev->cbarg);
return;

retry:
server_bufferevent_add(&bufev->ev_read, bufev->timeout_read);
return;

err:
(*bufev->errorcb)(bufev, what, bufev->cbarg);
840}

842void
843server_tls_writecb(int fd, short event, void *arg)
844{
struct bufferevent	*bufev = arg;
struct client		*clt = bufev->cbarg;
ssize_t			 ret;
short			 what = EVBUFFER_WRITE0x02;
size_t			 len;

if (event == EV_TIMEOUT0x01) {
what |= EVBUFFER_TIMEOUT0x40;
goto err;
}

if (EVBUFFER_LENGTH(bufev->output)(bufev->output)->off) {
ret = tls_write(clt->clt_tls_ctx,
    EVBUFFER_DATA(bufev->output)(bufev->output)->buffer,
    EVBUFFER_LENGTH(bufev->output)(bufev->output)->off);
if (ret == TLS_WANT_POLLIN-2 || ret == TLS_WANT_POLLOUT-3) {
	goto retry;
} else if (ret == -1) {
	what |= EVBUFFER_ERROR0x20;
	goto err;
}
len = ret;
evbuffer_drain(bufev->output, len);
}

if (EVBUFFER_LENGTH(bufev->output)(bufev->output)->off != 0)
server_bufferevent_add(&bufev->ev_write, bufev->timeout_write);

if (bufev->writecb != NULL((void *)0) &&
   EVBUFFER_LENGTH(bufev->output)(bufev->output)->off <= bufev->wm_write.low)
(*bufev->writecb)(bufev, bufev->cbarg);
return;

retry:
server_bufferevent_add(&bufev->ev_write, bufev->timeout_write);
return;

err:
(*bufev->errorcb)(bufev, what, bufev->cbarg);
884}

886void
887server_input(struct client *clt)
888{
struct server_config	*srv_conf = clt->clt_srv_conf;
evbuffercb		 inrd = server_read;
evbuffercb		 inwr = server_write;
socklen_t		 slen;

if (server_httpdesc_init(clt) == -1) {
server_close(clt, "failed to allocate http descriptor");
return;
}

clt->clt_toread = TOREAD_HTTP_HEADER;
inrd = server_read_http;

slen = sizeof(clt->clt_sndbufsiz);
if (getsockopt(clt->clt_s, SOL_SOCKET0xffff, SO_SNDBUF0x1001,
   &clt->clt_sndbufsiz, &slen) == -1) {
server_close(clt, "failed to get send buffer size");
return;
}

/*
* Client <-> Server
*/
clt->clt_bev = bufferevent_new(clt->clt_s, inrd, inwr,
   server_error, clt);
if (clt->clt_bev == NULL((void *)0)) {
server_close(clt, "failed to allocate input buffer event");
return;
}

if (srv_conf->flags & SRVFLAG_TLS0x00002000) {
event_set(&clt->clt_bev->ev_read, clt->clt_s, EV_READ0x02,
    server_tls_readcb, clt->clt_bev);
event_set(&clt->clt_bev->ev_write, clt->clt_s, EV_WRITE0x04,
    server_tls_writecb, clt->clt_bev);
}

/* Adjust write watermark to the socket buffer output size */
bufferevent_setwatermark(clt->clt_bev, EV_WRITE0x04,
   SERVER_MIN_PREFETCHED32 * clt->clt_sndbufsiz, 0);
/* Read at most amount of data that fits in one fcgi record. */
bufferevent_setwatermark(clt->clt_bev, EV_READ0x02, 0, FCGI_CONTENT_SIZE65535);

bufferevent_settimeout(clt->clt_bev,
   srv_conf->requesttimeout.tv_sec, srv_conf->requesttimeout.tv_sec);
bufferevent_enable(clt->clt_bev, EV_READ0x02|EV_WRITE0x04);
935}

