PVE/HTTPServer.pm

   1 package PVE::HTTPServer;
   2
   3 use strict;
   4 use warnings;
   5 use Time::HiRes qw(usleep ualarm gettimeofday tv_interval);
   6 use Socket qw(IPPROTO_TCP TCP_NODELAY SOMAXCONN);
   7 use POSIX qw(strftime EINTR EAGAIN);
   8 use Fcntl;
   9 use IO::File;
  10 use File::stat qw();
  11 use Digest::MD5;
  12 # use AnyEvent::Strict; # only use this for debugging
  13 use AnyEvent::Util qw(guard fh_nonblocking WSAEWOULDBLOCK WSAEINPROGRESS);
  14 use AnyEvent::Socket;
  15 use AnyEvent::Handle;
  16 use Net::SSLeay;
  17 use AnyEvent::TLS;
  18 use AnyEvent::IO;
  19 use AnyEvent::HTTP;
  20 use Fcntl ();
  21 use Compress::Zlib;
  22 use PVE::SafeSyslog;
  23 use PVE::INotify;
  24 use PVE::RPCEnvironment;
  25 use PVE::REST;
  26
  27 use Net::IP;
  28 use URI;
  29 use URI::Escape;
  30 use HTTP::Status qw(:constants);
  31 use HTTP::Headers;
  32 use HTTP::Response;
  33 use Data::Dumper;
  34
  35 my $limit_max_headers = 30;
  36 my $limit_max_header_size = 8*1024;
  37 my $limit_max_post = 16*1024;
  38
  39
  40 my $known_methods = {
  41     GET => 1,
  42     POST => 1,
  43     PUT => 1,
  44     DELETE => 1,
  45 };
  46
  47 my $baseuri = "/api2";
  48
  49 sub split_abs_uri {
  50     my ($abs_uri) = @_;
  51
  52     my ($format, $rel_uri) = $abs_uri =~ m/^\Q$baseuri\E\/+(html|text|json|extjs|png|htmljs|spiceconfig)(\/.*)?$/;
  53     $rel_uri = '/' if !$rel_uri;
  54
  55     return wantarray ? ($rel_uri, $format) : $rel_uri;
  56 }
  57
  58 sub log_request {
  59     my ($self, $reqstate) = @_;
  60
  61     my $loginfo = $reqstate->{log};
  62
  63     # like apache2 common log format
  64     # LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""
  65
  66     return if $loginfo->{written}; # avoid duplicate logs
  67     $loginfo->{written} = 1;
  68
  69     my $peerip = $reqstate->{peer_host} || '-';
  70     my $userid = $loginfo->{userid} || '-';
  71     my $content_length = defined($loginfo->{content_length}) ? $loginfo->{content_length} : '-';
  72     my $code =  $loginfo->{code} || 500;
  73     my $requestline = $loginfo->{requestline} || '-';
  74     my $timestr = strftime("%d/%b/%Y:%H:%M:%S %z", localtime());
  75
  76     my $msg = "$peerip - $userid [$timestr] \"$requestline\" $code $content_length\n";
  77
  78     $self->write_log($msg);
  79 }
  80
  81 sub log_aborted_request {
  82     my ($self, $reqstate, $error) = @_;
  83
  84     my $r = $reqstate->{request};
  85     return if !$r; # no active request
  86
  87     if ($error) {
  88         syslog("err", "problem with client $reqstate->{peer_host}; $error");
  89     }
  90
  91     $self->log_request($reqstate);
  92 }
  93
  94 sub cleanup_reqstate {
  95     my ($reqstate) = @_;
  96
  97     delete $reqstate->{log};
  98     delete $reqstate->{request};
  99     delete $reqstate->{proto};
 100     delete $reqstate->{accept_gzip};
 101     delete $reqstate->{starttime};
 102
 103     if ($reqstate->{tmpfilename}) {
 104         unlink $reqstate->{tmpfilename};
 105         delete $reqstate->{tmpfilename};
 106     }
 107 }
 108
 109 sub client_do_disconnect {
 110     my ($self, $reqstate) = @_;
 111
 112     cleanup_reqstate($reqstate);
 113
 114     my $shutdown_hdl = sub {
 115         my $hdl = shift;
 116
 117         shutdown($hdl->{fh}, 1);
 118         # clear all handlers
 119         $hdl->on_drain(undef);
 120         $hdl->on_read(undef);
 121         $hdl->on_eof(undef);
 122     };
 123
 124     if (my $proxyhdl = delete $reqstate->{proxyhdl}) {
 125         &$shutdown_hdl($proxyhdl);
 126     }
 127
 128     my $hdl = delete $reqstate->{hdl};
 129
 130     if (!$hdl) {
 131         syslog('err', "detected empty handle");
 132         return;
 133     }
 134
 135     print "close connection $hdl\n" if $self->{debug};
 136
 137     &$shutdown_hdl($hdl);
 138
 139     $self->{conn_count}--;
 140
 141     print "$$: CLOSE FH" .  $hdl->{fh}->fileno() . " CONN$self->{conn_count}\n" if $self->{debug};
 142 }
 143
 144 sub finish_response {
 145     my ($self, $reqstate) = @_;
 146
 147     my $hdl = $reqstate->{hdl};
 148
 149     cleanup_reqstate($reqstate);
 150
 151     if (!$self->{end_loop} && $reqstate->{keep_alive} > 0) {
 152         # print "KEEPALIVE $reqstate->{keep_alive}\n" if $self->{debug};
 153         $hdl->on_read(sub {
 154             eval { $self->push_request_header($reqstate); };
 155             warn $@ if $@;
 156         });
 157     } else {
 158         $hdl->on_drain (sub {
 159             eval {
 160                 $self->client_do_disconnect($reqstate);
 161             };
 162             warn $@ if $@;
 163         });
 164     }
 165 }
 166
 167 sub response {
 168     my ($self, $reqstate, $resp, $mtime, $nocomp, $delay) = @_;
 169
 170     #print "$$: send response: " . Dumper($resp);
 171
 172     # activate timeout
 173     $reqstate->{hdl}->timeout_reset();
 174     $reqstate->{hdl}->timeout($self->{timeout});
 175
 176     $nocomp = 1 if !$reqstate->{accept_gzip};
 177
 178     my $code = $resp->code;
 179     my $msg = $resp->message || HTTP::Status::status_message($code);
 180     ($msg) = $msg =~m/^(.*)$/m;
 181     my $content = $resp->content;
 182
 183     if ($code =~ /^(1\d\d|[23]04)$/) {
 184         # make sure content we have no content
 185         $content = "";
 186     }
 187
 188     $reqstate->{keep_alive} = 0 if ($code >= 400) || $self->{end_loop};
 189
 190     $reqstate->{log}->{code} = $code;
 191
 192     my $proto = $reqstate->{proto} ? $reqstate->{proto}->{str} : 'HTTP/1.0';
 193     my $res = "$proto $code $msg\015\012";
 194
 195     my $ctime = time();
 196     my $date = HTTP::Date::time2str($ctime);
