paivana

paivana-httpd_daemon.c (26248B)

---

 /*
      This file is part of GNUnet.
      Copyright (C) 2026 Taler Systems SA
 
      Paivana is free software; you can redistribute it and/or
      modify it under the terms of the GNU Affero General Public License
      as published by the Free Software Foundation; either version
      3, or (at your option) any later version.
 
      Paivana is distributed in the hope that it will be useful,
      but WITHOUT ANY WARRANTY; without even the implied warranty
      of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
      the GNU Affero General Public License for more details.
 
      You should have received a copy of the GNU Affero General Public
      License along with Paivana; see the file COPYING.  If not,
      write to the Free Software Foundation, Inc., 51 Franklin
      Street, Fifth Floor, Boston, MA 02110-1301, USA.
 */
 
 /**
  * @author Christian Grothoff
  * @file paivana-httpd_daemon.c
  * @brief daemon functions
  */
 
 #include "platform.h"
 #include <curl/curl.h>
 #include <gnunet/gnunet_util_lib.h>
 #include <gnunet/gnunet_curl_lib.h>
 #include <taler/taler_mhd_lib.h>
 #include "paivana-httpd_cookie.h"
 #include "paivana-httpd_daemon.h"
 #include "paivana-httpd_helper.h"
 #include "paivana-httpd_pay.h"
 #include "paivana-httpd_reverse.h"
 #include "paivana-httpd_templates.h"
 
 
 struct RequestContext
 {
 
   /**
    * HTTP connection to the client.
    */
   struct MHD_Connection *connection;
 
   /**
    * Handle for request forwarding as reverse proxy.
    */
   struct HttpRequest *hr;
 
   /**
    * Handle for processing actual payment.
    */
   struct PayRequest *hp;
 
   /**
    * Full request URL.
    */
   char *url;
 
   /**
    * True if this is a POST to the .well-known/paivana endpoint.
    */
   bool is_paivana;
 
   /**
    * We are past the paywall, forward to client.
    */
   bool do_forward;
 
   /**
    * Admission class charged to this request.  Classification waits until the
    * access handler has both the decoded path and method; the URI callback
    * alone cannot distinguish a payment POST from a GET to the same path.
    */
   enum
   {
     AC_UNDECIDED,
     AC_ORDINARY,
     AC_PAYMENT,
     AC_REJECTED
   } admission_class;
 };
 
 
 /**
  * How many seconds MHD lets a client connection sit idle before it
  * closes it.
  *
  * This is *not* a per-request ceiling: MHD takes a suspended
  * connection off its timeout lists, and every request that waits for
  * the upstream or the merchant backend is suspended for exactly that
  * time.  What it bounds is the phases MHD itself owns -- reading the
  * request line and headers, reading an upload, writing the response --
  * which is what keeps a client that opens a connection and says
  * nothing from holding one of the #PH_connection_limit slots.  The
  * time a request may spend waiting is bounded by the libcurl timeouts
  * in paivana-httpd_reverse.c instead.
  */
 #define CLIENT_CONNECTION_TIMEOUT 16
 
 
 /**
  * Set to true if we started a daemon.
  */
 static bool have_daemons;
 
 /**
  * MHD daemons retained so shutdown can quiesce only their listen sockets
  * while the Taler scheduler adapter continues driving accepted requests.
  */
 static struct MHD_Daemon **mhd_daemons;
 
 /**
  * Length of #mhd_daemons.
  */
 static unsigned int mhd_daemons_length;
 
 /**
  * Number of requests whose URI callback has run and whose completion
  * callback has not.  This is the drain condition; half-written request lines
  * are connections rather than requests and are closed at final cleanup.
  */
 static unsigned int active_requests;
 
 /**
  * Ordinary requests admitted against the non-payment part of the connection
  * budget.
  */
 static unsigned int ordinary_requests;
 
 /**
  * Payment redemption requests admitted against the reserved part of the
  * connection budget.
  */
 static unsigned int payment_requests;
 
 /**
  * True after listeners have been quiesced for graceful shutdown.
  */
 static bool draining;
 
