9ea6c31cd17fad509c8a97bb2ff099e8a5489ce8
[git/git.git] / daemon.c
1 #include "cache.h"
2 #include "pkt-line.h"
3 #include <signal.h>
4 #include <sys/wait.h>
5 #include <sys/socket.h>
6 #include <sys/time.h>
7 #include <sys/poll.h>
8 #include <netdb.h>
9 #include <netinet/in.h>
10 #include <arpa/inet.h>
11 #include <syslog.h>
12
13 static int log_syslog;
14 static int verbose;
15
16 static const char daemon_usage[] = "git-daemon [--verbose] [--syslog] [--inetd | --port=n] [--export-all] [directory...]";
17
18 /* List of acceptable pathname prefixes */
19 static char **ok_paths = NULL;
20
21 /* If this is set, git-daemon-export-ok is not required */
22 static int export_all_trees = 0;
23
24
25 static void logreport(int priority, const char *err, va_list params)
26 {
27 /* We should do a single write so that it is atomic and output
28 * of several processes do not get intermingled. */
29 char buf[1024];
30 int buflen;
31 int maxlen, msglen;
32
33 /* sizeof(buf) should be big enough for "[pid] \n" */
34 buflen = snprintf(buf, sizeof(buf), "[%ld] ", (long) getpid());
35
36 maxlen = sizeof(buf) - buflen - 1; /* -1 for our own LF */
37 msglen = vsnprintf(buf + buflen, maxlen, err, params);
38
39 if (log_syslog) {
40 syslog(priority, "%s", buf);
41 return;
42 }
43
44 /* maxlen counted our own LF but also counts space given to
45 * vsnprintf for the terminating NUL. We want to make sure that
46 * we have space for our own LF and NUL after the "meat" of the
47 * message, so truncate it at maxlen - 1.
48 */
49 if (msglen > maxlen - 1)
50 msglen = maxlen - 1;
51 else if (msglen < 0)
52 msglen = 0; /* Protect against weird return values. */
53 buflen += msglen;
54
55 buf[buflen++] = '\n';
56 buf[buflen] = '\0';
57
58 write(2, buf, buflen);
59 }
60
61 static void logerror(const char *err, ...)
62 {
63 va_list params;
64 va_start(params, err);
65 logreport(LOG_ERR, err, params);
66 va_end(params);
67 }
68
69 static void loginfo(const char *err, ...)
70 {
71 va_list params;
72 if (!verbose)
73 return;
74 va_start(params, err);
75 logreport(LOG_INFO, err, params);
76 va_end(params);
77 }
78
79 static int path_ok(const char *dir)
80 {
81 const char *p = dir;
82 char **pp;
83 int sl, ndot;
84
85 /* The pathname here should be an absolute path. */
86 if ( *p++ != '/' )
87 return 0;
88
89 sl = 1; ndot = 0;
90
91 for (;;) {
92 if ( *p == '.' ) {
93 ndot++;
94 } else if ( *p == '\0' ) {
95 /* Reject "." and ".." at the end of the path */
96 if ( sl && ndot > 0 && ndot < 3 )
97 return 0;
98
99 /* Otherwise OK */
100 break;
101 } else if ( *p == '/' ) {
102 /* Refuse "", "." or ".." */
103 if ( sl && ndot < 3 )
104 return 0;
105 sl = 1;
106 ndot = 0;
107 } else {
108 sl = ndot = 0;
109 }
110 p++;
111 }
112
113 if ( ok_paths && *ok_paths ) {
114 int ok = 0;
115 int dirlen = strlen(dir);
116
117 for ( pp = ok_paths ; *pp ; pp++ ) {
118 int len = strlen(*pp);
119 if ( len <= dirlen &&
120 !strncmp(*pp, dir, len) &&
121 (dir[len] == '/' || dir[len] == '\0') ) {
122 ok = 1;
123 break;
124 }
125 }
126
127 if ( !ok )
128 return 0; /* Path not in whitelist */
129 }
130
131 return 1; /* Path acceptable */
132 }
133
134 static int set_dir(const char *dir)
135 {
136 if (!path_ok(dir)) {
137 errno = EACCES;
138 return -1;
139 }
140
141 if ( chdir(dir) )
142 return -1;
143
144 /*
145 * Security on the cheap.
146 *
147 * We want a readable HEAD, usable "objects" directory, and
148 * a "git-daemon-export-ok" flag that says that the other side
149 * is ok with us doing this.
