1 /*
2  * Copyright (c) 2016, 2019, 2020-2022 Tracey Emery <tracey@traceyemery.net>
3  * Copyright (c) 2015 Mike Larkin <mlarkin@openbsd.org>
4  * Copyright (c) 2014 Reyk Floeter <reyk@openbsd.org>
5  * Copyright (c) 2013 David Gwynne <dlg@openbsd.org>
6  * Copyright (c) 2013 Florian Obser <florian@openbsd.org>
7  *
8  * Permission to use, copy, modify, and distribute this software for any
9  * purpose with or without fee is hereby granted, provided that the above
10  * copyright notice and this permission notice appear in all copies.
11  *
12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19  */
20 #include "got_compat.h"
21 
22 #include <net/if.h>
23 #include <netinet/in.h>
24 #include <sys/queue.h>
25 #include <sys/stat.h>
26 #include <sys/types.h>
27 
28 #include <ctype.h>
29 #include <dirent.h>
30 #include <errno.h>
31 #include <event.h>
32 #include <fcntl.h>
33 #include <imsg.h>
34 #include <stdio.h>
35 #include <stdlib.h>
36 #include <string.h>
37 #include <unistd.h>
38 
39 #include "got_error.h"
40 #include "got_object.h"
41 #include "got_reference.h"
42 #include "got_repository.h"
43 #include "got_path.h"
44 #include "got_cancel.h"
45 #include "got_worktree.h"
46 #include "got_diff.h"
47 #include "got_commit_graph.h"
48 #include "got_blame.h"
49 #include "got_privsep.h"
50 
51 #include "proc.h"
52 #include "gotwebd.h"
53 #include "tmpl.h"
54 
55 static const struct querystring_keys querystring_keys[] = {
56 	{ "action",		ACTION },
57 	{ "commit",		COMMIT },
58 	{ "file",		RFILE },
59 	{ "folder",		FOLDER },
60 	{ "headref",		HEADREF },
61 	{ "index_page",		INDEX_PAGE },
62 	{ "path",		PATH },
63 	{ "page",		PAGE },
64 };
65 
66 static const struct action_keys action_keys[] = {
67 	{ "blame",	BLAME },
68 	{ "blob",	BLOB },
69 	{ "blobraw",	BLOBRAW },
70 	{ "briefs",	BRIEFS },
71 	{ "commits",	COMMITS },
72 	{ "diff",	DIFF },
73 	{ "error",	ERR },
74 	{ "index",	INDEX },
75 	{ "summary",	SUMMARY },
76 	{ "tag",	TAG },
77 	{ "tags",	TAGS },
78 	{ "tree",	TREE },
79 	{ "rss",	RSS },
80 };
81 
82 static const struct got_error *gotweb_init_querystring(struct querystring **);
83 static const struct got_error *gotweb_parse_querystring(struct querystring **,
84     char *);
85 static const struct got_error *gotweb_assign_querystring(struct querystring **,
86     char *, char *);
87 static int gotweb_render_index(struct template *);
88 static const struct got_error *gotweb_init_repo_dir(struct repo_dir **,
89     const char *);
90 static const struct got_error *gotweb_load_got_path(struct request *c,
91     struct repo_dir *);
92 static const struct got_error *gotweb_get_repo_description(char **,
93     struct server *, const char *, int);
94 static const struct got_error *gotweb_get_clone_url(char **, struct server *,
95     const char *, int);
96 
97 static void gotweb_free_querystring(struct querystring *);
98 static void gotweb_free_repo_dir(struct repo_dir *);
99 
100 struct server *gotweb_get_server(const char *);
101 
102 static int
103 gotweb_reply(struct request *c, int status, const char *ctype,
104     struct gotweb_url *location)
105 {
106 	const char	*csp;
107 
108 	if (status != 200 && fcgi_printf(c, "Status: %d\r\n", status) == -1)
109 		return -1;
110 
111 	if (location) {
112 		if (fcgi_puts(c->tp, "Location: ") == -1 ||
113 		    gotweb_render_url(c, location) == -1 ||
114 		    fcgi_puts(c->tp, "\r\n") == -1)
115 			return -1;
116 	}
117 
118 	csp = "Content-Security-Policy: default-src 'self'; "
119 	    "script-src 'none'; object-src 'none';\r\n";
120 	if (fcgi_puts(c->tp, csp) == -1)
121 		return -1;
122 
123 	if (ctype && fcgi_printf(c, "Content-Type: %s\r\n", ctype) == -1)
124 		return -1;
125 
126 	return fcgi_puts(c->tp, "\r\n");
127 }
128 
129 static int
130 gotweb_reply_file(struct request *c, const char *ctype, const char *file,
131     const char *suffix)
132 {
133 	int r;
134 
135 	r = fcgi_printf(c, "Content-Disposition: attachment; "
136 	    "filename=%s%s\r\n", file, suffix ? suffix : "");
137 	if (r == -1)
138 		return -1;
139 	return gotweb_reply(c, 200, ctype, NULL);
140 }
141 
142 void
143 gotweb_process_request(struct request *c)
144 {
145 	const struct got_error *error = NULL;
146 	struct server *srv = NULL;
147 	struct querystring *qs = NULL;
148 	struct repo_dir *repo_dir = NULL;
149 	const char *rss_ctype = "application/rss+xml;charset=utf-8";
150 	const uint8_t *buf;
151 	size_t len;
152 	int r, binary = 0;
153 
154 	/* init the transport */
155 	error = gotweb_init_transport(&c->t);
156 	if (error) {
157 		log_warnx("%s: %s", __func__, error->msg);
158 		return;
159 	}
160 	/* don't process any further if client disconnected */
161 	if (c->sock->client_status == CLIENT_DISCONNECT)
162 		return;
163 	/* get the gotwebd server */
164 	srv = gotweb_get_server(c->server_name);
165 	if (srv == NULL) {
166 		log_warnx("%s: error server is NULL", __func__);
167 		goto err;
168 	}
169 	c->srv = srv;
170 	/* parse our querystring */
171 	error = gotweb_init_querystring(&qs);
172 	if (error) {
173 		log_warnx("%s: %s", __func__, error->msg);
174 		goto err;
175 	}
176 	c->t->qs = qs;
177 	error = gotweb_parse_querystring(&qs, c->querystring);
178 	if (error) {
179 		log_warnx("%s: %s", __func__, error->msg);
180 		goto err;
181 	}
182 
183 	/*
184 	 * certain actions require a commit id in the querystring. this stops
185 	 * bad actors from exploiting this by manually manipulating the
186 	 * querystring.
