wget: -O FILE is allowed to overwrite existing file (compat)
[oweals/busybox.git] / networking / httpd.c
index 7e60fc2527f99d95a3db1cc847c8b694f738be62..92a07107dc12742de776bb7f72141780e43a4285 100644 (file)
 //#define DEBUG 1
 #define DEBUG 0
 
+#define IOBUF_SIZE 8192    /* IO buffer */
+
 /* amount of buffering in a pipe */
 #ifndef PIPE_BUF
 # define PIPE_BUF 4096
 #endif
-
-#define IOBUF_SIZE 8192    /* IO buffer */
+#if PIPE_BUF >= IOBUF_SIZE
+# error "PIPE_BUF >= IOBUF_SIZE"
+#endif
 
 #define HEADER_READ_TIMEOUT 60
 
@@ -138,6 +141,7 @@ typedef struct Htaccess_IP {
 
 enum {
        HTTP_OK = 200,
+       HTTP_PARTIAL_CONTENT = 206,
        HTTP_MOVED_TEMPORARILY = 302,
        HTTP_BAD_REQUEST = 400,       /* malformed syntax */
        HTTP_UNAUTHORIZED = 401, /* authentication needed, respond with auth hdr */
@@ -163,8 +167,11 @@ enum {
 #endif
 };
 
-static const uint16_t http_response_type[] = {
+static const uint16_t http_response_type[] ALIGN2 = {
        HTTP_OK,
+#if ENABLE_FEATURE_HTTPD_RANGES
+       HTTP_PARTIAL_CONTENT,
+#endif
        HTTP_MOVED_TEMPORARILY,
        HTTP_REQUEST_TIMEOUT,
        HTTP_NOT_IMPLEMENTED,
@@ -192,7 +199,10 @@ static const struct {
        const char *info;
 } http_response[ARRAY_SIZE(http_response_type)] = {
        { "OK", NULL },
-       { "Found", "Directories must end with a slash" }, /* ?? */
+#if ENABLE_FEATURE_HTTPD_RANGES
+       { "Partial Content", NULL },
+#endif
+       { "Found", NULL },
        { "Request Timeout", "No request appeared within 60 seconds" },
        { "Not Implemented", "The requested method is not recognized" },
 #if ENABLE_FEATURE_HTTPD_BASIC_AUTH
@@ -214,13 +224,13 @@ static const struct {
 #endif
 };
 
+
 struct globals {
        int verbose;            /* must be int (used by getopt32) */
        smallint flg_deny_all;
 
        unsigned rmt_ip;        /* used for IP-based allow/deny rules */
        time_t last_mod;
-       off_t ContentLength;    /* -1 - unknown */
        char *rmt_ip_str;       /* for $REMOTE_ADDR and $REMOTE_PORT */
        const char *bind_addr_or_port;
 
@@ -237,6 +247,13 @@ struct globals {
        USE_FEATURE_HTTPD_CGI(char *referer;)
        USE_FEATURE_HTTPD_CGI(char *user_agent;)
 
+       off_t file_size;        /* -1 - unknown */
+#if ENABLE_FEATURE_HTTPD_RANGES
+       off_t range_start;
+       off_t range_end;
+       off_t range_len;
+#endif
+
 #if ENABLE_FEATURE_HTTPD_BASIC_AUTH
        Htaccess *g_auth;       /* config user:password lines */
 #endif
@@ -264,13 +281,18 @@ struct globals {
 #define home_httpd        (G.home_httpd       )
 #define found_mime_type   (G.found_mime_type  )
 #define found_moved_temporarily (G.found_moved_temporarily)
-#define ContentLength     (G.ContentLength    )
 #define last_mod          (G.last_mod         )
 #define ip_a_d            (G.ip_a_d           )
 #define g_realm           (G.g_realm          )
 #define remoteuser        (G.remoteuser       )
 #define referer           (G.referer          )
 #define user_agent        (G.user_agent       )
+#define file_size         (G.file_size        )
+#if ENABLE_FEATURE_HTTPD_RANGES
+#define range_start       (G.range_start      )
+#define range_end         (G.range_end        )
+#define range_len         (G.range_len        )
+#endif
 #define rmt_ip_str        (G.rmt_ip_str       )
 #define g_auth            (G.g_auth           )
 #define mime_a            (G.mime_a           )
@@ -283,10 +305,16 @@ struct globals {
        PTR_TO_GLOBALS = xzalloc(sizeof(G)); \
        USE_FEATURE_HTTPD_BASIC_AUTH(g_realm = "Web Server Authentication";) \
        bind_addr_or_port = "80"; \
-       ContentLength = -1; \
+       file_size = -1; \
 } while (0)
 
