Esercizio - Server HTTP con CGI (sul modello della prova pratica)

 client ---HTTP--->  server  --pipe stdin-->  programma CGI      (corpo della POST, CONTENT_LENGTH byte)
        <---HTTP---          <--pipe stdout--                    (header CGI + riga vuota + corpo)
                                 ambiente: meta-variabili

/* cgi_server.c - server HTTP che esegue programmi CGI (RFC 3875): GET e POST su /cgi-bin/NOME.
 *
 * Per ogni richiesta: fork + pipe + exec del programma, con le meta-variabili CGI nell'ambiente e il corpo
 * della POST sullo standard input; l'uscita del programma (header CGI, riga vuota, corpo) diventa la risposta HTTP.
 *
 * Compilare:  gcc -Wall -Wextra -o cgi_server cgi_server.c
 * Avviare:    ./cgi_server 8080 ./www       (i programmi stanno in ./www/cgi-bin, con il permesso di esecuzione)
 * Provare:    curl -i "http://127.0.0.1:8080/cgi-bin/hello.sh?nome=Mario"
 *             curl -i -d "a=3&b=4" http://127.0.0.1:8080/cgi-bin/somma         (POST)
 *             curl -i http://127.0.0.1:8080/cgi-bin/vai.sh                     (script che manda Location)
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <strings.h>
#include <ctype.h>
#include <errno.h>
#include <time.h>
#include <signal.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#define MAX_LINE 2048
#define MAX_BODY 60000            /* < 64 KiB (capienza di una pipe): scrivere il corpo non puo' bloccarsi */
#define MAX_OUTPUT (4 * 1024 * 1024)
#define CGI_TIMEOUT 10            /* secondi: poi il programma viene ucciso da SIGALRM */

static const char *root_dir;
static const char *port_str;

static int write_all(int fd, const char *buf, size_t n)
{
    while (n > 0) {
        ssize_t w = write(fd, buf, n);
        if (w < 0) {
            if (errno == EINTR)
                continue;
            return -1;
        }
        buf += w;
        n -= (size_t)w;
    }
    return 0;
}

/* ---------- lettore con buffer ---------- */
struct rbuf {
    int fd;
    char buf[4096];
    size_t pos, len;
};

static int rb_fill(struct rbuf *r)
{
    while (r->pos == r->len) {
        ssize_t k = read(r->fd, r->buf, sizeof r->buf);
        if (k < 0 && errno == EINTR)
            continue;
        if (k <= 0)
            return -1;
        r->pos = 0;
        r->len = (size_t)k;
    }
    return 0;
}

static int rb_line(struct rbuf *r, char *line, size_t max)
{
    size_t n = 0;
    for (;;) {
        if (rb_fill(r) < 0)
            return -1;
        char c = r->buf[r->pos++];
        if (c == '\n') {
            if (n > 0 && line[n - 1] == '\r')
                n--;
            line[n] = '\0';
            return (int)n;
        }
        if (n + 1 >= max)
            return -2;
        line[n++] = c;
    }
}

static int rb_readn(struct rbuf *r, char *dst, size_t n)   /* esattamente n byte */
{
    while (n > 0) {
        if (rb_fill(r) < 0)
            return -1;
        size_t take = r->len - r->pos < n ? r->len - r->pos : n;
        memcpy(dst, r->buf + r->pos, take);
        r->pos += take;
        dst += take;
        n -= take;
    }
    return 0;
}

/* ---------- ambiente del programma CGI ---------- */
static char envpool[16384];
static size_t envused;
static char *envp[96];
static int nenv;

static void add_env(const char *name, const char *value)
{
    size_t need = strlen(name) + strlen(value) + 2;
    if (nenv >= 95 || envused + need > sizeof envpool)
        return;                                    /* pieno: la variabile si perde (limite voluto) */
    char *dst = envpool + envused;
    snprintf(dst, need, "%s=%s", name, value);
    envp[nenv++] = dst;
    envused += need;
}

