3 #include <sys/socket.h>
7 #include <netinet/in.h>
14 static int log_syslog
;
18 static const char daemon_usage
[] =
19 "git-daemon [--verbose] [--syslog] [--inetd | --port=n] [--export-all]\n"
20 " [--timeout=n] [--init-timeout=n] [--strict-paths]\n"
21 " [--base-path=path] [--user-path | --user-path=path]\n"
22 " [--reuseaddr] [directory...]";
24 /* List of acceptable pathname prefixes */
25 static char **ok_paths
= NULL
;
26 static int strict_paths
= 0;
28 /* If this is set, git-daemon-export-ok is not required */
29 static int export_all_trees
= 0;
31 /* Take all paths relative to this one if non-NULL */
32 static char *base_path
= NULL
;
34 /* If defined, ~user notation is allowed and the string is inserted
35 * after ~user/. E.g. a request to git://host/~alice/frotz would
36 * go to /home/alice/pub_git/frotz with --user-path=pub_git.
38 static char *user_path
= NULL
;
40 /* Timeout, and initial timeout */
41 static unsigned int timeout
= 0;
42 static unsigned int init_timeout
= 0;
44 static void logreport(int priority
, const char *err
, va_list params
)
46 /* We should do a single write so that it is atomic and output
47 * of several processes do not get intermingled. */
52 /* sizeof(buf) should be big enough for "[pid] \n" */
53 buflen
= snprintf(buf
, sizeof(buf
), "[%ld] ", (long) getpid());
55 maxlen
= sizeof(buf
) - buflen
- 1; /* -1 for our own LF */
56 msglen
= vsnprintf(buf
+ buflen
, maxlen
, err
, params
);
59 syslog(priority
, "%s", buf
);
63 /* maxlen counted our own LF but also counts space given to
64 * vsnprintf for the terminating NUL. We want to make sure that
65 * we have space for our own LF and NUL after the "meat" of the
66 * message, so truncate it at maxlen - 1.
68 if (msglen
> maxlen
- 1)
71 msglen
= 0; /* Protect against weird return values. */
77 write(2, buf
, buflen
);
80 static void logerror(const char *err
, ...)
83 va_start(params
, err
);
84 logreport(LOG_ERR
, err
, params
);
88 static void loginfo(const char *err
, ...)
93 va_start(params
, err
);
94 logreport(LOG_INFO
, err
, params
);
98 static int avoid_alias(char *p
)
103 * This resurrects the belts and suspenders paranoia check by HPA
104 * done in <435560F7.4080006@zytor.com> thread, now enter_repo()
105 * does not do getcwd() based path canonicalizations.
107 * sl becomes true immediately after seeing '/' and continues to
108 * be true as long as dots continue after that without intervening
111 if (!p
|| (*p
!= '/' && *p
!= '~'))
121 else if (ch
== '/') {
123 /* reject //, /./ and /../ */
128 if (0 < ndot
&& ndot
< 3)
129 /* reject /.$ and /..$ */
138 else if (ch
== '/') {
145 static char *path_ok(char *dir
)
147 static char rpath
[PATH_MAX
];
150 if (avoid_alias(dir
)) {
151 logerror("'%s': aliased", dir
);
157 logerror("'%s': User-path not allowed", dir
);
161 /* Got either "~alice" or "~alice/foo";
162 * rewrite them to "~alice/%s" or
165 int namlen
, restlen
= strlen(dir
);
166 char *slash
= strchr(dir
, '/');
168 slash
= dir
+ restlen
;
169 namlen
= slash
- dir
;
171 loginfo("userpath <%s>, request <%s>, namlen %d, restlen %d, slash <%s>", user_path
, dir
, namlen
, restlen
, slash
);
172 snprintf(rpath
, PATH_MAX
, "%.*s/%s%.*s",
173 namlen
, dir
, user_path
, restlen
, slash
);
177 else if (base_path
) {
179 /* Allow only absolute */
180 logerror("'%s': Non-absolute path denied (base-path active)", dir
);
184 snprintf(rpath
, PATH_MAX
, "%s%s", base_path
, dir
);
189 path
= enter_repo(dir
, strict_paths
);
192 logerror("'%s': unable to chdir or not a git archive", dir
);
196 if ( ok_paths
&& *ok_paths
) {
198 int pathlen
= strlen(path
);
200 /* The validation is done on the paths after enter_repo
201 * appends optional {.git,.git/.git} and friends, but
202 * it does not use getcwd(). So if your /pub is
203 * a symlink to /mnt/pub, you can whitelist /pub and
204 * do not have to say /mnt/pub.