 197     $resp->header('Date' => $date);
 198     if ($mtime) {
 199         $resp->header('Last-Modified' => HTTP::Date::time2str($mtime));
 200     } else {
 201         $resp->header('Expires' => $date);
 202         $resp->header('Cache-Control' => "max-age=0");
 203         $resp->header("Pragma", "no-cache");
 204     }
 205
 206     $resp->header('Server' => "pve-api-daemon/3.0");
 207
 208     my $content_length;
 209     if ($content) {
 210
 211         $content_length = length($content);
 212
 213         if (!$nocomp && ($content_length > 1024)) {
 214             my $comp = Compress::Zlib::memGzip($content);
 215             $resp->header('Content-Encoding', 'gzip');
 216             $content = $comp;
 217             $content_length = length($content);
 218         }
 219         $resp->header("Content-Length" => $content_length);
 220         $reqstate->{log}->{content_length} = $content_length;
 221
 222     } else {
 223         $resp->remove_header("Content-Length");
 224     }
 225
 226     if ($reqstate->{keep_alive} > 0) {
 227         $resp->push_header('Connection' => 'Keep-Alive');
 228     } else {
 229         $resp->header('Connection' => 'close');
 230     }
 231
 232     $res .= $resp->headers_as_string("\015\012");
 233     #print "SEND(without content) $res\n" if $self->{debug};
 234
 235     $res .= "\015\012";
 236     $res .= $content if $content;
 237
 238     $self->log_request($reqstate, $reqstate->{request});
 239
 240     if ($delay && $delay > 0) {
 241         my $w; $w = AnyEvent->timer(after => $delay, cb => sub {
 242             undef $w; # delete reference
 243             $reqstate->{hdl}->push_write($res);
 244             $self->finish_response($reqstate);
 245         });
 246     } else {
 247         $reqstate->{hdl}->push_write($res);
 248         $self->finish_response($reqstate);
 249     }
 250 }
 251
 252 sub error {
 253     my ($self, $reqstate, $code, $msg, $hdr, $content) = @_;
 254
 255     eval {
 256         my $resp = HTTP::Response->new($code, $msg, $hdr, $content);
 257         $self->response($reqstate, $resp);
 258     };
 259     warn $@ if $@;
 260 }
 261
 262 sub send_file_start {
 263     my ($self, $reqstate, $filename) = @_;
 264
 265     eval {
 266         # print "SEND FILE $filename\n";
 267         # Note: aio_load() this is not really async unless we use IO::AIO!
 268         eval {
 269
 270             my $r = $reqstate->{request};
 271
 272             my $fh = IO::File->new($filename, '<') ||
 273                 die "$!\n";
 274             my $stat = File::stat::stat($fh) ||
 275                 die "$!\n";
 276
 277             my $mtime = $stat->mtime;
 278
 279             if (my $ifmod = $r->header('if-modified-since')) {
 280                 my $iftime = HTTP::Date::str2time($ifmod);
 281                 if ($mtime <= $iftime) {
 282                     my $resp = HTTP::Response->new(304, "NOT MODIFIED");
 283                     $self->response($reqstate, $resp, $mtime);
 284                     return;
 285                 }
 286             }
 287
 288             my $data;
 289             my $len = sysread($fh, $data,  $stat->size);
 290             die "got short file\n" if !defined($len) || $len != $stat->size;
 291
 292             my $ct;
 293             my $nocomp;
 294             if ($filename =~ m/\.css$/) {
 295                 $ct = 'text/css';
 296             } elsif ($filename =~ m/\.js$/) {
 297                 $ct = 'application/javascript';
 298             } elsif ($filename =~ m/\.png$/) {
 299                 $ct = 'image/png';
 300                 $nocomp = 1;
 301             } elsif ($filename =~ m/\.ico$/) {
 302                 $ct = 'image/x-icon';
 303                 $nocomp = 1;
 304             } elsif ($filename =~ m/\.gif$/) {
 305                 $ct = 'image/gif';
 306                 $nocomp = 1;
 307             } elsif ($filename =~ m/\.jar$/) {
 308                 $ct = 'application/java-archive';
 309                 $nocomp = 1;
 310             } else {
 311                 die "unable to detect content type";
 312             }
 313
 314             my $header = HTTP::Headers->new(Content_Type => $ct);
 315             my $resp = HTTP::Response->new(200, "OK", $header, $data);
 316             $self->response($reqstate, $resp, $mtime, $nocomp);
 317         };
 318         if (my $err = $@) {
 319             $self->error($reqstate, 501, $err);
 320         }
 321     };
 322
 323     warn $@ if $@;
 324 }
 325
 326 sub proxy_request {
 327     my ($self, $reqstate, $clientip, $host, $method, $uri, $ticket, $token, $params) = @_;
 328
 329     eval {
 330         my $target;
 331         my $keep_alive = 1;
 332         if ($host eq 'localhost') {
 333             $target = "http://$host:85$uri";
 334             # keep alive for localhost is not worth (connection setup is about 0.2ms)
 335             $keep_alive = 0;
 336         } else {
 337             $target = "https://$host:8006$uri";
 338         }
 339
 340         my $headers = {
 341             PVEDisableProxy => 'true',
 342             PVEClientIP => $clientip,
 343         };
 344
 345         $headers->{'cookie'} = PVE::REST::create_auth_cookie($ticket) if $ticket;
 346         $headers->{'CSRFPreventionToken'} = $token if $token;
 347         $headers->{'Accept-Encoding'} = 'gzip' if $reqstate->{accept_gzip};
 348
 349         my $content;
 350
 351         if  ($method eq 'POST' || $method eq 'PUT') {
 352             $headers->{'Content-Type'} = 'application/x-www-form-urlencoded';
 353             # use URI object to format application/x-www-form-urlencoded content.