187 	 */
188 
189 	if (qs->action == BLAME || qs->action == BLOB ||
190 	    qs->action == BLOBRAW || qs->action == DIFF) {
191 		if (qs->commit == NULL) {
192 			error = got_error(GOT_ERR_BAD_QUERYSTRING);
193 			goto err;
194 		}
195 	}
196 
197 	if (qs->action != INDEX) {
198 		error = gotweb_init_repo_dir(&repo_dir, qs->path);
199 		if (error)
200 			goto err;
201 		error = gotweb_load_got_path(c, repo_dir);
202 		c->t->repo_dir = repo_dir;
203 		if (error && error->code != GOT_ERR_LONELY_PACKIDX)
204 			goto err;
205 	}
206 
207 	if (qs->action == BLOBRAW || qs->action == BLOB) {
208 		error = got_get_repo_commits(c, 1);
209 		if (error)
210 			goto err;
211 
212 		error = got_open_blob_for_output(&c->t->blob, &c->t->fd,
213 		    &binary, c);
214 		if (error)
215 			goto err;
216 	}
217 
218 	switch(qs->action) {
219 	case BLAME:
220 		error = got_get_repo_commits(c, 1);
221 		if (error) {
222 			log_warnx("%s: %s", __func__, error->msg);
223 			goto err;
224 		}
225 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
226 			return;
227 		gotweb_render_page(c->tp, gotweb_render_blame);
228 		return;
229 	case BLOB:
230 		if (binary) {
231 			struct gotweb_url url = {
232 				.index_page = -1,
233 				.page = -1,
234 				.action = BLOBRAW,
235 				.path = qs->path,
236 				.commit = qs->commit,
237 				.folder = qs->folder,
238 				.file = qs->file,
239 			};
240 
241 			gotweb_reply(c, 302, NULL, &url);
242 			return;
243 		}
244 
245 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
246 			return;
247 		gotweb_render_page(c->tp, gotweb_render_blob);
248 		return;
249 	case BLOBRAW:
250 		if (binary)
251 			r = gotweb_reply_file(c, "application/octet-stream",
252 			    qs->file, NULL);
253 		else
254 			r = gotweb_reply(c, 200, "text/plain", NULL);
255 		if (r == -1)
256 			return;
257 
258 		for (;;) {
259 			error = got_object_blob_read_block(&len, c->t->blob);
260 			if (error)
261 				break;
262 			if (len == 0)
263 				break;
264 			buf = got_object_blob_get_read_buf(c->t->blob);
265 			if (fcgi_gen_binary_response(c, buf, len) == -1)
266 				break;
267 		}
268 		return;
269 	case BRIEFS:
270 		error = got_get_repo_commits(c, srv->max_commits_display);
271 		if (error)
272 			goto err;
273 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
274 			return;
275 		gotweb_render_page(c->tp, gotweb_render_briefs);
276 		return;
277 	case COMMITS:
278 		error = got_get_repo_commits(c, srv->max_commits_display);
279 		if (error) {
280 			log_warnx("%s: %s", __func__, error->msg);
281 			goto err;
282 		}
283 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
284 			return;
285 		gotweb_render_page(c->tp, gotweb_render_commits);
286 		return;
287 	case DIFF:
288 		error = got_get_repo_commits(c, 1);
289 		if (error) {
290 			log_warnx("%s: %s", __func__, error->msg);
291 			goto err;
292 		}
293 		error = got_open_diff_for_output(&c->t->fp, c);
294 		if (error) {
295 			log_warnx("%s: %s", __func__, error->msg);
296 			goto err;
297 		}
298 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
299 			return;
300 		gotweb_render_page(c->tp, gotweb_render_diff);
301 		return;
302 	case INDEX:
303 		c->t->nrepos = scandir(srv->repos_path, &c->t->repos, NULL,
304 		    alphasort);
305 		if (c->t->nrepos == -1) {
306 			c->t->repos = NULL;
307 			error = got_error_from_errno2("scandir",
308 			    srv->repos_path);
309 			goto err;
310 		}
311 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
312 			return;
313 		gotweb_render_page(c->tp, gotweb_render_index);
314 		return;
315 	case RSS:
316 		error = got_get_repo_tags(c, D_MAXSLCOMMDISP);
317 		if (error)
318 			goto err;
319 		if (gotweb_reply_file(c, rss_ctype, repo_dir->name, ".rss")
320 		    == -1)
321 			return;
322 		gotweb_render_rss(c->tp);
323 		return;
324 	case SUMMARY:
325 		error = got_ref_list(&c->t->refs, c->t->repo, "refs/heads",
326 		    got_ref_cmp_by_name, NULL);
327 		if (error) {
328 			log_warnx("%s: got_ref_list: %s", __func__,
329 			    error->msg);
330 			goto err;
331 		}
332 		error = got_get_repo_commits(c, D_MAXSLCOMMDISP);
333 		if (error)
334 			goto err;
335 		qs->action = TAGS;
336 		error = got_get_repo_tags(c, D_MAXSLCOMMDISP);
337 		if (error) {
338 			log_warnx("%s: got_get_repo_tags: %s", __func__,
339 			    error->msg);
340 			goto err;
341 		}
342 		qs->action = SUMMARY;
343 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
344 			return;
345 		gotweb_render_page(c->tp, gotweb_render_summary);
346 		return;
347 	case TAG:
348 		error = got_get_repo_tags(c, 1);
349 		if (error) {