-
+#if !ENABLE_FEATURE_HTTPD_RANGES
+enum {
+       range_start = 0,
+       range_end = MAXINT(off_t) - 1,
+       range_len = MAXINT(off_t),
+};
+#endif
 
 
 #define STRNCASECMP(a, str) strncasecmp((a), (str), sizeof(str)-1)
@@ -467,11 +495,6 @@ static void parse_conf(const char *path, int flag)
 
        if (flag == SUBDIR_PARSE || cf == NULL) {
                cf = alloca(strlen(path) + sizeof(httpd_conf) + 2);
-               if (cf == NULL) {
-                       if (flag == FIRST_PARSE)
-                               bb_error_msg_and_die(bb_msg_memory_exhausted);
-                       return;
-               }
                sprintf((char *)cf, "%s/%s", path, httpd_conf);
        }
 
@@ -554,7 +577,7 @@ static void parse_conf(const char *path, int flag)
                        /* error status code */
                        int status = atoi(++p0);
                        /* c already points at the character following ':' in parse loop */
-                       // c = strchr(p0, ':'); c++;
+                       /* c = strchr(p0, ':'); c++; */
                        if (status < HTTP_CONTINUE) {
                                bb_error_msg("config error '%s' in '%s'", buf, cf);
                                continue;
@@ -575,9 +598,7 @@ static void parse_conf(const char *path, int flag)
                if (*p0 == '/') {
                        /* make full path from httpd root / current_path / config_line_path */
                        cf = (flag == SUBDIR_PARSE ? path : "");
-                       p0 = malloc(strlen(cf) + (c - buf) + 2 + strlen(c));
-                       if (p0 == NULL)
-                               continue;
+                       p0 = xmalloc(strlen(cf) + (c - buf) + 2 + strlen(c));
                        c[-1] = '\0';
                        sprintf(p0, "/%s%s", cf, buf);
 
@@ -607,7 +628,7 @@ static void parse_conf(const char *path, int flag)
                                ++p;                             /* so keep last character */
                        }
                        *p = '\0';
-                       sprintf(p0, "%s:%s", p0, c);
+                       sprintf(p0 + strlen(p0), ":%s", c);
                }
 #endif
 
@@ -694,9 +715,11 @@ static char *encodeString(const char *string)
        char ch;
 
        while ((ch = *string++)) {
-               // very simple check for what to encode
-               if (isalnum(ch)) *p++ = ch;
-               else p += sprintf(p, "&#%d;", (unsigned char) ch);
+               /* very simple check for what to encode */
+               if (isalnum(ch))
+                       *p++ = ch;
+               else
+                       p += sprintf(p, "&#%d;", (unsigned char) ch);
        }
        *p = '\0';
        return out;
@@ -717,18 +740,21 @@ static char *encodeString(const char *string)
  */
 static unsigned hex_to_bin(unsigned char c)
 {
-       unsigned v = c | 0x20; /* lowercase */
-       v = v - '0';
+       unsigned v;
+
+       v = c - '0';
        if (v <= 9)
                return v;
-       v = v + ('0' - 'a');
+       /* c | 0x20: letters to lower case, non-letters
+        * to (potentially different) non-letters */
+       v = (unsigned)(c | 0x20) - 'a';
        if (v <= 5)
                return v + 10;
        return ~0;
 }
 /* For testing:
-void t(char c) { printf("'%c' %u\n", c, hex_to_bin(c)); }
-int main() { t('0'); t('9'); t('A'); t('F'); t('a'); t('f');
+void t(char c) { printf("'%c'(%u) %u\n", c, c, hex_to_bin(c)); }
+int main() { t(0x10); t(0x20); t('0'); t('9'); t('A'); t('F'); t('a'); t('f');
 t('0'-1); t('9'+1); t('A'-1); t('F'+1); t('a'-1); t('f'+1); return 0; }
 */
 static char *decodeString(char *orig, int option_d)
@@ -925,10 +951,26 @@ static void send_headers(int responseNum)
        }
 #endif
 