 354             my $url = URI->new('http:');
 355             $url->query_form(%$params);
 356             $content = $url->query;
 357             if (defined($content)) {
 358                 $headers->{'Content-Length'} = length($content);
 359             }
 360         }
 361
 362         my $w; $w = http_request(
 363             $method => $target,
 364             headers => $headers,
 365             timeout => 30,
 366             recurse => 0,
 367             proxy => undef, # avoid use of $ENV{HTTP_PROXY}
 368             keepalive => $keep_alive,
 369             body => $content,
 370             tls_ctx => $self->{tls_ctx},
 371             sub {
 372                 my ($body, $hdr) = @_;
 373
 374                 undef $w;
 375
 376                 if (!$reqstate->{hdl}) {
 377                     warn "proxy detected vanished client connection\n";
 378                     return;
 379                 }
 380
 381                 eval {
 382                     my $code = delete $hdr->{Status};
 383                     my $msg = delete $hdr->{Reason};
 384                     delete $hdr->{URL};
 385                     delete $hdr->{HTTPVersion};
 386                     my $header = HTTP::Headers->new(%$hdr);
 387                     my $resp = HTTP::Response->new($code, $msg, $header, $body);
 388                     # Note: disable compression, because body is already compressed
 389                     $self->response($reqstate, $resp, undef, 1);
 390                 };
 391                 warn $@ if $@;
 392             });
 393     };
 394     warn $@ if $@;
 395 }
 396
 397 # return arrays as \0 separated strings (like CGI.pm)
 398 sub decode_urlencoded {
 399     my ($data) = @_;
 400
 401     my $res = {};
 402
 403     return $res if !$data;
 404
 405     foreach my $kv (split(/[\&\;]/, $data)) {
 406         my ($k, $v) = split(/=/, $kv);
 407         $k =~s/\+/ /g;
 408         $k =~ s/%([0-9a-fA-F][0-9a-fA-F])/chr(hex($1))/eg;
 409         $v =~s/\+/ /g;
 410         $v =~ s/%([0-9a-fA-F][0-9a-fA-F])/chr(hex($1))/eg;
 411
 412         if (defined(my $old = $res->{$k})) {
 413             $res->{$k} = "$old\0$v";
 414         } else {
 415             $res->{$k} = $v;
 416         }
 417     }
 418     return $res;
 419 }
 420
 421 sub extract_params {
 422     my ($r, $method) = @_;
 423
 424     my $params = {};
 425
 426     if ($method eq 'PUT' || $method eq 'POST') {
 427         $params = decode_urlencoded($r->content);
 428     }
 429
 430     my $query_params = decode_urlencoded($r->url->query());
 431
 432     foreach my $k (keys %{$query_params}) {
 433         $params->{$k} = $query_params->{$k};
 434     }
 435
 436     return PVE::Tools::decode_utf8_parameters($params);
 437 }
 438
 439 sub handle_api2_request {
 440     my ($self, $reqstate, $auth, $upload_state) = @_;
 441
 442     eval {
 443         my $r = $reqstate->{request};
 444         my $method = $r->method();
 445         my $path = $r->uri->path();
 446
 447         my ($rel_uri, $format) = split_abs_uri($path);
 448         if (!$format) {
 449             $self->error($reqstate, HTTP_NOT_IMPLEMENTED, "no such uri");
 450             return;
 451         }
 452
 453         #print Dumper($upload_state) if $upload_state;
 454
 455         my $rpcenv = $self->{rpcenv};
 456
 457         my $params;
 458
 459         if ($upload_state) {
 460             $params = $upload_state->{params};
 461         } else {
 462             $params = extract_params($r, $method);
 463         }
 464
 465         delete $params->{_dc}; # remove disable cache parameter
 466
 467         my $clientip = $reqstate->{peer_host};
 468
 469         $rpcenv->init_request();
 470
 471         my $res = PVE::REST::rest_handler($rpcenv, $clientip, $method, $rel_uri, $auth, $params);
 472
 473         AnyEvent->now_update(); # in case somebody called sleep()
 474
 475         $rpcenv->set_user(undef); # clear after request
 476
 477         if (my $host = $res->{proxy}) {
 478
 479             if ($self->{trusted_env}) {
 480                 $self->error($reqstate, HTTP_INTERNAL_SERVER_ERROR, "proxy not allowed");
 481                 return;
 482             }
 483
 484             if ($host ne 'localhost' && $r->header('PVEDisableProxy')) {
 485                 $self->error($reqstate, HTTP_INTERNAL_SERVER_ERROR, "proxy loop detected");
 486                 return;
 487             }
 488
 489             $res->{proxy_params}->{tmpfilename} = $reqstate->{tmpfilename} if $upload_state;
 490
 491             $self->proxy_request($reqstate, $clientip, $host, $method,
 492                                  $r->uri, $auth->{ticket}, $auth->{token}, $res->{proxy_params});
 493             return;
 494
 495         }
 496
 497         my $delay = 0;
 498         if ($res->{status} == HTTP_UNAUTHORIZED) {
 499             # always delay unauthorized calls by 3 seconds
 500             $delay = 3 - tv_interval($reqstate->{starttime});
 501             $delay = 0 if $delay < 0;
 502         }
 503
 504         PVE::REST::prepare_response_data($format, $res);
 505         my ($raw, $ct, $nocomp) = PVE::REST::format_response_data($format, $res, $path);
 506
 507         my $resp = HTTP::Response->new($res->{status}, $res->{message});
 508         $resp->header("Content-Type" => $ct);
 509         $resp->content($raw);
 510         $self->response($reqstate, $resp, undef, $nocomp, $delay);
 511     };
 512     if (my $err = $@) {
 513         $self->error($reqstate, 501, $err);
 514     }
 515 }
 516
 517 sub handle_spice_proxy_request {
 518     my ($self, $reqstate, $connect_str, $vmid, $node, $spiceport) = @_;
 519
 520     eval {
 521
 522         die "Port $spiceport is not allowed" if ($spiceport < 61000 || $spiceport > 61099);
 523
 524         my $rpcenv = $self->{rpcenv};
 525         $rpcenv->init_request();
 526
 527         my $clientip = $reqstate->{peer_host};
 528         my $r = $reqstate->{request};
 529
 530         my $remip;
 531
