PVE/HTTPServer.pm

   1 package PVE::HTTPServer;
   2
   3 use strict;
   4 use warnings;
   5 use Time::HiRes qw(usleep ualarm gettimeofday tv_interval);
   6 use Socket qw(IPPROTO_TCP TCP_NODELAY SOMAXCONN);
   7 use POSIX qw(strftime EINTR EAGAIN);
   8 use Fcntl;
   9 use IO::File;
  10 use File::stat qw();
  11 use Digest::MD5;
  12 # use AnyEvent::Strict; # only use this for debugging
  13 use AnyEvent::Util qw(guard fh_nonblocking WSAEWOULDBLOCK WSAEINPROGRESS);
  14 use AnyEvent::Socket;
  15 use AnyEvent::Handle;
  16 use Net::SSLeay;
  17 use AnyEvent::TLS;
  18 use AnyEvent::IO;
  19 use AnyEvent::HTTP;
  20 use Fcntl ();
  21 use Compress::Zlib;
  22 use PVE::SafeSyslog;
  23 use PVE::INotify;
  24 use PVE::RPCEnvironment;
  25 use PVE::REST;
  26
  27 use Net::IP;
  28 use URI;
  29 use HTTP::Status qw(:constants);
  30 use HTTP::Headers;
  31 use HTTP::Response;
  32 use Data::Dumper;
  33
  34 my $limit_max_headers = 30;
  35 my $limit_max_header_size = 8*1024;
  36 my $limit_max_post = 16*1024;
  37
  38
  39 my $known_methods = {
  40     GET => 1,
  41     POST => 1,
  42     PUT => 1,
  43     DELETE => 1,
  44 };
  45
  46 my $baseuri = "/api2";
  47
  48 sub split_abs_uri {
  49     my ($abs_uri) = @_;
  50
  51     my ($format, $rel_uri) = $abs_uri =~ m/^\Q$baseuri\E\/+(html|text|json|extjs|png|htmljs|spiceconfig)(\/.*)?$/;
  52     $rel_uri = '/' if !$rel_uri;
  53
  54     return wantarray ? ($rel_uri, $format) : $rel_uri;
  55 }
  56
  57 sub log_request {
  58     my ($self, $reqstate) = @_;
  59
  60     my $loginfo = $reqstate->{log};
  61
  62     # like apache2 common log format
  63     # LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""
  64
  65     return if $loginfo->{written}; # avoid duplicate logs
  66     $loginfo->{written} = 1;
  67
  68     my $peerip = $reqstate->{peer_host} || '-';
  69     my $userid = $loginfo->{userid} || '-';
  70     my $content_length = defined($loginfo->{content_length}) ? $loginfo->{content_length} : '-';
  71     my $code =  $loginfo->{code} || 500;
  72     my $requestline = $loginfo->{requestline} || '-';
  73     my $timestr = strftime("%d/%b/%Y:%H:%M:%S %z", localtime());
  74
  75     my $msg = "$peerip - $userid [$timestr] \"$requestline\" $code $content_length\n";
  76
  77     $self->write_log($msg);
  78 }
  79
  80 sub log_aborted_request {
  81     my ($self, $reqstate, $error) = @_;
  82
  83     my $r = $reqstate->{request};
  84     return if !$r; # no active request
  85
  86     if ($error) {
  87         syslog("err", "problem with client $reqstate->{peer_host}; $error");
  88     }
  89
  90     $self->log_request($reqstate);
  91 }
  92
  93 sub cleanup_reqstate {
  94     my ($reqstate) = @_;
  95
  96     delete $reqstate->{log};
  97     delete $reqstate->{request};
  98     delete $reqstate->{proto};
  99     delete $reqstate->{accept_gzip};
 100     delete $reqstate->{starttime};
 101
 102     if ($reqstate->{tmpfilename}) {
 103         unlink $reqstate->{tmpfilename};
 104         delete $reqstate->{tmpfilename};
 105     }
 106 }
 107
 108 sub client_do_disconnect {
 109     my ($self, $reqstate) = @_;
 110
 111     cleanup_reqstate($reqstate);
 112
 113     my $shutdown_hdl = sub {
 114         my $hdl = shift;
 115
 116         shutdown($hdl->{fh}, 1);
 117         # clear all handlers
 118         $hdl->on_drain(undef);
 119         $hdl->on_read(undef);
 120         $hdl->on_eof(undef);
 121     };
 122
 123     if (my $proxyhdl = delete $reqstate->{proxyhdl}) {
 124         &$shutdown_hdl($proxyhdl);
 125     }
 126
 127     my $hdl = delete $reqstate->{hdl};
 128
 129     if (!$hdl) {
 130         syslog('err', "detected empty handle");
 131         return;
 132     }
 133
 134     print "close connection $hdl\n" if $self->{debug};
 135
 136     &$shutdown_hdl($hdl);
 137
 138     $self->{conn_count}--;
 139
 140     print "$$: CLOSE FH" .  $hdl->{fh}->fileno() . " CONN$self->{conn_count}\n" if $self->{debug};
 141 }
 142
 143 sub finish_response {
 144     my ($self, $reqstate) = @_;
 145
 146     my $hdl = $reqstate->{hdl};
 147
 148     cleanup_reqstate($reqstate);
 149
 150     if (!$self->{end_loop} && $reqstate->{keep_alive} > 0) {
 151         # print "KEEPALIVE $reqstate->{keep_alive}\n" if $self->{debug};
 152         $hdl->on_read(sub {
 153             eval { $self->push_request_header($reqstate); };
 154             warn $@ if $@;
 155         });
 156     } else {
 157         $hdl->on_drain (sub {
 158             eval {
 159                 $self->client_do_disconnect($reqstate);
 160             };
 161             warn $@ if $@;
 162         });
 163     }
 164 }
 165
 166 sub response {
 167     my ($self, $reqstate, $resp, $mtime, $nocomp, $delay) = @_;
 168
 169     #print "$$: send response: " . Dumper($resp);
 170
 171     # activate timeout
 172     $reqstate->{hdl}->timeout_reset();
 173     $reqstate->{hdl}->timeout($self->{timeout});
 174
 175     $nocomp = 1 if !$reqstate->{accept_gzip};
 176
 177     my $code = $resp->code;
 178     my $msg = $resp->message || HTTP::Status::status_message($code);
 179     ($msg) = $msg =~m/^(.*)$/m;
 180     my $content = $resp->content;
 181
 182     if ($code =~ /^(1\d\d|[23]04)$/) {
 183         # make sure content we have no content
 184         $content = "";
 185     }
 186
 187     $reqstate->{keep_alive} = 0 if ($code >= 400) || $self->{end_loop};
 188
 189     $reqstate->{log}->{code} = $code;
 190
 191     my $proto = $reqstate->{proto} ? $reqstate->{proto}->{str} : 'HTTP/1.0';
 192     my $res = "$proto $code $msg\015\012";
 193
 194     my $ctime = time();
 195     my $date = HTTP::Date::time2str($ctime);
