3 #include <sys/socket.h>
7 #include <netinet/in.h>
14 static int log_syslog;
18 static const char daemon_usage[] =
19 "git-daemon [--verbose] [--syslog] [--inetd | --port=n] [--export-all]\n"
20 " [--timeout=n] [--init-timeout=n] [--strict-paths]\n"
21 " [--base-path=path] [--reuseaddr] [directory...]";
23 /* List of acceptable pathname prefixes */
24 static char **ok_paths = NULL;
25 static int strict_paths = 0;
27 /* If this is set, git-daemon-export-ok is not required */
28 static int export_all_trees = 0;
30 /* Take all paths relative to this one if non-NULL */
31 static char *base_path = NULL;
33 /* Timeout, and initial timeout */
34 static unsigned int timeout = 0;
35 static unsigned int init_timeout = 0;
37 static void logreport(int priority, const char *err, va_list params)
39 /* We should do a single write so that it is atomic and output
40 * of several processes do not get intermingled. */
45 /* sizeof(buf) should be big enough for "[pid] \n" */
46 buflen = snprintf(buf, sizeof(buf), "[%ld] ", (long) getpid());
48 maxlen = sizeof(buf) - buflen - 1; /* -1 for our own LF */
49 msglen = vsnprintf(buf + buflen, maxlen, err, params);
52 syslog(priority, "%s", buf);
56 /* maxlen counted our own LF but also counts space given to
57 * vsnprintf for the terminating NUL. We want to make sure that
58 * we have space for our own LF and NUL after the "meat" of the
59 * message, so truncate it at maxlen - 1.
61 if (msglen > maxlen - 1)
64 msglen = 0; /* Protect against weird return values. */
70 write(2, buf, buflen);
73 static void logerror(const char *err, ...)
76 va_start(params, err);
77 logreport(LOG_ERR, err, params);
81 static void loginfo(const char *err, ...)
86 va_start(params, err);
87 logreport(LOG_INFO, err, params);
91 static int avoid_alias(char *p)
96 * This resurrects the belts and suspenders paranoia check by HPA
97 * done in <435560F7.4080006@zytor.com> thread, now enter_repo()
98 * does not do getcwd() based path canonicalizations.
100 * sl becomes true immediately after seeing '/' and continues to
101 * be true as long as dots continue after that without intervening
104 if (!p || (*p != '/' && *p != '~'))
114 else if (ch == '/') {
116 /* reject //, /./ and /../ */
121 if (0 < ndot && ndot < 3)
122 /* reject /.$ and /..$ */
131 else if (ch == '/') {
138 static char *path_ok(char *dir)
142 if (avoid_alias(dir)) {
143 logerror("'%s': aliased", dir);
148 static char rpath[PATH_MAX];
149 if (!strict_paths && *dir == '~')
150 ; /* allow user relative paths */
151 else if (*dir != '/') {
152 /* otherwise allow only absolute */
153 logerror("'%s': Non-absolute path denied (base-path active)", dir);
157 snprintf(rpath, PATH_MAX, "%s%s", base_path, dir);
162 path = enter_repo(dir, strict_paths);
165 logerror("'%s': unable to chdir or not a git archive", dir);
169 if ( ok_paths && *ok_paths ) {
171 int pathlen = strlen(path);
173 /* The validation is done on the paths after enter_repo
174 * appends optional {.git,.git/.git} and friends, but
175 * it does not use getcwd(). So if your /pub is
176 * a symlink to /mnt/pub, you can whitelist /pub and
177 * do not have to say /mnt/pub.
180 for ( pp = ok_paths ; *pp ; pp++ ) {
181 int len = strlen(*pp);
182 if (len <= pathlen &&
183 !memcmp(*pp, path, len) &&
184 (path[len] == '\0' ||
185 (!strict_paths && path[len] == '/')))
190 /* be backwards compatible */
195 logerror("'%s': not in whitelist", path);
196 return NULL; /* Fallthrough. Deny by default */
199 static int upload(char *dir)
201 /* Timeout as string */
202 char timeout_buf[64];
205 loginfo("Request for '%s'", dir);
207 if (!(path = path_ok(dir)))
211 * Security on the cheap.
213 * We want a readable HEAD, usable "objects" directory, and
214 * a "git-daemon-export-ok" flag that says that the other side
215 * is ok with us doing this.
217 * path_ok() uses enter_repo() and does whitelist checking.
218 * We only need to make sure the repository is exported.