 532         if ($node ne 'localhost' && PVE::INotify::nodename() !~ m/^$node$/i) {
 533             $remip = PVE::Cluster::remote_node_ip($node);
 534             die "unable to get remote IP address for node '$node'\n" if !$remip;
 535             print "REMOTE CONNECT $vmid, $remip, $connect_str\n" if $self->{debug};
 536         } else {
 537             print "$$: CONNECT $vmid, $node, $spiceport\n" if $self->{debug};
 538         }
 539
 540         if ($remip && $r->header('PVEDisableProxy')) {
 541             $self->error($reqstate, HTTP_INTERNAL_SERVER_ERROR, "proxy loop detected");
 542             return;
 543         }
 544
 545         $reqstate->{hdl}->timeout(0);
 546         $reqstate->{hdl}->wbuf_max(64*10*1024);
 547
 548         my $remhost = $remip ? $remip : "127.0.0.1";
 549         my $remport = $remip ? 3128 : $spiceport;
 550
 551         tcp_connect $remhost, $remport, sub {
 552             my ($fh) = @_
 553                 or die "connect to '$remhost:$remport' failed: $!";
 554
 555             print "$$: CONNECTed to '$remhost:$remport'\n" if $self->{debug};
 556             $reqstate->{proxyhdl} = AnyEvent::Handle->new(
 557                 fh => $fh,
 558                 rbuf_max => 64*1024,
 559                 wbuf_max => 64*10*1024,
 560                 timeout => 5,
 561                 on_eof => sub {
 562                     my ($hdl) = @_;
 563                     eval {
 564                         $self->log_aborted_request($reqstate);
 565                         $self->client_do_disconnect($reqstate);
 566                     };
 567                     if (my $err = $@) { syslog('err', $err); }
 568                 },
 569                 on_error => sub {
 570                     my ($hdl, $fatal, $message) = @_;
 571                     eval {
 572                         $self->log_aborted_request($reqstate, $message);
 573                         $self->client_do_disconnect($reqstate);
 574                     };
 575                     if (my $err = $@) { syslog('err', "$err"); }
 576                 });
 577
 578
 579             my $proxyhdlreader = sub {
 580                 my ($hdl) = @_;
 581
 582                 my $len = length($hdl->{rbuf});
 583                 my $data = substr($hdl->{rbuf}, 0, $len, '');
 584
 585                 #print "READ1 $len\n";
 586                 $reqstate->{hdl}->push_write($data) if $reqstate->{hdl};
 587             };
 588
 589             my $hdlreader = sub {
 590                 my ($hdl) = @_;
 591
 592                 my $len = length($hdl->{rbuf});
 593                 my $data = substr($hdl->{rbuf}, 0, $len, '');
 594
 595                 #print "READ0 $len\n";
 596                 $reqstate->{proxyhdl}->push_write($data) if $reqstate->{proxyhdl};
 597             };
 598
 599             my $proto = $reqstate->{proto} ? $reqstate->{proto}->{str} : 'HTTP/1.0';
 600
 601             my $startproxy = sub {
 602                 $reqstate->{proxyhdl}->timeout(0);
 603                 $reqstate->{proxyhdl}->on_read($proxyhdlreader);
 604                 $reqstate->{hdl}->on_read($hdlreader);
 605
 606                 # todo: use stop_read/start_read if write buffer grows to much
 607
 608                 my $res = "$proto 200 OK\015\012"; # hope this is the right answer?
 609                 $reqstate->{hdl}->push_write($res);
 610
 611                 # log early
 612                 $reqstate->{log}->{code} = 200;
 613                 $self->log_request($reqstate);
 614             };
 615
 616             if ($remip) {
 617                 my $header = "CONNECT ${connect_str} $proto\015\012" .
 618                     "Host: ${connect_str}\015\012" .
 619                     "Proxy-Connection: keep-alive\015\012" .
 620                     "User-Agent: spiceproxy\015\012" .
 621                     "PVEDisableProxy: true\015\012" .
 622                     "PVEClientIP: $clientip\015\012" .
 623                     "\015\012";
 624
 625                 $reqstate->{proxyhdl}->push_write($header);
 626                 $reqstate->{proxyhdl}->push_read(line => sub {
 627                     my ($hdl, $line) = @_;
 628
 629                     if ($line =~ m!^$proto 200 OK$!) {
 630                         &$startproxy();
 631                     } else {
 632                         $reqstate->{hdl}->push_write($line);
 633                         $self->client_do_disconnect($reqstate);
 634                     }
 635                 });
 636             } else {
 637                 &$startproxy();
 638             }
 639
 640         };
 641     };
 642     if (my $err = $@) {
 643         warn $err;
 644         $self->log_aborted_request($reqstate, $err);
 645         $self->client_do_disconnect($reqstate);
 646     }
 647 }
 648
 649 sub handle_request {
 650     my ($self, $reqstate, $auth) = @_;
 651
 652     eval {
 653         my $r = $reqstate->{request};
 654         my $method = $r->method();
 655         my $path = $r->uri->path();
 656
 657         # disable timeout on handle (we already have all data we need)
 658         # we re-enable timeout in response()
 659         $reqstate->{hdl}->timeout(0);
 660
 661         if ($path =~ m!$baseuri!) {
 662             $self->handle_api2_request($reqstate, $auth);
 663             return;
 664         }
 665
 666         if ($self->{pages} && ($method eq 'GET') && (my $handler = $self->{pages}->{$path})) {
 667             if (ref($handler) eq 'CODE') {
 668                 my $params = decode_urlencoded($r->url->query());
 669                 my ($resp, $userid) = &$handler($self, $reqstate->{request}, $params);
 670                 $self->response($reqstate, $resp);
 671             } elsif (ref($handler) eq 'HASH') {
 672                 if (my $filename = $handler->{file}) {
 673                     my $fh = IO::File->new($filename) ||
 674                         die "unable to open file '$filename' - $!\n";
 675                     send_file_start($self, $reqstate, $filename);
 676                 } else {