937void
938server_write(struct bufferevent *bev, void *arg)
939{
struct client		*clt = arg;
struct evbuffer		*dst = EVBUFFER_OUTPUT(bev)(bev)->output;

if (EVBUFFER_LENGTH(dst)(dst)->off == 0 &&
   clt->clt_toread == TOREAD_HTTP_NONE)
goto done;

getmonotime(&clt->clt_tv_last);

if (clt->clt_done)
goto done;

if (clt->clt_srvbev && clt->clt_srvbev_throttled) {
bufferevent_enable(clt->clt_srvbev, EV_READ0x02);
clt->clt_srvbev_throttled = 0;
}

return;
done:
(*bev->errorcb)(bev, EVBUFFER_WRITE0x02, bev->cbarg);
return;
961}

963void
964server_dump(struct client *clt, const void *buf, size_t len)
965{
if (!len)
return;

/*
* This function will dump the specified message directly
* to the underlying client, without waiting for success
* of non-blocking events etc. This is useful to print an
* error message before gracefully closing the client.
*/
if (clt->clt_tls_ctx != NULL((void *)0))
(void)tls_write(clt->clt_tls_ctx, buf, len);
else
(void)write(clt->clt_s, buf, len);
979}

981void
982server_read(struct bufferevent *bev, void *arg)
983{
struct client		*clt = arg;
struct evbuffer		*src = EVBUFFER_INPUT(bev)(bev)->input;

getmonotime(&clt->clt_tv_last);

if (!EVBUFFER_LENGTH(src)(src)->off)
return;
if (server_bufferevent_write_buffer(clt, src) == -1)
goto fail;
if (clt->clt_done)
goto done;

if (EVBUFFER_LENGTH(EVBUFFER_OUTPUT(clt->clt_bev))((clt->clt_bev)->output)->off > (size_t)
   SERVER_MAX_PREFETCH256 * clt->clt_sndbufsiz) {
bufferevent_disable(clt->clt_srvbev, EV_READ0x02);
clt->clt_srvbev_throttled = 1;
}

return;
done:
(*bev->errorcb)(bev, EVBUFFER_READ0x01, bev->cbarg);
return;
fail:
server_close(clt, strerror(errno(*__errno())));
1008}

1010void
1011server_error(struct bufferevent *bev, short error, void *arg)
1012{
struct client		*clt = arg;
struct evbuffer		*dst;

if (error & EVBUFFER_TIMEOUT0x40) {
if (!clt->clt_headersdone && clt->clt_line > 0)
	server_abort_http(clt, 408, "timeout");
else
	server_close(clt, "timeout");
return;
}
if (error & EVBUFFER_ERROR0x20) {
if (errno(*__errno()) == EFBIG27) {
	bufferevent_enable(bev, EV_READ0x02);
	return;
}
server_close(clt, "buffer event error");
return;
}
if (error & EVBUFFER_EOF0x10) {
server_close(clt, "closed");
return;
}
if (error & (EVBUFFER_READ0x01|EVBUFFER_WRITE0x02)) {
bufferevent_disable(bev, EV_READ0x02|EV_WRITE0x04);

clt->clt_done = 1;

dst = EVBUFFER_OUTPUT(clt->clt_bev)(clt->clt_bev)->output;
if (EVBUFFER_LENGTH(dst)(dst)->off) {
	/* Finish writing all data first */
	bufferevent_enable(clt->clt_bev, EV_WRITE0x04);
	return;
}

server_close(clt, "done");
return;
}
server_close(clt, "unknown event error");
return;
1052}

1054void
1055server_accept(int fd, short event, void *arg)
1056{
struct server		*srv = arg;
struct client		*clt = NULL((void *)0);
socklen_t		 slen;
struct sockaddr_storage	 ss;
int			 s = -1;

event_add(&srv->srv_ev, NULL((void *)0));
if ((event & EV_TIMEOUT0x01))
return;

slen = sizeof(ss);
if ((s = accept_reserve(fd, (struct sockaddr *)&ss,
   &slen, FD_RESERVE5, &server_inflight)) == -1) {
/*
 * Pause accept if we are out of file descriptors, or
 * libevent will haunt us here too.
 */
if (errno(*__errno()) == ENFILE23 || errno(*__errno()) == EMFILE24) {
	struct timeval evtpause = { 1, 0 };

	event_del(&srv->srv_ev);
	evtimer_add(&srv->srv_evt, &evtpause)event_add(&srv->srv_evt, &evtpause);
	log_debug("%s: deferring connections", __func__);
}
return;
}
if (server_clients >= SERVER_MAX_CLIENTS1024)
goto err;

if ((clt = calloc(1, sizeof(*clt))) == NULL((void *)0))
goto err;