221 if (!export_all_trees && access("git-daemon-export-ok", F_OK)) {
222 logerror("'%s': repository not exported.", path);
228 * We'll ignore SIGTERM from now on, we have a
231 signal(SIGTERM, SIG_IGN);
233 snprintf(timeout_buf, sizeof timeout_buf, "--timeout=%u", timeout);
235 /* git-upload-pack only ever reads stuff, so this is safe */
236 execl_git_cmd("upload-pack", "--strict", timeout_buf, ".", NULL);
240 static int execute(void)
242 static char line[1000];
245 alarm(init_timeout ? init_timeout : timeout);
246 len = packet_read_line(0, line, sizeof(line));
249 if (len && line[len-1] == '\n')
252 if (!strncmp("git-upload-pack ", line, 16))
253 return upload(line+16);
255 logerror("Protocol error: '%s'", line);
261 * We count spawned/reaped separately, just to avoid any
262 * races when updating them from signals. The SIGCHLD handler
263 * will only update children_reaped, and the fork logic will
264 * only update children_spawned.
266 * MAX_CHILDREN should be a power-of-two to make the modulus
267 * operation cheap. It should also be at least twice
268 * the maximum number of connections we will ever allow.
270 #define MAX_CHILDREN 128
272 static int max_connections = 25;
274 /* These are updated by the signal handler */
275 static volatile unsigned int children_reaped = 0;
276 static pid_t dead_child[MAX_CHILDREN];
278 /* These are updated by the main loop */
279 static unsigned int children_spawned = 0;
280 static unsigned int children_deleted = 0;
282 static struct child {
285 struct sockaddr_storage address;
286 } live_child[MAX_CHILDREN];
288 static void add_child(int idx, pid_t pid, struct sockaddr *addr, int addrlen)
290 live_child[idx].pid = pid;
291 live_child[idx].addrlen = addrlen;
292 memcpy(&live_child[idx].address, addr, addrlen);
296 * Walk from "deleted" to "spawned", and remove child "pid".
298 * We move everything up by one, since the new "deleted" will
301 static void remove_child(pid_t pid, unsigned deleted, unsigned spawned)
305 deleted %= MAX_CHILDREN;
306 spawned %= MAX_CHILDREN;
307 if (live_child[deleted].pid == pid) {
308 live_child[deleted].pid = -1;
311 n = live_child[deleted];
314 deleted = (deleted + 1) % MAX_CHILDREN;
315 if (deleted == spawned)
316 die("could not find dead child %d\n", pid);
317 m = live_child[deleted];
318 live_child[deleted] = n;
326 * This gets called if the number of connections grows
327 * past "max_connections".
329 * We _should_ start off by searching for connections
330 * from the same IP, and if there is some address wth
331 * multiple connections, we should kill that first.
333 * As it is, we just "randomly" kill 25% of the connections,
334 * and our pseudo-random generator sucks too. I have no
337 * Really, this is just a place-holder for a _real_ algorithm.
339 static void kill_some_children(int signo, unsigned start, unsigned stop)
341 start %= MAX_CHILDREN;
342 stop %= MAX_CHILDREN;
343 while (start != stop) {
345 kill(live_child[start].pid, signo);
346 start = (start + 1) % MAX_CHILDREN;
350 static void check_max_connections(void)
354 unsigned spawned, reaped, deleted;
356 spawned = children_spawned;
357 reaped = children_reaped;
358 deleted = children_deleted;
360 while (deleted < reaped) {
361 pid_t pid = dead_child[deleted % MAX_CHILDREN];
362 remove_child(pid, deleted, spawned);
365 children_deleted = deleted;
367 active = spawned - deleted;
368 if (active <= max_connections)
371 /* Kill some unstarted connections with SIGTERM */
372 kill_some_children(SIGTERM, deleted, spawned);
373 if (active <= max_connections << 1)
376 /* If the SIGTERM thing isn't helping use SIGKILL */
377 kill_some_children(SIGKILL, deleted, spawned);
382 static void handle(int incoming, struct sockaddr *addr, int addrlen)
385 char addrbuf[256] = "";
395 idx = children_spawned % MAX_CHILDREN;
397 add_child(idx, pid, addr, addrlen);
399 check_max_connections();
407 if (addr->sa_family == AF_INET) {
408 struct sockaddr_in *sin_addr = (void *) addr;
409 inet_ntop(AF_INET, &sin_addr->sin_addr, addrbuf, sizeof(addrbuf));
410 port = sin_addr->sin_port;
413 } else if (addr->sa_family == AF_INET6) {
414 struct sockaddr_in6 *sin6_addr = (void *) addr;
417 *buf++ = '['; *buf = '\0'; /* stpcpy() is cool */
