1 /*
2  * Copyright (c) 2016, 2019, 2020-2022 Tracey Emery <tracey@traceyemery.net>
3  * Copyright (c) 2015 Mike Larkin <mlarkin@openbsd.org>
4  * Copyright (c) 2014 Reyk Floeter <reyk@openbsd.org>
5  * Copyright (c) 2013 David Gwynne <dlg@openbsd.org>
6  * Copyright (c) 2013 Florian Obser <florian@openbsd.org>
7  *
8  * Permission to use, copy, modify, and distribute this software for any
9  * purpose with or without fee is hereby granted, provided that the above
10  * copyright notice and this permission notice appear in all copies.
11  *
12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19  */
20 
21 #include <net/if.h>
22 #include <netinet/in.h>
23 #include <sys/queue.h>
24 #include <sys/stat.h>
25 #include <sys/types.h>
26 
27 #include <ctype.h>
28 #include <dirent.h>
29 #include <errno.h>
30 #include <event.h>
31 #include <fcntl.h>
32 #include <imsg.h>
33 #include <sha2.h>
34 #include <stdio.h>
35 #include <stdlib.h>
36 #include <string.h>
37 #include <unistd.h>
38 
39 #include "got_error.h"
40 #include "got_object.h"
41 #include "got_reference.h"
42 #include "got_repository.h"
43 #include "got_path.h"
44 #include "got_cancel.h"
45 #include "got_worktree.h"
46 #include "got_diff.h"
47 #include "got_commit_graph.h"
48 #include "got_blame.h"
49 #include "got_privsep.h"
50 
51 #include "got_compat.h"
52 
53 #include "proc.h"
54 #include "gotwebd.h"
55 #include "tmpl.h"
56 
57 static const struct querystring_keys querystring_keys[] = {
58 	{ "action",		ACTION },
59 	{ "commit",		COMMIT },
60 	{ "file",		RFILE },
61 	{ "folder",		FOLDER },
62 	{ "headref",		HEADREF },
63 	{ "index_page",		INDEX_PAGE },
64 	{ "path",		PATH },
65 	{ "page",		PAGE },
66 };
67 
68 static const struct action_keys action_keys[] = {
69 	{ "blame",	BLAME },
70 	{ "blob",	BLOB },
71 	{ "blobraw",	BLOBRAW },
72 	{ "briefs",	BRIEFS },
73 	{ "commits",	COMMITS },
74 	{ "diff",	DIFF },
75 	{ "error",	ERR },
76 	{ "index",	INDEX },
77 	{ "summary",	SUMMARY },
78 	{ "tag",	TAG },
79 	{ "tags",	TAGS },
80 	{ "tree",	TREE },
81 	{ "rss",	RSS },
82 };
83 
84 static const struct got_error *gotweb_init_querystring(struct querystring **);
85 static const struct got_error *gotweb_parse_querystring(struct querystring **,
86     char *);
87 static const struct got_error *gotweb_assign_querystring(struct querystring **,
88     char *, char *);
89 static const struct got_error *gotweb_render_index(struct request *);
90 static const struct got_error *gotweb_init_repo_dir(struct repo_dir **,
91     const char *);
92 static const struct got_error *gotweb_load_got_path(struct request *c,
93     struct repo_dir *);
94 static const struct got_error *gotweb_get_repo_description(char **,
95     struct server *, const char *, int);
96 static const struct got_error *gotweb_get_clone_url(char **, struct server *,
97     const char *, int);
98 
99 static void gotweb_free_querystring(struct querystring *);
100 static void gotweb_free_repo_dir(struct repo_dir *);
101 
102 struct server *gotweb_get_server(uint8_t *, uint8_t *);
103 
104 static int
105 gotweb_reply(struct request *c, int status, const char *ctype,