/* ---------- risposta del programma CGI ---------- */
struct cgi_resp {
    int status;
    char reason[64];
    char ctype[256];
    char extra[2048];                              /* altri header da inoltrare (Set-Cookie, Location...) */
    const char *body;
    size_t body_len;
};

static const char *reason_of(int code)
{
    switch (code) {
    case 200: return "OK";
    case 201: return "Created";
    case 204: return "No Content";
    case 302: return "Found";
    case 400: return "Bad Request";
    case 403: return "Forbidden";
    case 404: return "Not Found";
    case 405: return "Method Not Allowed";
    case 411: return "Length Required";
    case 413: return "Content Too Large";
    case 500: return "Internal Server Error";
    case 502: return "Bad Gateway";
    case 504: return "Gateway Timeout";
    default:  return "Status";
    }
}

/* Separa header e corpo dell'uscita del programma. Torna 0 se valida.
 * Header CGI: Content-Type, Status ("Status: 404 Not Found"), Location, altri. Riga vuota. Corpo. */
static int cgi_parse(const char *out, size_t len, struct cgi_resp *r)
{
    memset(r, 0, sizeof *r);
    r->status = 0;
    size_t pos = 0;
    int have_location = 0;
    for (;;) {
        const char *nl = memchr(out + pos, '\n', len - pos);
        if (nl == NULL)
            return -1;                             /* niente riga vuota: uscita malformata */
        size_t ll = (size_t)(nl - (out + pos));
        char line[1024];
        size_t cl = ll > 0 && out[pos + ll - 1] == '\r' ? ll - 1 : ll;   /* senza CR */
        if (cl >= sizeof line)
            return -1;
        memcpy(line, out + pos, cl);
        line[cl] = '\0';
        pos += ll + 1;
        if (cl == 0)
            break;                                 /* riga vuota: finiscono gli header */
        char *colon = strchr(line, ':');
        if (colon == NULL)
            return -1;
        *colon = '\0';
        const char *v = colon + 1;
        while (*v == ' ' || *v == '\t')
            v++;
        if (strcasecmp(line, "Status") == 0) {
            r->status = atoi(v);
            const char *sp = strchr(v, ' ');
            snprintf(r->reason, sizeof r->reason, "%s", sp ? sp + 1 : reason_of(r->status));
        } else if (strcasecmp(line, "Content-Type") == 0) {
            snprintf(r->ctype, sizeof r->ctype, "%s", v);
        } else {
            if (strcasecmp(line, "Location") == 0)
                have_location = 1;
            size_t used = strlen(r->extra);
            snprintf(r->extra + used, sizeof r->extra - used, "%s: %s\r\n", line, v);
        }
    }
    r->body = out + pos;
    r->body_len = len - pos;
    if (r->status == 0) {
        r->status = have_location ? 302 : 200;     /* default CGI: 200, o 302 se c'e' solo Location */
        snprintf(r->reason, sizeof r->reason, "%s", reason_of(r->status));
    }
    if (r->ctype[0] == '\0' && r->body_len > 0)
        return -1;                                 /* con un corpo il Content-Type e' obbligatorio */
    if (r->status < 100 || r->status > 599)
        return -1;
    return 0;
}

static void http_date(char *out, size_t size)
{
    time_t t = time(NULL);
    strftime(out, size, "%a, %d %b %Y %H:%M:%S GMT", gmtime(&t));
}

static void send_response(int fd, int status, const char *reason, const char *ctype, const char *extra,
                          const char *body, size_t blen, int head_only)
{
    char head[4096], date[64];
    http_date(date, sizeof date);
    int n = snprintf(head, sizeof head,
                     "HTTP/1.1 %d %s\r\nDate: %s\r\nServer: mini-cgi/1.0\r\n", status, reason, date);
    if (ctype && ctype[0])
        n += snprintf(head + n, sizeof head - (size_t)n, "Content-Type: %s\r\n", ctype);
    n += snprintf(head + n, sizeof head - (size_t)n, "%sContent-Length: %zu\r\nConnection: close\r\n\r\n", extra, blen);
    write_all(fd, head, (size_t)n);
    if (!head_only && blen > 0)
        write_all(fd, body, blen);
}

static void send_error(int fd, int status)
{
    char body[128];
    int n = snprintf(body, sizeof body, "%d %s\n", status, reason_of(status));
    send_response(fd, status, reason_of(status), "text/plain", "", body, (size_t)n, 0);
}