 
 /**
  * Queue a controlled-overload response and force the connection closed.
  *
  * Payment callers receive the machine-readable Taler error used for local
  * resource exhaustion.  Other requests receive a small static HTML body so
  * overload itself does not allocate or render a template.  `Retry-After: 1'
  * discourages a hot retry loop without claiming a longer outage.
  *
  * @param connection client connection
  * @param payment true for the payment endpoint
  * @return MHD result
  */
 static enum MHD_Result
 reply_overloaded (struct MHD_Connection *connection,
                   bool payment)
 {
   static const char body[] =
     "<!doctype html><title>Service unavailable</title>"
     "<p>Paivana is temporarily at capacity. Please retry.</p>";
   struct MHD_Response *response;
   enum MHD_Result ret;
 
   if (payment)
     response = TALER_MHD_make_error (
       TALER_EC_GENERIC_OS_RESOURCE_ALLOCATION_FAILURE,
       "Paivana payment-check capacity is exhausted");
   else
     response = MHD_create_response_from_buffer_static (sizeof (body) - 1,
                                                        body);
   if (NULL == response)
     return MHD_NO;
   if ( (! payment) &&
        (MHD_YES !=
         MHD_add_response_header (response,
                                  MHD_HTTP_HEADER_CONTENT_TYPE,
                                  "text/html; charset=utf-8")) )
     goto fail;
   if ( (MHD_YES !=
         MHD_add_response_header (response,
                                  MHD_HTTP_HEADER_CONNECTION,
                                  "close")) ||
        (MHD_YES !=
         MHD_add_response_header (response,
                                  MHD_HTTP_HEADER_RETRY_AFTER,
                                  "1")) )
     goto fail;
   ret = MHD_queue_response (connection,
                             MHD_HTTP_SERVICE_UNAVAILABLE,
                             response);
   MHD_destroy_response (response);
   return ret;
 fail:
   MHD_destroy_response (response);
   return MHD_NO;
 }
 
 
 /**
  * Decide whether a request may consume one of the process-wide slots.
  *
  * MHD's connection limit remains the hard transport ceiling.  This second
  * request-level gate stops ordinary requests at CONNECTION_LIMIT minus
  * PAYMENT_CONNECTION_LIMIT, leaving the remainder available for payment
  * POSTs.  It cannot reserve against clients that connect but never finish a
  * request line; CLIENT_CONNECTION_TIMEOUT bounds that separate slowloris
  * case.
  *
  * @param rc request context
  * @param payment whether this is a payment POST
  * @return true if admitted
  */
 static bool
 admit_request (struct RequestContext *rc,
                bool payment)
 {
   GNUNET_assert (AC_UNDECIDED == rc->admission_class);
   if (draining)
   {
     rc->admission_class = AC_REJECTED;
     return false;
   }
   if (payment)
   {
     if (payment_requests >= PH_payment_connection_limit)
     {
       rc->admission_class = AC_REJECTED;
       return false;
     }
     payment_requests++;
     rc->admission_class = AC_PAYMENT;
     return true;
   }
   if (ordinary_requests >=
       PH_connection_limit - PH_payment_connection_limit)
   {
     rc->admission_class = AC_REJECTED;
     return false;
   }
   ordinary_requests++;
   rc->admission_class = AC_ORDINARY;
   return true;
 }
 
 
 /**
  * Is the request target something we may decide about and then forward
  * unchanged?
  *
  * Two strings describe one request here, and they are not the same:
  * @a raw is the target exactly as it arrived on the request line --
  * that is what we hand to libcurl -- while @a url is MHD's
  * percent-decoded, query-stripped path, and that is what the WHITELIST
  * expression and the templates' expressions are matched against.
  * Neither is normalized, but libcurl normalizes the URL we give it
  * (CURLOPT_PATH_AS_IS is not set), so "/assets/../premium/x" matches a
  * WHITELIST of "/assets/.*" and is then fetched as "/premium/x".
  * Rather than decide about one resource and fetch another, refuse
  * anything not already in normal form; browsers normalize before
  * sending, so only hand-built requests are affected.
  *
  * Non-origin-form targets are refused for a second reason: such a
  * target -- an absolute-form one, or merely one starting with "@" --
  * is concatenated onto DESTINATION_BASE_URL, where it can re-parse as
  * userinfo (RFC 3986 section 3.2.1) and let the client choose the host
  * we connect to.
  *
  * @param raw request target as it arrived on the request line
  * @param url percent-decoded path MHD gives the handler
  * @return true if the request may proceed
  */
 static bool
 canonical_request_target (const char *raw,
                           const char *url)
 {
   const char *p;
 