-       if (ContentLength != -1) {    /* file */
+       if (file_size != -1) {    /* file */
                strftime(tmp_str, sizeof(tmp_str), RFC1123FMT, gmtime(&last_mod));
-               len += sprintf(iobuf + len, "Last-Modified: %s\r\n%s %"OFF_FMT"d\r\n",
-                       tmp_str, "Content-length:", ContentLength);
+#if ENABLE_FEATURE_HTTPD_RANGES
+               if (responseNum == HTTP_PARTIAL_CONTENT) {
+                       len += sprintf(iobuf + len, "Content-Range: bytes %"OFF_FMT"d-%"OFF_FMT"d/%"OFF_FMT"d\r\n",
+                                       range_start,
+                                       range_end,
+                                       file_size);
+                       file_size = range_end - range_start + 1;
+               }
+#endif
+               len += sprintf(iobuf + len,
+#if ENABLE_FEATURE_HTTPD_RANGES
+                       "Accept-Ranges: bytes\r\n"
+#endif
+                       "Last-Modified: %s\r\n%s %"OFF_FMT"d\r\n",
+                               tmp_str,
+                               "Content-length:",
+                               file_size
+               );
        }
        iobuf[len++] = '\r';
        iobuf[len++] = '\n';
@@ -990,6 +1032,169 @@ static int get_line(void)
 }
 