/* ---------- esecuzione del programma ---------- */

/* Esegue script con l'ambiente envp e 'input' sullo stdin; raccoglie l'uscita in *out (malloc). Torna 0 se ok,
 * -1 errore di sistema, -2 uscita troppo lunga, -3 il programma e' fallito (codice diverso da 0 o ucciso). */
static int run_cgi(const char *script, const char *dir, const char *input, size_t ilen, char **out, size_t *olen)
{
    int inp[2], outp[2];
    if (pipe(inp) < 0)
        return -1;
    if (pipe(outp) < 0) {
        close(inp[0]);
        close(inp[1]);
        return -1;
    }
    const char *name = strrchr(script, '/') + 1;
    char local[256];
    snprintf(local, sizeof local, "./%s", name);   /* dopo chdir(dir) il programma sta in "./nome" */
    pid_t pid = fork();
    if (pid < 0) {
        close(inp[0]); close(inp[1]); close(outp[0]); close(outp[1]);
        return -1;
    }
    if (pid == 0) {
        /* FIGLIO: stdin <- pipe in, stdout -> pipe out. stderr resta quello del server (log). */
        dup2(inp[0], STDIN_FILENO);
        dup2(outp[1], STDOUT_FILENO);
        for (int fd = 3; fd < 256; fd++)           /* chiude pipe, socket di ascolto e socket del client ereditati */
            close(fd);
        signal(SIGPIPE, SIG_DFL);                  /* "ignorato" resta tale dopo exec: il programma riavra' il default */
        if (chdir(dir) < 0)
            _exit(126);
        alarm(CGI_TIMEOUT);                        /* il timer sopravvive a exec: un programma bloccato viene ucciso */
        execle(local, name, (char *)NULL, envp);
        _exit(127);                                /* exec fallita */
    }
    /* PADRE: chiude le estremita' che non usa, altrimenti non vedrebbe mai EOF. */
    close(inp[0]);
    close(outp[1]);
    if (ilen > 0)
        write_all(inp[1], input, ilen);            /* corpo della POST: sta tutto nella pipe (limite MAX_BODY) */
    close(inp[1]);                                 /* il programma vede EOF su stdin */

    size_t cap = 8192, len = 0;
    char *buf = malloc(cap);
    int rc = 0;
    for (;;) {
        if (len == cap) {
            if (cap >= MAX_OUTPUT) {
                rc = -2;
                break;
            }
            cap *= 2;
            char *nb = realloc(buf, cap);
            if (nb == NULL) {
                rc = -1;
                break;
            }
            buf = nb;
        }
        ssize_t r = read(outp[0], buf + len, cap - len);
        if (r < 0 && errno == EINTR)
            continue;
        if (r <= 0)
            break;                                 /* EOF: il programma ha chiuso stdout (di solito, e' terminato) */
        len += (size_t)r;
    }
    close(outp[0]);
    int status = 0;
    waitpid(pid, &status, 0);                      /* raccoglie il figlio: niente zombie */
    if (rc == 0 && (!WIFEXITED(status) || WEXITSTATUS(status) != 0))
        rc = -3;
    if (rc != 0 && rc != -3) {
        free(buf);
        return rc;
    }
    *out = buf;
    *olen = len;
    return rc;
}

static int name_ok(const char *s)                  /* solo lettere, cifre, '_', '-', '.'; non inizia con '.' */
{
    if (*s == '\0' || *s == '.')
        return 0;
    for (; *s; s++)
        if (!isalnum((unsigned char)*s) && *s != '_' && *s != '-' && *s != '.')
            return 0;
    return 1;
}