/* Pre-allocate log buffer */
clt->clt_log = evbuffer_new();
if (clt->clt_log == NULL((void *)0))
goto err;

clt->clt_s = s;
clt->clt_fd = -1;
clt->clt_toread = TOREAD_UNLIMITED;
clt->clt_srv = srv;
clt->clt_srv_conf = &srv->srv_conf;
clt->clt_id = ++server_cltid;
clt->clt_srv_id = srv->srv_conf.id;
clt->clt_pid = getpid();
clt->clt_inflight = 1;

/* get local address */
slen = sizeof(clt->clt_srv_ss);
if (getsockname(s, (struct sockaddr *)&clt->clt_srv_ss,
   &slen) == -1) {
server_close(clt, "listen address lookup failed");
return;
}

/* get client address */
memcpy(&clt->clt_ss, &ss, sizeof(clt->clt_ss));

/* get ports */
switch (ss.ss_family) {
case AF_INET2:
clt->clt_port = ((struct sockaddr_in *)&ss)->sin_port;
break;
case AF_INET624:
clt->clt_port = ((struct sockaddr_in6 *)&ss)->sin6_port;
break;
}

getmonotime(&clt->clt_tv_start);
memcpy(&clt->clt_tv_last, &clt->clt_tv_start, sizeof(clt->clt_tv_last));

server_clients++;
SPLAY_INSERT(client_tree, &srv->srv_clients, clt)client_tree_SPLAY_INSERT(&srv->srv_clients, clt);

/* Pre-allocate output buffer */
clt->clt_output = evbuffer_new();
if (clt->clt_output == NULL((void *)0)) {
server_close(clt, "failed to allocate output buffer");
return;
}

if (srv->srv_conf.flags & SRVFLAG_TLS0x00002000) {
if (tls_accept_socket(srv->srv_tls_ctx, &clt->clt_tls_ctx,
    clt->clt_s) != 0) {
	server_close(clt, "failed to accept tls socket");
	return;
}
event_again(&clt->clt_ev, clt->clt_s, EV_TIMEOUT0x01|EV_READ0x02,
    server_tls_handshake, &clt->clt_tv_start,
    &srv->srv_conf.timeout, clt);
return;
}

server_input(clt);
return;

err:
if (s != -1) {
close(s);
free(clt);
/*
 * the client struct was not completely set up, but still
 * counted as an inflight client. account for this.
 */
server_inflight_dec(NULL((void *)0), __func__);
}
1163}

1165void
1166server_tls_handshake(int fd, short event, void *arg)
1167{
struct client *clt = (struct client *)arg;
struct server *srv = (struct server *)clt->clt_srv;
int ret;

if (event == EV_TIMEOUT0x01) {
server_close(clt, "tls handshake timeout");
return;
}

if (srv->srv_tls_ctx == NULL((void *)0) || clt->clt_tls_ctx == NULL((void *)0))
fatalx("NULL tls context");

ret = tls_handshake(clt->clt_tls_ctx);
if (ret == 0) {
server_input(clt);
} else if (ret == TLS_WANT_POLLIN-2) {
event_again(&clt->clt_ev, clt->clt_s, EV_TIMEOUT0x01|EV_READ0x02,
    server_tls_handshake, &clt->clt_tv_start,
    &srv->srv_conf.timeout, clt);
} else if (ret == TLS_WANT_POLLOUT-3) {
event_again(&clt->clt_ev, clt->clt_s, EV_TIMEOUT0x01|EV_WRITE0x04,
    server_tls_handshake, &clt->clt_tv_start,
    &srv->srv_conf.timeout, clt);
} else {
log_debug("%s: tls handshake failed - %s", __func__,
    tls_error(clt->clt_tls_ctx));
server_close(clt, "tls handshake failed");
}
1196}

1198void
1199server_inflight_dec(struct client *clt, const char *why)
1200{
if (clt != NULL((void *)0)) {
/* the flight already left inflight mode. */
if (clt->clt_inflight == 0)
	return;
clt->clt_inflight = 0;
}

/* the file was never opened, thus this was an inflight client. */
server_inflight--;
DPRINTF("%s: inflight decremented, now %d, %s",do {} while(0)
   __func__, server_inflight, why)do {} while(0);
1212}