 #if ENABLE_FEATURE_HTTPD_CGI
+
+/* gcc 4.2.1 fares better with NOINLINE */
+static NOINLINE void cgi_io_loop_and_exit(int fromCgi_rd, int toCgi_wr, int post_len) ATTRIBUTE_NORETURN;
+static NOINLINE void cgi_io_loop_and_exit(int fromCgi_rd, int toCgi_wr, int post_len)
+{
+       enum { FROM_CGI = 1, TO_CGI = 2 }; /* indexes in pfd[] */
+       struct pollfd pfd[3];
+       int out_cnt; /* we buffer a bit of initial CGI output */
+       int count;
+
+       /* iobuf is used for CGI -> network data,
+        * hdr_buf is for network -> CGI data (POSTDATA) */
+
+       /* If CGI dies, we still want to correctly finish reading its output
+        * and send it to the peer. So please no SIGPIPEs! */
+       signal(SIGPIPE, SIG_IGN);
+
+       /* NB: breaking out of this loop jumps to log_and_exit() */
+       out_cnt = 0;
+       while (1) {
+               memset(pfd, 0, sizeof(pfd));
+
+               pfd[FROM_CGI].fd = fromCgi_rd;
+               pfd[FROM_CGI].events = POLLIN;
+
+               if (toCgi_wr) {
+                       pfd[TO_CGI].fd = toCgi_wr;
+                       if (hdr_cnt > 0) {
+                               pfd[TO_CGI].events = POLLOUT;
+                       } else if (post_len > 0) {
+                               pfd[0].events = POLLIN;
+                       } else {
+                               /* post_len <= 0 && hdr_cnt <= 0:
+                                * no more POST data to CGI,
+                                * let CGI see EOF on CGI's stdin */
+                               close(toCgi_wr);
+                               toCgi_wr = 0;
+                       }
+               }
+
+               /* Now wait on the set of sockets */
+               count = safe_poll(pfd, 3, -1);
+               if (count <= 0) {
+#if 0
+                       if (waitpid(pid, &status, WNOHANG) <= 0) {
+                               /* Weird. CGI didn't exit and no fd's
+                                * are ready, yet poll returned?! */
+                               continue;
+                       }
+                       if (DEBUG && WIFEXITED(status))
+                               bb_error_msg("CGI exited, status=%d", WEXITSTATUS(status));
+                       if (DEBUG && WIFSIGNALED(status))
+                               bb_error_msg("CGI killed, signal=%d", WTERMSIG(status));
+#endif
+                       break;
+               }
+
+               if (pfd[TO_CGI].revents) {
+                       /* hdr_cnt > 0 here due to the way pfd[TO_CGI].events set */
+                       /* Have data from peer and can write to CGI */
+                       count = safe_write(toCgi_wr, hdr_ptr, hdr_cnt);
+                       /* Doesn't happen, we dont use nonblocking IO here
+                        *if (count < 0 && errno == EAGAIN) {
+                        *      ...
+                        *} else */
+                       if (count > 0) {
+                               hdr_ptr += count;
+                               hdr_cnt -= count;
+                       } else {
+                               /* EOF/broken pipe to CGI, stop piping POST data */
+                               hdr_cnt = post_len = 0;
+                       }
+               }
+
+               if (pfd[0].revents) {
+                       /* post_len > 0 && hdr_cnt == 0 here */
+                       /* We expect data, prev data portion is eaten by CGI
+                        * and there *is* data to read from the peer
+                        * (POSTDATA) */
+                       //count = post_len > (int)sizeof(hdr_buf) ? (int)sizeof(hdr_buf) : post_len;
+                       //count = safe_read(0, hdr_buf, count);
+                       count = safe_read(0, hdr_buf, sizeof(hdr_buf));
+                       if (count > 0) {
+                               hdr_cnt = count;
+                               hdr_ptr = hdr_buf;
+                               post_len -= count;
+                       } else {
+                               /* no more POST data can be read */
+                               post_len = 0;
+                       }
+               }
+
+               if (pfd[FROM_CGI].revents) {
+                       /* There is something to read from CGI */
+                       char *rbuf = iobuf;
+
+                       /* Are we still buffering CGI output? */
+                       if (out_cnt >= 0) {
+                               /* HTTP_200[] has single "\r\n" at the end.
+                                * According to http://hoohoo.ncsa.uiuc.edu/cgi/out.html,
+                                * CGI scripts MUST send their own header terminated by
+                                * empty line, then data. That's why we have only one
+                                * <cr><lf> pair here. We will output "200 OK" line
+                                * if needed, but CGI still has to provide blank line
+                                * between header and body */
+
+                               /* Must use safe_read, not full_read, because
