diff options
Diffstat (limited to 'daemon.c')
| -rw-r--r-- | daemon.c | 420 |
1 files changed, 236 insertions, 184 deletions
@@ -39,13 +39,10 @@ static int strict_paths; static int export_all_trees; /* Take all paths relative to this one if non-NULL */ -static char *base_path; -static char *interpolated_path; +static const char *base_path; +static const char *interpolated_path; static int base_path_relaxed; -/* Flag indicating client sent extra args. */ -static int saw_extended_args; - /* If defined, ~user notation is allowed and the string is inserted * after ~user/. E.g. a request to git://host/~alice/frotz would * go to /home/alice/pub_git/frotz with --user-path=pub_git. @@ -56,10 +53,28 @@ static const char *user_path; static unsigned int timeout; static unsigned int init_timeout; -static char *hostname; -static char *canon_hostname; -static char *ip_address; -static char *tcp_port; +struct hostinfo { + struct strbuf hostname; + struct strbuf canon_hostname; + struct strbuf ip_address; + struct strbuf tcp_port; + unsigned int hostname_lookup_done:1; + unsigned int saw_extended_args:1; +}; + +static void lookup_hostname(struct hostinfo *hi); + +static const char *get_canon_hostname(struct hostinfo *hi) +{ + lookup_hostname(hi); + return hi->canon_hostname.buf; +} + +static const char *get_ip_address(struct hostinfo *hi) +{ + lookup_hostname(hi); + return hi->ip_address.buf; +} static void logreport(int priority, const char *err, va_list params) { @@ -106,12 +121,48 @@ static void NORETURN daemon_die(const char *err, va_list params) exit(1); } -static const char *path_ok(char *directory) +struct expand_path_context { + const char *directory; + struct hostinfo *hostinfo; +}; + +static size_t expand_path(struct strbuf *sb, const char *placeholder, void *ctx) +{ + struct expand_path_context *context = ctx; + struct hostinfo *hi = context->hostinfo; + + switch (placeholder[0]) { + case 'H': + strbuf_addbuf(sb, &hi->hostname); + return 1; + case 'C': + if (placeholder[1] == 'H') { + strbuf_addstr(sb, get_canon_hostname(hi)); + return 2; + } + break; + case 'I': + if (placeholder[1] == 'P') { + strbuf_addstr(sb, get_ip_address(hi)); + return 2; + } + break; + case 'P': + strbuf_addbuf(sb, &hi->tcp_port); + return 1; + case 'D': + strbuf_addstr(sb, context->directory); + return 1; + } + return 0; +} + +static const char *path_ok(const char *directory, struct hostinfo *hi) { static char rpath[PATH_MAX]; static char interp_path[PATH_MAX]; const char *path; - char *dir; + const char *dir; dir = directory; @@ -131,7 +182,7 @@ static const char *path_ok(char *directory) * "~alice/%s/foo". */ int namlen, restlen = strlen(dir); - char *slash = strchr(dir, '/'); + const char *slash = strchr(dir, '/'); if (!slash) slash = dir + restlen; namlen = slash - dir; @@ -142,16 +193,13 @@ static const char *path_ok(char *directory) dir = rpath; } } - else if (interpolated_path && saw_extended_args) { + else if (interpolated_path && hi->saw_extended_args) { struct strbuf expanded_path = STRBUF_INIT; - struct strbuf_expand_dict_entry dict[6]; - - dict[0].placeholder = "H"; dict[0].value = hostname; - dict[1].placeholder = "CH"; dict[1].value = canon_hostname; - dict[2].placeholder = "IP"; dict[2].value = ip_address; - dict[3].placeholder = "P"; dict[3].value = tcp_port; - dict[4].placeholder = "D"; dict[4].value = directory; - dict[5].placeholder = NULL; dict[5].value = NULL; + struct expand_path_context context; + + context.directory = directory; + context.hostinfo = hi; + if (*dir != '/') { /* Allow only