   if ( ('/' != raw[0]) ||
        ('/' != url[0]) )
     return false; /* not origin-form; RFC 9112 section 3.2.1 */
   /* Reject ".", ".." and empty segments: RFC 3986 section 5.2.4's
      remove_dot_segments is exactly what libcurl would apply behind our
      back, after we have already decided. */
   for (p = url; NULL != p; p = strchr (p + 1, '/'))
   {
     const char *seg = p + 1;
     const char *end = strchr (seg, '/');
     size_t len = (NULL == end) ? strlen (seg) : (size_t) (end - seg);
 
     if (0 == len)
       return ('\0' == *seg); /* a trailing '/' is fine, "//" is not */
     if ( ( (1 == len) &&
            ('.' == seg[0]) ) ||
          ( (2 == len) &&
            ('.' == seg[0]) &&
            ('.' == seg[1]) ) )
       return false;
   }
   return true;
 }
 
 
 /**
  * Main MHD callback for handling requests.
  *
  * @param cls unused
  * @param con MHD connection handle
  * @param url the url in the request
  * @param meth the HTTP method used ("GET", "PUT", etc.)
  * @param ver the HTTP version string (i.e. "HTTP/1.1")
  * @param upload_data the data being uploaded (excluding HEADERS,
  *        for a POST that fits into memory and that is encoded
  *        with a supported encoding, the POST data will NOT be
  *        given in upload_data and is instead available as
  *        part of MHD_get_connection_values; very large POST
  *        data *will* be made available incrementally in
  *        upload_data)
  * @param upload_data_size set initially to the size of the
  *        @a upload_data provided; the method must update this
  *        value to the number of bytes NOT processed;
  * @param con_cls pointer to the `struct RequestContext` that
  *        mhd_log_callback() made for this request
  * @return #MHD_YES if the connection was handled successfully,
  *         #MHD_NO if the socket must be closed due to a serious
  *         error while handling the request
  */
 static enum MHD_Result
 create_response (void *cls,
                  struct MHD_Connection *con,
                  const char *url,
                  const char *meth,
                  const char *ver,
                  const char *upload_data,
                  size_t *upload_data_size,
                  void **con_cls)
 {
   struct RequestContext *rc = *con_cls;
   const char *cookie;
   bool ok = false;
   struct GNUNET_Buffer buf;
   char *website;
   const bool payment
     = ( (0 == strcmp (url,
                       "/.well-known/paivana")) &&
         (0 == strcasecmp (meth,
                           MHD_HTTP_METHOD_POST)) );
 
   (void) cls;
   memset (&buf,
           0,
           sizeof (buf));
   if (AC_UNDECIDED == rc->admission_class)
     (void) admit_request (rc,
                           payment);
   if (AC_REJECTED == rc->admission_class)
     return reply_overloaded (con,
                              payment);
   if (! canonical_request_target (rc->url,
                                   url))
   {
     GNUNET_break_op (0);
     return TALER_MHD_reply_with_error (
       rc->connection,
       MHD_HTTP_BAD_REQUEST,
       TALER_EC_GENERIC_PARAMETER_MALFORMED,
       "request-target must be in origin-form and free of '.', '..'"
       " and empty path segments");
   }
   if ( (! rc->is_paivana) &&
        payment )
   {
     rc->is_paivana = true;
   }
   if (rc->is_paivana)
   {
     if (PH_no_check)
     {
       /* paywall disabled, 501 */
       GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                   "Paywall disabled, refusing to respond to %s\n",
                   url);
       return TALER_MHD_reply_with_error (rc->connection,
                                          MHD_HTTP_NOT_IMPLEMENTED,
                                          TALER_EC_PAIVANA_PAYWALL_DISABLED,
                                          NULL);
     }
     if (NULL == rc->hp)
     {
       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                   "Client POSTed payment, checking validity\n");
       rc->hp = PAIVANA_HTTPD_payment_create (rc->connection);
     }
     return PAIVANA_HTTPD_payment_handle (rc->hp,
                                          upload_data,
                                          upload_data_size);
   }
 
   if ( (! rc->do_forward) &&
        (PH_MAX_URL_LENGTH < strlen (url)) )
   {
     /* Refuse before either regexec() -- the whitelist just below and
        the templates' expressions further down both run on the
        pre-payment path with a client-controlled subject.  Refusing
        outright (rather than skipping the whitelist) also keeps this
        from being read as "not whitelisted, so charge for it": there
        is nothing to charge for at this length.  Requests already
        destined to be forwarded reach no expression at all, and are
        left alone -- notably every request under -n, where paivana is
        a plain reverse proxy. */
     GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                 "Refusing %llu byte URL\n",
                 (unsigned long long) strlen (url));
     return TALER_MHD_reply_with_error (rc->connection,
                                        MHD_HTTP_URI_TOO_LONG,
                                        TALER_EC_GENERIC_URI_TOO_LONG,
                                        NULL);
   }
 