+                                * CGI may output a few first bytes and then wait
+                                * for POSTDATA without closing stdout.
+                                * With full_read we may wait here forever. */
+                               count = safe_read(fromCgi_rd, rbuf + out_cnt, PIPE_BUF - 8);
+                               if (count <= 0) {
+                                       /* eof (or error) and there was no "HTTP",
+                                        * so write it, then write received data */
+                                       if (out_cnt) {
+                                               full_write(1, HTTP_200, sizeof(HTTP_200)-1);
+                                               full_write(1, rbuf, out_cnt);
+                                       }
+                                       break; /* CGI stdout is closed, exiting */
+                               }
+                               out_cnt += count;
+                               count = 0;
+                               /* "Status" header format is: "Status: 302 Redirected\r\n" */
+                               if (out_cnt >= 8 && memcmp(rbuf, "Status: ", 8) == 0) {
+                                       /* send "HTTP/1.0 " */
+                                       if (full_write(1, HTTP_200, 9) != 9)
+                                               break;
+                                       rbuf += 8; /* skip "Status: " */
+                                       count = out_cnt - 8;
+                                       out_cnt = -1; /* buffering off */
+                               } else if (out_cnt >= 4) {
+                                       /* Did CGI add "HTTP"? */
+                                       if (memcmp(rbuf, HTTP_200, 4) != 0) {
+                                               /* there is no "HTTP", do it ourself */
+                                               if (full_write(1, HTTP_200, sizeof(HTTP_200)-1) != sizeof(HTTP_200)-1)
+                                                       break;
+                                       }
+                                       /* Commented out:
+                                       if (!strstr(rbuf, "ontent-")) {
+                                               full_write(s, "Content-type: text/plain\r\n\r\n", 28);
+                                       }
+                                        * Counter-example of valid CGI without Content-type:
+                                        * echo -en "HTTP/1.0 302 Found\r\n"
+                                        * echo -en "Location: http://www.busybox.net\r\n"
+                                        * echo -en "\r\n"
+                                        */
+                                       count = out_cnt;
+                                       out_cnt = -1; /* buffering off */
+                               }
+                       } else {
+                               count = safe_read(fromCgi_rd, rbuf, PIPE_BUF);
+                               if (count <= 0)
+                                       break;  /* eof (or error) */
+                       }
+                       if (full_write(1, rbuf, count) != count)
+                               break;
+                       if (DEBUG)
+                               fprintf(stderr, "cgi read %d bytes: '%.*s'\n", count, count, rbuf);
+               } /* if (pfd[FROM_CGI].revents) */
+       } /* while (1) */
+       log_and_exit();
+}
+
 static void setenv1(const char *name, const char *value)
 {
        setenv(name, value ? value : "", 1);
@@ -999,25 +1204,25 @@ static void setenv1(const char *name, const char *value)
  * Spawn CGI script, forward CGI's stdin/out <=> network
  *
  * Environment variables are set up and the script is invoked with pipes
- * for stdin/stdout.  If a post is being done the script is fed the POST
+ * for stdin/stdout.  If a POST is being done the script is fed the POST
  * data in addition to setting the QUERY_STRING variable (for GETs or POSTs).
  *
  * Parameters:
  * const char *url              The requested URL (with leading /).
- * int bodyLen                  Length of the post body.
+ * int post_len                 Length of the POST body.
  * const char *cookie           For set HTTP_COOKIE.
  * const char *content_type     For set CONTENT_TYPE.
  */
 static void send_cgi_and_exit(
                const char *url,
                const char *request,
-               int bodyLen,
+               int post_len,
                const char *cookie,
                const char *content_type) ATTRIBUTE_NORETURN;
 static void send_cgi_and_exit(
                const char *url,
                const char *request,
-               int bodyLen,
+               int post_len,
                const char *cookie,
                const char *content_type)
 {
@@ -1026,9 +1231,7 @@ static void send_cgi_and_exit(
        char *fullpath;
        char *script;
        char *purl;
-       int buf_count;
-       int status;
-       int pid = 0;
+       int pid;
 