1214void
1215server_sendlog(struct server_config *srv_conf, int cmd, const char *emsg, ...)
1216{
va_list		 ap;
char		*msg;
int		 ret;
struct iovec	 iov[2];

if (srv_conf->flags & SRVFLAG_SYSLOG0x00000800) {
va_start(ap, emsg)__builtin_va_start((ap), emsg);
if (cmd == IMSG_LOG_ACCESS)
	vlog(LOG_INFO6, emsg, ap);
else
	vlog(LOG_DEBUG7, emsg, ap);
va_end(ap)__builtin_va_end((ap));
return;
}

va_start(ap, emsg)__builtin_va_start((ap), emsg);
ret = vasprintf(&msg, emsg, ap);
va_end(ap)__builtin_va_end((ap));
if (ret == -1) {
log_warn("%s: vasprintf", __func__);
return;
}

iov[0].iov_base = &srv_conf->id;
iov[0].iov_len = sizeof(srv_conf->id);
iov[1].iov_base = msg;
iov[1].iov_len = ret + 1;

if (proc_composev(httpd_env->sc_ps, PROC_LOGGER, cmd, iov, 2) != 0) {
log_warn("%s: failed to compose imsg", __func__);
free(msg);
return;
}
free(msg);
1251}

1253void
1254server_log(struct client *clt, const char *msg)
1255{
char			 ibuf[HOST_NAME_MAX255+1], obuf[HOST_NAME_MAX255+1];
struct server_config	*srv_conf = clt->clt_srv_conf;
char			*ptr = NULL((void *)0), *vmsg = NULL((void *)0);
int			 debug_cmd = -1;

switch (srv_conf->logformat) {
case LOG_FORMAT_CONNECTION:
debug_cmd = IMSG_LOG_ACCESS;
break;
default:
if (log_getverbose() > 1)
	debug_cmd = IMSG_LOG_ERROR;
if (EVBUFFER_LENGTH(clt->clt_log)(clt->clt_log)->off) {
	while ((ptr =
	    evbuffer_readline(clt->clt_log)) != NULL((void *)0)) {
		server_sendlog(srv_conf,
		    IMSG_LOG_ACCESS, "%s", ptr);
		free(ptr);
	}
}
break;
}

if (debug_cmd != -1 && msg != NULL((void *)0)) {
memset(ibuf, 0, sizeof(ibuf));
memset(obuf, 0, sizeof(obuf));
(void)print_host(&clt->clt_ss, ibuf, sizeof(ibuf));
(void)server_http_host(&clt->clt_srv_ss, obuf, sizeof(obuf));
if (EVBUFFER_LENGTH(clt->clt_log)(clt->clt_log)->off &&
    evbuffer_add_printf(clt->clt_log, "\n") != -1)
	ptr = evbuffer_readline(clt->clt_log);
(void)stravis(&vmsg, msg, HTTPD_LOGVIS0x10|0x08|0x02);
server_sendlog(srv_conf, debug_cmd, "server %s, "
    "client %d (%d active), %s:%u -> %s, "
    "%s%s%s", srv_conf->name, clt->clt_id, server_clients,
    ibuf, ntohs(clt->clt_port)(__uint16_t)(__builtin_constant_p(clt->clt_port) ? (__uint16_t
)(((__uint16_t)(clt->clt_port) & 0xffU) << 8 | (
(__uint16_t)(clt->clt_port) & 0xff00U) >> 8) : __swap16md
(clt->clt_port)), obuf, vmsg == NULL((void *)0) ? "" : vmsg,
    ptr == NULL((void *)0) ? "" : ",", ptr == NULL((void *)0) ? "" : ptr);
free(vmsg);
free(ptr);
}
1296}

1298void
1299server_close(struct client *clt, const char *msg)
1300{
struct server		*srv = clt->clt_srv;

if (clt->clt_fcgi_count-- > 0) {
13
←
Assuming the condition is false→
14
←
Taking false branch→
clt->clt_fcgi_error = msg;
return;
}

SPLAY_REMOVE(client_tree, &srv->srv_clients, clt)client_tree_SPLAY_REMOVE(&srv->srv_clients, clt);