150 */
151 if (!export_all_trees && access("git-daemon-export-ok", F_OK)) {
152 errno = EACCES;
153 return -1;
154 }
155
156 if (access("objects/", X_OK) || access("HEAD", R_OK)) {
157 errno = EINVAL;
158 return -1;
159 }
160
161 /* If all this passed, we're OK */
162 return 0;
163 }
164
165 static int upload(char *dir)
166 {
167 /* Try paths in this order */
168 static const char *paths[] = { "%s", "%s/.git", "%s.git", "%s.git/.git", NULL };
169 const char **pp;
170 /* Enough for the longest path above including final null */
171 int buflen = strlen(dir)+10;
172 char *dirbuf = xmalloc(buflen);
173
174 loginfo("Request for '%s'", dir);
175
176 for ( pp = paths ; *pp ; pp++ ) {
177 snprintf(dirbuf, buflen, *pp, dir);
178 if ( !set_dir(dirbuf) )
179 break;
180 }
181
182 if ( !*pp ) {
183 logerror("Cannot set directory '%s': %s", dir, strerror(errno));
184 return -1;
185 }
186
187 /*
188 * We'll ignore SIGTERM from now on, we have a
189 * good client.
190 */
191 signal(SIGTERM, SIG_IGN);
192
193 /* git-upload-pack only ever reads stuff, so this is safe */
194 execlp("git-upload-pack", "git-upload-pack", ".", NULL);
195 return -1;
196 }
197
198 static int execute(void)
199 {
200 static char line[1000];
201 int len;
202
203 len = packet_read_line(0, line, sizeof(line));
204
205 if (len && line[len-1] == '\n')
206 line[--len] = 0;
207
208 if (!strncmp("git-upload-pack /", line, 17))
209 return upload(line+16);
210
211 logerror("Protocol error: '%s'", line);
212 return -1;
213 }
214
215
216 /*
217 * We count spawned/reaped separately, just to avoid any
218 * races when updating them from signals. The SIGCHLD handler
219 * will only update children_reaped, and the fork logic will
220 * only update children_spawned.
221 *
222 * MAX_CHILDREN should be a power-of-two to make the modulus
223 * operation cheap. It should also be at least twice
224 * the maximum number of connections we will ever allow.
225 */
226 #define MAX_CHILDREN 128
227
228 static int max_connections = 25;
229
230 /* These are updated by the signal handler */
231 static volatile unsigned int children_reaped = 0;
232 static pid_t dead_child[MAX_CHILDREN];
233
234 /* These are updated by the main loop */
235 static unsigned int children_spawned = 0;
236 static unsigned int children_deleted = 0;
237
238 static struct child {
239 pid_t pid;
240 int addrlen;
241 struct sockaddr_storage address;
242 } live_child[MAX_CHILDREN];
243
244 static void add_child(int idx, pid_t pid, struct sockaddr *addr, int addrlen)
245 {
246 live_child[idx].pid = pid;
247 live_child[idx].addrlen = addrlen;
248 memcpy(&live_child[idx].address, addr, addrlen);
249 }
250
251 /*
252 * Walk from "deleted" to "spawned", and remove child "pid".
253 *
254 * We move everything up by one, since the new "deleted" will
255 * be one higher.
256 */
257 static void remove_child(pid_t pid, unsigned deleted, unsigned spawned)
258 {
259 struct child n;
260
261 deleted %= MAX_CHILDREN;
262 spawned %= MAX_CHILDREN;
263 if (live_child[deleted].pid == pid) {
264 live_child[deleted].pid = -1;
265 return;
266 }
267 n = live_child[deleted];
268 for (;;) {
269 struct child m;
270 deleted = (deleted + 1) % MAX_CHILDREN;
271 if (deleted == spawned)
272 die("could not find dead child %d\n", pid);
273 m = live_child[deleted];
274 live_child[deleted] = n;
275 if (m.pid == pid)
276 return;
277 n = m;
278 }
279 }
280
281 /*
282 * This gets called if the number of connections grows
283 * past "max_connections".
284 *
285 * We _should_ start off by searching for connections
286 * from the same IP, and if there is some address wth
287 * multiple connections, we should kill that first.
288 *
289 * As it is, we just "randomly" kill 25% of the connections,
290 * and our pseudo-random generator sucks too. I have no
291 * shame.
292 *
293 * Really, this is just a place-holder for a _real_ algorithm.