        /*
         * We are mucking with environment _first_ and then vfork/exec,
@@ -1099,8 +1302,8 @@ static void send_cgi_and_exit(
                }
        }
        setenv1("HTTP_USER_AGENT", user_agent);
-       if (bodyLen)
-               putenv(xasprintf("CONTENT_LENGTH=%d", bodyLen));
+       if (post_len)
+               putenv(xasprintf("CONTENT_LENGTH=%d", post_len));
        if (cookie)
                setenv1("HTTP_COOKIE", cookie);
        if (content_type)
@@ -1176,168 +1379,15 @@ static void send_cgi_and_exit(
 
        /* Parent process */
 
-       /* First, restore variables possibly changed by child */
+       /* Restore variables possibly changed by child */
        xfunc_error_retval = 0;
 
-       /* Prepare for pumping data.
-        * iobuf is used for CGI -> network data,
-        * hdr_buf is for network -> CGI data (POSTDATA) */
-       buf_count = 0;
+       /* Pump data */
        close(fromCgi.wr);
        close(toCgi.rd);
-
-       /* If CGI dies, we still want to correctly finish reading its output
-        * and send it to the peer. So please no SIGPIPEs! */
-       signal(SIGPIPE, SIG_IGN);
-
-       /* This loop still looks messy. What is an exit criteria?
-        * "CGI's output closed"? Or "CGI has exited"?
-        * What to do if CGI has closed both input and output, but
-        * didn't exit? etc... */
-
-       /* NB: breaking out of this loop jumps to log_and_exit() */
-       while (1) {
-               fd_set readSet;
-               fd_set writeSet;
-               int nfound;
-               int count;
-
-               FD_ZERO(&readSet);
-               FD_ZERO(&writeSet);
-               FD_SET(fromCgi.rd, &readSet);
-               if (bodyLen > 0 || hdr_cnt > 0) {
-                       FD_SET(toCgi.wr, &writeSet);
-                       nfound = toCgi.wr > fromCgi.rd ? toCgi.wr : fromCgi.rd;
-                       if (hdr_cnt <= 0)
-                               FD_SET(0, &readSet);
-                       /* Now wait on the set of sockets! */
-                       nfound = select(nfound + 1, &readSet, &writeSet, NULL, NULL);
-               } else {
-                       if (!bodyLen) {
-                               close(toCgi.wr); /* no more POST data to CGI */
-                               bodyLen = -1;
-                       }
-                       nfound = select(fromCgi.rd + 1, &readSet, NULL, NULL, NULL);
-               }
-
-               if (nfound <= 0) {
-                       if (waitpid(pid, &status, WNOHANG) <= 0) {
-                               /* Weird. CGI didn't exit and no fd's
-                                * are ready, yet select returned?! */
-                               continue;
-                       }
-                       close(fromCgi.rd);
-                       if (DEBUG && WIFEXITED(status))
-                               bb_error_msg("CGI exited, status=%d", WEXITSTATUS(status));
-                       if (DEBUG && WIFSIGNALED(status))
-                               bb_error_msg("CGI killed, signal=%d", WTERMSIG(status));
-                       break;
-               }
-
-               if (hdr_cnt > 0 && FD_ISSET(toCgi.wr, &writeSet)) {
-                       /* Have data from peer and can write to CGI */
-                       count = safe_write(toCgi.wr, hdr_ptr, hdr_cnt);
-                       /* Doesn't happen, we dont use nonblocking IO here
-                        *if (count < 0 && errno == EAGAIN) {
-                        *      ...
-                        *} else */
-                       if (count > 0) {
-                               hdr_ptr += count;
-                               hdr_cnt -= count;
-                       } else {
-                               hdr_cnt = bodyLen = 0; /* EOF/broken pipe to CGI */
-                       }
-               } else if (bodyLen > 0 && hdr_cnt == 0
-                && FD_ISSET(0, &readSet)
-               ) {
-                       /* We expect data, prev data portion is eaten by CGI
-                        * and there *is* data to read from the peer
-                        * (POSTDATA?) */
-                       count = bodyLen > (int)sizeof(hdr_buf) ? (int)sizeof(hdr_buf) : bodyLen;
-                       count = safe_read(0, hdr_buf, count);
-                       if (count > 0) {
-                               hdr_cnt = count;
-                               hdr_ptr = hdr_buf;
-                               bodyLen -= count;
-                       } else {
-                               bodyLen = 0; /* closed */
-                       }
-               }
-
-#define PIPESIZE PIPE_BUF
-#if PIPESIZE >= IOBUF_SIZE
-# error "PIPESIZE >= IOBUF_SIZE"
-#endif
-               if (FD_ISSET(fromCgi.rd, &readSet)) {
-                       /* There is something to read from CGI */
-                       char *rbuf = iobuf;
-
-                       /* Are we still buffering CGI output? */
-                       if (buf_count >= 0) {
-                               /* HTTP_200[] has single "\r\n" at the end.
-                                * According to http://hoohoo.ncsa.uiuc.edu/cgi/out.html,
-                                * CGI scripts MUST send their own header terminated by
-                                * empty line, then data. That's why we have only one
-                                * <cr><lf> pair here. We will output "200 OK" line
-                                * if needed, but CGI still has to provide blank line
-                                * between header and body */
-
-                               /* Must use safe_read, not full_read, because
-                                * CGI may output a few first bytes and then wait
-                                * for POSTDATA without closing stdout.
-                                * With full_read we may wait here forever. */
-                               count = safe_read(fromCgi.rd, rbuf + buf_count, PIPESIZE - 8);
-                               if (count <= 0) {
-                                       /* eof (or error) and there was no "HTTP",
-                                        * so write it, then write received data */
-                                       if (buf_count) {
-                                               full_write(1, HTTP_200, sizeof(HTTP_200)-1);
-                                               full_write(1, rbuf, buf_count);
-                                       }
-                                       break; /* CGI stdout is closed, exiting */
-                               }
-                               buf_count += count;
-                               count = 0;
-                               /* "Status" header format is: "Status: 302 Redirected\r\n" */
-                               if (buf_count >= 8 && memcmp(rbuf, "Status: ", 8) == 0) {
-                                       /* send "HTTP/1.0 " */
-                                       if (full_write(1, HTTP_200, 9) != 9)
-                                               break;
-                                       rbuf += 8; /* skip "Status: " */
-                                       count = buf_count - 8;
-                                       buf_count = -1; /* buffering off */
-                               } else if (buf_count >= 4) {
-                                       /* Did CGI add "HTTP"? */
-                                       if (memcmp(rbuf, HTTP_200, 4) != 0) {
-                                               /* there is no "HTTP", do it ourself */
-                                               if (full_write(1, HTTP_200, sizeof(HTTP_200)-1) != sizeof(HTTP_200)-1)
-                                                       break;
-                                       }
-                                       /* Commented out:
-                                       if (!strstr(rbuf, "ontent-")) {
-                                               full_write(s, "Content-type: text/plain\r\n\r\n", 28);
-                                       }
-                                        * Counter-example of valid CGI without Content-type:
-                                        * echo -en "HTTP/1.0 302 Found\r\n"
-                                        * echo -en "Location: http://www.busybox.net\r\n"
-                                        * echo -en "\r\n"
-                                        */
-                                       count = buf_count;
-                                       buf_count = -1; /* buffering off */
-                               }
-                       } else {
-                               count = safe_read(fromCgi.rd, rbuf, PIPESIZE);
-                               if (count <= 0)
-                                       break;  /* eof (or error) */
-                       }
-                       if (full_write(1, rbuf, count) != count)
-                               break;
-                       if (DEBUG)
-                               fprintf(stderr, "cgi read %d bytes: '%.*s'\n", count, count, rbuf);
-               } /* if (FD_ISSET(fromCgi.rd)) */
-       } /* while (1) */
-       log_and_exit();
+       cgi_io_loop_and_exit(fromCgi.rd, toCgi.wr, post_len);
 }
+
 #endif          /* FEATURE_HTTPD_CGI */
 