350 			log_warnx("%s: %s", __func__, error->msg);
351 			goto err;
352 		}
353 		if (c->t->tag_count == 0) {
354 			error = got_error_msg(GOT_ERR_BAD_OBJ_ID,
355 			    "bad commit id");
356 			goto err;
357 		}
358 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
359 			return;
360 		gotweb_render_page(c->tp, gotweb_render_tag);
361 		return;
362 	case TAGS:
363 		error = got_get_repo_tags(c, srv->max_commits_display);
364 		if (error) {
365 			log_warnx("%s: %s", __func__, error->msg);
366 			goto err;
367 		}
368 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
369 			return;
370 		gotweb_render_page(c->tp, gotweb_render_tags);
371 		return;
372 	case TREE:
373 		error = got_get_repo_commits(c, 1);
374 		if (error) {
375 			log_warnx("%s: %s", __func__, error->msg);
376 			goto err;
377 		}
378 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
379 			return;
380 		gotweb_render_page(c->tp, gotweb_render_tree);
381 		return;
382 	case ERR:
383 	default:
384 		error = got_error(GOT_ERR_BAD_QUERYSTRING);
385 	}
386 
387 err:
388 	c->t->error = error;
389 	if (gotweb_reply(c, 400, "text/html", NULL) == -1)
390 		return;
391 	gotweb_render_page(c->tp, gotweb_render_error);
392 }
393 
394 struct server *
395 gotweb_get_server(const char *server_name)
396 {
397 	struct server *srv;
398 
399 	/* check against the server name first */
400 	if (*server_name != '\0')
401 		TAILQ_FOREACH(srv, &gotwebd_env->servers, entry)
402 			if (strcmp(srv->name, server_name) == 0)
403 				return srv;
404 
405 	/* otherwise, use the first server */
406 	return TAILQ_FIRST(&gotwebd_env->servers);
407 };
408 
409 const struct got_error *
410 gotweb_init_transport(struct transport **t)
411 {
412 	const struct got_error *error = NULL;
413 
414 	*t = calloc(1, sizeof(**t));
415 	if (*t == NULL)
416 		return got_error_from_errno2(__func__, "calloc");
417 
418 	TAILQ_INIT(&(*t)->repo_commits);
419 	TAILQ_INIT(&(*t)->repo_tags);
420 	TAILQ_INIT(&(*t)->refs);
421 
422 	(*t)->fd = -1;
423 
424 	return error;
425 }
426 
427 static const struct got_error *
428 gotweb_init_querystring(struct querystring **qs)
429 {
430 	const struct got_error *error = NULL;
431 
432 	*qs = calloc(1, sizeof(**qs));
433 	if (*qs == NULL)
434 		return got_error_from_errno2(__func__, "calloc");
435 
436 	(*qs)->headref = strdup("HEAD");
437 	if ((*qs)->headref == NULL) {
438 		free(*qs);
439 		*qs = NULL;
440 		return got_error_from_errno2(__func__, "strdup");
441 	}
442 
443 	(*qs)->action = INDEX;
444 	(*qs)->commit = NULL;
445 	(*qs)->file = NULL;
446 	(*qs)->folder = NULL;
447 	(*qs)->index_page = 0;
448 	(*qs)->path = NULL;
449 
450 	return error;
451 }
452 
453 static const struct got_error *
454 gotweb_parse_querystring(struct querystring **qs, char *qst)
455 {
456 	const struct got_error *error = NULL;
457 	char *tok1 = NULL, *tok1_pair = NULL, *tok1_end = NULL;
458 	char *tok2 = NULL, *tok2_pair = NULL, *tok2_end = NULL;
459 
460 	if (qst == NULL)
461 		return error;
462 
463 	tok1 = strdup(qst);
464 	if (tok1 == NULL)
465 		return got_error_from_errno2(__func__, "strdup");
466 
467 	tok1_pair = tok1;
468 	tok1_end = tok1;
469 
470 	while (tok1_pair != NULL) {
471 		strsep(&tok1_end, "&");
472 
473 		tok2 = strdup(tok1_pair);
474 		if (tok2 == NULL) {
475 			free(tok1);
476 			return got_error_from_errno2(__func__, "strdup");
477 		}
478 
479 		tok2_pair = tok2;
480 		tok2_end = tok2;
481 
482 		while (tok2_pair != NULL) {
483 			strsep(&tok2_end, "=");
484 			if (tok2_end) {
485 				error = gotweb_assign_querystring(qs, tok2_pair,
486 				    tok2_end);
487 				if (error)
488 					goto err;
489 			}
490 			tok2_pair = tok2_end;
491 		}
492 		free(tok2);
493 		tok1_pair = tok1_end;
494 	}
495 	free(tok1);
496 	return error;
497 err:
498 	free(tok2);
499 	free(tok1);
500 	return error;
501 }
502 
503 /*
504  * Adapted from usr.sbin/httpd/httpd.c url_decode.
505  */
506 static const struct got_error *
507 gotweb_urldecode(char *url)
508 {
509 	char		*p, *q;
510 	char		 hex[3];
511 	unsigned long	 x;
512 
513 	hex[2] = '\0';
514 	p = q = url;
515 
516 	while (*p != '\0') {
517 		switch (*p) {
518 		case '%':
519 			/* Encoding character is followed by two hex chars */
520 			if (!isxdigit((unsigned char)p[1]) ||
521 			    !isxdigit((unsigned char)p[2]) ||
522 			    (p[1] == '0' && p[2] == '0'))
523 				return got_error(GOT_ERR_BAD_QUERYSTRING);
524 
525 			hex[0] = p[1];
526 			hex[1] = p[2];
527 
528 			/*
529 			 * We don't have to validate "hex" because it is
530 			 * guaranteed to include two hex chars followed by nul.