/* PATH_INFO, a differenza di QUERY_STRING, arriva al programma DECODIFICATO (RFC 3875 par. 4.1.5): "%20" -> ' '.
 * Torna -1 se una sequenza e' rotta o se contiene un byte nullo o una '/' codificata (%2F): perderebbe informazione. */
static int pct_decode(const char *src, char *dst, size_t size)
{
    size_t n = 0;
    for (; *src; src++) {
        int c = (unsigned char)*src;
        if (c == '%') {
            if (!isxdigit((unsigned char)src[1]) || !isxdigit((unsigned char)src[2]))
                return -1;
            char hex[3] = {src[1], src[2], '\0'};
            c = (int)strtol(hex, NULL, 16);
            src += 2;
            if (c == 0 || c == '/')
                return -1;
        }
        if (n + 1 >= size)
            return -1;
        dst[n++] = (char)c;
    }
    dst[n] = '\0';
    return 0;
}

static void handle(int fd, const char *peer)
{
    struct rbuf in = {.fd = fd};
    char line[MAX_LINE], method[16], target[MAX_LINE], ver[16];

    int len = rb_line(&in, line, sizeof line);
    if (len < 0 || sscanf(line, "%15s %2047s %15s", method, target, ver) != 3 || strncmp(ver, "HTTP/1.", 7) != 0) {
        send_error(fd, 400);
        return;
    }

    /* header: il resto diventa HTTP_* nell'ambiente */
    nenv = 0;
    envused = 0;
    long clen = -1;
    char ctype[256] = "", host[256] = "localhost";
    int nh = 0, chunked = 0;
    char hdrs[32][2][512];                         /* header ricevuti, per costruire HTTP_* dopo */
    int nhdr = 0;
    for (;;) {
        len = rb_line(&in, line, sizeof line);
        if (len < 0 || ++nh > 100) {
            send_error(fd, 400);
            return;
        }
        if (len == 0)
            break;
        char *colon = strchr(line, ':');
        if (colon == NULL) {
            send_error(fd, 400);
            return;
        }
        *colon = '\0';
        const char *v = colon + 1;
        while (*v == ' ' || *v == '\t')
            v++;
        if (strcasecmp(line, "Content-Length") == 0)
            clen = atol(v);
        else if (strcasecmp(line, "Content-Type") == 0)
            snprintf(ctype, sizeof ctype, "%s", v);
        else if (strcasecmp(line, "Host") == 0)
            snprintf(host, sizeof host, "%s", v);
        else if (strcasecmp(line, "Transfer-Encoding") == 0)
            chunked = 1;
        if (nhdr < 32) {
            snprintf(hdrs[nhdr][0], sizeof hdrs[0][0], "%s", line);
            snprintf(hdrs[nhdr][1], sizeof hdrs[0][1], "%s", v);
            nhdr++;
        }
    }

    int is_post = strcmp(method, "POST") == 0;
    int head_only = strcmp(method, "HEAD") == 0;
    if (!is_post && strcmp(method, "GET") != 0 && !head_only) {
        send_error(fd, 405);
        return;
    }
    if (chunked || (is_post && clen < 0)) {
        send_error(fd, 411);                       /* un corpo CGI ha bisogno di CONTENT_LENGTH */
        return;
    }
    if (clen > MAX_BODY) {
        send_error(fd, 413);
        return;
    }

    /* target = /cgi-bin/NOME[/PATH_INFO][?QUERY] */
    char *query = strchr(target, '?');
    if (query)
        *query++ = '\0';
    if (strncmp(target, "/cgi-bin/", 9) != 0) {
        send_error(fd, 404);
        return;
    }
    char name[128];
    const char *after = target + 9;
    size_t nl = strcspn(after, "/");
    if (nl == 0 || nl >= sizeof name) {
        send_error(fd, 404);
        return;
    }
    memcpy(name, after, nl);
    name[nl] = '\0';
    char path_info[MAX_LINE];                      /* "" oppure "/resto", decodificato */
    if (!name_ok(name)) {
        send_error(fd, 404);
        return;
    }
    if (pct_decode(after + nl, path_info, sizeof path_info) < 0) {
        send_error(fd, 400);
        return;
    }
    char dir[MAX_LINE], script[MAX_LINE];
    snprintf(dir, sizeof dir, "%s/cgi-bin", root_dir);
    snprintf(script, sizeof script, "%s/%s", dir, name);
    struct stat st;
    if (stat(script, &st) < 0 || !S_ISREG(st.st_mode)) {
        send_error(fd, 404);
        return;
    }
    if (access(script, X_OK) < 0) {
        send_error(fd, 403);
        return;
    }