 /*
@@ -1377,7 +1427,7 @@ static void send_file_and_exit(const char *url, int headers)
        const char *try_suffix;
        ssize_t count;
 #if ENABLE_FEATURE_HTTPD_USE_SENDFILE
-       off_t offset = 0;
+       off_t offset;
 #endif
 
        suffix = strrchr(url, '.');
@@ -1419,6 +1469,26 @@ static void send_file_and_exit(const char *url, int headers)
                if (headers)
                        send_headers_and_exit(HTTP_NOT_FOUND);
        }
+#if ENABLE_FEATURE_HTTPD_RANGES
+       if (!headers)
+               range_start = 0; /* err pages and ranges don't mix */
+       range_len = MAXINT(off_t);
+       if (range_start) {
+               if (!range_end) {
+                       range_end = file_size - 1;
+               }
+               if (range_end < range_start
+                || lseek(f, range_start, SEEK_SET) != range_start
+               ) {
+                       lseek(f, 0, SEEK_SET);
+                       range_start = 0;
+               } else {
+                       range_len = range_end - range_start + 1;
+                       send_headers(HTTP_PARTIAL_CONTENT);
+                       headers = 0;
+               }
+       }
+#endif
 
        if (headers)
                send_headers(HTTP_OK);
@@ -1428,24 +1498,32 @@ static void send_file_and_exit(const char *url, int headers)
        signal(SIGPIPE, SIG_IGN);
 