294 */
295 static void kill_some_children(int signo, unsigned start, unsigned stop)
296 {
297 start %= MAX_CHILDREN;
298 stop %= MAX_CHILDREN;
299 while (start != stop) {
300 if (!(start & 3))
301 kill(live_child[start].pid, signo);
302 start = (start + 1) % MAX_CHILDREN;
303 }
304 }
305
306 static void check_max_connections(void)
307 {
308 for (;;) {
309 int active;
310 unsigned spawned, reaped, deleted;
311
312 spawned = children_spawned;
313 reaped = children_reaped;
314 deleted = children_deleted;
315
316 while (deleted < reaped) {
317 pid_t pid = dead_child[deleted % MAX_CHILDREN];
318 remove_child(pid, deleted, spawned);
319 deleted++;
320 }
321 children_deleted = deleted;
322
323 active = spawned - deleted;
324 if (active <= max_connections)
325 break;
326
327 /* Kill some unstarted connections with SIGTERM */
328 kill_some_children(SIGTERM, deleted, spawned);
329 if (active <= max_connections << 1)
330 break;
331
332 /* If the SIGTERM thing isn't helping use SIGKILL */
333 kill_some_children(SIGKILL, deleted, spawned);
334 sleep(1);
335 }
336 }
337
338 static void handle(int incoming, struct sockaddr *addr, int addrlen)
339 {
340 pid_t pid = fork();
341 char addrbuf[256] = "";
342 int port = -1;
343
344 if (pid) {
345 unsigned idx;
346
347 close(incoming);
348 if (pid < 0)
349 return;
350
351 idx = children_spawned % MAX_CHILDREN;
352 children_spawned++;
353 add_child(idx, pid, addr, addrlen);
354
355 check_max_connections();
356 return;
357 }
358
359 dup2(incoming, 0);
360 dup2(incoming, 1);
361 close(incoming);
362
363 if (addr->sa_family == AF_INET) {
364 struct sockaddr_in *sin_addr = (void *) addr;
365 inet_ntop(AF_INET, &sin_addr->sin_addr, addrbuf, sizeof(addrbuf));
366 port = sin_addr->sin_port;
367
368 #ifndef NO_IPV6
369 } else if (addr->sa_family == AF_INET6) {
370 struct sockaddr_in6 *sin6_addr = (void *) addr;
371
372 char *buf = addrbuf;
373 *buf++ = '['; *buf = '\0'; /* stpcpy() is cool */
374 inet_ntop(AF_INET6, &sin6_addr->sin6_addr, buf, sizeof(addrbuf) - 1);
375 strcat(buf, "]");
376
377 port = sin6_addr->sin6_port;
378 #endif
379 }
380 loginfo("Connection from %s:%d", addrbuf, port);
381
382 exit(execute());
383 }
384
385 static void child_handler(int signo)
386 {
387 for (;;) {
388 int status;
389 pid_t pid = waitpid(-1, &status, WNOHANG);
390
391 if (pid > 0) {
392 unsigned reaped = children_reaped;
393 dead_child[reaped % MAX_CHILDREN] = pid;
394 children_reaped = reaped + 1;
395 /* XXX: Custom logging, since we don't wanna getpid() */
396 if (verbose) {
397 char *dead = "";
398 if (!WIFEXITED(status) || WEXITSTATUS(status) > 0)
399 dead = " (with error)";
400 if (log_syslog)
401 syslog(LOG_INFO, "[%d] Disconnected%s", pid, dead);
402 else
403 fprintf(stderr, "[%d] Disconnected%s\n", pid, dead);
404 }
405 continue;
406 }
407 break;
408 }
409 }
410
411 #ifndef NO_IPV6
412
413 static int socksetup(int port, int **socklist_p)
414 {
415 int socknum = 0, *socklist = NULL;
416 int maxfd = -1;
417 char pbuf[NI_MAXSERV];
418
419 struct addrinfo hints, *ai0, *ai;
420 int gai;
421
422 sprintf(pbuf, "%d", port);
423 memset(&hints, 0, sizeof(hints));
424 hints.ai_family = AF_UNSPEC;
425 hints.ai_socktype = SOCK_STREAM;
426 hints.ai_protocol = IPPROTO_TCP;
427 hints.ai_flags = AI_PASSIVE;
428
429 gai = getaddrinfo(NULL, pbuf, &hints, &ai0);
430 if (gai)
431 die("getaddrinfo() failed: %s\n", gai_strerror(gai));
432
433 for (ai = ai0; ai; ai = ai->ai_next) {
434 int sockfd;
435 int *newlist;
436
437 sockfd = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
438 if (sockfd < 0)
439 continue;
440 if (sockfd >= FD_SETSIZE) {
441 error("too large socket descriptor.");