 677                     die "internal error - no handler";
 678                 }
 679             } else {
 680                 die "internal error - no handler";
 681             }
 682             return;
 683         }
 684
 685         if ($self->{dirs} && ($method eq 'GET')) {
 686             # we only allow simple names
 687             if ($path =~ m!^(/\S+/)([a-zA-Z0-9\-\_\.]+)$!) {
 688                 my ($subdir, $file) = ($1, $2);
 689                 if (my $dir = $self->{dirs}->{$subdir}) {
 690                     my $filename = "$dir$file";
 691                     my $fh = IO::File->new($filename) ||
 692                         die "unable to open file '$filename' - $!\n";
 693                     send_file_start($self, $reqstate, $filename);
 694                     return;
 695                 }
 696             }
 697         }
 698
 699         die "no such file '$path'";
 700     };
 701     if (my $err = $@) {
 702         $self->error($reqstate, 501, $err);
 703     }
 704 }
 705
 706 sub file_upload_multipart {
 707     my ($self, $reqstate, $auth, $rstate) = @_;
 708
 709     eval {
 710         my $boundary = $rstate->{boundary};
 711         my $hdl = $reqstate->{hdl};
 712
 713         my $startlen = length($hdl->{rbuf});
 714
 715         if ($rstate->{phase} == 0) { # skip everything until start
 716             if ($hdl->{rbuf} =~ s/^.*?--\Q$boundary\E  \015?\012
 717                        ((?:[^\015]+\015\012)* ) \015?\012//xs) {
 718                 my $header = $1;
 719                 my ($ct, $disp, $name, $filename);
 720                 foreach my $line (split(/\015?\012/, $header)) {
 721                     # assume we have single line headers
 722                     if ($line =~ m/^Content-Type\s*:\s*(.*)/i) {
 723                         $ct = parse_content_type($1);
 724                     } elsif ($line =~ m/^Content-Disposition\s*:\s*(.*)/i) {
 725                         ($disp, $name, $filename) = parse_content_disposition($1);
 726                     }
 727                 }
 728
 729                 if (!($disp && $disp eq 'form-data' && $name)) {
 730                     syslog('err', "wrong content disposition in multipart - abort upload");
 731                     $rstate->{phase} = -1;
 732                 } else {
 733
 734                     $rstate->{fieldname} = $name;
 735
 736                     if ($filename) {
 737                         if ($name eq 'filename') {
 738                             # found file upload data
 739                             $rstate->{phase} = 1;
 740                             $rstate->{filename} = $filename;
 741                         } else {
 742                             syslog('err', "wrong field name for file upload - abort upload");
 743                             $rstate->{phase} = -1;
 744                         }
 745                     } else {
 746                         # found form data for field $name
 747                         $rstate->{phase} = 2;
 748                     }
 749                 }
 750             } else {
 751                 my $len = length($hdl->{rbuf});
 752                 substr($hdl->{rbuf}, 0, $len - $rstate->{maxheader}, '')
 753                     if $len > $rstate->{maxheader}; # skip garbage
 754             }
 755         } elsif ($rstate->{phase} == 1) { # inside file - dump until end marker
 756             if ($hdl->{rbuf} =~ s/^(.*?)\015?\012(--\Q$boundary\E(--)? \015?\012(.*))$/$2/xs) {
 757                 my ($rest, $eof) = ($1, $3);
 758                 my $len = length($rest);
 759                 die "write to temporary file failed - $!"
 760                     if syswrite($rstate->{outfh}, $rest) != $len;
 761                 $rstate->{ctx}->add($rest);
 762                 $rstate->{params}->{filename} = $rstate->{filename};
 763                 $rstate->{md5sum} = $rstate->{ctx}->hexdigest;
 764                 $rstate->{bytes} += $len;
 765                 $rstate->{phase} =  $eof ? 100 : 0;
 766             } else {
 767                 my $len = length($hdl->{rbuf});
 768                 my $wlen = $len - $rstate->{boundlen};
 769                 if ($wlen > 0) {
 770                     my $data = substr($hdl->{rbuf}, 0, $wlen, '');
 771                     die "write to temporary file failed - $!"
 772                         if syswrite($rstate->{outfh}, $data) != $wlen;
 773                     $rstate->{bytes} += $wlen;
 774                     $rstate->{ctx}->add($data);
 775                 }
 776             }
 777         } elsif ($rstate->{phase} == 2) { # inside normal field
 778
 779             if ($hdl->{rbuf} =~ s/^(.*?)\015?\012(--\Q$boundary\E(--)? \015?\012(.*))$/$2/xs) {
 780                 my ($rest, $eof) = ($1, $3);
 781                 my $len = length($rest);
 782                 $rstate->{post_size} += $len;
 783                 if ($rstate->{post_size} < $limit_max_post) {
 784                     $rstate->{params}->{$rstate->{fieldname}} = $rest;
 785                     $rstate->{phase} = $eof ? 100 : 0;
 786                 } else {
 787                     syslog('err', "form data to large - abort upload");
 788                     $rstate->{phase} = -1; # skip
 789                 }
 790             }
 791         } else { # skip
 792             my $len = length($hdl->{rbuf});
 793             substr($hdl->{rbuf}, 0, $len, ''); # empty rbuf
 794         }
 795
 796         $rstate->{read} += ($startlen - length($hdl->{rbuf}));
 797
 798         if (!$rstate->{done} && ($rstate->{read} + length($hdl->{rbuf})) >= $rstate->{size}) {
 799             $rstate->{done} = 1; # make sure we dont get called twice
 800             if ($rstate->{phase} < 0 || !$rstate->{md5sum}) {
 801                 die "upload failed\n";
 802             } else {
 803                 my $elapsed = tv_interval($rstate->{starttime});
 804
 805                 my $rate = int($rstate->{bytes}/($elapsed*1024*1024));
 806                 syslog('info', "multipart upload complete " .