418 inet_ntop(AF_INET6, &sin6_addr->sin6_addr, buf, sizeof(addrbuf) - 1);
421 port = sin6_addr->sin6_port;
424 loginfo("Connection from %s:%d", addrbuf, port);
429 static void child_handler(int signo)
433 pid_t pid = waitpid(-1, &status, WNOHANG);
436 unsigned reaped = children_reaped;
437 dead_child[reaped % MAX_CHILDREN] = pid;
438 children_reaped = reaped + 1;
439 /* XXX: Custom logging, since we don't wanna getpid() */
442 if (!WIFEXITED(status) || WEXITSTATUS(status) > 0)
443 dead = " (with error)";
445 syslog(LOG_INFO, "[%d] Disconnected%s", pid, dead);
447 fprintf(stderr, "[%d] Disconnected%s\n", pid, dead);
455 static int set_reuse_addr(int sockfd)
461 return setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR,
467 static int socksetup(int port, int **socklist_p)
469 int socknum = 0, *socklist = NULL;
471 char pbuf[NI_MAXSERV];
473 struct addrinfo hints, *ai0, *ai;
476 sprintf(pbuf, "%d", port);
477 memset(&hints, 0, sizeof(hints));
478 hints.ai_family = AF_UNSPEC;
479 hints.ai_socktype = SOCK_STREAM;
480 hints.ai_protocol = IPPROTO_TCP;
481 hints.ai_flags = AI_PASSIVE;
483 gai = getaddrinfo(NULL, pbuf, &hints, &ai0);
485 die("getaddrinfo() failed: %s\n", gai_strerror(gai));
487 for (ai = ai0; ai; ai = ai->ai_next) {
491 sockfd = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
494 if (sockfd >= FD_SETSIZE) {
495 error("too large socket descriptor.");
501 if (ai->ai_family == AF_INET6) {
503 setsockopt(sockfd, IPPROTO_IPV6, IPV6_V6ONLY,
505 /* Note: error is not fatal */
509 if (set_reuse_addr(sockfd)) {
511 return 0; /* not fatal */
514 if (bind(sockfd, ai->ai_addr, ai->ai_addrlen) < 0) {
516 continue; /* not fatal */
518 if (listen(sockfd, 5) < 0) {
520 continue; /* not fatal */
523 newlist = realloc(socklist, sizeof(int) * (socknum + 1));
525 die("memory allocation failed: %s", strerror(errno));
528 socklist[socknum++] = sockfd;
536 *socklist_p = socklist;
542 static int socksetup(int port, int **socklist_p)
544 struct sockaddr_in sin;
547 sockfd = socket(AF_INET, SOCK_STREAM, 0);
551 memset(&sin, 0, sizeof sin);
552 sin.sin_family = AF_INET;
553 sin.sin_addr.s_addr = htonl(INADDR_ANY);
554 sin.sin_port = htons(port);
556 if (set_reuse_addr(sockfd)) {
561 if ( bind(sockfd, (struct sockaddr *)&sin, sizeof sin) < 0 ) {
566 if (listen(sockfd, 5) < 0) {
571 *socklist_p = xmalloc(sizeof(int));
572 **socklist_p = sockfd;
578 static int service_loop(int socknum, int *socklist)
583 pfd = xcalloc(socknum, sizeof(struct pollfd));
585 for (i = 0; i < socknum; i++) {
586 pfd[i].fd = socklist[i];
587 pfd[i].events = POLLIN;
590 signal(SIGCHLD, child_handler);
595 if (poll(pfd, socknum, -1) < 0) {
596 if (errno != EINTR) {
597 error("poll failed, resuming: %s",
604 for (i = 0; i < socknum; i++) {
605 if (pfd[i].revents & POLLIN) {
606 struct sockaddr_storage ss;
607 unsigned int sslen = sizeof(ss);
608 int incoming = accept(pfd[i].fd, (struct sockaddr *)&ss, &sslen);
616 die("accept returned %s", strerror(errno));
619 handle(incoming, (struct sockaddr *)&ss, sslen);
625 static int serve(int port)
627 int socknum, *socklist;
629 socknum = socksetup(port, &socklist);
631 die("unable to allocate any listen sockets on port %u", port);
633 return service_loop(socknum, socklist);
636 int main(int argc, char **argv)
638 int port = DEFAULT_GIT_PORT;
642 for (i = 1; i < argc; i++) {
645 if (!strncmp(arg, "--port=", 7)) {
648 n = strtoul(arg+7, &end, 0);
649 if (arg[7] && !*end) {
654 if (!strcmp(arg, "--inetd")) {
659 if (!strcmp(arg, "--verbose")) {
663 if (!strcmp(arg, "--syslog")) {
667 if (!strcmp(arg, "--export-all")) {
668 export_all_trees = 1;
671 if (!strncmp(arg, "--timeout=", 10)) {
672 timeout = atoi(arg+10);
675 if (!strncmp(arg, "--init-timeout=", 15)) {
676 init_timeout = atoi(arg+15);
679 if (!strcmp(arg, "--strict-paths")) {
683 if (!strncmp(arg, "--base-path=", 12)) {
687 if (!strcmp(arg, "--reuseaddr")) {
691 if (!strcmp(arg, "--")) {
692 ok_paths = &argv[i+1];
694 } else if (arg[0] != '-') {
703 openlog("git-daemon", 0, LOG_DAEMON);
705 if (strict_paths && (!ok_paths || !*ok_paths)) {
707 die("git-daemon: option --strict-paths requires a whitelist");
709 logerror("option --strict-paths requires a whitelist");
714 fclose(stderr); //FIXME: workaround