531 			 */
532 			x = strtoul(hex, NULL, 16);
533 			*q = (char)x;
534 			p += 2;
535 			break;
536 		default:
537 			*q = *p;
538 			break;
539 		}
540 		p++;
541 		q++;
542 	}
543 	*q = '\0';
544 
545 	return NULL;
546 }
547 
548 static const struct got_error *
549 gotweb_assign_querystring(struct querystring **qs, char *key, char *value)
550 {
551 	const struct got_error *error = NULL;
552 	const char *errstr;
553 	int a_cnt, el_cnt;
554 
555 	error = gotweb_urldecode(value);
556 	if (error)
557 		return error;
558 
559 	for (el_cnt = 0; el_cnt < QSELEM__MAX; el_cnt++) {
560 		if (strcmp(key, querystring_keys[el_cnt].name) != 0)
561 			continue;
562 
563 		switch (querystring_keys[el_cnt].element) {
564 		case ACTION:
565 			for (a_cnt = 0; a_cnt < ACTIONS__MAX; a_cnt++) {
566 				if (strcmp(value, action_keys[a_cnt].name) != 0)
567 					continue;
568 				else if (strcmp(value,
569 				    action_keys[a_cnt].name) == 0){
570 					(*qs)->action =
571 					    action_keys[a_cnt].action;
572 					goto qa_found;
573 				}
574 			}
575 			(*qs)->action = ERR;
576 qa_found:
577 			break;
578 		case COMMIT:
579 			(*qs)->commit = strdup(value);
580 			if ((*qs)->commit == NULL) {
581 				error = got_error_from_errno2(__func__,
582 				    "strdup");
583 				goto done;
584 			}
585 			break;
586 		case RFILE:
587 			(*qs)->file = strdup(value);
588 			if ((*qs)->file == NULL) {
589 				error = got_error_from_errno2(__func__,
590 				    "strdup");
591 				goto done;
592 			}
593 			break;
594 		case FOLDER:
595 			(*qs)->folder = strdup(value);
596 			if ((*qs)->folder == NULL) {
597 				error = got_error_from_errno2(__func__,
598 				    "strdup");
599 				goto done;
600 			}
601 			break;
602 		case HEADREF:
603 			free((*qs)->headref);
604 			(*qs)->headref = strdup(value);
605 			if ((*qs)->headref == NULL) {
606 				error = got_error_from_errno2(__func__,
607 				    "strdup");
608 				goto done;
609 			}
610 			break;
611 		case INDEX_PAGE:
612 			if (*value == '\0')
613 				break;
614 			(*qs)->index_page = strtonum(value, INT64_MIN,
615 			    INT64_MAX, &errstr);
616 			if (errstr) {
617 				error = got_error_from_errno3(__func__,
618 				    "strtonum", errstr);
619 				goto done;
620 			}
621 			if ((*qs)->index_page < 0)
622 				(*qs)->index_page = 0;
623 			break;
624 		case PATH:
625 			(*qs)->path = strdup(value);
626 			if ((*qs)->path == NULL) {
627 				error = got_error_from_errno2(__func__,
628 				    "strdup");
629 				goto done;
630 			}
631 			break;
632 		case PAGE:
633 			if (*value == '\0')
634 				break;
635 			(*qs)->page = strtonum(value, INT64_MIN,
636 			    INT64_MAX, &errstr);
637 			if (errstr) {
638 				error = got_error_from_errno3(__func__,
639 				    "strtonum", errstr);
640 				goto done;
641 			}
642 			if ((*qs)->page < 0)
643 				(*qs)->page = 0;
644 			break;
645 		default:
646 			break;
647 		}
648 	}
649 done:
650 	return error;
651 }
652 
653 void
654 gotweb_free_repo_tag(struct repo_tag *rt)
655 {
656 	if (rt != NULL) {
657 		free(rt->commit_id);
658 		free(rt->tag_name);
659 		free(rt->tag_commit);
660 		free(rt->commit_msg);
661 		free(rt->tagger);
662 	}
663 	free(rt);
664 }
665 
666 void
667 gotweb_free_repo_commit(struct repo_commit *rc)
668 {
669 	if (rc != NULL) {
670 		free(rc->path);
671 		free(rc->refs_str);
672 		free(rc->commit_id);
673 		free(rc->parent_id);
674 		free(rc->tree_id);
675 		free(rc->author);
676 		free(rc->committer);
677 		free(rc->commit_msg);
678 	}
679 	free(rc);
680 }
681 
682 static void
683 gotweb_free_querystring(struct querystring *qs)
684 {
685 	if (qs != NULL) {
686 		free(qs->commit);
687 		free(qs->file);
688 		free(qs->folder);
689 		free(qs->headref);
690 		free(qs->path);
691 	}
692 	free(qs);
693 }
694 
695 static void
696 gotweb_free_repo_dir(struct repo_dir *repo_dir)
697 {
698 	if (repo_dir != NULL) {
699 		free(repo_dir->name);
700 		free(repo_dir->owner);
701 		free(repo_dir->description);
702 		free(repo_dir->url);
703 		free(repo_dir->path);
704 	}
705 	free(repo_dir);
706 }
707 
708 void
709 gotweb_free_transport(struct transport *t)
710 {
711 	const struct got_error *err;
712 	struct repo_commit *rc = NULL, *trc = NULL;
713 	struct repo_tag *rt = NULL, *trt = NULL;
714 	int i;
715 
716 	got_ref_list_free(&t->refs);
717 	TAILQ_FOREACH_SAFE(rc, &t->repo_commits, entry, trc) {
718 		TAILQ_REMOVE(&t->repo_commits, rc, entry);
719 		gotweb_free_repo_commit(rc);
720 	}
721 	TAILQ_FOREACH_SAFE(rt, &t->repo_tags, entry, trt) {
722 		TAILQ_REMOVE(&t->repo_tags, rt, entry);
723 		gotweb_free_repo_tag(rt);
724 	}