207 for ( pp
= ok_paths
; *pp
; pp
++ ) {
208 int len
= strlen(*pp
);
209 if (len
<= pathlen
&&
210 !memcmp(*pp
, path
, len
) &&
211 (path
[len
] == '\0' ||
212 (!strict_paths
&& path
[len
] == '/')))
217 /* be backwards compatible */
222 logerror("'%s': not in whitelist", path
);
223 return NULL
; /* Fallthrough. Deny by default */
226 static int upload(char *dir
)
228 /* Timeout as string */
229 char timeout_buf
[64];
232 loginfo("Request for '%s'", dir
);
234 if (!(path
= path_ok(dir
)))
238 * Security on the cheap.
240 * We want a readable HEAD, usable "objects" directory, and
241 * a "git-daemon-export-ok" flag that says that the other side
242 * is ok with us doing this.
244 * path_ok() uses enter_repo() and does whitelist checking.
245 * We only need to make sure the repository is exported.
248 if (!export_all_trees
&& access("git-daemon-export-ok", F_OK
)) {
249 logerror("'%s': repository not exported.", path
);
255 * We'll ignore SIGTERM from now on, we have a
258 signal(SIGTERM
, SIG_IGN
);
260 snprintf(timeout_buf
, sizeof timeout_buf
, "--timeout=%u", timeout
);
262 /* git-upload-pack only ever reads stuff, so this is safe */
263 execl_git_cmd("upload-pack", "--strict", timeout_buf
, ".", NULL
);
267 static int execute(void)
269 static char line
[1000];
272 alarm(init_timeout
? init_timeout
: timeout
);
273 len
= packet_read_line(0, line
, sizeof(line
));
276 if (len
&& line
[len
-1] == '\n')
279 if (!strncmp("git-upload-pack ", line
, 16))
280 return upload(line
+16);
282 logerror("Protocol error: '%s'", line
);
288 * We count spawned/reaped separately, just to avoid any
289 * races when updating them from signals. The SIGCHLD handler
290 * will only update children_reaped, and the fork logic will
291 * only update children_spawned.
293 * MAX_CHILDREN should be a power-of-two to make the modulus
294 * operation cheap. It should also be at least twice
295 * the maximum number of connections we will ever allow.
297 #define MAX_CHILDREN 128
299 static int max_connections
= 25;
301 /* These are updated by the signal handler */
302 static volatile unsigned int children_reaped
= 0;
303 static pid_t dead_child
[MAX_CHILDREN
];
305 /* These are updated by the main loop */
306 static unsigned int children_spawned
= 0;
307 static unsigned int children_deleted
= 0;
309 static struct child
{
312 struct sockaddr_storage address
;
313 } live_child
[MAX_CHILDREN
];
315 static void add_child(int idx
, pid_t pid
, struct sockaddr
*addr
, int addrlen
)
317 live_child
[idx
].pid
= pid
;
318 live_child
[idx
].addrlen
= addrlen
;
319 memcpy(&live_child
[idx
].address
, addr
, addrlen
);
323 * Walk from "deleted" to "spawned", and remove child "pid".
325 * We move everything up by one, since the new "deleted" will
328 static void remove_child(pid_t pid
, unsigned deleted
, unsigned spawned
)
332 deleted
%= MAX_CHILDREN
;
333 spawned
%= MAX_CHILDREN
;
334 if (live_child
[deleted
].pid
== pid
) {
335 live_child
[deleted
].pid
= -1;
338 n
= live_child
[deleted
];
341 deleted
= (deleted
+ 1) % MAX_CHILDREN
;
342 if (deleted
== spawned
)
343 die("could not find dead child %d\n", pid
);
344 m
= live_child
[deleted
];
345 live_child
[deleted
] = n
;
353 * This gets called if the number of connections grows
354 * past "max_connections".
356 * We _should_ start off by searching for connections
357 * from the same IP, and if there is some address wth
358 * multiple connections, we should kill that first.