 196     $resp->header('Date' => $date);
 197     if ($mtime) {
 198         $resp->header('Last-Modified' => HTTP::Date::time2str($mtime));
 199     } else {
 200         $resp->header('Expires' => $date);
 201         $resp->header('Cache-Control' => "max-age=0");
 202         $resp->header("Pragma", "no-cache");
 203     }
 204
 205     $resp->header('Server' => "pve-api-daemon/3.0");
 206
 207     my $content_length;
 208     if ($content) {
 209
 210         $content_length = length($content);
 211
 212         if (!$nocomp && ($content_length > 1024)) {
 213             my $comp = Compress::Zlib::memGzip($content);
 214             $resp->header('Content-Encoding', 'gzip');
 215             $content = $comp;
 216             $content_length = length($content);
 217         }
 218         $resp->header("Content-Length" => $content_length);
 219         $reqstate->{log}->{content_length} = $content_length;
 220
 221     } else {
 222         $resp->remove_header("Content-Length");
 223     }
 224
 225     if ($reqstate->{keep_alive} > 0) {
 226         $resp->push_header('Connection' => 'Keep-Alive');
 227     } else {
 228         $resp->header('Connection' => 'close');
 229     }
 230
 231     $res .= $resp->headers_as_string("\015\012");
 232     #print "SEND(without content) $res\n" if $self->{debug};
 233
 234     $res .= "\015\012";
 235     $res .= $content if $content;
 236
 237     $self->log_request($reqstate, $reqstate->{request});
 238
 239     if ($delay && $delay > 0) {
 240         my $w; $w = AnyEvent->timer(after => $delay, cb => sub {
 241             undef $w; # delete reference
 242             $reqstate->{hdl}->push_write($res);
 243             $self->finish_response($reqstate);
 244         });
 245     } else {
 246         $reqstate->{hdl}->push_write($res);
 247         $self->finish_response($reqstate);
 248     }
 249 }
 250
 251 sub error {
 252     my ($self, $reqstate, $code, $msg, $hdr, $content) = @_;
 253
 254     eval {
 255         my $resp = HTTP::Response->new($code, $msg, $hdr, $content);
 256         $self->response($reqstate, $resp);
 257     };
 258     warn $@ if $@;
 259 }
 260
 261 sub send_file_start {
 262     my ($self, $reqstate, $filename) = @_;
 263
 264     eval {
 265         # print "SEND FILE $filename\n";
 266         # Note: aio_load() this is not really async unless we use IO::AIO!
 267         eval {
 268
 269             my $r = $reqstate->{request};
 270
 271             my $fh = IO::File->new($filename, '<') ||
 272                 die "$!\n";
 273             my $stat = File::stat::stat($fh) ||
 274                 die "$!\n";
 275
 276             my $mtime = $stat->mtime;
 277
 278             if (my $ifmod = $r->header('if-modified-since')) {
 279                 my $iftime = HTTP::Date::str2time($ifmod);
 280                 if ($mtime <= $iftime) {
 281                     my $resp = HTTP::Response->new(304, "NOT MODIFIED");
 282                     $self->response($reqstate, $resp, $mtime);
 283                     return;
 284                 }
 285             }
 286
 287             my $data;
 288             my $len = sysread($fh, $data,  $stat->size);
 289             die "got short file\n" if !defined($len) || $len != $stat->size;
 290
 291             my $ct;
 292             my $nocomp;
 293             if ($filename =~ m/\.css$/) {
 294                 $ct = 'text/css';
 295             } elsif ($filename =~ m/\.js$/) {
 296                 $ct = 'application/javascript';
 297             } elsif ($filename =~ m/\.png$/) {
 298                 $ct = 'image/png';
 299                 $nocomp = 1;
 300             } elsif ($filename =~ m/\.ico$/) {
 301                 $ct = 'image/x-icon';
 302                 $nocomp = 1;
 303             } elsif ($filename =~ m/\.gif$/) {
 304                 $ct = 'image/gif';
 305                 $nocomp = 1;
 306             } elsif ($filename =~ m/\.jar$/) {
 307                 $ct = 'application/java-archive';
 308                 $nocomp = 1;
 309             } else {
 310                 die "unable to detect content type";
 311             }
 312
 313             my $header = HTTP::Headers->new(Content_Type => $ct);
 314             my $resp = HTTP::Response->new(200, "OK", $header, $data);
 315             $self->response($reqstate, $resp, $mtime, $nocomp);
 316         };
 317         if (my $err = $@) {
 318             $self->error($reqstate, 501, $err);
 319         }
 320     };
 321
 322     warn $@ if $@;
 323 }
 324
 325 sub proxy_request {
 326     my ($self, $reqstate, $clientip, $host, $method, $uri, $ticket, $token, $params) = @_;
 327
 328     eval {
 329         my $target;
 330         my $keep_alive = 1;
 331         if ($host eq 'localhost') {
 332             $target = "http://$host:85$uri";
 333             # keep alive for localhost is not worth (connection setup is about 0.2ms)
 334             $keep_alive = 0;
 335         } else {
 336             $target = "https://$host:8006$uri";
 337         }
 338
 339         my $headers = {
 340             PVEDisableProxy => 'true',
 341             PVEClientIP => $clientip,
 342         };
 343
 344         my $cookie_name = 'PVEAuthCookie';
 345
 346         $headers->{'cookie'} = PVE::REST::create_auth_cookie($ticket) if $ticket;
 347         $headers->{'CSRFPreventionToken'} = $token if $token;
 348         $headers->{'Accept-Encoding'} = 'gzip' if $reqstate->{accept_gzip};
 349
 350         my $content;
 351
 352         if  ($method eq 'POST' || $method eq 'PUT') {
 353             $headers->{'Content-Type'} = 'application/x-www-form-urlencoded';
 354             # use URI object to format application/x-www-form-urlencoded content.