725 	gotweb_free_repo_dir(t->repo_dir);
726 	gotweb_free_querystring(t->qs);
727 	free(t->more_id);
728 	free(t->next_id);
729 	free(t->prev_id);
730 	if (t->blob)
731 		got_object_blob_close(t->blob);
732 	if (t->fp) {
733 		err = got_gotweb_closefile(t->fp);
734 		if (err)
735 			log_warnx("%s: got_gotweb_closefile failure: %s",
736 			    __func__, err->msg);
737 	}
738 	if (t->fd != -1 && close(t->fd) == -1)
739 		log_warn("%s: close", __func__);
740 	if (t->repos) {
741 		for (i = 0; i < t->nrepos; ++i)
742 			free(t->repos[i]);
743 		free(t->repos);
744 	}
745 	free(t);
746 }
747 
748 void
749 gotweb_get_navs(struct request *c, struct gotweb_url *prev, int *have_prev,
750     struct gotweb_url *next, int *have_next)
751 {
752 	struct transport *t = c->t;
753 	struct querystring *qs = t->qs;
754 	struct server *srv = c->srv;
755 
756 	*have_prev = *have_next = 0;
757 
758 	switch(qs->action) {
759 	case INDEX:
760 		if (qs->index_page > 0) {
761 			*have_prev = 1;
762 			*prev = (struct gotweb_url){
763 				.action = -1,
764 				.index_page = qs->index_page - 1,
765 				.page = -1,
766 			};
767 		}
768 		if (t->next_disp == srv->max_repos_display &&
769 		    t->repos_total != (qs->index_page + 1) *
770 		    srv->max_repos_display) {
771 			*have_next = 1;
772 			*next = (struct gotweb_url){
773 				.action = -1,
774 				.index_page = qs->index_page + 1,
775 				.page = -1,
776 			};
777 		}
778 		break;
779 	case TAGS:
780 		if (t->prev_id && qs->commit != NULL &&
781 		    strcmp(qs->commit, t->prev_id) != 0) {
782 			*have_prev = 1;
783 			*prev = (struct gotweb_url){
784 				.action = TAGS,
785 				.index_page = -1,
786 				.page = qs->page - 1,
787 				.path = qs->path,
788 				.commit = t->prev_id,
789 				.headref = qs->headref,
790 			};
791 		}
792 		if (t->next_id) {
793 			*have_next = 1;
794 			*next = (struct gotweb_url){
795 				.action = TAGS,
796 				.index_page = -1,
797 				.page = qs->page + 1,
798 				.path = qs->path,
799 				.commit = t->next_id,
800 				.headref = qs->headref,
801 			};
802 		}
803 		break;
804 	}
805 }
806 
807 static int
808 gotweb_render_index(struct template *tp)
809 {
810 	const struct got_error *error = NULL;
811 	struct request *c = tp->tp_arg;
812 	struct server *srv = c->srv;
813 	struct transport *t = c->t;
814 	struct querystring *qs = t->qs;
815 	struct repo_dir *repo_dir = NULL;
816 	struct dirent **sd_dent = t->repos;
817 	unsigned int d_i, d_disp = 0;
818 	unsigned int d_skipped = 0;
819 	int type, r;
820 
821 	if (gotweb_render_repo_table_hdr(c->tp) == -1)
822 		return -1;
823 
824 	for (d_i = 0; d_i < t->nrepos; d_i++) {
825 		if (srv->max_repos > 0 && t->prev_disp == srv->max_repos)
826 			break;
827 
828 		if (strcmp(sd_dent[d_i]->d_name, ".") == 0 ||
829 		    strcmp(sd_dent[d_i]->d_name, "..") == 0) {
830 			d_skipped++;
831 			continue;
832 		}
833 
834 		error = got_path_dirent_type(&type, srv->repos_path,
835 		    sd_dent[d_i]);
836 		if (error)
837 			continue;
838 		if (type != DT_DIR) {
839 			d_skipped++;
840 			continue;
841 		}
842 
843 		if (qs->index_page > 0 && (qs->index_page *
844 		    srv->max_repos_display) > t->prev_disp) {
845 			t->prev_disp++;
846 			continue;
847 		}
848 
849 		error = gotweb_init_repo_dir(&repo_dir, sd_dent[d_i]->d_name);
850 		if (error)
851 			continue;
852 
853 		error = gotweb_load_got_path(c, repo_dir);
854 		if (error && error->code != GOT_ERR_LONELY_PACKIDX) {
855 			if (error->code != GOT_ERR_NOT_GIT_REPO)
856 				log_warnx("%s: %s: %s", __func__,
857 				    sd_dent[d_i]->d_name, error->msg);
858 			gotweb_free_repo_dir(repo_dir);
859 			repo_dir = NULL;
860 			d_skipped++;
861 			continue;
862 		}
863 
864 		d_disp++;
865 		t->prev_disp++;
866 
867 		r = gotweb_render_repo_fragment(c->tp, repo_dir);
868 		gotweb_free_repo_dir(repo_dir);
869 		if (r == -1)
870 			return -1;
871 
872 		t->next_disp++;
873 		if (d_disp == srv->max_repos_display)
874 			break;
875 	}
876 	t->repos_total = t->nrepos - d_skipped;
877 
878 	if (srv->max_repos_display == 0)
879 		return 0;
880 	if (srv->max_repos > 0 && srv->max_repos < srv->max_repos_display)
881 		return 0;
882 	if (t->repos_total <= srv->max_repos ||
883 	    t->repos_total <= srv->max_repos_display)
884 		return 0;
885 
886 	if (gotweb_render_navs(c->tp) == -1)
887 		return -1;
888 
889 	return 0;
890 }
891 
892 static inline int
893 should_urlencode(int c)
894 {
895 	if (c <= ' ' || c >= 127)
896 		return 1;
897 
898 	switch (c) {
899 		/* gen-delim */
900 	case ':':
901 	case '/':
902 	case '?':
903 	case '#':
904 	case '[':
905 	case ']':
906 	case '@':