/* free the HTTP descriptors incl. headers */
server_close_http(clt);

/* tls_close must be called before the underlying socket is closed. */
if (clt->clt_tls_ctx != NULL((void *)0))
15
←
Assuming field 'clt_tls_ctx' is equal to NULL→
16
←
Taking false branch→
tls_close(clt->clt_tls_ctx); /* XXX - error handling */
tls_free(clt->clt_tls_ctx);

event_del(&clt->clt_ev);
if (clt->clt_bev != NULL((void *)0))
17
←
Assuming field 'clt_bev' is equal to NULL→
18
←
Taking false branch→
bufferevent_disable(clt->clt_bev, EV_READ0x02|EV_WRITE0x04);
if (clt->clt_srvbev != NULL((void *)0))
19
←
Assuming field 'clt_srvbev' is equal to NULL→
20
←
Taking false branch→
bufferevent_disable(clt->clt_srvbev, EV_READ0x02|EV_WRITE0x04);

server_log(clt, msg);

if (clt->clt_bev != NULL((void *)0))
21
←
Assuming field 'clt_bev' is equal to NULL→
22
←
Taking false branch→
bufferevent_free(clt->clt_bev);
if (clt->clt_output != NULL((void *)0))
23
←
Assuming field 'clt_output' is equal to NULL→
24
←
Taking false branch→
evbuffer_free(clt->clt_output);
if (clt->clt_srvevb != NULL((void *)0))
25
←
Assuming field 'clt_srvevb' is equal to NULL→
26
←
Taking false branch→
evbuffer_free(clt->clt_srvevb);

if (clt->clt_srvbev != NULL((void *)0))
27
←
Assuming field 'clt_srvbev' is equal to NULL→
28
←
Taking false branch→
bufferevent_free(clt->clt_srvbev);

if (clt->clt_fd != -1)
29
←
Assuming the condition is false→
30
←
Taking false branch→
close(clt->clt_fd);
if (clt->clt_s != -1)
31
←
Assuming the condition is false→
32
←
Taking false branch→
close(clt->clt_s);

server_inflight_dec(clt, __func__);

if (clt->clt_log != NULL((void *)0))
33
←
Assuming field 'clt_log' is equal to NULL→
34
←
Taking false branch→
evbuffer_free(clt->clt_log);

free(clt);
35
←
Memory is released→
server_clients--;
1348}

1350int
1351server_dispatch_parent(int fd, struct privsep_proc *p, struct imsg *imsg)
1352{
struct server			*srv;
struct server_tls_ticket	 key;

switch (imsg->hdr.type) {
case IMSG_CFG_MEDIA:
config_getmedia(httpd_env, imsg);
break;
case IMSG_CFG_AUTH:
config_getauth(httpd_env, imsg);
break;
case IMSG_CFG_SERVER:
config_getserver(httpd_env, imsg);
break;
case IMSG_CFG_TLS:
config_getserver_tls(httpd_env, imsg);
break;
case IMSG_CFG_FCGI:
config_getserver_fcgiparams(httpd_env, imsg);
break;
case IMSG_CFG_DONE:
config_getcfg(httpd_env, imsg);
break;
case IMSG_CTL_START:
server_launch();
break;
case IMSG_CTL_RESET:
config_getreset(httpd_env, imsg);
break;
case IMSG_TLSTICKET_REKEY:
IMSG_SIZE_CHECK(imsg, (&key))do { if (((imsg)->hdr.len - sizeof(struct imsg_hdr)) < sizeof
(*(&key))) fatalx("bad length imsg received"); } while (0
);
memcpy(&key, imsg->data, sizeof(key));
/* apply to the right server */
srv = server_byid(key.tt_id);
if (srv) {
	tls_config_add_ticket_key(srv->srv_tls_config,
	    key.tt_keyrev, key.tt_key, sizeof(key.tt_key));
}
break;
default:
return (-1);
}

return (0);
1396}

1398int
1399server_dispatch_logger(int fd, struct privsep_proc *p, struct imsg *imsg)
1400{
switch (imsg->hdr.type) {
default:
return (-1);
}

return (0);
1407}

1409int
1410server_bufferevent_add(struct event *ev, int timeout)
1411{
struct timeval tv, *ptv = NULL((void *)0);