 355             my $url = URI->new('http:');
 356             $url->query_form(%$params);
 357             $content = $url->query;
 358             if (defined($content)) {
 359                 $headers->{'Content-Length'} = length($content);
 360             }
 361         }
 362
 363         my $w; $w = http_request(
 364             $method => $target,
 365             headers => $headers,
 366             timeout => 30,
 367             recurse => 0,
 368             proxy => undef, # avoid use of $ENV{HTTP_PROXY}
 369             keepalive => $keep_alive,
 370             body => $content,
 371             tls_ctx => $self->{tls_ctx},
 372             sub {
 373                 my ($body, $hdr) = @_;
 374
 375                 undef $w;
 376
 377                 if (!$reqstate->{hdl}) {
 378                     warn "proxy detected vanished client connection\n";
 379                     return;
 380                 }
 381
 382                 eval {
 383                     my $code = delete $hdr->{Status};
 384                     my $msg = delete $hdr->{Reason};
 385                     delete $hdr->{URL};
 386                     delete $hdr->{HTTPVersion};
 387                     my $header = HTTP::Headers->new(%$hdr);
 388                     my $resp = HTTP::Response->new($code, $msg, $header, $body);
 389                     # Note: disable compression, because body is already compressed
 390                     $self->response($reqstate, $resp, undef, 1);
 391                 };
 392                 warn $@ if $@;
 393             });
 394     };
 395     warn $@ if $@;
 396 }
 397
 398 # return arrays as \0 separated strings (like CGI.pm)
 399 sub decode_urlencoded {
 400     my ($data) = @_;
 401
 402     my $res = {};
 403
 404     return $res if !$data;
 405
 406     foreach my $kv (split(/[\&\;]/, $data)) {
 407         my ($k, $v) = split(/=/, $kv);
 408         $k =~s/\+/ /g;
 409         $k =~ s/%([0-9a-fA-F][0-9a-fA-F])/chr(hex($1))/eg;
 410         $v =~s/\+/ /g;
 411         $v =~ s/%([0-9a-fA-F][0-9a-fA-F])/chr(hex($1))/eg;
 412
 413         if (defined(my $old = $res->{$k})) {
 414             $res->{$k} = "$old\0$v";
 415         } else {
 416             $res->{$k} = $v;
 417         }
 418     }
 419     return $res;
 420 }
 421
 422 sub extract_params {
 423     my ($r, $method) = @_;
 424
 425     my $params = {};
 426
 427     if ($method eq 'PUT' || $method eq 'POST') {
 428         $params = decode_urlencoded($r->content);
 429     }
 430
 431     my $query_params = decode_urlencoded($r->url->query());
 432
 433     foreach my $k (keys %{$query_params}) {
 434         $params->{$k} = $query_params->{$k};
 435     }
 436
 437     return PVE::Tools::decode_utf8_parameters($params);
 438 }
 439
 440 sub handle_api2_request {
 441     my ($self, $reqstate, $auth, $upload_state) = @_;
 442
 443     eval {
 444         my $r = $reqstate->{request};
 445         my $method = $r->method();
 446         my $path = $r->uri->path();
 447
 448         my ($rel_uri, $format) = split_abs_uri($path);
 449         if (!$format) {
 450             $self->error($reqstate, HTTP_NOT_IMPLEMENTED, "no such uri");
 451             return;
 452         }
 453
 454         #print Dumper($upload_state) if $upload_state;
 455
 456         my $rpcenv = $self->{rpcenv};
 457
 458         my $params;
 459
 460         if ($upload_state) {
 461             $params = $upload_state->{params};
 462         } else {
 463             $params = extract_params($r, $method);
 464         }
 465
 466         delete $params->{_dc}; # remove disable cache parameter
 467
 468         my $clientip = $reqstate->{peer_host};
 469
 470         $rpcenv->init_request();
 471
 472         my $res = PVE::REST::rest_handler($rpcenv, $clientip, $method, $rel_uri, $auth, $params);
 473
 474         AnyEvent->now_update(); # in case somebody called sleep()
 475
 476         $rpcenv->set_user(undef); # clear after request
 477
 478         if (my $host = $res->{proxy}) {
 479
 480             if ($self->{trusted_env}) {
 481                 $self->error($reqstate, HTTP_INTERNAL_SERVER_ERROR, "proxy not allowed");
 482                 return;
 483             }
 484
 485             if ($host ne 'localhost' && $r->header('PVEDisableProxy')) {
 486                 $self->error($reqstate, HTTP_INTERNAL_SERVER_ERROR, "proxy loop detected");
 487                 return;
 488             }
 489
 490             $res->{proxy_params}->{tmpfilename} = $reqstate->{tmpfilename} if $upload_state;
 491
 492             $self->proxy_request($reqstate, $clientip, $host, $method,
 493                                  $r->uri, $auth->{ticket}, $auth->{token}, $res->{proxy_params});
 494             return;
 495
 496         }
 497
 498         my $delay = 0;
 499         if ($res->{status} == HTTP_UNAUTHORIZED) {
 500             # always delay unauthorized calls by 3 seconds
 501             $delay = 3 - tv_interval($reqstate->{starttime});
 502             $delay = 0 if $delay < 0;
 503         }
 504
 505         PVE::REST::prepare_response_data($format, $res);
 506         my ($raw, $ct, $nocomp) = PVE::REST::format_response_data($format, $res, $path);
 507
 508         my $resp = HTTP::Response->new($res->{status}, $res->{message});
 509         $resp->header("Content-Type" => $ct);
 510         $resp->content($raw);
 511         $self->response($reqstate, $resp, undef, $nocomp, $delay);
 512     };
 513     if (my $err = $@) {
 514         $self->error($reqstate, 501, $err);
 515     }
 516 }
 517
 518 sub handle_spice_proxy_request {
 519     my ($self, $reqstate, $connect_str, $vmid, $node, $spiceport) = @_;
 520
 521     eval {
 522
 523         die "Port $spiceport is not allowed" if ($spiceport < 61000 || $spiceport > 61099);
 524
 525         my $rpcenv = $self->{rpcenv};
 526         $rpcenv->init_request();
 527
 528         my $clientip = $reqstate->{peer_host};
 529         my $r = $reqstate->{request};
 530
 531         my $remip;
 532