360 * As it is, we just "randomly" kill 25% of the connections,
361 * and our pseudo-random generator sucks too. I have no
364 * Really, this is just a place-holder for a _real_ algorithm.
366 static void kill_some_children(int signo
, unsigned start
, unsigned stop
)
368 start
%= MAX_CHILDREN
;
369 stop
%= MAX_CHILDREN
;
370 while (start
!= stop
) {
372 kill(live_child
[start
].pid
, signo
);
373 start
= (start
+ 1) % MAX_CHILDREN
;
377 static void check_max_connections(void)
381 unsigned spawned
, reaped
, deleted
;
383 spawned
= children_spawned
;
384 reaped
= children_reaped
;
385 deleted
= children_deleted
;
387 while (deleted
< reaped
) {
388 pid_t pid
= dead_child
[deleted
% MAX_CHILDREN
];
389 remove_child(pid
, deleted
, spawned
);
392 children_deleted
= deleted
;
394 active
= spawned
- deleted
;
395 if (active
<= max_connections
)
398 /* Kill some unstarted connections with SIGTERM */
399 kill_some_children(SIGTERM
, deleted
, spawned
);
400 if (active
<= max_connections
<< 1)
403 /* If the SIGTERM thing isn't helping use SIGKILL */
404 kill_some_children(SIGKILL
, deleted
, spawned
);
409 static void handle(int incoming
, struct sockaddr
*addr
, int addrlen
)
412 char addrbuf
[256] = "";
422 idx
= children_spawned
% MAX_CHILDREN
;
424 add_child(idx
, pid
, addr
, addrlen
);
426 check_max_connections();
434 if (addr
->sa_family
== AF_INET
) {
435 struct sockaddr_in
*sin_addr
= (void *) addr
;
436 inet_ntop(AF_INET
, &sin_addr
->sin_addr
, addrbuf
, sizeof(addrbuf
));
437 port
= sin_addr
->sin_port
;
440 } else if (addr
->sa_family
== AF_INET6
) {
441 struct sockaddr_in6
*sin6_addr
= (void *) addr
;
444 *buf
++ = '['; *buf
= '\0'; /* stpcpy() is cool */
445 inet_ntop(AF_INET6
, &sin6_addr
->sin6_addr
, buf
, sizeof(addrbuf
) - 1);
448 port
= sin6_addr
->sin6_port
;
451 loginfo("Connection from %s:%d", addrbuf
, port
);
456 static void child_handler(int signo
)
460 pid_t pid
= waitpid(-1, &status
, WNOHANG
);
463 unsigned reaped
= children_reaped
;
464 dead_child
[reaped
% MAX_CHILDREN
] = pid
;
465 children_reaped
= reaped
+ 1;
466 /* XXX: Custom logging, since we don't wanna getpid() */
469 if (!WIFEXITED(status
) || WEXITSTATUS(status
) > 0)
470 dead
= " (with error)";
472 syslog(LOG_INFO
, "[%d] Disconnected%s", pid
, dead
);
474 fprintf(stderr
, "[%d] Disconnected%s\n", pid
, dead
);
482 static int set_reuse_addr(int sockfd
)
488 return setsockopt(sockfd
, SOL_SOCKET
, SO_REUSEADDR
,
494 static int socksetup(int port
, int **socklist_p
)
496 int socknum
= 0, *socklist
= NULL
;
498 char pbuf
[NI_MAXSERV
];
500 struct addrinfo hints
, *ai0
, *ai
;
503 sprintf(pbuf
, "%d", port
);
504 memset(&hints
, 0, sizeof(hints
));
505 hints
.ai_family
= AF_UNSPEC
;
506 hints
.ai_socktype
= SOCK_STREAM
;
507 hints
.ai_protocol
= IPPROTO_TCP
;
508 hints
.ai_flags
= AI_PASSIVE
;
510 gai
= getaddrinfo(NULL
, pbuf
, &hints
, &ai0
);
512 die("getaddrinfo() failed: %s\n", gai_strerror(gai
));
514 for (ai
= ai0
; ai
; ai
= ai
->ai_next
) {
518 sockfd
= socket(ai
->ai_family
, ai
->ai_socktype
, ai
->ai_protocol
);
521 if (sockfd
>= FD_SETSIZE
) {