 807                        "(size: %d time: %ds rate: %.2fMiB/s md5sum: $rstate->{md5sum})",
 808                        $rstate->{bytes}, $elapsed, $rate);
 809                 $self->handle_api2_request($reqstate, $auth, $rstate);
 810             }
 811         }
 812     };
 813     if (my $err = $@) {
 814         syslog('err', $err);
 815         $self->error($reqstate, 501, $err);
 816     }
 817 }
 818
 819 sub parse_content_type {
 820     my ($ctype) = @_;
 821
 822     my ($ct, @params) = split(/\s*[;,]\s*/o, $ctype);
 823
 824     foreach my $v (@params) {
 825         if ($v =~ m/^\s*boundary\s*=\s*(\S+?)\s*$/o) {
 826             return wantarray ? ($ct, $1) : $ct;
 827         }
 828     }
 829
 830     return  wantarray ? ($ct) : $ct;
 831 }
 832
 833 sub parse_content_disposition {
 834     my ($line) = @_;
 835
 836     my ($disp, @params) = split(/\s*[;,]\s*/o, $line);
 837     my $name;
 838     my $filename;
 839
 840     foreach my $v (@params) {
 841         if ($v =~ m/^\s*name\s*=\s*(\S+?)\s*$/o) {
 842             $name = $1;
 843             $name =~ s/^"(.*)"$/$1/;
 844         } elsif ($v =~ m/^\s*filename\s*=\s*(.+?)\s*$/o) {
 845             $filename = $1;
 846             $filename =~ s/^"(.*)"$/$1/;
 847         }
 848     }
 849
 850     return  wantarray ? ($disp, $name, $filename) : $disp;
 851 }
 852
 853 my $tmpfile_seq_no = 0;
 854
 855 sub get_upload_filename {
 856     # choose unpredictable tmpfile name
 857
 858     $tmpfile_seq_no++;
 859     return "/var/tmp/pveupload-" . Digest::MD5::md5_hex($tmpfile_seq_no . time() . $$);
 860 }
 861
 862 sub unshift_read_header {
 863     my ($self, $reqstate, $state) = @_;
 864
 865     $state = { size => 0, count => 0 } if !$state;
 866
 867     $reqstate->{hdl}->unshift_read(line => sub {
 868         my ($hdl, $line) = @_;
 869
 870         eval {
 871             # print "$$: got header: $line\n" if $self->{debug};
 872
 873             die "to many http header lines\n" if ++$state->{count} >= $limit_max_headers;
 874             die "http header too large\n" if ($state->{size} += length($line)) >= $limit_max_header_size;
 875
 876             my $r = $reqstate->{request};
 877             if ($line eq '') {
 878
 879                 my $path = $r->uri->path();
 880                 my $method = $r->method();
 881
 882                 $r->push_header($state->{key}, $state->{val})
 883                     if $state->{key};
 884
 885                 if (!$known_methods->{$method}) {
 886                     my $resp = HTTP::Response->new(HTTP_NOT_IMPLEMENTED, "method '$method' not available");
 887                     $self->response($reqstate, $resp);
 888                     return;
 889                 }
 890
 891                 my $conn = $r->header('Connection');
 892                 my $accept_enc = $r->header('Accept-Encoding');
 893                 $reqstate->{accept_gzip} = ($accept_enc && $accept_enc =~ m/gzip/) ? 1 : 0;
 894
 895                 if ($conn) {
 896                     $reqstate->{keep_alive} = 0 if $conn =~ m/close/oi;
 897                 } else {
 898                     if ($reqstate->{proto}->{ver} < 1001) {
 899                         $reqstate->{keep_alive} = 0;
 900                     }
 901                 }
 902
 903                 my $te  = $r->header('Transfer-Encoding');
 904                 if ($te && lc($te) eq 'chunked') {
 905                     # Handle chunked transfer encoding
 906                     $self->error($reqstate, 501, "chunked transfer encoding not supported");
 907                     return;
 908                 } elsif ($te) {
 909                     $self->error($reqstate, 501, "Unknown transfer encoding '$te'");
 910                     return;
 911                 }
 912
 913                 my $pveclientip = $r->header('PVEClientIP');
 914
 915                 # fixme: how can we make PVEClientIP header trusted?
 916                 if ($self->{trusted_env} && $pveclientip) {
 917                     $reqstate->{peer_host} = $pveclientip;
 918                 } else {
 919                     $r->header('PVEClientIP', $reqstate->{peer_host});
 920                 }
 921
 922                 my $len = $r->header('Content-Length');
 923
 924                 # header processing complete - authenticate now
 925
 926                 my $auth = {};
 927                 if ($self->{spiceproxy}) {
 928                     my $connect_str = $r->header('Host');
 929                     my ($vmid, $node, $port) = PVE::AccessControl::verify_spice_connect_url($connect_str);
 930                     if (!(defined($vmid) && $node && $port)) {
 931                         $self->error($reqstate, HTTP_UNAUTHORIZED, "invalid ticket");
 932                         return;
 933                     }
 934                     $self->handle_spice_proxy_request($reqstate, $connect_str, $vmid, $node, $port);
 935                     return;
 936                 } elsif ($path =~ m!$baseuri!) {
 937                     my $token = $r->header('CSRFPreventionToken');
 938                     my $cookie = $r->header('Cookie');
 939                     my $ticket = PVE::REST::extract_auth_cookie($cookie);
 940
 941                     my ($rel_uri, $format) = split_abs_uri($path);
 942                     if (!$format) {
 943                         $self->error($reqstate, HTTP_NOT_IMPLEMENTED, "no such uri");
 944                         return;
 945                     }
 946
 947                     eval {
 948                         $auth = PVE::REST::auth_handler($self->{rpcenv}, $reqstate->{peer_host}, $method,
 949                                                         $rel_uri, $ticket, $token);
 950                     };
 951                     if (my $err = $@) {
 952                         $self->error($reqstate, HTTP_UNAUTHORIZED, $err);
 953                         return;
 954                     }
 955                 }
 956
 957                 $reqstate->{log}->{userid} = $auth->{userid};
 958
 959                 if ($len) {
 960
 961                     if (!($method eq 'PUT' || $method eq 'POST')) {
 962                         $self->error($reqstate, 501, "Unexpected content for method '$method'");
 963                         return;
 964                     }
 965
 966                     my $ctype = $r->header('Content-Type');
 967                     my ($ct, $boundary) = parse_content_type($ctype) if $ctype;
 968
 969                     if ($auth->{isUpload} && !$self->{trusted_env}) {
 970                         die "upload 'Content-Type '$ctype' not implemented\n"
 971                             if !($boundary && $ct && ($ct eq 'multipart/form-data'));
 972
 973                         die "upload without content length header not supported" if !$len;
 974
 975                         die "upload without content length header not supported" if !$len;
 976
 977                         print "start upload $path $ct $boundary\n" if $self->{debug};
 978
 979                         my $tmpfilename = get_upload_filename();
 980                         my $outfh = IO::File->new($tmpfilename, O_RDWR|O_CREAT|O_EXCL, 0600) ||
 981                             die "unable to create temporary upload file '$tmpfilename'";
 982
 983                         $reqstate->{keep_alive} = 0;
 984
 985                         my $boundlen = length($boundary) + 8; # \015?\012--$boundary--\015?\012
 986
 987                         my $state = {
 988                             size => $len,
 989                             boundary => $boundary,
 990                             ctx => Digest::MD5->new,
 991                             boundlen =>  $boundlen,
 992                             maxheader => 2048 + $boundlen, # should be large enough
 993                             params => decode_urlencoded($r->url->query()),
 994                             phase => 0,
 995                             read => 0,
 996                             post_size => 0,