absolute */ logerror("'%s': Non-absolute path denied (interpolated-path active)", dir); @@ -159,7 +207,7 @@ static const char *path_ok(char *directory) } strbuf_expand(&expanded_path, interpolated_path, - strbuf_expand_dict_cb, &dict); + expand_path, &context); strlcpy(interp_path, expanded_path.buf, PATH_MAX); strbuf_release(&expanded_path); loginfo("Interpolated dir '%s'", interp_path); @@ -230,21 +278,6 @@ struct daemon_service { int overridable; }; -static struct daemon_service *service_looking_at; -static int service_enabled; - -static int git_daemon_config(const char *var, const char *value, void *cb) -{ - if (starts_with(var, "daemon.") && - !strcmp(var + 7, service_looking_at->config_name)) { - service_enabled = git_config_bool(var, value); - return 0; - } - - /* we are not interested in parsing any other configuration here */ - return 0; -} - static int daemon_error(const char *dir, const char *msg) { if (!informative_errors) @@ -253,29 +286,27 @@ static int daemon_error(const char *dir, const char *msg) return -1; } -static char *access_hook; +static const char *access_hook; -static int run_access_hook(struct daemon_service *service, const char *dir, const char *path) +static int run_access_hook(struct daemon_service *service, const char *dir, + const char *path, struct hostinfo *hi) { - struct child_process child; + struct child_process child = CHILD_PROCESS_INIT; struct strbuf buf = STRBUF_INIT; const char *argv[8]; const char **arg = argv; char *eol; int seen_errors = 0; -#define STRARG(x) ((x) ? (x) : "") *arg++ = access_hook; *arg++ = service->name; *arg++ = path; - *arg++ = STRARG(hostname); - *arg++ = STRARG(canon_hostname); - *arg++ = STRARG(ip_address); - *arg++ = STRARG(tcp_port); + *arg++ = hi->hostname.buf; + *arg++ = get_canon_hostname(hi); + *arg++ = get_ip_address(hi); + *arg++ = hi->tcp_port.buf; *arg = NULL; -#undef STRARG - memset(&child, 0, sizeof(child)); child.use_shell = 1; child.argv = argv; child.no_stdin = 1; @@ -318,10 +349,12 @@ error_return: return -1; } -static int run_service(char *dir, struct daemon_service *service) +static int run_service(const char *dir, struct daemon_service *service, + struct hostinfo *hi) { const char *path; int enabled = service->enabled; + struct strbuf var = STRBUF_INIT; loginfo("Request %s for '%s'", service->name, dir); @@ -331,7 +364,7 @@ static int run_service(char *dir, struct daemon_service *service) return daemon_error(dir, "service not enabled"); } - if (!(path = path_ok(dir))) + if (!(path = path_ok(dir, hi))) return daemon_error(dir, "no such repository"); /* @@ -352,11 +385,9 @@ static int run_service(char *dir, struct daemon_service *service) } if (service->overridable) { - service_looking_at = service; - service_enabled = -1; - git_config(git_daemon_config, NULL); - if (0 <= service_enabled) - enabled = service_enabled; + strbuf_addf(&var, "daemon.%s", service->config_name); + git_config_get_bool(var.buf, &enabled); + strbuf_release(&var); } if (!enabled) { logerror("'%s': service not enabled for '%s'", @@ -369,7 +400,7 @@ static int run_service(char *dir, struct daemon_service *service) * Optionally, a hook can choose to deny access to the * repository depending on the phase of the moon. */ - if (access_hook && run_access_hook(service, dir, path)) + if (access_hook && run_access_hook(service, dir, path, hi)) return -1; /* @@ -393,7 +424,7 @@ static void copy_to_log(int fd) return; } - while (strbuf_getline(&line, fp, '\n') != EOF) { + while (strbuf_getline_lf(&line, fp) != EOF) { logerror("%s", line.buf); strbuf_setlen(&line, 