Fix git-daemon argument-parsing bug

[git.git] / daemon.c

diff --git a/daemon.c b/daemon.c
index fe46d3e..8bb4d91 100644 (file)
--- a/daemon.c
+++ b/daemon.c
@@ -12,8 +12,19 @@
 static int log_syslog;
 static int verbose;
 
-static const char daemon_usage[] = "git-daemon [--verbose] [--syslog] [--inetd | --port=n]";
+static const char daemon_usage[] =
+"git-daemon [--verbose] [--syslog] [--inetd | --port=n] [--export-all]\n"
+"           [--timeout=n] [--init-timeout=n] [directory...]";
 
+/* List of acceptable pathname prefixes */
+static char **ok_paths = NULL;
+
+/* If this is set, git-daemon-export-ok is not required */
+static int export_all_trees = 0;
+
+/* Timeout, and initial timeout */
+static unsigned int timeout = 0;
+static unsigned int init_timeout = 0;
 
 static void logreport(int priority, const char *err, va_list params)
 {
@@ -51,7 +62,7 @@ static void logreport(int priority, const char *err, va_list params)
        write(2, buf, buflen);
 }
 
-void logerror(const char *err, ...)
+static void logerror(const char *err, ...)
 {
        va_list params;
        va_start(params, err);
@@ -59,7 +70,7 @@ void logerror(const char *err, ...)
        va_end(params);
 }
 
-void loginfo(const char *err, ...)
+static void loginfo(const char *err, ...)
 {
        va_list params;
        if (!verbose)
@@ -69,16 +80,71 @@ void loginfo(const char *err, ...)
        va_end(params);
 }
 
+static int path_ok(const char *dir)
+{
+       const char *p = dir;
+       char **pp;
+       int sl, ndot;
+
+       /* The pathname here should be an absolute path. */
+       if ( *p++ != '/' )
+               return 0;
+
+       sl = 1;  ndot = 0;
+
+       for (;;) {
+               if ( *p == '.' ) {
+                       ndot++;
+               } else if ( *p == '\0' ) {
+                       /* Reject "." and ".." at the end of the path */
+                       if ( sl && ndot > 0 && ndot < 3 )
+                               return 0;
+
+                       /* Otherwise OK */
+                       break;
+               } else if ( *p == '/' ) {
+                       /* Refuse "", "." or ".." */
+                       if ( sl && ndot < 3 )
+                               return 0;
+                       sl = 1;
+                       ndot = 0;
+               } else {
+                       sl = ndot = 0;
+               }
+               p++;
+       }
+
+       if ( ok_paths && *ok_paths ) {
+               int ok = 0;
+               int dirlen = strlen(dir);
+
+               for ( pp = ok_paths ; *pp ; pp++ ) {
+                       int len = strlen(*pp);
+                       if ( len <= dirlen &&
+                            !strncmp(*pp, dir, len) &&
+                            (dir[len] == '/' || dir[len] == '\0') ) {
+                               ok = 1;
+                               break;
+                       }
+               }
+
+               if ( !ok )
+                       return 0; /* Path not in whitelist */
+       }
+
+       return 1;               /* Path acceptable */
+}
 
-static int upload(char *dir, int dirlen)
+static int set_dir(const char *dir)
 {
-       loginfo("Request for '%s'", dir);
-       if (chdir(dir) < 0) {
-               logerror("Cannot chdir('%s'): %s", dir, strerror(errno));
+       if (!path_ok(dir)) {
+               errno = EACCES;
                return -1;
        }
-       chdir(".git");
 
+       if ( chdir(dir) )
+               return -1;
+       
        /*
         * Security on the cheap.
         *
@@ -86,10 +152,41 @@ static int upload(char *dir, int dirlen)
         * a "git-daemon-export-ok" flag that says that the other side
         * is ok with us doing this.
         */
-       if (access("git-daemon-export-ok", F_OK) ||
-           access("objects/00", X_OK) ||
-           access("HEAD", R_OK)) {
-               logerror("Not a valid gitd-enabled repository: '%s'", dir);
+       if (!export_all_trees && access("git-daemon-export-ok", F_OK)) {
+               errno = EACCES;
+               return -1;
+       }
+
+       if (access("objects/", X_OK) || access("HEAD", R_OK)) {
+               errno = EINVAL;
+               return -1;
+       }
+
+       /* If all this passed, we're OK */
+       return 0;
+}
+
+static int upload(char *dir)
+{
+       /* Try paths in this order */
+       static const char *paths[] = { "%s", "%s/.git", "%s.git", "%s.git/.git", NULL };
+       const char **pp;
+       /* Enough for the longest path above including final null */
+       int buflen = strlen(dir)+10;
+       char *dirbuf = xmalloc(buflen);
+       /* Timeout as string */
+       char timeout_buf[64];
+
+       loginfo("Request for '%s'", dir);
+
+       for ( pp = paths ; *pp ; pp++ ) {
+               snprintf(dirbuf, buflen, *pp, dir);
+               if ( !set_dir(dirbuf) )
+                       break;
+       }
+
+       if ( !*pp ) {
+               logerror("Cannot set directory '%s': %s", dir, strerror(errno));
                return -1;
        }
 
@@ -99,8 +196,10 @@ static int upload(char *dir, int dirlen)
         */
        signal(SIGTERM, SIG_IGN);
 
+       snprintf(timeout_buf, sizeof timeout_buf, "--timeout=%u", timeout);
+
        /* git-upload-pack only ever reads stuff, so this is safe */
-       execlp("git-upload-pack", "git-upload-pack", ".", NULL);
+       execlp("git-upload-pack", "git-upload-pack", "--strict", timeout_buf, ".", NULL);
        return -1;
 }
 
@@ -109,13 +208,15 @@ static int execute(void)
        static char line[1000];
        int len;
 
+       alarm(init_timeout ? init_timeout : timeout);
        len = packet_read_line(0, line, sizeof(line));
+       alarm(0);
 
        if (len && line[len-1] == '\n')
                line[--len] = 0;
 
        if (!strncmp("git-upload-pack /", line, 17))
-               return upload(line + 16, len - 16);
+               return upload(line+16);
 
        logerror("Protocol error: '%s'", line);
        return -1;
@@ -441,7 +542,6 @@ int main(int argc, char **argv)
                                continue;
                        }
                }
-
                if (!strcmp(arg, "--inetd")) {
                        inetd_mode = 1;
                        continue;
@@ -455,6 +555,23 @@ int main(int argc, char **argv)
                        openlog("git-daemon", 0, LOG_DAEMON);
                        continue;
                }
+               if (!strcmp(arg, "--export-all")) {
+                       export_all_trees = 1;
+                       continue;
+               }
+               if (!strncmp(arg, "--timeout=", 10)) {
+                       timeout = atoi(arg+10);
+               }
+               if (!strncmp(arg, "--init-timeout=", 15)) {
+                       init_timeout = atoi(arg+15);
+               }
+               if (!strcmp(arg, "--")) {
+                       ok_paths = &argv[i+1];
+                       break;
+               } else if (arg[0] != '-') {
+                       ok_paths = &argv[i];
+                       break;
+               }
 
                usage(daemon_usage);
        }