106     struct gotweb_url *location)
107 {
108 	const char	*csp;
109 
110 	if (status != 200 && fcgi_printf(c, "Status: %d\r\n", status) == -1)
111 		return -1;
112 
113 	if (location) {
114 		if (fcgi_puts(c->tp, "Location: ") == -1 ||
115 		    gotweb_render_url(c, location) == -1 ||
116 		    fcgi_puts(c->tp, "\r\n") == -1)
117 			return -1;
118 	}
119 
120 	csp = "Content-Security-Policy: default-src 'self'; "
121 	    "script-src 'none'; object-src 'none';\r\n";
122 	if (fcgi_puts(c->tp, csp) == -1)
123 		return -1;
124 
125 	if (ctype && fcgi_printf(c, "Content-Type: %s\r\n", ctype) == -1)
126 		return -1;
127 
128 	return fcgi_puts(c->tp, "\r\n");
129 }
130 
131 static int
132 gotweb_reply_file(struct request *c, const char *ctype, const char *file,
133     const char *suffix)
134 {
135 	int r;
136 
137 	r = fcgi_printf(c, "Content-Disposition: attachment; "
138 	    "filename=%s%s\r\n", file, suffix ? suffix : "");
139 	if (r == -1)
140 		return -1;
141 	return gotweb_reply(c, 200, ctype, NULL);
142 }
143 
144 void
145 gotweb_process_request(struct request *c)
146 {
147 	const struct got_error *error = NULL, *error2 = NULL;
148 	struct got_blob_object *blob = NULL;
149 	struct server *srv = NULL;
150 	struct querystring *qs = NULL;
151 	struct repo_dir *repo_dir = NULL;
152 	struct got_reflist_head refs;
153 	FILE *fp = NULL;
154 	uint8_t err[] = "gotwebd experienced an error: ";
155 	int r, html = 0, fd = -1;
156 
157 	TAILQ_INIT(&refs);
158 
159 	/* init the transport */
160 	error = gotweb_init_transport(&c->t);
161 	if (error) {
162 		log_warnx("%s: %s", __func__, error->msg);
163 		return;
164 	}
165 	/* don't process any further if client disconnected */
166 	if (c->sock->client_status == CLIENT_DISCONNECT)
167 		return;
168 	/* get the gotwebd server */
169 	srv = gotweb_get_server(c->server_name, c->http_host);
170 	if (srv == NULL) {
171 		log_warnx("%s: error server is NULL", __func__);
172 		goto err;
173 	}
174 	c->srv = srv;
175 	/* parse our querystring */
176 	error = gotweb_init_querystring(&qs);
177 	if (error) {
178 		log_warnx("%s: %s", __func__, error->msg);
179 		goto err;
180 	}
181 	c->t->qs = qs;
182 	error = gotweb_parse_querystring(&qs, c->querystring);
183 	if (error) {
184 		log_warnx("%s: %s", __func__, error->msg);
185 		goto err;
186 	}
187 
188 	/*
189 	 * certain actions require a commit id in the querystring. this stops
190 	 * bad actors from exploiting this by manually manipulating the
191 	 * querystring.
192 	 */
193 
194 	if (qs->action == BLAME || qs->action == BLOB ||
195 	    qs->action == BLOBRAW || qs->action == DIFF) {
196 		if (qs->commit == NULL) {
197 			error2 = got_error(GOT_ERR_QUERYSTRING);
198 			goto render;
199 		}
200 	}
201 
202 	if (qs->action != INDEX) {
203 		error = gotweb_init_repo_dir(&repo_dir, qs->path);
204 		if (error)
205 			goto done;
206 		error = gotweb_load_got_path(c, repo_dir);
207 		c->t->repo_dir = repo_dir;
208 		if (error && error->code != GOT_ERR_LONELY_PACKIDX)
209 			goto err;
210 	}
211 
212 	if (qs->action == BLOBRAW) {
213 		const uint8_t *buf;
214 		size_t len;
215 		int binary, r;