 533         if ($node ne 'localhost' && PVE::INotify::nodename() !~ m/^$node$/i) {
 534             $remip = PVE::Cluster::remote_node_ip($node);
 535             die "unable to get remote IP address for node '$node'\n" if !$remip;
 536             print "REMOTE CONNECT $vmid, $remip, $connect_str\n" if $self->{debug};
 537         } else {
 538             print "$$: CONNECT $vmid, $node, $spiceport\n" if $self->{debug};
 539         }
 540
 541         if ($remip && $r->header('PVEDisableProxy')) {
 542             $self->error($reqstate, HTTP_INTERNAL_SERVER_ERROR, "proxy loop detected");
 543             return;
 544         }
 545
 546         $reqstate->{hdl}->timeout(0);
 547         $reqstate->{hdl}->wbuf_max(64*10*1024);
 548
 549         my $remhost = $remip ? $remip : "127.0.0.1";
 550         my $remport = $remip ? 3128 : $spiceport;
 551
 552         tcp_connect $remhost, $remport, sub {
 553             my ($fh) = @_
 554                 or die "connect to '$remhost:$remport' failed: $!";
 555
 556             print "$$: CONNECTed to '$remhost:$remport'\n" if $self->{debug};
 557             $reqstate->{proxyhdl} = AnyEvent::Handle->new(
 558                 fh => $fh,
 559                 rbuf_max => 64*1024,
 560                 wbuf_max => 64*10*1024,
 561                 timeout => 5,
 562                 on_eof => sub {
 563                     my ($hdl) = @_;
 564                     eval {
 565                         $self->log_aborted_request($reqstate);
 566                         $self->client_do_disconnect($reqstate);
 567                     };
 568                     if (my $err = $@) { syslog('err', $err); }
 569                 },
 570                 on_error => sub {
 571                     my ($hdl, $fatal, $message) = @_;
 572                     eval {
 573                         $self->log_aborted_request($reqstate, $message);
 574                         $self->client_do_disconnect($reqstate);
 575                     };
 576                     if (my $err = $@) { syslog('err', "$err"); }
 577                 });
 578
 579
 580             my $proxyhdlreader = sub {
 581                 my ($hdl) = @_;
 582
 583                 my $len = length($hdl->{rbuf});
 584                 my $data = substr($hdl->{rbuf}, 0, $len, '');
 585
 586                 #print "READ1 $len\n";
 587                 $reqstate->{hdl}->push_write($data) if $reqstate->{hdl};
 588             };
 589
 590             my $hdlreader = sub {
 591                 my ($hdl) = @_;
 592
 593                 my $len = length($hdl->{rbuf});
 594                 my $data = substr($hdl->{rbuf}, 0, $len, '');
 595
 596                 #print "READ0 $len\n";
 597                 $reqstate->{proxyhdl}->push_write($data) if $reqstate->{proxyhdl};
 598             };
 599
 600             my $proto = $reqstate->{proto} ? $reqstate->{proto}->{str} : 'HTTP/1.0';
 601
 602             my $startproxy = sub {
 603                 $reqstate->{proxyhdl}->timeout(0);
 604                 $reqstate->{proxyhdl}->on_read($proxyhdlreader);
 605                 $reqstate->{hdl}->on_read($hdlreader);
 606
 607                 # todo: use stop_read/start_read if write buffer grows to much
 608
 609                 my $res = "$proto 200 OK\015\012"; # hope this is the right answer?
 610                 $reqstate->{hdl}->push_write($res);
 611
 612                 # log early
 613                 $reqstate->{log}->{code} = 200;
 614                 $self->log_request($reqstate);
 615             };
 616
 617             if ($remip) {
 618                 my $header = "CONNECT ${connect_str} $proto\015\012" .
 619                     "Host: ${connect_str}\015\012" .
 620                     "Proxy-Connection: keep-alive\015\012" .
 621                     "User-Agent: spiceproxy\015\012" .
 622                     "PVEDisableProxy: true\015\012" .
 623                     "PVEClientIP: $clientip\015\012" .
 624                     "\015\012";
 625
 626                 $reqstate->{proxyhdl}->push_write($header);
 627                 $reqstate->{proxyhdl}->push_read(line => sub {
 628                     my ($hdl, $line) = @_;
 629
 630                     if ($line =~ m!^$proto 200 OK$!) {
 631                         &$startproxy();
 632                     } else {
 633                         $reqstate->{hdl}->push_write($line);
 634                         $self->client_do_disconnect($reqstate);
 635                     }
 636                 });
 637             } else {
 638                 &$startproxy();
 639             }
 640
 641         };
 642     };
 643     if (my $err = $@) {
 644         warn $err;
 645         $self->log_aborted_request($reqstate, $err);
 646         $self->client_do_disconnect($reqstate);
 647     }
 648 }
 649
 650 sub handle_request {
 651     my ($self, $reqstate, $auth) = @_;
 652
 653     eval {
 654         my $r = $reqstate->{request};
 655         my $method = $r->method();
 656         my $path = $r->uri->path();
 657
 658         # disable timeout on handle (we already have all data we need)
 659         # we re-enable timeout in response()
 660         $reqstate->{hdl}->timeout(0);
 661
 662         if ($path =~ m!$baseuri!) {
 663             $self->handle_api2_request($reqstate, $auth);
 664             return;
 665         }
 666
 667         if ($self->{pages} && ($method eq 'GET') && (my $handler = $self->{pages}->{$path})) {
 668             if (ref($handler) eq 'CODE') {
 669                 my $params = decode_urlencoded($r->url->query());
 670                 my ($resp, $userid) = &$handler($self, $reqstate->{request}, $params);
 671                 $self->response($reqstate, $resp);
 672             } elsif (ref($handler) eq 'HASH') {
 673                 if (my $filename = $handler->{file}) {
 674                     my $fh = IO::File->new($filename) ||
 675                         die "unable to open file '$filename' - $!\n";
 676                     send_file_start($self, $reqstate, $filename);
 677                 } else {