 997                             starttime => [gettimeofday],
 998                             outfh => $outfh,
 999                         };
1000                         $reqstate->{tmpfilename} = $tmpfilename;
1001                         $reqstate->{hdl}->on_read(sub { $self->file_upload_multipart($reqstate, $auth, $state); });
1002                         return;
1003                     }
1004
1005                     if ($len > $limit_max_post) {
1006                         $self->error($reqstate, 501, "for data too large");
1007                         return;
1008                     }
1009
1010                     if (!$ct || $ct eq 'application/x-www-form-urlencoded') {
1011                         $reqstate->{hdl}->unshift_read(chunk => $len, sub {
1012                             my ($hdl, $data) = @_;
1013                             $r->content($data);
1014                             $self->handle_request($reqstate, $auth);
1015                         });
1016                     } else {
1017                         $self->error($reqstate, 506, "upload 'Content-Type '$ctype' not implemented");
1018                     }
1019                 } else {
1020                     $self->handle_request($reqstate, $auth);
1021                 }
1022             } elsif ($line =~ /^([^:\s]+)\s*:\s*(.*)/) {
1023                 $r->push_header($state->{key}, $state->{val}) if $state->{key};
1024                 ($state->{key}, $state->{val}) = ($1, $2);
1025                 $self->unshift_read_header($reqstate, $state);
1026             } elsif ($line =~ /^\s+(.*)/) {
1027                 $state->{val} .= " $1";
1028                 $self->unshift_read_header($reqstate, $state);
1029             } else {
1030                 $self->error($reqstate, 506, "unable to parse request header");
1031             }
1032         };
1033         warn $@ if $@;
1034     });
1035 };
1036
1037 sub push_request_header {
1038     my ($self, $reqstate) = @_;
1039
1040     eval {
1041         $reqstate->{hdl}->push_read(line => sub {
1042             my ($hdl, $line) = @_;
1043
1044             eval {
1045                 # print "got request header: $line\n" if $self->{debug};
1046
1047                 $reqstate->{keep_alive}--;
1048
1049                 if ($line =~ /(\S+)\040(\S+)\040HTTP\/(\d+)\.(\d+)/o) {
1050                     my ($method, $url, $maj, $min) = ($1, $2, $3, $4);
1051
1052                     if ($maj != 1) {
1053                         $self->error($reqstate, 506, "http protocol version $maj.$min not supported");
1054                         return;
1055                     }
1056
1057                     $self->{request_count}++; # only count valid request headers
1058                     if ($self->{request_count} >= $self->{max_requests}) {
1059                         $self->{end_loop} = 1;
1060                     }
1061                     $reqstate->{log} = { requestline => $line };
1062                     $reqstate->{proto}->{str} = "HTTP/$maj.$min";
1063                     $reqstate->{proto}->{maj} = $maj;
1064                     $reqstate->{proto}->{min} = $min;
1065                     $reqstate->{proto}->{ver} = $maj*1000+$min;
1066                     $reqstate->{request} = HTTP::Request->new($method, uri_unescape($url));
1067                     $reqstate->{starttime} = [gettimeofday],
1068
1069                     $self->unshift_read_header($reqstate);
1070                 } elsif ($line eq '') {
1071                     # ignore empty lines before requests (browser bugs?)
1072                     $self->push_request_header($reqstate);
1073                 } else {
1074                     $self->error($reqstate, 400, 'bad request');
1075                 }
1076             };
1077             warn $@ if $@;
1078         });
1079     };
1080     warn $@ if $@;
1081 }
1082
1083 sub accept {
1084     my ($self) = @_;
1085
1086     my $clientfh;
1087
1088     return if $self->{end_loop};
1089
1090     # we need to m make sure that only one process calls accept
1091     while (!flock($self->{lockfh}, Fcntl::LOCK_EX())) {
1092         next if $! == EINTR;
1093         die "could not get lock on file '$self->{lockfile}' -  $!\n";
1094     }
1095
1096     my $again = 0;
1097     my $errmsg;
1098     eval {
1099         while (!$self->{end_loop} &&
1100                !defined($clientfh = $self->{socket}->accept()) &&
1101                ($! == EINTR)) {};
1102
1103         if ($self->{end_loop}) {
1104             $again = 0;
1105         } else {
1106             $again = ($! == EAGAIN || $! == WSAEWOULDBLOCK);
1107             if (!defined($clientfh)) {
1108                 $errmsg = "failed to accept connection: $!\n";
1109             }
1110         }
1111     };
1112     warn $@ if $@;
1113
1114     flock($self->{lockfh}, Fcntl::LOCK_UN());
1115
1116     if (!defined($clientfh)) {
1117         return if $again;
1118         die $errmsg if $errmsg;
1119     }
1120
1121     fh_nonblocking $clientfh, 1;
1122
1123     $self->{conn_count}++;
1124
1125     return $clientfh;
1126 }
1127
1128 sub wait_end_loop {
1129     my ($self) = @_;
1130
1131     $self->{end_loop} = 1;
1132
1133     undef $self->{socket_watch};
1134
1135     if ($self->{conn_count} <= 0) {
1136         $self->{end_cond}->send(1);
1137         return;
1138     }
1139
1140     # else we need to wait until all open connections gets closed
1141     my $w; $w = AnyEvent->timer (after => 1, interval => 1, cb => sub {
1142         eval {
1143             # todo: test for active connections instead (we can abort idle connections)
1144             if ($self->{conn_count} <= 0) {
1145                 undef $w;
1146                 $self->{end_cond}->send(1);
1147             }
1148         };
1149         warn $@ if $@;
1150     });
1151 }
1152
1153
1154 sub check_host_access {
1155     my ($self, $clientip) = @_;
1156
1157     my $cip = Net::IP->new($clientip);
1158
1159     my $match_allow = 0;
1160     my $match_deny = 0;
1161
1162     if ($self->{allow_from}) {
1163         foreach my $t (@{$self->{allow_from}}) {
1164             if ($t->overlaps($cip)) {
1165                 $match_allow = 1;
1166                 last;
1167             }
1168         }
1169     }
1170
1171     if ($self->{deny_from}) {
1172         foreach my $t (@{$self->{deny_from}}) {
1173             if ($t->overlaps($cip)) {
1174                 $match_deny = 1;
1175                 last;
1176             }
1177         }
1178     }
1179
1180     if ($match_allow == $match_deny) {
1181         # match both allow and deny, or no match
1182         return $self->{policy} && $self->{policy} eq 'allow' ? 1 : 0;
1183     }
1184
1185     return $match_allow;
1186 }
1187
1188 sub accept_connections {
1189     my ($self) = @_;
1190
1191     eval {
1192
1193         while (my $clientfh = $self->accept()) {
1194
1195             my $reqstate = { keep_alive => $self->{keep_alive} };
1196
1197             # stop keep-alive when there are many open connections
1198             if ($self->{conn_count} >= $self->{max_conn_soft_limit}) {
1199                 $reqstate->{keep_alive} = 0;
1200             }
1201
1202             if (my $sin = getpeername($clientfh)) {
1203                 my ($pport, $phost) = Socket::unpack_sockaddr_in($sin);
1204                 ($reqstate->{peer_port}, $reqstate->{peer_host}) = ($pport,  Socket::inet_ntoa($phost));
1205             }
1206
1207             if (!$self->{trusted_env} && !$self->check_host_access($reqstate->{peer_host})) {
1208                 print "$$: ABORT request from $reqstate->{peer_host} - access denied\n" if $self->{debug};
1209                 $reqstate->{log}->{code} = 403;
1210                 $self->log_request($reqstate);
1211                 next;
1212             }
1213
1214             $reqstate->{hdl} = AnyEvent::Handle->new(
1215                 fh => $clientfh,
1216                 rbuf_max => 64*1024,
1217                 timeout => $self->{timeout},
1218                 linger => 0, # avoid problems with ssh - really needed ?