216 
217 		error = got_get_repo_commits(c, 1);
218 		if (error)
219 			goto done;
220 
221 		error2 = got_open_blob_for_output(&blob, &fd, &binary, c);
222 		if (error2)
223 			goto render;
224 
225 		if (binary)
226 			r = gotweb_reply_file(c, "application/octet-stream",
227 			    qs->file, NULL);
228 		else
229 			r = gotweb_reply(c, 200, "text/plain", NULL);
230 		if (r == -1)
231 			goto done;
232 
233 		for (;;) {
234 			error = got_object_blob_read_block(&len, blob);
235 			if (error)
236 				goto done;
237 			if (len == 0)
238 				break;
239 			buf = got_object_blob_get_read_buf(blob);
240 			if (fcgi_gen_binary_response(c, buf, len) == -1)
241 				goto done;
242 		}
243 
244 		goto done;
245 	}
246 
247 	if (qs->action == BLOB) {
248 		int binary;
249 		struct gotweb_url url = {
250 			.index_page = -1,
251 			.page = -1,
252 			.action = BLOBRAW,
253 			.path = qs->path,
254 			.commit = qs->commit,
255 			.folder = qs->folder,
256 			.file = qs->file,
257 		};
258 
259 		error = got_get_repo_commits(c, 1);
260 		if (error)
261 			goto done;
262 
263 		error2 = got_open_blob_for_output(&blob, &fd, &binary, c);
264 		if (error2)
265 			goto render;
266 		if (binary) {
267 			gotweb_reply(c, 302, NULL, &url);
268 			goto done;
269 		}
270 	}
271 
272 	if (qs->action == RSS) {
273 		const char *ctype = "application/rss+xml;charset=utf-8";
274 
275 		if (gotweb_reply_file(c, ctype, repo_dir->name, ".rss") == -1)
276 			goto done;
277 
278 		error = got_get_repo_tags(c, D_MAXSLCOMMDISP);
279 		if (error) {
280 			log_warnx("%s: %s", __func__, error->msg);
281 			goto err;
282 		}
283 		if (gotweb_render_rss(c->tp) == -1)
284 			goto err;
285 		goto done;
286 	}
287 
288 render:
289 	if (gotweb_reply(c, 200, "text/html", NULL) == -1)
290 		goto done;
291 	html = 1;
292 
293 	if (gotweb_render_header(c->tp) == -1)
294 		goto err;
295 
296 	if (error2) {
297 		error = error2;
298 		goto err;
299 	}
300 
301 	switch(qs->action) {
302 	case BLAME:
303 		error = got_get_repo_commits(c, 1);
304 		if (error) {
305 			log_warnx("%s: %s", __func__, error->msg);
306 			goto err;
307 		}
308 		if (gotweb_render_blame(c->tp) == -1)
309 			goto done;
310 		break;
311 	case BLOB:
312 		if (gotweb_render_blob(c->tp, blob) == -1)
313 			goto err;
314 		break;
315 	case BRIEFS:
316 		if (gotweb_render_briefs(c->tp) == -1)
317 			goto err;
318 		break;
319 	case COMMITS:
320 		error = got_get_repo_commits(c, srv->max_commits_display);
321 		if (error) {
322 			log_warnx("%s: %s", __func__, error->msg);
323 			goto err;
324 		}
325 		if (gotweb_render_commits(c->tp) == -1)
326 			goto err;
327 		break;
328 	case DIFF:
329 		error = got_get_repo_commits(c, 1);
330 		if (error) {
331 			log_warnx("%s: %s", __func__, error->msg);
332 			goto err;
333 		}
334 		error = got_open_diff_for_output(&fp, &fd, c);
335 		if (error) {
336 			log_warnx("%s: %s", __func__, error->msg);
337 			goto err;
338 		}
339 		if (gotweb_render_diff(c->tp, fp) == -1)
340 			goto err;
341 		break;
342 	case INDEX:
343 		error = gotweb_render_index(c);
344 		if (error) {
345 			log_warnx("%s: %s", __func__, error->msg);