 #if ENABLE_FEATURE_HTTPD_USE_SENDFILE
+       offset = range_start;
        do {
-               /* byte count (3rd arg) is rounded down to 64k */
-               count = sendfile(1, f, &offset, MAXINT(ssize_t) - 0xffff);
+               /* sz is rounded down to 64k */
+               ssize_t sz = MAXINT(ssize_t) - 0xffff;
+               USE_FEATURE_HTTPD_RANGES(if (sz > range_len) sz = range_len;)
+               count = sendfile(1, f, &offset, sz);
                if (count < 0) {
-                       if (offset == 0)
+                       if (offset == range_start)
                                goto fallback;
                        goto fin;
                }
-       } while (count > 0);
+               USE_FEATURE_HTTPD_RANGES(range_len -= sz;)
+       } while (count > 0 && range_len);
        log_and_exit();
 
  fallback:
 #endif
        while ((count = safe_read(f, iobuf, IOBUF_SIZE)) > 0) {
-               ssize_t n = count;
-               count = full_write(1, iobuf, count);
+               ssize_t n;
+               USE_FEATURE_HTTPD_RANGES(if (count > range_len) count = range_len;)
+               n = full_write(1, iobuf, count);
                if (count != n)
                        break;
+               USE_FEATURE_HTTPD_RANGES(range_len -= count;)
+               if (!range_len)
+                       break;
        }
 #if ENABLE_FEATURE_HTTPD_USE_SENDFILE
  fin:
@@ -1606,6 +1684,13 @@ static void handle_incoming_and_exit(const len_and_sockaddr *fromAddr)
        if (fromAddr->sa.sa_family == AF_INET) {
                rmt_ip = ntohl(fromAddr->sin.sin_addr.s_addr);
        }
+#if ENABLE_FEATURE_IPV6
+       if (fromAddr->sa.sa_family == AF_INET6
+        && fromAddr->sin6.sin6_addr.s6_addr32[0] == 0
+        && fromAddr->sin6.sin6_addr.s6_addr32[1] == 0
+        && ntohl(fromAddr->sin6.sin6_addr.s6_addr32[2]) == 0xffff)
+               rmt_ip = ntohl(fromAddr->sin6.sin6_addr.s6_addr32[3]);
+#endif
        if (ENABLE_FEATURE_HTTPD_CGI || DEBUG || verbose) {
                rmt_ip_str = xmalloc_sockaddr2dotted(&fromAddr->sa);
        }
@@ -1785,6 +1870,23 @@ static void handle_incoming_and_exit(const len_and_sockaddr *fromAddr)
                                credentials = checkPerm(urlcopy, tptr);
                        }
 #endif          /* FEATURE_HTTPD_BASIC_AUTH */
+#if ENABLE_FEATURE_HTTPD_RANGES
+                       if (STRNCASECMP(iobuf, "Range:") == 0) {
+                               // We know only bytes=NNN-[MMM]
+                               char *s = skip_whitespace(iobuf + sizeof("Range:")-1);
+                               if (strncmp(s, "bytes=", 6) == 0) {
+                                       s += sizeof("bytes=")-1;
+                                       range_start = BB_STRTOOFF(s, &s, 10);
+                                       if (s[0] != '-' || range_start < 0) {
+                                               range_start = 0;
+                                       } else if (s[1]) {
+                                               range_end = BB_STRTOOFF(s+1, NULL, 10);
+                                               if (errno || range_end < range_start)
+                                                       range_start = 0;
+                                       }
+                               }
+                       }
+#endif
                } /* while extra header reading */
        }
 
@@ -1837,8 +1939,7 @@ static void handle_incoming_and_exit(const len_and_sockaddr *fromAddr)
        if (urlp[-1] == '/')
                strcpy(urlp, "index.html");
        if (stat(tptr, &sb) == 0) {
-               /* It's a dir URL and there is index.html */
-               ContentLength = sb.st_size;
+               file_size = sb.st_size;
                last_mod = sb.st_mtime;
        }
 #if ENABLE_FEATURE_HTTPD_CGI
@@ -2093,7 +2194,13 @@ int httpd_main(int argc, char **argv)
 #endif
        }
 
-#if ENABLE_FEATURE_HTTPD_CGI
+#if 0 /*was #if ENABLE_FEATURE_HTTPD_CGI*/
+       /* User can do it himself: 'env - PATH="$PATH" httpd'
+        * We don't do it because we don't want to screw users
+        * which want to do
+        * 'env - VAR1=val1 VAR2=val2 https'
+        * and have VAR1 and VAR2 values visible in their CGIs.
+        * Besides, it is also smaller. */
        {
                char *p = getenv("PATH");
                /* env strings themself are not freed, no need to strdup(p): */