    /* corpo della POST */
    char *body = NULL;
    if (clen > 0) {
        body = malloc((size_t)clen);
        if (body == NULL || rb_readn(&in, body, (size_t)clen) < 0) {
            free(body);
            send_error(fd, 400);
            return;
        }
    }

    /* meta-variabili (RFC 3875 par. 4.1) */
    char tmp[32];
    add_env("GATEWAY_INTERFACE", "CGI/1.1");
    add_env("SERVER_SOFTWARE", "mini-cgi/1.0");
    add_env("SERVER_PROTOCOL", ver);
    char *hc = (host[0] == '[') ? strchr(host, ']') : strrchr(host, ':');   /* SERVER_NAME e' il nome senza ":porta" */
    if (hc != NULL) {
        if (host[0] == '[')
            hc[1] = '\0';
        else
            *hc = '\0';
    }
    add_env("SERVER_NAME", host);
    add_env("SERVER_PORT", port_str);
    add_env("REQUEST_METHOD", method);
    char sname[160];
    snprintf(sname, sizeof sname, "/cgi-bin/%s", name);
    add_env("SCRIPT_NAME", sname);
    add_env("PATH_INFO", path_info);
    add_env("QUERY_STRING", query ? query : "");   /* grezza: la decodifica %XX spetta al programma */
    add_env("REMOTE_ADDR", peer);
    if (clen >= 0) {
        snprintf(tmp, sizeof tmp, "%ld", clen);
        add_env("CONTENT_LENGTH", tmp);
    }
    if (ctype[0])
        add_env("CONTENT_TYPE", ctype);
    for (int i = 0; i < nhdr; i++) {               /* gli altri header -> HTTP_NOME */
        const char *h = hdrs[i][0];
        if (!strcasecmp(h, "Content-Length") || !strcasecmp(h, "Content-Type") || !strcasecmp(h, "Host") ||
            !strcasecmp(h, "Authorization") ||     /* le credenziali non si passano ai programmi */
            !strcasecmp(h, "Proxy"))               /* "Proxy" -> HTTP_PROXY ingannerebbe le librerie HTTP (httpoxy) */
            continue;
        char vname[600] = "HTTP_";
        size_t k = 5;
        for (const char *c = h; *c && k < sizeof vname - 1; c++)
            vname[k++] = *c == '-' ? '_' : (char)toupper((unsigned char)*c);
        vname[k] = '\0';
        add_env(vname, hdrs[i][1]);
    }
    envp[nenv] = NULL;

    char *out = NULL;
    size_t olen = 0;
    int rc = run_cgi(script, dir, body, clen > 0 ? (size_t)clen : 0, &out, &olen);
    free(body);
    if (rc == -2 || rc == -1) {
        send_error(fd, 502);
        return;
    }
    struct cgi_resp cr;
    if (rc == -3 && olen == 0) {
        free(out);
        send_error(fd, 502);                       /* il programma e' fallito senza produrre nulla */
        return;
    }
    if (cgi_parse(out, olen, &cr) < 0) {
        fprintf(stderr, "%s: uscita CGI non valida da %s\n", peer, name);
        free(out);
        send_error(fd, 502);                       /* risposta incomprensibile dal programma: Bad Gateway */
        return;
    }
    send_response(fd, cr.status, cr.reason, cr.ctype, cr.extra, cr.body, cr.body_len, head_only);
    fprintf(stderr, "%s \"%s %s\" -> %d (CGI %s)\n", peer, method, target, cr.status, name);
    free(out);
}

int main(int argc, char **argv)
{
    if (argc != 3) {
        fprintf(stderr, "uso: %s porta radice\n", argv[0]);
        return 1;
    }
    port_str = argv[1];
    root_dir = argv[2];
    signal(SIGPIPE, SIG_IGN);