0); } @@ -404,9 +435,8 @@ static void copy_to_log(int fd) static int run_service_command(const char **argv) { - struct child_process cld; + struct child_process cld = CHILD_PROCESS_INIT; - memset(&cld, 0, sizeof(cld)); cld.argv = argv; cld.git_cmd = 1; cld.err = -1; @@ -475,14 +505,6 @@ static void make_service_overridable(const char *name, int ena) die("No such service %s", name); } -static char *xstrdup_tolower(const char *str) -{ - char *p, *dup = xstrdup(str); - for (p = dup; *p; p++) - *p = tolower(*p); - return dup; -} - static void parse_host_and_port(char *hostport, char **host, char **port) { @@ -511,16 +533,46 @@ static void parse_host_and_port(char *hostport, char **host, } /* + * Sanitize a string from the client so that it's OK to be inserted into a + * filesystem path. Specifically, we disallow slashes, runs of "..", and + * trailing and leading dots, which means that the client cannot escape + * our base path via ".." traversal. + */ +static void sanitize_client(struct strbuf *out, const char *in) +{ + for (; *in; in++) { + if (*in == '/') + continue; + if (*in == '.' && (!out->len || out->buf[out->len - 1] == '.')) + continue; + strbuf_addch(out, *in); + } + + while (out->len && out->buf[out->len - 1] == '.') + strbuf_setlen(out, out->len - 1); +} + +/* + * Like sanitize_client, but we also perform any canonicalization + * to make life easier on the admin. + */ +static void canonicalize_client(struct strbuf *out, const char *in) +{ + sanitize_client(out, in); + strbuf_tolower(out); +} + +/* * Read the host as supplied by the client connection. */ -static void parse_host_arg(char *extra_args, int buflen) +static void parse_host_arg(struct hostinfo *hi, char *extra_args, int buflen) { char *val; int vallen; char *end = extra_args + buflen; if (extra_args < end && *extra_args) { - saw_extended_args = 1; + hi->saw_extended_args = 1; if (strncasecmp("host=", extra_args, 5) == 0) { val = extra_args + 5; vallen = strlen(val) + 1; @@ -529,12 +581,10 @@ static void parse_host_arg(char *extra_args, int buflen) char *host; char *port; parse_host_and_port(val, &host, &port); - if (port) { - free(tcp_port); - tcp_port = xstrdup(port); - } - free(hostname); - hostname = xstrdup_tolower(host); + if (port) + sanitize_client(&hi->tcp_port, port); + canonicalize_client(&hi->hostname, host); + hi->hostname_lookup_done = 0; } /* On to the next one */ @@ -543,11 +593,14 @@ static void parse_host_arg(char *extra_args, int buflen) if (extra_args < end && *extra_args) die("Invalid request"); } +} - /* - * Locate canonical hostname and its IP address. - */ - if (hostname) { +/* + * Locate canonical hostname and its IP address. + */ +static void lookup_hostname(struct hostinfo *hi) +{ + if (!hi->hostname_lookup_done && hi->hostname.len) { #ifndef NO_IPV6 struct addrinfo hints; struct addrinfo *ai; @@ -557,18 +610,20 @@ static void parse_host_arg(char *extra_args, int buflen) memset(&hints, 0, sizeof(hints)); hints.ai_flags = AI_CANONNAME; - gai = getaddrinfo(hostname, NULL, &hints, &ai); + gai = getaddrinfo(hi->hostname.buf, NULL, &hints, &ai); if (!gai) { struct sockaddr_in *sin_addr = (void *)ai->ai_addr; inet_ntop(AF_INET, &sin_addr->sin_addr, addrbuf, sizeof(addrbuf)); - free(ip_address); - ip_address = xstrdup(addrbuf); + strbuf_addstr(&hi->ip_address, addrbuf); - free(canon_hostname); - canon_hostname = xstrdup(ai->ai_canonname ? - ai->ai_canonname : ip_address); + if (ai->ai_canonname) + sanitize_client(&hi->canon_hostname, + ai->ai_canonname); + else + strbuf_addbuf(&hi->canon_hostname, + &hi->ip_address); freeaddrinfo(ai); } @@ -578,31 +633,50 @@ static void parse_host_arg(char *extra_args, int buflen) char **ap; static char addrbuf[HOST_NAME_MAX + 1]; - hent = gethostbyname(hostname); + hent = gethostbyname(hi->hostname.buf); + if (hent) { + ap = hent->h_addr_list; + memset(&sa, 0, sizeof sa); + sa.sin_family = hent->h_addrtype; + sa.sin_port = htons(0); + memcpy(&sa.sin_addr, *ap, hent->h_length); - ap = hent->h_addr_list; - memset(&sa, 0, sizeof sa); - sa.sin_family = hent->h_addrtype; - sa.sin_port = htons(0); - memcpy(&sa.sin_addr, *ap, hent->h_length); - - inet_ntop(hent->h_addrtype, &sa.sin_addr, - addrbuf, sizeof(addrbuf)); + inet_ntop(hent->h_addrtype, &sa.sin_addr, + addrbuf, sizeof(addrbuf)); - free(canon_hostname); - canon_hostname = xstrdup(hent->h_name); - free(ip_address); - ip_address = xstrdup(addrbuf); + sanitize_client(&hi->canon_hostname, hent->h_name); + strbuf_addstr(&hi->ip_address, addrbuf); + } #endif + hi->hostname_lookup_done = 1; } } +static void hostinfo_init(struct hostinfo *hi) +{ + memset(hi, 0, sizeof(*hi)); + strbuf_init(&hi->hostname, 0); + strbuf_init(&hi->canon_hostname, 0); + strbuf_init(&hi->ip_address, 0); + strbuf_init(&hi->tcp_port, 0); +} + +static void hostinfo_clear(struct hostinfo *hi) +{ + strbuf_release(&hi->hostname); + strbuf_release(&hi->canon_hostname); + strbuf_release(&hi->ip_address); + strbuf_release(&hi->tcp_port); +} static int execute(void) { char *line = packet_buffer; int pktlen, len, i; char *addr = getenv("REMOTE_ADDR"), *port = getenv("REMOTE_PORT"); + struct hostinfo hi; + + hostinfo_init(&hi); if (addr) loginfo("Connection from %s:%s", addr, port); @@ -621,29 +695,27 @@ static int execute(void) pktlen--; } - free(hostname); - free(canon_hostname); - free(ip_address); - free(tcp_port); - hostname = canon_hostname = ip_address = tcp_port = NULL; - if (len != pktlen) - parse_host_arg(line + len + 1, pktlen - len - 1); + parse_host_arg(&hi, line + len + 1, pktlen - len - 1); for (i = 0; i < ARRAY_SIZE(daemon_service); i++) { struct daemon_service *s = &(daemon_service[i]); - int namelen = strlen(s->name); - if (starts_with(line, "git-") && - !strncmp(s->name, line + 4, namelen) && - line[namelen + 4] == ' ') { + const char *arg; + + if (skip_prefix(line, "git-", &arg) && + skip_prefix(arg, s->name, &arg) && + *arg++ == ' ') { /* * Note: The directory here is probably context sensitive, * and might depend on the actual service being performed. */ - return run_service(line + namelen + 5, s); + int rc = run_service(arg, s, &hi); + hostinfo_clear(&hi); + return rc; } } + hostinfo_clear(&hi); logerror("Protocol error: '%s'", line); return -1; } @@ -730,17 +802,16 @@ static void check_dead_children(void) /* remove the child */ *cradle = blanket->next; live_children--; + child_process_clear(&blanket->cld); free(blanket); } else cradle = &blanket->next; } -static char **cld_argv; +static struct argv_array cld_argv = ARGV_ARRAY_INIT; static void handle(int incoming, struct sockaddr *addr, socklen_t addrlen) { - struct child_process cld = { NULL }; - char addrbuf[300] = "REMOTE_ADDR=", portbuf[300]; - char *env[] = { addrbuf, portbuf, NULL }; + struct child_process cld = CHILD_PROCESS_INIT; if (max_connections && live_children >= max_connections) { kill_some_child(); @@ -754,28 +825,24 @@ static void handle(int incoming, struct sockaddr *addr, socklen_t addrlen) } if (addr->sa_family == AF_INET) { + char buf[128] = ""; struct sockaddr_in *sin_addr = (void *) addr; - inet_ntop(addr->sa_family, &sin_addr->sin_addr, addrbuf + 12, - sizeof(addrbuf) - 12); - snprintf(portbuf, sizeof(portbuf), "REMOTE_PORT=%d", - ntohs(sin_addr->sin_port)); + inet_ntop(addr->sa_family, &sin_addr->sin_addr, buf, sizeof(buf)); + argv_array_pushf(&cld.env_array, "REMOTE_ADDR=%s", buf); + argv_array_pushf(&cld.env_array, "REMOTE_PORT=%d", + ntohs(sin_addr->sin_port)); #ifndef NO_IPV6 } else if (addr->sa_family == AF_INET6) { + char buf[128] = ""; struct sockaddr_in6 *sin6_addr = (void *) addr; - - char *buf = addrbuf + 12; - *buf++ = '['; *buf = '\0'; /* stpcpy() is cool */ - inet_ntop(AF_INET6, &sin6_addr->sin6_addr, buf, - sizeof(addrbuf) - 13); - strcat(buf, "]"); - - snprintf(portbuf, sizeof(portbuf), "REMOTE_PORT=%d", - ntohs(sin6_addr->sin6_port)); + inet_ntop(AF_INET6, &sin6_addr->sin6_addr, buf, sizeof(buf)); + argv_array_pushf(&cld.env_array, "REMOTE_ADDR=[%s]", buf); + argv_array_pushf(&cld.env_array, "REMOTE_PORT=%d", + ntohs(sin6_addr->sin6_port)); #endif } - cld.env = (const char **)env; - cld.argv = (const char **)cld_argv; + cld.argv = cld_argv.argv; cld.in = incoming; cld.out = dup(incoming); @@ -783,7 +850,6 @@ static void handle(int incoming, struct sockaddr *addr, socklen_t addrlen) logerror("unable to fork"); else add_child(&cld, addr, addrlen); - close(incoming); } static void child_handler(int signo) @@ -830,7 +896,7 @@ static const char *ip2str(int family, struct sockaddr *sin, socklen_t len) inet_ntop(family, &((struct sockaddr_in*)sin)->sin_addr, ip, len); break; default: - strcpy(ip, "<unknown>"); + xsnprintf(ip, sizeof(ip), "<unknown>"); } return ip; } @@ -840,13 +906,12 @@ static const char *ip2str(int family, struct sockaddr *sin, socklen_t len) static int setup_named_sock(char *listen_addr, int listen_port, struct socketlist *socklist) { int socknum = 0; - int maxfd = -1; char pbuf[NI_MAXSERV]; struct addrinfo hints, *ai0, *ai; int gai; long flags; - sprintf(pbuf, "%d", listen_port); + xsnprintf(pbuf, sizeof(pbuf), "%d", listen_port); memset(&hints, 0, sizeof(hints)); hints.ai_family = AF_UNSPEC; hints.ai_socktype = SOCK_STREAM; @@ -908,9 +973,6 @@ static int setup_named_sock(char *listen_addr, int listen_port, struct socketlis ALLOC_GROW(socklist->list, socklist->nr + 1, socklist->alloc); socklist->list[socklist->nr++] = sockfd; socknum++; - - if (maxfd < sockfd) - maxfd = sockfd; } freeaddrinfo(ai0); @@ -949,7 +1011,7 @@ static int setup_named_sock(char *listen_addr, int listen_port, struct socketlis } if ( bind(sockfd, (struct sockaddr *)&sin, sizeof sin) < 0 ) { - logerror("Could not listen to %s: %s", + logerror("Could not bind to %s: %s", ip2str(AF_INET, (struct sockaddr *)&sin, sizeof(sin)), strerror(errno)); close(sockfd); @@ -1099,15 +1161,6 @@ static struct credentials *prepare_credentials(const char *user_name, } #endif -static void store_pid(const char *path) -{ - FILE *f = fopen(path, "w"); - if (!f) - die_errno("cannot open pid file '%s'", path); - if (fprintf(f, "%"PRIuMAX"\n", (uintmax_t) getpid()) < 0 || fclose(f) != 0) - die_errno("failed to write pid file '%s'", path); -} - static int serve(struct string_list *listen_addr, int listen_port, struct credentials *cred) { @@ -1141,16 +1194,17 @@ int main(int argc, char **argv) for (i = 1; i < argc; i++) { char *arg = argv[i]; + const char *v; - if (starts_with(arg, "--listen=")) { - string_list_append(&listen_addr, xstrdup_tolower(arg + 9)); + if (skip_prefix(arg, "--listen=", &v)) { + string_list_append(&listen_addr, xstrdup_tolower(v)); continue; } - if (starts_with(arg, "--port=")) { + if (skip_prefix(arg, "--port=", &v)) { char *end; unsigned long n; - n = strtoul(arg+7, &end, 0); - if (arg[7] && !