907 		/* sub-delims */
908 	case '!':
909 	case '$':
910 	case '&':
911 	case '\'':
912 	case '(':
913 	case ')':
914 	case '*':
915 	case '+':
916 	case ',':
917 	case ';':
918 	case '=':
919 		/* needed because the URLs are embedded into the HTML */
920 	case '\"':
921 		return 1;
922 	default:
923 		return 0;
924 	}
925 }
926 
927 static char *
928 gotweb_urlencode(const char *str)
929 {
930 	const char *s;
931 	char *escaped;
932 	size_t i, len;
933 	int a, b;
934 
935 	len = 0;
936 	for (s = str; *s; ++s) {
937 		len++;
938 		if (should_urlencode(*s))
939 			len += 2;
940 	}
941 
942 	escaped = calloc(1, len + 1);
943 	if (escaped == NULL)
944 		return NULL;
945 
946 	i = 0;
947 	for (s = str; *s; ++s) {
948 		if (should_urlencode(*s)) {
949 			a = (*s & 0xF0) >> 4;
950 			b = (*s & 0x0F);
951 
952 			escaped[i++] = '%';
953 			escaped[i++] = a <= 9 ? ('0' + a) : ('7' + a);
954 			escaped[i++] = b <= 9 ? ('0' + b) : ('7' + b);
955 		} else
956 			escaped[i++] = *s;
957 	}
958 
959 	return escaped;
960 }
961 
962 const char *
963 gotweb_action_name(int action)
964 {
965 	switch (action) {
966 	case BLAME:
967 		return "blame";
968 	case BLOB:
969 		return "blob";
970 	case BLOBRAW:
971 		return "blobraw";
972 	case BRIEFS:
973 		return "briefs";
974 	case COMMITS:
975 		return "commits";
976 	case DIFF:
977 		return "diff";
978 	case ERR:
979 		return "err";
980 	case INDEX:
981 		return "index";
982 	case SUMMARY:
983 		return "summary";
984 	case TAG:
985 		return "tag";
986 	case TAGS:
987 		return "tags";
988 	case TREE:
989 		return "tree";
990 	case RSS:
991 		return "rss";
992 	default:
993 		return NULL;
994 	}
995 }
996 
997 int
998 gotweb_render_url(struct request *c, struct gotweb_url *url)
999 {
1000 	const char *sep = "?", *action;
1001 	char *tmp;
1002 	int r;
1003 
1004 	action = gotweb_action_name(url->action);
1005 	if (action != NULL) {
1006 		if (fcgi_printf(c, "?action=%s", action) == -1)
1007 			return -1;
1008 		sep = "&";
1009 	}
1010 
1011 	if (url->commit) {
1012 		if (fcgi_printf(c, "%scommit=%s", sep, url->commit) == -1)
1013 			return -1;
1014 		sep = "&";
1015 	}
1016 
1017 	if (url->previd) {
1018 		if (fcgi_printf(c, "%sprevid=%s", sep, url->previd) == -1)
1019 			return -1;
1020 		sep = "&";
1021 	}
1022 
1023 	if (url->prevset) {
1024 		if (fcgi_printf(c, "%sprevset=%s", sep, url->prevset) == -1)
1025 			return -1;
1026 		sep = "&";
1027 	}
1028 
1029 	if (url->file) {
1030 		tmp = gotweb_urlencode(url->file);
1031 		if (tmp == NULL)
1032 			return -1;
1033 		r = fcgi_printf(c, "%sfile=%s", sep, tmp);
1034 		free(tmp);
1035 		if (r == -1)
1036 			return -1;
1037 		sep = "&";
1038 	}
1039 
1040 	if (url->folder) {
1041 		tmp = gotweb_urlencode(url->folder);
1042 		if (tmp == NULL)
1043 			return -1;
1044 		r = fcgi_printf(c, "%sfolder=%s", sep, tmp);
1045 		free(tmp);
1046 		if (r == -1)
1047 			return -1;
1048 		sep = "&";
1049 	}
1050 
1051 	if (url->headref) {
1052 		tmp = gotweb_urlencode(url->headref);
1053 		if (tmp == NULL)
1054 			return -1;
1055 		r = fcgi_printf(c, "%sheadref=%s", sep, url->headref);
1056 		free(tmp);
1057 		if (r == -1)
1058 			return -1;
1059 		sep = "&";
1060 	}
1061 
1062 	if (url->index_page != -1) {
1063 		if (fcgi_printf(c, "%sindex_page=%d", sep,
1064 		    url->index_page) == -1)
1065 			return -1;
1066 		sep = "&";
1067 	}
1068 
1069 	if (url->path) {
1070 		tmp = gotweb_urlencode(url->path);
1071 		if (tmp == NULL)
1072 			return -1;
1073 		r = fcgi_printf(c, "%spath=%s", sep, tmp);
1074 		free(tmp);
1075 		if (r == -1)
1076 			return -1;
1077 		sep = "&";
1078 	}
1079 
1080 	if (url->page != -1) {
1081 		if (fcgi_printf(c, "%spage=%d", sep, url->page) == -1)
1082 			return -1;
1083 		sep = "&";
1084 	}
1085 
1086 	return 0;
1087 }
1088 
1089 int
1090 gotweb_render_absolute_url(struct request *c, struct gotweb_url *url)
1091 {
1092 	struct template	*tp = c->tp;
1093 	const char	*proto = c->https ? "https" : "http";
1094 
1095 	if (fcgi_puts(tp, proto) == -1 ||
1096 	    fcgi_puts(tp, "://") == -1 ||
1097 	    tp_htmlescape(tp, c->server_name) == -1 ||
1098 	    tp_htmlescape(tp, c->document_uri) == -1)
1099 		return -1;
1100 
1101 	return gotweb_render_url(c, url);
1102 }
1103 
1104 static struct got_repository *
1105 find_cached_repo(struct server *srv, const char *path)
1106 {
1107 	int i;
1108 
1109 	for (i = 0; i < srv->ncached_repos; i++) {
1110 		if (strcmp(srv->cached_repos[i].path, path) == 0)
1111 			return srv->cached_repos[i].repo;
1112 	}
1113 
1114 	return NULL;
1115 }
1116 
1117 static const struct got_error *