    int lfd = socket(AF_INET, SOCK_STREAM, 0);
    if (lfd < 0) {
        perror("socket");
        return 1;
    }
    int yes = 1;
    setsockopt(lfd, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof yes);
    struct sockaddr_in addr;
    memset(&addr, 0, sizeof addr);
    addr.sin_family = AF_INET;
    addr.sin_addr.s_addr = htonl(INADDR_ANY);
    addr.sin_port = htons((unsigned short)atoi(port_str));
    if (bind(lfd, (struct sockaddr *)&addr, sizeof addr) < 0 || listen(lfd, 16) < 0) {
        perror("bind/listen");
        return 1;
    }
    for (;;) {
        struct sockaddr_in cli;
        socklen_t clen = sizeof cli;
        int cfd = accept(lfd, (struct sockaddr *)&cli, &clen);
        if (cfd < 0) {
            if (errno == EINTR)
                continue;
            perror("accept");
            break;
        }
        char peer[INET_ADDRSTRLEN];
        inet_ntop(AF_INET, &cli.sin_addr, peer, sizeof peer);
        handle(cfd, peer);                         /* iterativo: il CGI gira in un figlio, il server aspetta */
        close(cfd);
    }
    return 0;
}

#!/bin/sh
# hello.sh - programma CGI in shell: mostra alcune meta-variabili (copiarlo in www/cgi-bin/ e chmod +x)
echo "Content-Type: text/plain; charset=utf-8"
echo ""
echo "Ciao dal CGI!"
echo "REQUEST_METHOD  = $REQUEST_METHOD"
echo "QUERY_STRING    = $QUERY_STRING"
echo "SCRIPT_NAME     = $SCRIPT_NAME"
echo "PATH_INFO       = $PATH_INFO"
echo "SERVER_PROTOCOL = $SERVER_PROTOCOL"
echo "REMOTE_ADDR     = $REMOTE_ADDR"
echo "HTTP_USER_AGENT = $HTTP_USER_AGENT"

/* somma.c - programma CGI: somma i parametri a e b, passati con GET (QUERY_STRING) o POST (stdin).
 * Compilare:  gcc -Wall -Wextra -o somma somma.c   e copiare l'eseguibile in www/cgi-bin/
 * Provare:    curl "http://127.0.0.1:8080/cgi-bin/somma?a=3&b=4"      curl -d "a=3&b=4" http://127.0.0.1:8080/cgi-bin/somma
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

/* Cerca "nome=" in una stringa del tipo "a=3&b=4" e torna il valore intero (0 se manca). */
static long param(const char *qs, const char *name)
{
    size_t k = strlen(name);
    for (const char *p = qs; p != NULL && *p; ) {
        if (strncmp(p, name, k) == 0 && p[k] == '=')
            return strtol(p + k + 1, NULL, 10);
        p = strchr(p, '&');                        /* salta al parametro successivo */
        if (p != NULL)
            p++;
    }
    return 0;
}

int main(void)
{
    const char *method = getenv("REQUEST_METHOD");
    char data[1024] = "";

    if (method != NULL && strcmp(method, "POST") == 0) {
        /* POST: i dati stanno sullo stdin; CONTENT_LENGTH dice quanti byte leggere (non c'e' EOF garantito). */
        const char *cl = getenv("CONTENT_LENGTH");
        size_t n = cl ? (size_t)atol(cl) : 0;
        if (n >= sizeof data)
            n = sizeof data - 1;
        size_t got = fread(data, 1, n, stdin);
        data[got] = '\0';
    } else {
        const char *qs = getenv("QUERY_STRING");   /* GET: i dati stanno nell'ambiente */
        snprintf(data, sizeof data, "%s", qs ? qs : "");
    }

    long a = param(data, "a"), b = param(data, "b");

    /* Uscita CGI: header, RIGA VUOTA, corpo. Il server aggiunge Content-Length, Date ecc. */
    printf("Content-Type: text/plain; charset=utf-8\r\n");
    printf("\r\n");
    printf("%ld + %ld = %ld\n", a, b, a + b);
    return 0;
}