346 			goto err;
347 		}
348 		break;
349 	case SUMMARY:
350 		error = got_ref_list(&refs, c->t->repo, "refs/heads",
351 		    got_ref_cmp_by_name, NULL);
352 		if (error) {
353 			log_warnx("%s: got_ref_list: %s", __func__,
354 			    error->msg);
355 			goto err;
356 		}
357 		qs->action = TAGS;
358 		error = got_get_repo_tags(c, D_MAXSLCOMMDISP);
359 		if (error) {
360 			log_warnx("%s: got_get_repo_tags: %s", __func__,
361 			    error->msg);
362 			goto err;
363 		}
364 		qs->action = SUMMARY;
365 		if (gotweb_render_summary(c->tp, &refs) == -1)
366 			goto done;
367 		break;
368 	case TAG:
369 		error = got_get_repo_tags(c, 1);
370 		if (error) {
371 			log_warnx("%s: %s", __func__, error->msg);
372 			goto err;
373 		}
374 		if (c->t->tag_count == 0) {
375 			error = got_error_msg(GOT_ERR_BAD_OBJ_ID,
376 			    "bad commit id");
377 			goto err;
378 		}
379 		if (gotweb_render_tag(c->tp) == -1)
380 			goto done;
381 		break;
382 	case TAGS:
383 		error = got_get_repo_tags(c, srv->max_commits_display);
384 		if (error) {
385 			log_warnx("%s: %s", __func__, error->msg);
386 			goto err;
387 		}
388 		if (gotweb_render_tags(c->tp) == -1)
389 			goto done;
390 		break;
391 	case TREE:
392 		error = got_get_repo_commits(c, 1);
393 		if (error) {
394 			log_warnx("%s: %s", __func__, error->msg);
395 			goto err;
396 		}
397 		if (gotweb_render_tree(c->tp) == -1)
398 			goto err;
399 		break;
400 	case ERR:
401 	default:
402 		r = fcgi_printf(c, "<div id='err_content'>%s</div>\n",
403 		    "Erorr: Bad Querystring");
404 		if (r == -1)
405 			goto err;
406 		break;
407 	}
408 
409 	goto done;
410 err:
411 	if (html && fcgi_printf(c, "<div id='err_content'>") == -1)
412 		return;
413 	if (fcgi_printf(c, "\n%s", err) == -1)
414 		return;
415 	if (error) {
416 		if (fcgi_printf(c, "%s", error->msg) == -1)
417 			return;
418 	} else {
419 		if (fcgi_printf(c, "see daemon logs for details") == -1)
420 			return;
421 	}
422 	if (html && fcgi_printf(c, "</div>\n") == -1)
423 		return;
424 done:
425 	if (blob)
426 		got_object_blob_close(blob);
427 	if (fp) {
428 		error = got_gotweb_flushfile(fp, fd);
429 		if (error)
430 			log_warnx("%s: got_gotweb_flushfile failure: %s",
431 			    __func__, error->msg);
432 		fd = -1;
433 	}
434 	if (fd != -1)
435 		close(fd);
436 	if (html && srv != NULL)
437 		gotweb_render_footer(c->tp);
438 
439 	got_ref_list_free(&refs);
440 }
441 
442 struct server *
443 gotweb_get_server(uint8_t *server_name, uint8_t *subdomain)
444 {
445 	struct server *srv = NULL;
446 
447 	/* check against the server name first */
448 	if (strlen(server_name) > 0)
449 		TAILQ_FOREACH(srv, &gotwebd_env->servers, entry)
450 			if (strcmp(srv->name, server_name) == 0)
451 				goto done;
452 
453 	/* check against subdomain second */
454 	if (strlen(subdomain) > 0)
455 		TAILQ_FOREACH(srv, &gotwebd_env->servers, entry)
456 			if (strcmp(srv->name, subdomain) == 0)
457 				goto done;
458 
459 	/* if those fail, send first server */
460 	TAILQ_FOREACH(srv, &gotwebd_env->servers, entry)
461 		if (srv != NULL)
462 			break;
463 done:
464 	return srv;
465 };
466 
467 const struct got_error *
468 gotweb_init_transport(struct transport **t)
469 {
470 	const struct got_error *error = NULL;
471 
472 	*t = calloc(1, sizeof(**t));
473 	if (*t == NULL)
474 		return got_error_from_errno2("%s: calloc", __func__);
475 
476 	TAILQ_INIT(&(*t)->repo_commits);
477 	TAILQ_INIT(&(*t)->repo_tags);
478 
479 	(*t)->repo = NULL;
480 	(*t)->repo_dir = NULL;
481 	(*t)->qs = NULL;
482 	(*t)->next_id = NULL;
483 	(*t)->prev_id = NULL;
484 	(*t)->next_disp = 0;
485 	(*t)->prev_disp = 0;
486 
487 	return error;
488 }
489 
490 static const struct got_error *
491 gotweb_init_querystring(struct querystring **qs)
492 {
493 	const struct got_error *error = NULL;
494 
495 	*qs = calloc(1, sizeof(**qs));
496 	if (*qs == NULL)
497 		return got_error_from_errno2("%s: calloc", __func__);
498 
499 	(*qs)->headref = strdup("HEAD");
500 	if ((*qs)->headref == NULL) {
501 		free(*qs);
502 		*qs = NULL;
503 		return got_error_from_errno2("%s: strdup", __func__);
504 	}
505 
506 	(*qs)->action = INDEX;
507 	(*qs)->commit = NULL;
508 	(*qs)->file = NULL;
509 	(*qs)->folder = NULL;
510 	(*qs)->index_page = 0;
511 	(*qs)->path = NULL;
512 
513 	return error;
514 }
515 
516 static const struct got_error *
517 gotweb_parse_querystring(struct querystring **qs, char *qst)
518 {
519 	const struct got_error *error = NULL;
520 	char *tok1 = NULL, *tok1_pair = NULL, *tok1_end = NULL;
521 	char *tok2 = NULL, *tok2_pair = NULL, *tok2_end = NULL;
522 
523 	if (qst == NULL)
524 		return error;
525 
526 	tok1 = strdup(qst);
527 	if (tok1 == NULL)
528 		return got_error_from_errno2("%s: strdup", __func__);
529 
530 	tok1_pair = tok1;
531 	tok1_end = tok1;
532 
533 	while (tok1_pair != NULL) {
534 		strsep(&tok1_end, "&");
535 
536 		tok2 = strdup(tok1_pair);
537 		if (tok2 == NULL) {
538 			free(tok1);
539 			return got_error_from_errno2("%s: strdup", __func__);
540 		}
541 
542 		tok2_pair = tok2;
543 		tok2_end = tok2;
544 
545 		while (tok2_pair != NULL) {
546 			strsep(&tok2_end, "=");
547 			if (tok2_end) {
548 				error = gotweb_assign_querystring(qs, tok2_pair,
549 				    tok2_end);
550 				if (error)
551 					goto err;
552 			}
553 			tok2_pair = tok2_end;
554 		}
555 		free(tok2);
556 		tok1_pair = tok1_end;
557 	}
558 	free(tok1);
559 	return error;
560 err:
561 	free(tok2);
562 	free(tok1);
563 	return error;
564 }
565 
566 /*
567  * Adapted from usr.sbin/httpd/httpd.c url_decode.
568  */
569 static const struct got_error *
570 gotweb_urldecode(char *url)
571 {
572 	char		*p, *q;
573 	char		 hex[3];
574 	unsigned long	 x;
575 
576 	hex[2] = '\0';
577 	p = q = url;
578 
579 	while (*p != '\0') {
580 		switch (*p) {
581 		case '%':
582 			/* Encoding character is followed by two hex chars */
583 			if (!isxdigit((unsigned char)p[1]) ||
584 			    !isxdigit((unsigned char)p[2]) ||
585 			    (p[1] == '0' && p[2] == '0'))
586 				return got_error(GOT_ERR_BAD_QUERYSTRING);
587 
588 			hex[0] = p[1];
589 			hex[1] = p[2];
590 
591 			/*
592 			 * We don't have to validate "hex" because it is
593 			 * guaranteed to include two hex chars followed by nul.