if (timeout) {
timerclear(&tv)(&tv)->tv_sec = (&tv)->tv_usec = 0;
tv.tv_sec = timeout;
ptv = &tv;
}

return (event_add(ev, ptv));
1421}

1423int
1424server_bufferevent_printf(struct client *clt, const char *fmt, ...)
1425{
int	 ret;
va_list	 ap;
char	*str;

va_start(ap, fmt)__builtin_va_start((ap), fmt);
ret = vasprintf(&str, fmt, ap);
va_end(ap)__builtin_va_end((ap));

if (ret == -1)
return (ret);

ret = server_bufferevent_print(clt, str);
free(str);

return (ret);
1441}

1443int
1444server_bufferevent_print(struct client *clt, const char *str)
1445{
if (clt->clt_bev == NULL((void *)0))
return (evbuffer_add(clt->clt_output, str, strlen(str)));
return (bufferevent_write(clt->clt_bev, str, strlen(str)));
1449}

1451int
1452server_bufferevent_write_buffer(struct client *clt, struct evbuffer *buf)
1453{
if (clt->clt_bev == NULL((void *)0))
return (evbuffer_add_buffer(clt->clt_output, buf));
return (bufferevent_write_buffer(clt->clt_bev, buf));
1457}

1459int
1460server_bufferevent_write_chunk(struct client *clt,
  struct evbuffer *buf, size_t size)
1462{
int ret;
ret = server_bufferevent_write(clt, EVBUFFER_DATA(buf)(buf)->buffer, size);
if (ret != -1)
evbuffer_drain(buf, size);
return (ret);
1468}

1470int
1471server_bufferevent_write(struct client *clt, void *data, size_t size)
1472{
if (clt->clt_bev == NULL((void *)0))
return (evbuffer_add(clt->clt_output, data, size));
return (bufferevent_write(clt->clt_bev, data, size));
1476}

1478int
1479server_client_cmp(struct client *a, struct client *b)
1480{
return ((int)a->clt_id - b->clt_id);
1482}