1118 cache_repo(struct got_repository **new, struct server *srv,
1119     struct repo_dir *repo_dir, struct socket *sock)
1120 {
1121 	const struct got_error *error = NULL;
1122 	struct got_repository *repo;
1123 	struct cached_repo *cr;
1124 	int evicted = 0;
1125 
1126 	if (srv->ncached_repos >= GOTWEBD_REPO_CACHESIZE) {
1127 		cr = &srv->cached_repos[srv->ncached_repos - 1];
1128 		error = got_repo_close(cr->repo);
1129 		memset(cr, 0, sizeof(*cr));
1130 		srv->ncached_repos--;
1131 		if (error)
1132 			return error;
1133 		memmove(&srv->cached_repos[1], &srv->cached_repos[0],
1134 		    srv->ncached_repos * sizeof(srv->cached_repos[0]));
1135 		cr = &srv->cached_repos[0];
1136 		evicted = 1;
1137 	} else {
1138 		cr = &srv->cached_repos[srv->ncached_repos];
1139 	}
1140 
1141 	error = got_repo_open(&repo, repo_dir->path, NULL, sock->pack_fds);
1142 	if (error) {
1143 		if (evicted) {
1144 			memmove(&srv->cached_repos[0], &srv->cached_repos[1],
1145 			    srv->ncached_repos * sizeof(srv->cached_repos[0]));
1146 		}
1147 		return error;
1148 	}
1149 
1150 	if (strlcpy(cr->path, repo_dir->path, sizeof(cr->path))
1151 	    >= sizeof(cr->path)) {
1152 		if (evicted) {
1153 			memmove(&srv->cached_repos[0], &srv->cached_repos[1],
1154 			    srv->ncached_repos * sizeof(srv->cached_repos[0]));
1155 		}
1156 		return got_error(GOT_ERR_NO_SPACE);
1157 	}
1158 
1159 	cr->repo = repo;
1160 	srv->ncached_repos++;
1161 	*new = repo;
1162 	return NULL;
1163 }
1164 
1165 static const struct got_error *
1166 gotweb_load_got_path(struct request *c, struct repo_dir *repo_dir)
1167 {
1168 	const struct got_error *error = NULL;
1169 	struct socket *sock = c->sock;
1170 	struct server *srv = c->srv;
1171 	struct transport *t = c->t;
1172 	struct got_repository *repo = NULL;
1173 	DIR *dt;
1174 	char *dir_test;
1175 
1176 	if (asprintf(&dir_test, "%s/%s/%s", srv->repos_path, repo_dir->name,
1177 	    GOTWEB_GIT_DIR) == -1)
1178 		return got_error_from_errno("asprintf");
1179 
1180 	dt = opendir(dir_test);
1181 	if (dt == NULL) {
1182 		free(dir_test);
1183 	} else {
1184 		repo_dir->path = dir_test;
1185 		dir_test = NULL;
1186 		goto done;
1187 	}
1188 
1189 	if (asprintf(&dir_test, "%s/%s", srv->repos_path,
1190 	    repo_dir->name) == -1)
1191 		return got_error_from_errno("asprintf");
1192 
1193 	dt = opendir(dir_test);
1194 	if (dt == NULL) {
1195 		error = got_error_path(repo_dir->name, GOT_ERR_NOT_GIT_REPO);
1196 		goto err;
1197 	} else {
1198 		repo_dir->path = dir_test;
1199 		dir_test = NULL;
1200 	}
1201 
1202 done:
1203 	if (srv->respect_exportok &&
1204 	    faccessat(dirfd(dt), "git-daemon-export-ok", F_OK, 0) == -1) {
1205 		error = got_error_path(repo_dir->name, GOT_ERR_NOT_GIT_REPO);
1206 		goto err;
1207 	}
1208 
1209 	repo = find_cached_repo(srv, repo_dir->path);
1210 	if (repo == NULL) {
1211 		error = cache_repo(&repo, srv, repo_dir, sock);
1212 		if (error)
1213 			goto err;
1214 	}
1215 	t->repo = repo;
1216 	error = gotweb_get_repo_description(&repo_dir->description, srv,
1217 	    repo_dir->path, dirfd(dt));
1218 	if (error)
1219 		goto err;
1220 	error = got_get_repo_owner(&repo_dir->owner, c);
1221 	if (error)
1222 		goto err;
1223 	if (srv->show_repo_age) {
1224 		error = got_get_repo_age(&repo_dir->age, c, NULL);
1225 		if (error)
1226 			goto err;
1227 	}
1228 	error = gotweb_get_clone_url(&repo_dir->url, srv, repo_dir->path,
1229 	    dirfd(dt));
1230 err:
1231 	free(dir_test);
1232 	if (dt != NULL && closedir(dt) == EOF && error == NULL)
1233 		error = got_error_from_errno("closedir");
1234 	return error;
1235 }
1236 
1237 static const struct got_error *
1238 gotweb_init_repo_dir(struct repo_dir **repo_dir, const char *dir)
1239 {
1240 	const struct got_error *error;
1241 
1242 	*repo_dir = calloc(1, sizeof(**repo_dir));
1243 	if (*repo_dir == NULL)
1244 		return got_error_from_errno("calloc");
1245 
1246 	if (asprintf(&(*repo_dir)->name, "%s", dir) == -1) {
1247 		error = got_error_from_errno("asprintf");
1248 		free(*repo_dir);
1249 		*repo_dir = NULL;
1250 		return error;
1251 	}
1252 	(*repo_dir)->owner = NULL;
1253 	(*repo_dir)->description = NULL;
1254 	(*repo_dir)->url = NULL;
1255 	(*repo_dir)->path = NULL;
1256 
1257 	return NULL;
1258 }
1259 
1260 static const struct got_error *
1261 gotweb_get_repo_description(char **description, struct server *srv,
1262     const char *dirpath, int dir)
1263 {
1264 	const struct got_error *error = NULL;
1265 	struct stat sb;
1266 	int fd = -1;
1267 	off_t len;
1268 
1269 	*description = NULL;
1270 	if (srv->show_repo_description == 0)
1271 		return NULL;
1272 