 678                     die "internal error - no handler";
 679                 }
 680             } else {
 681                 die "internal error - no handler";
 682             }
 683             return;
 684         }
 685
 686         if ($self->{dirs} && ($method eq 'GET')) {
 687             # we only allow simple names
 688             if ($path =~ m!^(/\S+/)([a-zA-Z0-9\-\_\.]+)$!) {
 689                 my ($subdir, $file) = ($1, $2);
 690                 if (my $dir = $self->{dirs}->{$subdir}) {
 691                     my $filename = "$dir$file";
 692                     my $fh = IO::File->new($filename) ||
 693                         die "unable to open file '$filename' - $!\n";
 694                     send_file_start($self, $reqstate, $filename);
 695                     return;
 696                 }
 697             }
 698         }
 699
 700         die "no such file '$path'";
 701     };
 702     if (my $err = $@) {
 703         $self->error($reqstate, 501, $err);
 704     }
 705 }
 706
 707 sub file_upload_multipart {
 708     my ($self, $reqstate, $auth, $rstate) = @_;
 709
 710     eval {
 711         my $boundary = $rstate->{boundary};
 712         my $hdl = $reqstate->{hdl};
 713
 714         my $startlen = length($hdl->{rbuf});
 715
 716         if ($rstate->{phase} == 0) { # skip everything until start
 717             if ($hdl->{rbuf} =~ s/^.*?--\Q$boundary\E  \015?\012
 718                        ((?:[^\015]+\015\012)* ) \015?\012//xs) {
 719                 my $header = $1;
 720                 my ($ct, $disp, $name, $filename);
 721                 foreach my $line (split(/\015?\012/, $header)) {
 722                     # assume we have single line headers
 723                     if ($line =~ m/^Content-Type\s*:\s*(.*)/i) {
 724                         $ct = parse_content_type($1);
 725                     } elsif ($line =~ m/^Content-Disposition\s*:\s*(.*)/i) {
 726                         ($disp, $name, $filename) = parse_content_disposition($1);
 727                     }
 728                 }
 729
 730                 if (!($disp && $disp eq 'form-data' && $name)) {
 731                     syslog('err', "wrong content disposition in multipart - abort upload");
 732                     $rstate->{phase} = -1;
 733                 } else {
 734
 735                     $rstate->{fieldname} = $name;
 736
 737                     if ($filename) {
 738                         if ($name eq 'filename') {
 739                             # found file upload data
 740                             $rstate->{phase} = 1;
 741                             $rstate->{filename} = $filename;
 742                         } else {
 743                             syslog('err', "wrong field name for file upload - abort upload");
 744                             $rstate->{phase} = -1;
 745                         }
 746                     } else {
 747                         # found form data for field $name
 748                         $rstate->{phase} = 2;
 749                     }
 750                 }
 751             } else {
 752                 my $len = length($hdl->{rbuf});
 753                 substr($hdl->{rbuf}, 0, $len - $rstate->{maxheader}, '')
 754                     if $len > $rstate->{maxheader}; # skip garbage
 755             }
 756         } elsif ($rstate->{phase} == 1) { # inside file - dump until end marker
 757             if ($hdl->{rbuf} =~ s/^(.*?)\015?\012(--\Q$boundary\E(--)? \015?\012(.*))$/$2/xs) {
 758                 my ($rest, $eof) = ($1, $3);
 759                 my $len = length($rest);
 760                 die "write to temporary file failed - $!"
 761                     if syswrite($rstate->{outfh}, $rest) != $len;
 762                 $rstate->{ctx}->add($rest);
 763                 $rstate->{params}->{filename} = $rstate->{filename};
 764                 $rstate->{md5sum} = $rstate->{ctx}->hexdigest;
 765                 $rstate->{bytes} += $len;
 766                 $rstate->{phase} =  $eof ? 100 : 0;
 767             } else {
 768                 my $len = length($hdl->{rbuf});
 769                 my $wlen = $len - $rstate->{boundlen};
 770                 if ($wlen > 0) {
 771                     my $data = substr($hdl->{rbuf}, 0, $wlen, '');
 772                     die "write to temporary file failed - $!"
 773                         if syswrite($rstate->{outfh}, $data) != $wlen;
 774                     $rstate->{bytes} += $wlen;
 775                     $rstate->{ctx}->add($data);
 776                 }
 777             }
 778         } elsif ($rstate->{phase} == 2) { # inside normal field
 779
 780             if ($hdl->{rbuf} =~ s/^(.*?)\015?\012(--\Q$boundary\E(--)? \015?\012(.*))$/$2/xs) {
 781                 my ($rest, $eof) = ($1, $3);
 782                 my $len = length($rest);
 783                 $rstate->{post_size} += $len;
 784                 if ($rstate->{post_size} < $limit_max_post) {
 785                     $rstate->{params}->{$rstate->{fieldname}} = $rest;
 786                     $rstate->{phase} = $eof ? 100 : 0;
 787                 } else {
 788                     syslog('err', "form data to large - abort upload");
 789                     $rstate->{phase} = -1; # skip
 790                 }
 791             }
 792         } else { # skip
 793             my $len = length($hdl->{rbuf});
 794             substr($hdl->{rbuf}, 0, $len, ''); # empty rbuf
 795         }
 796
 797         $rstate->{read} += ($startlen - length($hdl->{rbuf}));
 798
 799         if (!$rstate->{done} && ($rstate->{read} + length($hdl->{rbuf})) >= $rstate->{size}) {
 800             $rstate->{done} = 1; # make sure we dont get called twice
 801             if ($rstate->{phase} < 0 || !$rstate->{md5sum}) {
 802                 die "upload failed\n";
 803             } else {
 804                 my $elapsed = tv_interval($rstate->{starttime});
 805
 806                 my $rate = int($rstate->{bytes}/($elapsed*1024*1024));
 807                 syslog('info', "multipart upload complete " .