442 close(sockfd);
443 continue;
444 }
445
446 #ifdef IPV6_V6ONLY
447 if (ai->ai_family == AF_INET6) {
448 int on = 1;
449 setsockopt(sockfd, IPPROTO_IPV6, IPV6_V6ONLY,
450 &on, sizeof(on));
451 /* Note: error is not fatal */
452 }
453 #endif
454
455 if (bind(sockfd, ai->ai_addr, ai->ai_addrlen) < 0) {
456 close(sockfd);
457 continue; /* not fatal */
458 }
459 if (listen(sockfd, 5) < 0) {
460 close(sockfd);
461 continue; /* not fatal */
462 }
463
464 newlist = realloc(socklist, sizeof(int) * (socknum + 1));
465 if (!newlist)
466 die("memory allocation failed: %s", strerror(errno));
467
468 socklist = newlist;
469 socklist[socknum++] = sockfd;
470
471 if (maxfd < sockfd)
472 maxfd = sockfd;
473 }
474
475 freeaddrinfo(ai0);
476
477 *socklist_p = socklist;
478 return socknum;
479 }
480
481 #else /* NO_IPV6 */
482
483 static int socksetup(int port, int **socklist_p)
484 {
485 struct sockaddr_in sin;
486 int sockfd;
487
488 sockfd = socket(AF_INET, SOCK_STREAM, 0);
489 if (sockfd < 0)
490 return 0;
491
492 memset(&sin, 0, sizeof sin);
493 sin.sin_family = AF_INET;
494 sin.sin_addr.s_addr = htonl(INADDR_ANY);
495 sin.sin_port = htons(port);
496
497 if ( bind(sockfd, (struct sockaddr *)&sin, sizeof sin) < 0 ) {
498 close(sockfd);
499 return 0;
500 }
501
502 *socklist_p = xmalloc(sizeof(int));
503 **socklist_p = sockfd;
504 }
505
506 #endif
507
508 static int service_loop(int socknum, int *socklist)
509 {
510 struct pollfd *pfd;
511 int i;
512
513 pfd = xcalloc(socknum, sizeof(struct pollfd));
514
515 for (i = 0; i < socknum; i++) {
516 pfd[i].fd = socklist[i];
517 pfd[i].events = POLLIN;
518 }
519
520 signal(SIGCHLD, child_handler);
521
522 for (;;) {
523 int i;
524
525 if (poll(pfd, socknum, 0) < 0) {
526 if (errno != EINTR) {
527 error("poll failed, resuming: %s",
528 strerror(errno));
529 sleep(1);
530 }
531 continue;
532 }
533
534 for (i = 0; i < socknum; i++) {
535 if (pfd[i].revents & POLLIN) {
536 struct sockaddr_storage ss;
537 unsigned int sslen = sizeof(ss);
538 int incoming = accept(pfd[i].fd, (struct sockaddr *)&ss, &sslen);
539 if (incoming < 0) {
540 switch (errno) {
541 case EAGAIN:
542 case EINTR:
543 case ECONNABORTED:
544 continue;
545 default:
546 die("accept returned %s", strerror(errno));
547 }
548 }
549 handle(incoming, (struct sockaddr *)&ss, sslen);
550 }
551 }
552 }
553 }
554
555 static int serve(int port)
556 {
557 int socknum, *socklist;
558
559 socknum = socksetup(port, &socklist);
560 if (socknum == 0)
561 die("unable to allocate any listen sockets on port %u", port);
562
563 return service_loop(socknum, socklist);
564 }
565
566 int main(int argc, char **argv)
567 {
568 int port = DEFAULT_GIT_PORT;
569 int inetd_mode = 0;
570 int i;
571
572 for (i = 1; i < argc; i++) {
573 char *arg = argv[i];
574
575 if (!strncmp(arg, "--port=", 7)) {
576 char *end;
577 unsigned long n;
578 n = strtoul(arg+7, &end, 0);
579 if (arg[7] && !*end) {
580 port = n;
581 continue;
582 }
583 }
584 if (!strcmp(arg, "--inetd")) {
585 inetd_mode = 1;
586 continue;
587 }
588 if (!strcmp(arg, "--verbose")) {
589 verbose = 1;
590 continue;
591 }
592 if (!strcmp(arg, "--syslog")) {
593 log_syslog = 1;
594 openlog("git-daemon", 0, LOG_DAEMON);
595 continue;
596 }
597 if (!strcmp(arg, "--export-all")) {
598 export_all_trees = 1;
599 continue;
600 }
601 if (!strcmp(arg, "--")) {
602 ok_paths = &argv[i+1];
603 break;
604 } else if (arg[0] != '-') {
605 ok_paths = &argv[i];
606 break;
607 }
608
609 usage(daemon_usage);
610 }
611
612 if (inetd_mode) {
613 fclose(stderr); //FIXME: workaround
614 return execute();
615 } else {
616 return serve(port);
617 }
618 }