1273 	fd = openat(dir, "description", O_RDONLY);
1274 	if (fd == -1) {
1275 		if (errno != ENOENT && errno != EACCES) {
1276 			error = got_error_from_errno_fmt("openat %s/%s",
1277 			    dirpath, "description");
1278 		}
1279 		goto done;
1280 	}
1281 
1282 	if (fstat(fd, &sb) == -1) {
1283 		error = got_error_from_errno_fmt("fstat %s/%s",
1284 		    dirpath, "description");
1285 		goto done;
1286 	}
1287 
1288 	len = sb.st_size;
1289 	if (len > GOTWEBD_MAXDESCRSZ - 1)
1290 		len = GOTWEBD_MAXDESCRSZ - 1;
1291 
1292 	*description = calloc(len + 1, sizeof(**description));
1293 	if (*description == NULL) {
1294 		error = got_error_from_errno("calloc");
1295 		goto done;
1296 	}
1297 
1298 	if (read(fd, *description, len) == -1)
1299 		error = got_error_from_errno("read");
1300 done:
1301 	if (fd != -1 && close(fd) == -1 && error == NULL)
1302 		error = got_error_from_errno("close");
1303 	return error;
1304 }
1305 
1306 static const struct got_error *
1307 gotweb_get_clone_url(char **url, struct server *srv, const char *dirpath,
1308     int dir)
1309 {
1310 	const struct got_error *error = NULL;
1311 	struct stat sb;
1312 	int fd = -1;
1313 	off_t len;
1314 
1315 	*url = NULL;
1316 	if (srv->show_repo_cloneurl == 0)
1317 		return NULL;
1318 
1319 	fd = openat(dir, "cloneurl", O_RDONLY);
1320 	if (fd == -1) {
1321 		if (errno != ENOENT && errno != EACCES) {
1322 			error = got_error_from_errno_fmt("openat %s/%s",
1323 			    dirpath, "cloneurl");
1324 		}
1325 		goto done;
1326 	}
1327 
1328 	if (fstat(fd, &sb) == -1) {
1329 		error = got_error_from_errno_fmt("fstat %s/%s",
1330 		    dirpath, "cloneurl");
1331 		goto done;
1332 	}
1333 
1334 	len = sb.st_size;
1335 	if (len > GOTWEBD_MAXCLONEURLSZ - 1)
1336 		len = GOTWEBD_MAXCLONEURLSZ - 1;
1337 
1338 	*url = calloc(len + 1, sizeof(**url));
1339 	if (*url == NULL) {
1340 		error = got_error_from_errno("calloc");
1341 		goto done;
1342 	}
1343 
1344 	if (read(fd, *url, len) == -1)
1345 		error = got_error_from_errno("read");
1346 done:
1347 	if (fd != -1 && close(fd) == -1 && error == NULL)
1348 		error = got_error_from_errno("close");
1349 	return error;
1350 }
1351 
1352 int
1353 gotweb_render_age(struct template *tp, time_t committer_time, int ref_tm)
1354 {
1355 	struct request *c = tp->tp_arg;
1356 	struct tm tm;
1357 	long long diff_time;
1358 	const char *years = "years ago", *months = "months ago";
1359 	const char *weeks = "weeks ago", *days = "days ago";
1360 	const char *hours = "hours ago",  *minutes = "minutes ago";
1361 	const char *seconds = "seconds ago", *now = "right now";
1362 	char *s;
1363 	char datebuf[64];
1364 	size_t r;
1365 
1366 	switch (ref_tm) {
1367 	case TM_DIFF:
1368 		diff_time = time(NULL) - committer_time;
1369 		if (diff_time > 60 * 60 * 24 * 365 * 2) {
1370 			if (fcgi_printf(c, "%lld %s",
1371 			    (diff_time / 60 / 60 / 24 / 365), years) == -1)
1372 				return -1;
1373 		} else if (diff_time > 60 * 60 * 24 * (365 / 12) * 2) {
1374 			if (fcgi_printf(c, "%lld %s",
1375 			    (diff_time / 60 / 60 / 24 / (365 / 12)),
1376 			    months) == -1)
1377 				return -1;
1378 		} else if (diff_time > 60 * 60 * 24 * 7 * 2) {
1379 			if (fcgi_printf(c, "%lld %s",
1380 			    (diff_time / 60 / 60 / 24 / 7), weeks) == -1)
1381 				return -1;
1382 		} else if (diff_time > 60 * 60 * 24 * 2) {
1383 			if (fcgi_printf(c, "%lld %s",
1384 			    (diff_time / 60 / 60 / 24), days) == -1)
1385 				return -1;
1386 		} else if (diff_time > 60 * 60 * 2) {
1387 			if (fcgi_printf(c, "%lld %s",
1388 			    (diff_time / 60 / 60), hours) == -1)
1389 				return -1;
1390 		} else if (diff_time > 60 * 2) {
1391 			if (fcgi_printf(c, "%lld %s", (diff_time / 60),
1392 			    minutes) == -1)
1393 				return -1;
1394 		} else if (diff_time > 2) {
1395 			if (fcgi_printf(c, "%lld %s", diff_time,
1396 			    seconds) == -1)
1397 				return -1;
1398 		} else {
1399 			if (fcgi_puts(tp, now) == -1)
1400 				return -1;
1401 		}
1402 		break;
1403 	case TM_LONG:
1404 		if (gmtime_r(&committer_time, &tm) == NULL)
1405 			return -1;
1406 
1407 		s = asctime_r(&tm, datebuf);
1408 		if (s == NULL)
1409 			return -1;
1410 
1411 		if (fcgi_puts(tp, datebuf) == -1 ||
1412 		    fcgi_puts(tp, " UTC") == -1)
1413 			return -1;
1414 		break;
1415 	case TM_RFC822:
1416 		if (gmtime_r(&committer_time, &tm) == NULL)
1417 			return -1;
1418 
1419 		r = strftime(datebuf, sizeof(datebuf),
1420 		    "%a, %d %b %Y %H:%M:%S GMT", &tm);
1421 		if (r == 0)
1422 			return -1;
1423 
1424 		if (fcgi_puts(tp, datebuf) == -1)
1425 			return -1;
1426 		break;
1427 	}
1428 	return 0;
1429 }