522 error("too large socket descriptor.");
528 if (ai
->ai_family
== AF_INET6
) {
530 setsockopt(sockfd
, IPPROTO_IPV6
, IPV6_V6ONLY
,
532 /* Note: error is not fatal */
536 if (set_reuse_addr(sockfd
)) {
538 return 0; /* not fatal */
541 if (bind(sockfd
, ai
->ai_addr
, ai
->ai_addrlen
) < 0) {
543 continue; /* not fatal */
545 if (listen(sockfd
, 5) < 0) {
547 continue; /* not fatal */
550 newlist
= realloc(socklist
, sizeof(int) * (socknum
+ 1));
552 die("memory allocation failed: %s", strerror(errno
));
555 socklist
[socknum
++] = sockfd
;
563 *socklist_p
= socklist
;
569 static int socksetup(int port
, int **socklist_p
)
571 struct sockaddr_in sin
;
574 sockfd
= socket(AF_INET
, SOCK_STREAM
, 0);
578 memset(&sin
, 0, sizeof sin
);
579 sin
.sin_family
= AF_INET
;
580 sin
.sin_addr
.s_addr
= htonl(INADDR_ANY
);
581 sin
.sin_port
= htons(port
);
583 if (set_reuse_addr(sockfd
)) {
588 if ( bind(sockfd
, (struct sockaddr
*)&sin
, sizeof sin
) < 0 ) {
593 if (listen(sockfd
, 5) < 0) {
598 *socklist_p
= xmalloc(sizeof(int));
599 **socklist_p
= sockfd
;
605 static int service_loop(int socknum
, int *socklist
)
610 pfd
= xcalloc(socknum
, sizeof(struct pollfd
));
612 for (i
= 0; i
< socknum
; i
++) {
613 pfd
[i
].fd
= socklist
[i
];
614 pfd
[i
].events
= POLLIN
;
617 signal(SIGCHLD
, child_handler
);
622 if (poll(pfd
, socknum
, -1) < 0) {
623 if (errno
!= EINTR
) {
624 error("poll failed, resuming: %s",
631 for (i
= 0; i
< socknum
; i
++) {
632 if (pfd
[i
].revents
& POLLIN
) {
633 struct sockaddr_storage ss
;
634 unsigned int sslen
= sizeof(ss
);
635 int incoming
= accept(pfd
[i
].fd
, (struct sockaddr
*)&ss
, &sslen
);
643 die("accept returned %s", strerror(errno
));
646 handle(incoming
, (struct sockaddr
*)&ss
, sslen
);
652 static int serve(int port
)
654 int socknum
, *socklist
;
656 socknum
= socksetup(port
, &socklist
);
658 die("unable to allocate any listen sockets on port %u", port
);
660 return service_loop(socknum
, socklist
);
663 int main(int argc
, char **argv
)
665 int port
= DEFAULT_GIT_PORT
;
669 for (i
= 1; i
< argc
; i
++) {
672 if (!strncmp(arg
, "--port=", 7)) {
675 n
= strtoul(arg
+7, &end
, 0);
676 if (arg
[7] && !*end
) {
681 if (!strcmp(arg
, "--inetd")) {
686 if (!strcmp(arg
, "--verbose")) {
690 if (!strcmp(arg
, "--syslog")) {
694 if (!strcmp(arg
, "--export-all")) {
695 export_all_trees
= 1;
698 if (!strncmp(arg
, "--timeout=", 10)) {
699 timeout
= atoi(arg
+10);
702 if (!strncmp(arg
, "--init-timeout=", 15)) {
703 init_timeout
= atoi(arg
+15);
706 if (!strcmp(arg
, "--strict-paths")) {
710 if (!strncmp(arg
, "--base-path=", 12)) {
714 if (!strcmp(arg
, "--reuseaddr")) {
718 if (!strcmp(arg
, "--user-path")) {
722 if (!strncmp(arg
, "--user-path=", 12)) {
723 user_path
= arg
+ 12;
726 if (!strcmp(arg
, "--")) {
727 ok_paths
= &argv
[i
+1];
729 } else if (arg
[0] != '-') {
738 openlog("git-daemon", 0, LOG_DAEMON
);
740 if (strict_paths
&& (!ok_paths
|| !*ok_paths
)) {
742 die("git-daemon: option --strict-paths requires a whitelist");
744 logerror("option --strict-paths requires a whitelist");
749 fclose(stderr
); //FIXME: workaround