   if (PH_have_whitelist_ex && (! rc->do_forward))
   {
     rc->do_forward = (0 ==
                       regexec (&PH_whitelist_ex,
                                url,
                                0,
                                NULL,
                                0));
   }
 
   if (rc->do_forward)
     goto do_forward;
 
   if ( (0 == strncmp (url,
                       "/.well-known/paivana/templates/",
                       strlen ("/.well-known/paivana/templates/"))) &&
        ( (0 == strcasecmp (meth,
                            MHD_HTTP_METHOD_GET)) ||
          /* HEAD must be answered like GET (MHD suppresses the body);
             otherwise it falls through to the paywall check below,
             which redirects to this very URL again -- forever. */
          (0 == strcasecmp (meth,
                            MHD_HTTP_METHOD_HEAD)) ) )
   {
     const char *id = &url[strlen ("/.well-known/paivana/templates/")];
 
     return PAIVANA_HTTPD_return_template (rc->connection,
                                           id);
   }
 
   if (! PAIVANA_HTTPD_get_base_url (con,
                                     &buf))
   {
     GNUNET_break (0);
     GNUNET_buffer_clear (&buf);
     return TALER_MHD_reply_with_error (
       con,
       MHD_HTTP_BAD_REQUEST,
       TALER_EC_GENERIC_HTTP_HEADERS_MALFORMED,
       "Host or X-Forwarded-Host required");
   }
   GNUNET_buffer_write_str (&buf,
                            url);
   website = GNUNET_buffer_reap_str (&buf);
   cookie = MHD_lookup_connection_value (con,
                                         MHD_COOKIE_KIND,
                                         PAIVANA_COOKIE_NAME);
   if (NULL != cookie)
   {
     void *ca = NULL;
     size_t ca_len = 0;
 
     /* If we cannot get the client address, we just
        use 0/NULL and log an error. */
     GNUNET_break (PAIVANA_HTTPD_get_client_address (con,
                                                     &ca,
                                                     &ca_len));
     ok = PAIVANA_HTTPD_check_cookie (cookie,
                                      website,
                                      ca_len,
                                      ca);
     /* The cookie value itself is deliberately not logged: it is the
        bearer credential the client paid for, it outlives its own
        Max-Age in the log file, and anyone sharing the client's address
        -- everyone behind one NAT -- could replay it. */
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Client sent an access cookie for %s: %s\n",
                 website,
                 ok ? "good" : "invalid");
     GNUNET_free (ca);
   }
   if (! ok)
   {
     enum GNUNET_GenericReturnValue ret;
 
     ret = PAIVANA_HTTPD_search_templates (con,
                                           website);
     if (GNUNET_SYSERR != ret)
     {
       GNUNET_free (website);
       /* #GNUNET_OK only says a response was queued; besides the
          redirect to the paywall that may be a 414 or a 400. */
       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                   "A paywall applies, response queued: %s\n",
                   (GNUNET_OK == ret) ? "ok" : "failed");
       return (GNUNET_OK == ret) ? MHD_YES : MHD_NO;
     }
   }
   GNUNET_free (website);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Request OK, no paywall applies!\n");
   rc->do_forward = true;
 do_forward:
   if (NULL == rc->hr)
     rc->hr = PAIVANA_HTTPD_reverse_create (rc->connection,
                                            rc->url);
   return PAIVANA_HTTPD_reverse (rc->hr,
                                 con,
                                 url,
                                 meth,
                                 ver,
                                 upload_data,
                                 upload_data_size);
 }
 
 
 /**
  * Function called when MHD decides that we
  * are done with a request.
  *
  * @param cls NULL
  * @param connection connection handle
  * @param con_cls value as set by the last call to
  *        the MHD_AccessHandlerCallback, should be
  *        our `struct RequestContext *` (created in `mhd_log_callback()`)
  * @param toe reason for request termination (ignored)
  */
 static void
 mhd_completed_cb (void *cls,
                   struct MHD_Connection *connection,
                   void **con_cls,
                   enum MHD_RequestTerminationCode toe)
 {
   struct RequestContext *rc = *con_cls;
 