#!/bin/sh
# vai.sh - programma CGI che reindirizza il client: con solo Location (URI assoluto) il server risponde 302 Found
# (RFC 3875 par. 6.2.3). L'URI assoluto si costruisce con le meta-variabili SERVER_NAME e SERVER_PORT.
echo "Location: http://$SERVER_NAME:$SERVER_PORT/cgi-bin/hello.sh?da=vai"
echo ""

$ mkdir -p www/cgi-bin
$ cp hello.sh vai.sh www/cgi-bin/ && chmod +x www/cgi-bin/hello.sh www/cgi-bin/vai.sh
$ gcc -Wall -Wextra -o www/cgi-bin/somma somma.c
$ gcc -Wall -Wextra -o cgi_server cgi_server.c
$ ./cgi_server 8080 ./www &

$ curl -i "http://127.0.0.1:8080/cgi-bin/hello.sh?nome=Mario"
HTTP/1.1 200 OK
Date: Sun, 11 Oct 2026 21:00:00 GMT
Server: mini-cgi/1.0
Content-Type: text/plain; charset=utf-8
Content-Length: 204
Connection: close

Ciao dal CGI!
REQUEST_METHOD  = GET
QUERY_STRING    = nome=Mario
SCRIPT_NAME     = /cgi-bin/hello.sh
PATH_INFO       =
SERVER_PROTOCOL = HTTP/1.1
REMOTE_ADDR     = 127.0.0.1
HTTP_USER_AGENT = curl/8.5.0

$ curl "http://127.0.0.1:8080/cgi-bin/somma?a=3&b=4"           # GET: dati in QUERY_STRING
3 + 4 = 7
$ curl -i -d "a=30&b=12" http://127.0.0.1:8080/cgi-bin/somma    # POST: dati su stdin
HTTP/1.1 200 OK ...
30 + 12 = 42
$ curl -i http://127.0.0.1:8080/cgi-bin/vai.sh                  # solo Location: il server risponde 302
HTTP/1.1 302 Found
Location: http://127.0.0.1:8080/cgi-bin/hello.sh?da=vai
Content-Length: 0
$ curl -i http://127.0.0.1:8080/cgi-bin/nonesiste               # 404
$ curl -i "http://127.0.0.1:8080/cgi-bin/hello.sh/extra%20path"    # PATH_INFO = /extra path (decodificato)

$ printf '#!/bin/sh\nexit 3\n' > www/cgi-bin/fallisce.sh && chmod +x www/cgi-bin/fallisce.sh
$ curl -i http://127.0.0.1:8080/cgi-bin/fallisce.sh             # nessuna uscita e codice 3: 502 Bad Gateway
$ printf '#!/bin/sh\nsleep 30\n' > www/cgi-bin/lento.sh && chmod +x www/cgi-bin/lento.sh
$ time curl -i http://127.0.0.1:8080/cgi-bin/lento.sh          # dopo 10 s SIGALRM uccide il programma: 502
$ printf '#!/bin/sh\necho "senza header"\n' > www/cgi-bin/rotto.sh && chmod +x www/cgi-bin/rotto.sh
$ curl -i http://127.0.0.1:8080/cgi-bin/rotto.sh                # uscita senza riga vuota/Content-Type: 502
$ chmod -x www/cgi-bin/hello.sh; curl -i http://127.0.0.1:8080/cgi-bin/hello.sh   # 403
$ curl -i "http://127.0.0.1:8080/cgi-bin/%2e%2e/x"              # 404 (il nome contiene '%')
$ printf 'POST /cgi-bin/somma HTTP/1.1\r\nHost: x\r\n\r\n' | nc 127.0.0.1 8080 | head -1    # POST senza Content-Length: 411 Length Required

 padre:  pipe(inp); pipe(outp); fork ─────────────► figlio: dup2(inp[0],0); dup2(outp[1],1);
                                                           close(3..255); signal(SIGPIPE,SIG_DFL);
                                                           chdir(cgi-bin); alarm(10); execle("./nome", ...)
         close(inp[0]); close(outp[1]);
         write(inp[1], corpo); close(inp[1]);       ← il programma vede EOF su stdin
         read(outp[0]) fino a EOF; waitpid