*end) { + n = strtoul(v, &end, 0); + if (*v && !*end) { listen_port = n; continue; } @@ -1176,20 +1230,20 @@ int main(int argc, char **argv) export_all_trees = 1; continue; } - if (starts_with(arg, "--access-hook=")) { - access_hook = arg + 14; + if (skip_prefix(arg, "--access-hook=", &v)) { + access_hook = v; continue; } - if (starts_with(arg, "--timeout=")) { - timeout = atoi(arg+10); + if (skip_prefix(arg, "--timeout=", &v)) { + timeout = atoi(v); continue; } - if (starts_with(arg, "--init-timeout=")) { - init_timeout = atoi(arg+15); + if (skip_prefix(arg, "--init-timeout=", &v)) { + init_timeout = atoi(v); continue; } - if (starts_with(arg, "--max-connections=")) { - max_connections = atoi(arg+18); + if (skip_prefix(arg, "--max-connections=", &v)) { + max_connections = atoi(v); if (max_connections < 0) max_connections = 0; /* unlimited */ continue; @@ -1198,16 +1252,16 @@ int main(int argc, char **argv) strict_paths = 1; continue; } - if (starts_with(arg, "--base-path=")) { - base_path = arg+12; + if (skip_prefix(arg, "--base-path=", &v)) { + base_path = v; continue; } if (!strcmp(arg, "--base-path-relaxed")) { base_path_relaxed = 1; continue; } - if (starts_with(arg, "--interpolated-path=")) { - interpolated_path = arg+20; + if (skip_prefix(arg, "--interpolated-path=", &v)) { + interpolated_path = v; continue; } if (!strcmp(arg, "--reuseaddr")) { @@ -1218,12 +1272,12 @@ int main(int argc, char **argv) user_path = ""; continue; } - if (starts_with(arg, "--user-path=")) { - user_path = arg + 12; + if (skip_prefix(arg, "--user-path=", &v)) { + user_path = v; continue; } - if (starts_with(arg, "--pid-file=")) { - pid_file = arg + 11; + if (skip_prefix(arg, "--pid-file=", &v)) { + pid_file = v; continue; } if (!strcmp(arg, "--detach")) { @@ -1231,28 +1285,28 @@ int main(int argc, char **argv) log_syslog = 1; continue; } - if (starts_with(arg, "--user=")) { - user_name = arg + 7; + if (skip_prefix(arg, "--user=", &v)) { + user_name = v; continue; } - if (starts_with(arg, "--group=")) { - group_name = arg + 8; + if (skip_prefix(arg, "--group=", &v)) { + group_name = v; continue; } - if (starts_with(arg, "--enable=")) { - enable_service(arg + 9, 1); + if (skip_prefix(arg, "--enable=", &v)) { + enable_service(v, 1); continue; } - if (starts_with(arg, "--disable=")) { - enable_service(arg + 10, 0); + if (skip_prefix(arg, "--disable=", &v)) { + enable_service(v, 0); continue; } - if (starts_with(arg, "--allow-override=")) { - make_service_overridable(arg + 17, 1); + if (skip_prefix(arg, "--allow-override=", &v)) { + make_service_overridable(v, 1); continue; } - if (starts_with(arg, "--forbid-override=")) { - make_service_overridable(arg + 18, 0); + if (skip_prefix(arg, "--forbid-override=", &v)) { + make_service_overridable(v, 0); continue; } if (!strcmp(arg, "--informative-errors")) { @@ -1317,15 +1371,13 @@ int main(int argc, char **argv) sanitize_stdfds(); if (pid_file) - store_pid(pid_file); + write_file(pid_file, "%"PRIuMAX, (uintmax_t) getpid()); /* prepare argv for serving-processes */ - cld_argv = xmalloc(sizeof (char *) * (argc + 2)); - cld_argv[0] = argv[0]; /* git-daemon */ - cld_argv[1] = "--serve"; + argv_array_push(&cld_argv, argv[0]); /* git-daemon */ + argv_array_push(&cld_argv, "--serve"); for (i = 1; i < argc; ++i) - cld_argv[i+1] = argv[i]; - cld_argv[argc+1] = NULL; + argv_array_push(&cld_argv, argv[i]); return serve(&listen_addr, listen_port, cred); } |