   (void) cls;
   (void) connection;
   if (NULL == rc)
     return;
   if (MHD_REQUEST_TERMINATED_COMPLETED_OK != toe)
     GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                 "MHD encountered error handling request to %s: %d\n",
                 rc->url,
                 toe);
   if (NULL != rc->hr)
     PAIVANA_HTTPD_reverse_cleanup (rc->hr);
   if (NULL != rc->hp)
     PAIVANA_HTTPD_payment_destroy (rc->hp);
   switch (rc->admission_class)
   {
   case AC_ORDINARY:
     GNUNET_assert (ordinary_requests > 0);
     ordinary_requests--;
     break;
   case AC_PAYMENT:
     GNUNET_assert (payment_requests > 0);
     payment_requests--;
     break;
   case AC_UNDECIDED:
   case AC_REJECTED:
     break;
   }
   GNUNET_assert (active_requests > 0);
   active_requests--;
   GNUNET_free (rc->url);
   GNUNET_free (rc);
   *con_cls = NULL;
 }
 
 
 /**
  * Function called when MHD first processes an incoming connection.
  * Gives us the respective URI information.
  *
  * We use this to associate the `struct MHD_Connection` with our
  * internal `struct HttpRequest` data structure (by checking
  * for matching sockets).
  *
  * @param cls unused
  * @param url the request target exactly as it arrived on the request
  *        line: RAW, i.e. neither percent-decoded nor stripped of its
  *        query, unlike the @a url create_response() is given.  That is
  *        the string we forward, and the difference between the two is
  *        why canonical_request_target() has to see both.
  * @param connection MHD connection object for the request
  * @return the `struct RequestContext` that this @a connection is for
  */
 static void *
 mhd_log_callback (void *cls,
                   const char *url,
                   struct MHD_Connection *connection)
 {
   struct RequestContext *rc;
 
   (void) cls;
   rc = GNUNET_new (struct RequestContext);
   active_requests++;
   rc->connection = connection;
   rc->url = GNUNET_strdup (url);
   rc->do_forward = (1 == PH_no_check);
   return rc;
 }
 
 
 /**
  * Listen sockets handed to us by TALER_MHD_listen_bind(), collected
  * before any daemon is started; see #collect_socket().
  */
 static int *lsocks;
 
 /**
  * Length of #lsocks.
  */
 static unsigned int lsocks_length;
 
 
 /**
  * Callback invoked on every listen socket: remember it.
  *
  * The daemons are not started here because
  * MHD_OPTION_CONNECTION_LIMIT is per daemon and cannot be changed
  * afterwards, while the budget it has to divide is process-wide --
  * TALER_MHD_listen_bind() starts one daemon per getaddrinfo() result,
  * so an empty BIND_TO yields two, and giving each the whole budget
  * would double it.  We cannot know the divisor until the last socket
  * has been handed over.
  *
  * @param cls unused
  * @param lsock the listen socket
  */
 static void
 collect_socket (void *cls,
                 int lsock)
 {
   (void) cls;
   GNUNET_assert (-1 != lsock);
   GNUNET_array_append (lsocks,
                        lsocks_length,
                        lsock);
 }
 
 
 /**
  * Start one MHD daemon on @a lsock, entitled to @a climit concurrent
  * connections.
  *
  * @param lsock the listen socket, ownership passes to MHD on success
  * @param climit connection limit for this daemon
  */
 static void
 start_daemon (int lsock,
               unsigned int climit)
 {
   struct MHD_Daemon *mhd;
 
   mhd = MHD_start_daemon (
     MHD_USE_DEBUG
     | MHD_ALLOW_SUSPEND_RESUME,
     0,
     NULL, NULL,
     &create_response, NULL,
     /* First, and MHD says so itself: it logs about the options it is
        still parsing, and anything before this one would be printed by
        its built-in logger.  Without the option at all -- MHD_USE_DEBUG
        above is the same bit as MHD_USE_ERROR_LOG -- MHD fprintf()s to
        stderr for the lifetime of the daemon, outside GNUnet's level
        and logfile handling entirely.  Malformed request lines are
        remotely triggerable, so that is client-influenced output
        arriving on stderr regardless of -L ERROR. */
     MHD_OPTION_EXTERNAL_LOGGER, &TALER_MHD_handle_logs, NULL,
     MHD_OPTION_LISTEN_SOCKET,
     lsock,
     MHD_OPTION_CONNECTION_TIMEOUT, (unsigned int) CLIENT_CONNECTION_TIMEOUT,
     MHD_OPTION_CONNECTION_LIMIT, climit,
     MHD_OPTION_PER_IP_CONNECTION_LIMIT, PH_per_ip_connection_limit,
     MHD_OPTION_NOTIFY_COMPLETED, &mhd_completed_cb, NULL,
     MHD_OPTION_URI_LOG_CALLBACK, &mhd_log_callback, NULL,
     MHD_OPTION_END);
 