 808                        "(size: %d time: %ds rate: %.2fMiB/s md5sum: $rstate->{md5sum})",
 809                        $rstate->{bytes}, $elapsed, $rate);
 810                 $self->handle_api2_request($reqstate, $auth, $rstate);
 811             }
 812         }
 813     };
 814     if (my $err = $@) {
 815         syslog('err', $err);
 816         $self->error($reqstate, 501, $err);
 817     }
 818 }
 819
 820 sub parse_content_type {
 821     my ($ctype) = @_;
 822
 823     my ($ct, @params) = split(/\s*[;,]\s*/o, $ctype);
 824
 825     foreach my $v (@params) {
 826         if ($v =~ m/^\s*boundary\s*=\s*(\S+?)\s*$/o) {
 827             return wantarray ? ($ct, $1) : $ct;
 828         }
 829     }
 830
 831     return  wantarray ? ($ct) : $ct;
 832 }
 833
 834 sub parse_content_disposition {
 835     my ($line) = @_;
 836
 837     my ($disp, @params) = split(/\s*[;,]\s*/o, $line);
 838     my $name;
 839     my $filename;
 840
 841     foreach my $v (@params) {
 842         if ($v =~ m/^\s*name\s*=\s*(\S+?)\s*$/o) {
 843             $name = $1;
 844             $name =~ s/^"(.*)"$/$1/;
 845         } elsif ($v =~ m/^\s*filename\s*=\s*(.+?)\s*$/o) {
 846             $filename = $1;
 847             $filename =~ s/^"(.*)"$/$1/;
 848         }
 849     }
 850
 851     return  wantarray ? ($disp, $name, $filename) : $disp;
 852 }
 853
 854 my $tmpfile_seq_no = 0;
 855
 856 sub get_upload_filename {
 857     # choose unpredictable tmpfile name
 858
 859     $tmpfile_seq_no++;
 860     return "/var/tmp/pveupload-" . Digest::MD5::md5_hex($tmpfile_seq_no . time() . $$);
 861 }
 862
 863 sub unshift_read_header {
 864     my ($self, $reqstate, $state) = @_;
 865
 866     $state = { size => 0, count => 0 } if !$state;
 867
 868     $reqstate->{hdl}->unshift_read(line => sub {
 869         my ($hdl, $line) = @_;
 870
 871         eval {
 872             # print "$$: got header: $line\n" if $self->{debug};
 873
 874             die "to many http header lines\n" if ++$state->{count} >= $limit_max_headers;
 875             die "http header too large\n" if ($state->{size} += length($line)) >= $limit_max_header_size;
 876
 877             my $r = $reqstate->{request};
 878             if ($line eq '') {
 879
 880                 my $path = $r->uri->path();
 881                 my $method = $r->method();
 882
 883                 $r->push_header($state->{key}, $state->{val})
 884                     if $state->{key};
 885
 886                 if (!$known_methods->{$method}) {
 887                     my $resp = HTTP::Response->new(HTTP_NOT_IMPLEMENTED, "method '$method' not available");
 888                     $self->response($reqstate, $resp);
 889                     return;
 890                 }
 891
 892                 my $conn = $r->header('Connection');
 893                 my $accept_enc = $r->header('Accept-Encoding');
 894                 $reqstate->{accept_gzip} = ($accept_enc && $accept_enc =~ m/gzip/) ? 1 : 0;
 895
 896                 if ($conn) {
 897                     $reqstate->{keep_alive} = 0 if $conn =~ m/close/oi;
 898                 } else {
 899                     if ($reqstate->{proto}->{ver} < 1001) {
 900                         $reqstate->{keep_alive} = 0;
 901                     }
 902                 }
 903
 904                 my $te  = $r->header('Transfer-Encoding');
 905                 if ($te && lc($te) eq 'chunked') {
 906                     # Handle chunked transfer encoding
 907                     $self->error($reqstate, 501, "chunked transfer encoding not supported");
 908                     return;
 909                 } elsif ($te) {
 910                     $self->error($reqstate, 501, "Unknown transfer encoding '$te'");
 911                     return;
 912                 }
 913
 914                 my $pveclientip = $r->header('PVEClientIP');
 915
 916                 # fixme: how can we make PVEClientIP header trusted?
 917                 if ($self->{trusted_env} && $pveclientip) {
 918                     $reqstate->{peer_host} = $pveclientip;
 919                 } else {
 920                     $r->header('PVEClientIP', $reqstate->{peer_host});
 921                 }
 922
 923                 my $len = $r->header('Content-Length');
 924
 925                 # header processing complete - authenticate now
 926
 927                 my $auth = {};
 928                 if ($self->{spiceproxy}) {
 929                     my $connect_str = $r->header('Host');
 930                     my ($vmid, $node, $port) = PVE::AccessControl::verify_spice_connect_url($connect_str);
 931                     if (!(defined($vmid) && $node && $port)) {
 932                         $self->error($reqstate, HTTP_UNAUTHORIZED, "invalid ticket");
 933                         return;
 934                     }
 935                     $self->handle_spice_proxy_request($reqstate, $connect_str, $vmid, $node, $port);
 936                     return;
 937                 } elsif ($path =~ m!$baseuri!) {
 938                     my $token = $r->header('CSRFPreventionToken');
 939                     my $cookie = $r->header('Cookie');
 940                     my $ticket = PVE::REST::extract_auth_cookie($cookie);
 941
 942                     my ($rel_uri, $format) = split_abs_uri($path);
 943                     if (!$format) {
 944                         $self->error($reqstate, HTTP_NOT_IMPLEMENTED, "no such uri");
 945                         return;
 946                     }
 947
 948                     eval {
 949                         $auth = PVE::REST::auth_handler($self->{rpcenv}, $reqstate->{peer_host}, $method,
 950                                                         $rel_uri, $ticket, $token);
 951                     };
 952                     if (my $err = $@) {
 953                         $self->error($reqstate, HTTP_UNAUTHORIZED, $err);
 954                         return;
 955                     }
 956                 }
 957
 958                 $reqstate->{log}->{userid} = $auth->{userid};
 959
 960                 if ($len) {
 961
 962                     if (!($method eq 'PUT' || $method eq 'POST')) {
 963                         $self->error($reqstate, 501, "Unexpected content for method '$method'");
 964                         return;
 965                     }
 966
 967                     my $ctype = $r->header('Content-Type');
 968                     my ($ct, $boundary) = parse_content_type($ctype) if $ctype;
 969
 970                     if ($auth->{isUpload} && !$self->{trusted_env}) {
 971                         die "upload 'Content-Type '$ctype' not implemented\n"
 972                             if !($boundary && $ct && ($ct eq 'multipart/form-data'));
 973
 974                         die "upload without content length header not supported" if !$len;
 975
 976                         die "upload without content length header not supported" if !$len;
 977
 978                         print "start upload $path $ct $boundary\n" if $self->{debug};
 979
 980                         my $tmpfilename = get_upload_filename();
 981                         my $outfh = IO::File->new($tmpfilename, O_RDWR|O_CREAT|O_EXCL, 0600) ||
 982                             die "unable to create temporary upload file '$tmpfilename'";
 983
 984                         $reqstate->{keep_alive} = 0;
 985
 986                         my $boundlen = length($boundary) + 8; # \015?\012--$boundary--\015?\012
 987
 988                         my $state = {
 989                             size => $len,
 990                             boundary => $boundary,
 991                             ctx => Digest::MD5->new,
 992                             boundlen =>  $boundlen,
 993                             maxheader => 2048 + $boundlen, # should be large enough
 994                             params => decode_urlencoded($r->url->query()),
 995                             phase => 0,
 996                             read => 0,
 997                             post_size => 0,