1484SPLAY_GENERATE(client_tree, client, clt_nodes, server_client_cmp)struct client * client_tree_SPLAY_INSERT(struct client_tree *
head, struct client *elm) { if (((head)->sph_root == ((void
 *)0))) { (elm)->clt_nodes.spe_left = (elm)->clt_nodes.
spe_right = ((void *)0); } else { int __comp; client_tree_SPLAY
(head, elm); __comp = (server_client_cmp)(elm, (head)->sph_root
); if(__comp < 0) { (elm)->clt_nodes.spe_left = ((head)
->sph_root)->clt_nodes.spe_left; (elm)->clt_nodes.spe_right
 = (head)->sph_root; ((head)->sph_root)->clt_nodes.spe_left
 = ((void *)0); } else if (__comp > 0) { (elm)->clt_nodes
.spe_right = ((head)->sph_root)->clt_nodes.spe_right; (
elm)->clt_nodes.spe_left = (head)->sph_root; ((head)->
sph_root)->clt_nodes.spe_right = ((void *)0); } else return
 ((head)->sph_root); } (head)->sph_root = (elm); return
 (((void *)0)); } struct client * client_tree_SPLAY_REMOVE(struct
 client_tree *head, struct client *elm) { struct client *__tmp
; if (((head)->sph_root == ((void *)0))) return (((void *)
0)); client_tree_SPLAY(head, elm); if ((server_client_cmp)(elm
, (head)->sph_root) == 0) { if (((head)->sph_root)->
clt_nodes.spe_left == ((void *)0)) { (head)->sph_root = ((
head)->sph_root)->clt_nodes.spe_right; } else { __tmp =
 ((head)->sph_root)->clt_nodes.spe_right; (head)->sph_root
 = ((head)->sph_root)->clt_nodes.spe_left; client_tree_SPLAY
(head, elm); ((head)->sph_root)->clt_nodes.spe_right = __tmp
; } return (elm); } return (((void *)0)); } void client_tree_SPLAY
(struct client_tree *head, struct client *elm) { struct client
 __node, *__left, *__right, *__tmp; int __comp; (&__node)
->clt_nodes.spe_left = (&__node)->clt_nodes.spe_right
 = ((void *)0); __left = __right = &__node; while ((__comp
 = (server_client_cmp)(elm, (head)->sph_root))) { if (__comp
 < 0) { __tmp = ((head)->sph_root)->clt_nodes.spe_left
; if (__tmp == ((void *)0)) break; if ((server_client_cmp)(elm
, __tmp) < 0){ do { ((head)->sph_root)->clt_nodes.spe_left
 = (__tmp)->clt_nodes.spe_right; (__tmp)->clt_nodes.spe_right
 = (head)->sph_root; (head)->sph_root = __tmp; } while (
0); if (((head)->sph_root)->clt_nodes.spe_left == ((void
 *)0)) break; } do { (__right)->clt_nodes.spe_left = (head
)->sph_root; __right = (head)->sph_root; (head)->sph_root
 = ((head)->sph_root)->clt_nodes.spe_left; } while (0);
 } else if (__comp > 0) { __tmp = ((head)->sph_root)->
clt_nodes.spe_right; if (__tmp == ((void *)0)) break; if ((server_client_cmp
)(elm, __tmp) > 0){ do { ((head)->sph_root)->clt_nodes
.spe_right = (__tmp)->clt_nodes.spe_left; (__tmp)->clt_nodes
.spe_left = (head)->sph_root; (head)->sph_root = __tmp;
 } while (0); if (((head)->sph_root)->clt_nodes.spe_right
 == ((void *)0)) break; } do { (__left)->clt_nodes.spe_right
 = (head)->sph_root; __left = (head)->sph_root; (head)->
sph_root = ((head)->sph_root)->clt_nodes.spe_right; } while
 (0); } } do { (__left)->clt_nodes.spe_right = ((head)->
sph_root)->clt_nodes.spe_left; (__right)->clt_nodes.spe_left
 = ((head)->sph_root)->clt_nodes.spe_right; ((head)->
sph_root)->clt_nodes.spe_left = (&__node)->clt_nodes
.spe_right; ((head)->sph_root)->clt_nodes.spe_right = (
&__node)->clt_nodes.spe_left; } while (0); } void client_tree_SPLAY_MINMAX
(struct client_tree *head, int __comp) { struct client __node
, *__left, *__right, *__tmp; (&__node)->clt_nodes.spe_left
 = (&__node)->clt_nodes.spe_right = ((void *)0); __left
 = __right = &__node; while (1) { if (__comp < 0) { __tmp
 = ((head)->sph_root)->clt_nodes.spe_left; if (__tmp ==
 ((void *)0)) break; if (__comp < 0){ do { ((head)->sph_root
)->clt_nodes.spe_left = (__tmp)->clt_nodes.spe_right; (
__tmp)->clt_nodes.spe_right = (head)->sph_root; (head)->
sph_root = __tmp; } while (0); if (((head)->sph_root)->
clt_nodes.spe_left == ((void *)0)) break; } do { (__right)->
clt_nodes.spe_left = (head)->sph_root; __right = (head)->
sph_root; (head)->sph_root = ((head)->sph_root)->clt_nodes
.spe_left; } while (0); } else if (__comp > 0) { __tmp = (
(head)->sph_root)->clt_nodes.spe_right; if (__tmp == ((
void *)0)) break; if (__comp > 0) { do { ((head)->sph_root
)->clt_nodes.spe_right = (__tmp)->clt_nodes.spe_left; (
__tmp)->clt_nodes.spe_left = (head)->sph_root; (head)->
sph_root = __tmp; } while (0); if (((head)->sph_root)->
clt_nodes.spe_right == ((void *)0)) break; } do { (__left)->
clt_nodes.spe_right = (head)->sph_root; __left = (head)->
sph_root; (head)->sph_root = ((head)->sph_root)->clt_nodes
.spe_right; } while (0); } } do { (__left)->clt_nodes.spe_right
 = ((head)->sph_root)->clt_nodes.spe_left; (__right)->
clt_nodes.spe_left = ((head)->sph_root)->clt_nodes.spe_right
; ((head)->sph_root)->clt_nodes.spe_left = (&__node
)->clt_nodes.spe_right; ((head)->sph_root)->clt_nodes
.spe_right = (&__node)->clt_nodes.spe_left; } while (0
); };