   if (NULL == mhd)
   {
     /* Not fatal on its own: TALER_MHD_listen_bind() starts one daemon
        per getaddrinfo() result, so an empty BIND_TO yields a v4 and a
        v6 socket, and losing the whole process because MHD would not
        take the v6 one is the same over-reaction the GNUNET_NO arm in
        PAIVANA_HTTPD_serve_requests() already refuses to make for a
        socket that would not bind.  Serving on nothing at all is still
        fatal; that is decided once, by the caller. */
     GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                 "Failed to start HTTP daemon on one of the listen sockets\n");
     /* MHD did not take ownership of the socket; close it ourselves. */
     GNUNET_break (0 == close (lsock));
     return;
   }
   have_daemons = true;
   GNUNET_array_append (mhd_daemons,
                        mhd_daemons_length,
                        mhd);
   TALER_MHD_daemon_start (mhd);
 }
 
 
 unsigned int
 PAIVANA_HTTPD_begin_drain (void)
 {
   if (! draining)
   {
     draining = true;
     for (unsigned int i = 0; i < mhd_daemons_length; i++)
     {
       MHD_socket fd;
 
       fd = MHD_quiesce_daemon (mhd_daemons[i]);
       if (MHD_INVALID_SOCKET == fd)
       {
         GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                     "HTTP listen socket was already quiesced\n");
         continue;
       }
       /* TALER_MHD_daemon_start() has a GNUnet select task whose fdset was
          built before quiescing and therefore still contains @a fd.  Triggering
          cancels that pending task and schedules a fresh MHD_run(), which will
          rebuild the set without the listener.  Closing first leaves select()
          holding an invalid descriptor and makes the scheduler abort with
          EBADF.  The trigger task cannot run until this callback returns, so
          the returned socket is no longer referenced when close() follows. */
       TALER_MHD_daemon_trigger ();
       GNUNET_break (0 == close (fd));
     }
   }
   return active_requests;
 }
 
 
 unsigned int
 PAIVANA_HTTPD_active_requests (void)
 {
   return active_requests;
 }
 
 
 void
 PAIVANA_HTTPD_daemons_destroy (void)
 {
   TALER_MHD_daemons_halt ();
   TALER_MHD_daemons_destroy ();
   GNUNET_array_grow (mhd_daemons,
                      mhd_daemons_length,
                      0);
   have_daemons = false;
 }
 
 
 void
 PAIVANA_HTTPD_serve_requests ()
 {
   enum GNUNET_GenericReturnValue ret;
 
   ret = TALER_MHD_listen_bind (PH_cfg,
                                "paivana",
                                &collect_socket,
                                NULL);
   if (0 != lsocks_length)
   {
     unsigned int climit
       = GNUNET_MAX (1,
                     PH_connection_limit / lsocks_length);
 
     GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                 "Serving on %u listen socket(s), %u connection(s) each"
                 " (%u per client address, 0 = unlimited)\n",
                 lsocks_length,
                 climit,
                 PH_per_ip_connection_limit);
     for (unsigned int i = 0; i < lsocks_length; i++)
       start_daemon (lsocks[i],
                     climit);
     GNUNET_array_grow (lsocks,
                        lsocks_length,
                        0);
   }
   switch (ret)
   {
   case GNUNET_SYSERR:
     /* Configuration error; TALER_MHD_listen_bind() has diagnosed it. */
     PH_global_ret = EXIT_NOTCONFIGURED;
     GNUNET_SCHEDULER_shutdown ();
     return;
   case GNUNET_NO:
     GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                 "Could not open all configured listen sockets\n");
     break;
   case GNUNET_OK:
     break;
   }
   if (! have_daemons)
   {
     /* One policy for both ways a listener can fail to come up: a
        socket that would not bind, and a socket MHD would not serve
        on.  Some is enough; none is not. */
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                 "Not a single listen socket came up, refusing to run\n");
     PH_global_ret = EXIT_NOTCONFIGURED;
     GNUNET_SCHEDULER_shutdown ();
     return;
   }
 }