 998                             starttime => [gettimeofday],
 999                             outfh => $outfh,
1000                         };
1001                         $reqstate->{tmpfilename} = $tmpfilename;
1002                         $reqstate->{hdl}->on_read(sub { $self->file_upload_multipart($reqstate, $auth, $state); });
1003                         return;
1004                     }
1005
1006                     if ($len > $limit_max_post) {
1007                         $self->error($reqstate, 501, "for data too large");
1008                         return;
1009                     }
1010
1011                     if (!$ct || $ct eq 'application/x-www-form-urlencoded') {
1012                         $reqstate->{hdl}->unshift_read(chunk => $len, sub {
1013                             my ($hdl, $data) = @_;
1014                             $r->content($data);
1015                             $self->handle_request($reqstate, $auth);
1016                         });
1017                     } else {
1018                         $self->error($reqstate, 506, "upload 'Content-Type '$ctype' not implemented");
1019                     }
1020                 } else {
1021                     $self->handle_request($reqstate, $auth);
1022                 }
1023             } elsif ($line =~ /^([^:\s]+)\s*:\s*(.*)/) {
1024                 $r->push_header($state->{key}, $state->{val}) if $state->{key};
1025                 ($state->{key}, $state->{val}) = ($1, $2);
1026                 $self->unshift_read_header($reqstate, $state);
1027             } elsif ($line =~ /^\s+(.*)/) {
1028                 $state->{val} .= " $1";
1029                 $self->unshift_read_header($reqstate, $state);
1030             } else {
1031                 $self->error($reqstate, 506, "unable to parse request header");
1032             }
1033         };
1034         warn $@ if $@;
1035     });
1036 };
1037
1038 sub push_request_header {
1039     my ($self, $reqstate) = @_;
1040
1041     eval {
1042         $reqstate->{hdl}->push_read(line => sub {
1043             my ($hdl, $line) = @_;
1044
1045             eval {
1046                 # print "got request header: $line\n" if $self->{debug};
1047
1048                 $reqstate->{keep_alive}--;
1049
1050                 if ($line =~ /(\S+)\040(\S+)\040HTTP\/(\d+)\.(\d+)/o) {
1051                     my ($method, $uri, $maj, $min) = ($1, $2, $3, $4);
1052
1053                     if ($maj != 1) {
1054                         $self->error($reqstate, 506, "http protocol version $maj.$min not supported");
1055                         return;
1056                     }
1057
1058                     $self->{request_count}++; # only count valid request headers
1059                     if ($self->{request_count} >= $self->{max_requests}) {
1060                         $self->{end_loop} = 1;
1061                     }
1062                     $reqstate->{log} = { requestline => $line };
1063                     $reqstate->{proto}->{str} = "HTTP/$maj.$min";
1064                     $reqstate->{proto}->{maj} = $maj;
1065                     $reqstate->{proto}->{min} = $min;
1066                     $reqstate->{proto}->{ver} = $maj*1000+$min;
1067                     $reqstate->{request} = HTTP::Request->new($method, $uri);
1068                     $reqstate->{starttime} = [gettimeofday],
1069
1070                     $self->unshift_read_header($reqstate);
1071                 } elsif ($line eq '') {
1072                     # ignore empty lines before requests (browser bugs?)
1073                     $self->push_request_header($reqstate);
1074                 } else {
1075                     $self->error($reqstate, 400, 'bad request');
1076                 }
1077             };
1078             warn $@ if $@;
1079         });
1080     };
1081     warn $@ if $@;
1082 }
1083
1084 sub accept {
1085     my ($self) = @_;
1086
1087     my $clientfh;
1088
1089     return if $self->{end_loop};
1090
1091     # we need to m make sure that only one process calls accept
1092     while (!flock($self->{lockfh}, Fcntl::LOCK_EX())) {
1093         next if $! == EINTR;
1094         die "could not get lock on file '$self->{lockfile}' -  $!\n";
1095     }
1096
1097     my $again = 0;
1098     my $errmsg;
1099     eval {
1100         while (!$self->{end_loop} &&
1101                !defined($clientfh = $self->{socket}->accept()) &&
1102                ($! == EINTR)) {};
1103
1104         if ($self->{end_loop}) {
1105             $again = 0;
1106         } else {
1107             $again = ($! == EAGAIN || $! == WSAEWOULDBLOCK);
1108             if (!defined($clientfh)) {
1109                 $errmsg = "failed to accept connection: $!\n";
1110             }
1111         }
1112     };
1113     warn $@ if $@;
1114
1115     flock($self->{lockfh}, Fcntl::LOCK_UN());
1116
1117     if (!defined($clientfh)) {
1118         return if $again;
1119         die $errmsg if $errmsg;
1120     }
1121
1122     fh_nonblocking $clientfh, 1;
1123
1124     $self->{conn_count}++;
1125
1126     return $clientfh;
1127 }
1128
1129 sub wait_end_loop {
1130     my ($self) = @_;
1131
1132     $self->{end_loop} = 1;
1133
1134     undef $self->{socket_watch};
1135
1136     if ($self->{conn_count} <= 0) {
1137         $self->{end_cond}->send(1);
1138         return;
1139     }
1140
1141     # else we need to wait until all open connections gets closed
1142     my $w; $w = AnyEvent->timer (after => 1, interval => 1, cb => sub {
1143         eval {
1144             # todo: test for active connections instead (we can abort idle connections)
1145             if ($self->{conn_count} <= 0) {
1146                 undef $w;
1147                 $self->{end_cond}->send(1);
1148             }
1149         };
1150         warn $@ if $@;
1151     });
1152 }
1153
1154
1155 sub check_host_access {
1156     my ($self, $clientip) = @_;
1157
1158     my $cip = Net::IP->new($clientip);
1159
1160     my $match_allow = 0;
1161     my $match_deny = 0;
1162
1163     if ($self->{allow_from}) {
1164         foreach my $t (@{$self->{allow_from}}) {
1165             if ($t->overlaps($cip)) {
1166                 $match_allow = 1;
1167                 last;
1168             }
1169         }
1170     }
1171
1172     if ($self->{deny_from}) {
1173         foreach my $t (@{$self->{deny_from}}) {
1174             if ($t->overlaps($cip)) {
1175                 $match_deny = 1;
1176                 last;
1177             }
1178         }
1179     }
1180
1181     if ($match_allow == $match_deny) {
1182         # match both allow and deny, or no match
1183         return $self->{policy} && $self->{policy} eq 'allow' ? 1 : 0;
1184     }
1185
1186     return $match_allow;
1187 }
1188
1189 sub accept_connections {
1190     my ($self) = @_;
1191
1192     eval {
1193
1194         while (my $clientfh = $self->accept()) {
1195
1196             my $reqstate = { keep_alive => $self->{keep_alive} };
1197
1198             # stop keep-alive when there are many open connections
1199             if ($self->{conn_count} >= $self->{max_conn_soft_limit}) {
1200                 $reqstate->{keep_alive} = 0;
1201             }
1202
1203             if (my $sin = getpeername($clientfh)) {
1204                 my ($pport, $phost) = Socket::unpack_sockaddr_in($sin);
1205                 ($reqstate->{peer_port}, $reqstate->{peer_host}) = ($pport,  Socket::inet_ntoa($phost));
1206             }
1207
1208             if (!$self->{trusted_env} && !$self->check_host_access($reqstate->{peer_host})) {
1209                 print "$$: ABORT request from $reqstate->{peer_host} - access denied\n" if $self->{debug};
1210                 $reqstate->{log}->{code} = 403;
1211                 $self->log_request($reqstate);
1212                 next;
1213             }
1214
1215             $reqstate->{hdl} = AnyEvent::Handle->new(
1216                 fh => $clientfh,
1217                 rbuf_max => 64*1024,
1218                 timeout => $self->{timeout},
1219                 linger => 0, # avoid problems with ssh - really needed ?