1219                 on_eof   => sub {
1220                     my ($hdl) = @_;
1221                     eval {
1222                         $self->log_aborted_request($reqstate);
1223                         $self->client_do_disconnect($reqstate);
1224                     };
1225                     if (my $err = $@) { syslog('err', $err); }
1226                 },
1227                 on_error => sub {
1228                     my ($hdl, $fatal, $message) = @_;
1229                     eval {
1230                         $self->log_aborted_request($reqstate, $message);
1231                         $self->client_do_disconnect($reqstate);
1232                     };
1233                     if (my $err = $@) { syslog('err', "$err"); }
1234                 },
1235                 ($self->{tls_ctx} ? (tls => "accept", tls_ctx => $self->{tls_ctx}) : ()));
1236
1237             print "$$: ACCEPT FH" .  $clientfh->fileno() . " CONN$self->{conn_count}\n" if $self->{debug};
1238
1239             $self->push_request_header($reqstate);
1240         }
1241     };
1242
1243     if (my $err = $@) {
1244         syslog('err', $err);
1245         $self->{end_loop} = 1;
1246     }
1247
1248     $self->wait_end_loop() if $self->{end_loop};
1249 }
1250
1251 # Note: We can't open log file in non-blocking mode and use AnyEvent::Handle,
1252 # because we write from multiple processes, and that would arbitrarily mix output
1253 # of all processes.
1254 sub open_access_log {
1255     my ($self, $filename) = @_;
1256
1257     my $old_mask = umask(0137);;
1258     my $logfh = IO::File->new($filename, ">>") ||
1259         die "unable to open log file '$filename' - $!\n";
1260     umask($old_mask);
1261
1262     $logfh->autoflush(1);
1263
1264     $self->{logfh} = $logfh;
1265 }
1266
1267 sub write_log {
1268     my ($self, $data) = @_;
1269
1270     return if !defined($self->{logfh}) || !$data;
1271
1272     my $res = $self->{logfh}->print($data);
1273
1274     if (!$res) {
1275         delete $self->{logfh};
1276         syslog('err', "error writing access log");
1277         $self->{end_loop} = 1; # terminate asap
1278     }
1279 }
1280
1281 sub atfork_handler {
1282     my ($self) = @_;
1283
1284     eval {
1285         # something else do to ?
1286         close($self->{socket});
1287     };
1288     warn $@ if $@;
1289 }
1290
1291 sub new {
1292     my ($this, %args) = @_;
1293
1294     my $class = ref($this) || $this;
1295
1296     foreach my $req (qw(base_handler_class socket lockfh lockfile)) {
1297         die "misssing required argument '$req'" if !defined($args{$req});
1298     }
1299
1300     my $self = bless { %args }, $class;
1301
1302     PVE::REST::set_base_handler_class($self->{base_handler_class});
1303
1304     # init inotify
1305     PVE::INotify::inotify_init();
1306
1307     $self->{rpcenv} = PVE::RPCEnvironment->init(
1308         $self->{trusted_env} ? 'priv' : 'pub', atfork =>  sub { $self-> atfork_handler() });
1309
1310     fh_nonblocking($self->{socket}, 1);
1311
1312     $self->{end_loop} = 0;
1313     $self->{conn_count} = 0;
1314     $self->{request_count} = 0;
1315     $self->{timeout} = 5 if !$self->{timeout};
1316     $self->{keep_alive} = 0 if !defined($self->{keep_alive});
1317     $self->{max_conn} = 800 if !$self->{max_conn};
1318     $self->{max_requests} = 8000 if !$self->{max_requests};
1319
1320     $self->{policy} = 'allow' if !$self->{policy};
1321
1322     $self->{end_cond} = AnyEvent->condvar;
1323
1324     if ($self->{ssl}) {
1325         $self->{tls_ctx} = AnyEvent::TLS->new(%{$self->{ssl}});
1326         Net::SSLeay::CTX_set_options($self->{tls_ctx}->{ctx}, &Net::SSLeay::OP_NO_COMPRESSION);
1327     }
1328
1329     if ($self->{spiceproxy}) {
1330         $known_methods = { CONNECT => 1 };
1331     }
1332
1333     $self->open_access_log($self->{logfile}) if $self->{logfile};
1334
1335     $self->{max_conn_soft_limit} = $self->{max_conn} > 100 ? $self->{max_conn} - 20 : $self->{max_conn};
1336
1337     $self->{socket_watch} = AnyEvent->io(fh => $self->{socket}, poll => 'r', cb => sub {
1338         eval {
1339             if ($self->{conn_count} >= $self->{max_conn}) {
1340                 my $w; $w = AnyEvent->timer (after => 1, interval => 1, cb => sub {
1341                     if ($self->{conn_count} < $self->{max_conn}) {
1342                         undef $w;
1343                         $self->accept_connections();
1344                     }
1345                 });
1346             } else {
1347                 $self->accept_connections();
1348             }
1349         };
1350         warn $@ if $@;
1351     });
1352
1353     $self->{term_watch} = AnyEvent->signal(signal => "TERM", cb => sub {
1354         undef $self->{term_watch};
1355         $self->wait_end_loop();
1356     });
1357
1358     $self->{quit_watch} = AnyEvent->signal(signal => "QUIT", cb => sub {
1359         undef $self->{quit_watch};
1360         $self->wait_end_loop();
1361     });
1362
1363     $self->{inotify_poll} = AnyEvent->timer(after => 5, interval => 5, cb => sub {
1364         PVE::INotify::poll(); # read inotify events
1365     });
1366
1367     return $self;
1368 }
1369
1370 sub run {
1371     my ($self) = @_;
1372
1373     $self->{end_cond}->recv;
1374 }
1375
1376 1;