1220                 on_eof   => sub {
1221                     my ($hdl) = @_;
1222                     eval {
1223                         $self->log_aborted_request($reqstate);
1224                         $self->client_do_disconnect($reqstate);
1225                     };
1226                     if (my $err = $@) { syslog('err', $err); }
1227                 },
1228                 on_error => sub {
1229                     my ($hdl, $fatal, $message) = @_;
1230                     eval {
1231                         $self->log_aborted_request($reqstate, $message);
1232                         $self->client_do_disconnect($reqstate);
1233                     };
1234                     if (my $err = $@) { syslog('err', "$err"); }
1235                 },
1236                 ($self->{tls_ctx} ? (tls => "accept", tls_ctx => $self->{tls_ctx}) : ()));
1237
1238             print "$$: ACCEPT FH" .  $clientfh->fileno() . " CONN$self->{conn_count}\n" if $self->{debug};
1239
1240             $self->push_request_header($reqstate);
1241         }
1242     };
1243
1244     if (my $err = $@) {
1245         syslog('err', $err);
1246         $self->{end_loop} = 1;
1247     }
1248
1249     $self->wait_end_loop() if $self->{end_loop};
1250 }
1251
1252 # Note: We can't open log file in non-blocking mode and use AnyEvent::Handle,
1253 # because we write from multiple processes, and that would arbitrarily mix output
1254 # of all processes.
1255 sub open_access_log {
1256     my ($self, $filename) = @_;
1257
1258     my $old_mask = umask(0137);;
1259     my $logfh = IO::File->new($filename, ">>") ||
1260         die "unable to open log file '$filename' - $!\n";
1261     umask($old_mask);
1262
1263     $logfh->autoflush(1);
1264
1265     $self->{logfh} = $logfh;
1266 }
1267
1268 sub write_log {
1269     my ($self, $data) = @_;
1270
1271     return if !defined($self->{logfh}) || !$data;
1272
1273     my $res = $self->{logfh}->print($data);
1274
1275     if (!$res) {
1276         delete $self->{logfh};
1277         syslog('err', "error writing access log");
1278         $self->{end_loop} = 1; # terminate asap
1279     }
1280 }
1281
1282 sub atfork_handler {
1283     my ($self) = @_;
1284
1285     eval {
1286         # something else do to ?
1287         close($self->{socket});
1288     };
1289     warn $@ if $@;
1290 }
1291
1292 sub new {
1293     my ($this, %args) = @_;
1294
1295     my $class = ref($this) || $this;
1296
1297     foreach my $req (qw(socket lockfh lockfile)) {
1298         die "misssing required argument '$req'" if !defined($args{$req});
1299     }
1300
1301     my $self = bless { %args }, $class;
1302
1303     # init inotify
1304     PVE::INotify::inotify_init();
1305
1306     $self->{rpcenv} = PVE::RPCEnvironment->init(
1307         $self->{trusted_env} ? 'priv' : 'pub', atfork =>  sub { $self-> atfork_handler() });
1308
1309     fh_nonblocking($self->{socket}, 1);
1310
1311     $self->{end_loop} = 0;
1312     $self->{conn_count} = 0;
1313     $self->{request_count} = 0;
1314     $self->{timeout} = 5 if !$self->{timeout};
1315     $self->{keep_alive} = 0 if !defined($self->{keep_alive});
1316     $self->{max_conn} = 800 if !$self->{max_conn};
1317     $self->{max_requests} = 8000 if !$self->{max_requests};
1318
1319     $self->{policy} = 'allow' if !$self->{policy};
1320
1321     $self->{end_cond} = AnyEvent->condvar;
1322
1323     if ($self->{ssl}) {
1324         $self->{tls_ctx} = AnyEvent::TLS->new(%{$self->{ssl}});
1325         Net::SSLeay::CTX_set_options($self->{tls_ctx}->{ctx}, &Net::SSLeay::OP_NO_COMPRESSION);
1326     }
1327
1328     if ($self->{spiceproxy}) {
1329         $known_methods = { CONNECT => 1 };
1330     }
1331
1332     $self->open_access_log($self->{logfile}) if $self->{logfile};
1333
1334     $self->{max_conn_soft_limit} = $self->{max_conn} > 100 ? $self->{max_conn} - 20 : $self->{max_conn};
1335
1336     $self->{socket_watch} = AnyEvent->io(fh => $self->{socket}, poll => 'r', cb => sub {
1337         eval {
1338             if ($self->{conn_count} >= $self->{max_conn}) {
1339                 my $w; $w = AnyEvent->timer (after => 1, interval => 1, cb => sub {
1340                     if ($self->{conn_count} < $self->{max_conn}) {
1341                         undef $w;
1342                         $self->accept_connections();
1343                     }
1344                 });
1345             } else {
1346                 $self->accept_connections();
1347             }
1348         };
1349         warn $@ if $@;
1350     });
1351
1352     $self->{term_watch} = AnyEvent->signal(signal => "TERM", cb => sub {
1353         undef $self->{term_watch};
1354         $self->wait_end_loop();
1355     });
1356
1357     $self->{quit_watch} = AnyEvent->signal(signal => "QUIT", cb => sub {
1358         undef $self->{quit_watch};
1359         $self->wait_end_loop();
1360     });
1361
1362     $self->{inotify_poll} = AnyEvent->timer(after => 5, interval => 5, cb => sub {
1363         PVE::INotify::poll(); # read inotify events
1364     });
1365
1366     return $self;
1367 }
1368
1369 sub run {
1370     my ($self) = @_;
1371
1372     $self->{end_cond}->recv;
1373 }
1374
1375 1;