594 			 */
595 			x = strtoul(hex, NULL, 16);
596 			*q = (char)x;
597 			p += 2;
598 			break;
599 		default:
600 			*q = *p;
601 			break;
602 		}
603 		p++;
604 		q++;
605 	}
606 	*q = '\0';
607 
608 	return NULL;
609 }
610 
611 static const struct got_error *
612 gotweb_assign_querystring(struct querystring **qs, char *key, char *value)
613 {
614 	const struct got_error *error = NULL;
615 	const char *errstr;
616 	int a_cnt, el_cnt;
617 
618 	error = gotweb_urldecode(value);
619 	if (error)
620 		return error;
621 
622 	for (el_cnt = 0; el_cnt < QSELEM__MAX; el_cnt++) {
623 		if (strcmp(key, querystring_keys[el_cnt].name) != 0)
624 			continue;
625 
626 		switch (querystring_keys[el_cnt].element) {
627 		case ACTION:
628 			for (a_cnt = 0; a_cnt < ACTIONS__MAX; a_cnt++) {
629 				if (strcmp(value, action_keys[a_cnt].name) != 0)
630 					continue;
631 				else if (strcmp(value,
632 				    action_keys[a_cnt].name) == 0){
633 					(*qs)->action =
634 					    action_keys[a_cnt].action;
635 					goto qa_found;
636 				}
637 			}
638 			(*qs)->action = ERR;
639 qa_found:
640 			break;
641 		case COMMIT:
642 			(*qs)->commit = strdup(value);
643 			if ((*qs)->commit == NULL) {
644 				error = got_error_from_errno2("%s: strdup",
645 				    __func__);
646 				goto done;
647 			}
648 			break;
649 		case RFILE:
650 			(*qs)->file = strdup(value);
651 			if ((*qs)->file == NULL) {
652 				error = got_error_from_errno2("%s: strdup",
653 				    __func__);
654 				goto done;
655 			}
656 			break;
657 		case FOLDER:
658 			(*qs)->folder = strdup(value);
659 			if ((*qs)->folder == NULL) {
660 				error = got_error_from_errno2("%s: strdup",
661 				    __func__);
662 				goto done;
663 			}
664 			break;
665 		case HEADREF:
666 			free((*qs)->headref);
667 			(*qs)->headref = strdup(value);
668 			if ((*qs)->headref == NULL) {
669 				error = got_error_from_errno2("%s: strdup",
670 				    __func__);
671 				goto done;
672 			}
673 			break;
674 		case INDEX_PAGE:
675 			if (strlen(value) == 0)
676 				break;
677 			(*qs)->index_page = strtonum(value, INT64_MIN,
678 			    INT64_MAX, &errstr);
679 			if (errstr) {
680 				error = got_error_from_errno3("%s: strtonum %s",
681 				    __func__, errstr);
682 				goto done;
683 			}
684 			if ((*qs)->index_page < 0)
685 				(*qs)->index_page = 0;
686 			break;
687 		case PATH:
688 			(*qs)->path = strdup(value);
689 			if ((*qs)->path == NULL) {
690 				error = got_error_from_errno2("%s: strdup",
691 				    __func__);
692 				goto done;
693 			}
694 			break;
695 		case PAGE:
696 			if (strlen(value) == 0)
697 				break;
698 			(*qs)->page = strtonum(value, INT64_MIN,
699 			    INT64_MAX, &errstr);
700 			if (errstr) {
701 				error = got_error_from_errno3("%s: strtonum %s",
702 				    __func__, errstr);
703 				goto done;
704 			}
705 			if ((*qs)->page < 0)
706 				(*qs)->page = 0;
707 			break;
708 		default:
709 			break;
710 		}
711 	}
712 done:
713 	return error;
714 }
715 
716 void
717 gotweb_free_repo_tag(struct repo_tag *rt)
718 {
719 	if (rt != NULL) {
720 		free(rt->commit_id);
721 		free(rt->tag_name);
722 		free(rt->tag_commit);
723 		free(rt->commit_msg);
724 		free(rt->tagger);
725 	}
726 	free(rt);
727 }
728 
729 void
730 gotweb_free_repo_commit(struct repo_commit *rc)
731 {
732 	if (rc != NULL) {
733 		free(rc->path);
734 		free(rc->refs_str);
735 		free(rc->commit_id);
736 		free(rc->parent_id);
737 		free(rc->tree_id);
738 		free(rc->author);
739 		free(rc->committer);
740 		free(rc->commit_msg);
741 	}
742 	free(rc);
743 }
744 
745 static void
746 gotweb_free_querystring(struct querystring *qs)
747 {
748 	if (qs != NULL) {
749 		free(qs->commit);
750 		free(qs->file);
751 		free(qs->folder);
752 		free(qs->headref);
753 		free(qs->path);
754 	}
755 	free(qs);
756 }
757 
758 static void
759 gotweb_free_repo_dir(struct repo_dir *repo_dir)
760 {
761 	if (repo_dir != NULL) {
762 		free(repo_dir->name);
763 		free(repo_dir->owner);
764 		free(repo_dir->description);
765 		free(repo_dir->url);
766 		free(repo_dir->path);
767 	}
768 	free(repo_dir);
769 }
770 
771 void
772 gotweb_free_transport(struct transport *t)
773 {
774 	struct repo_commit *rc = NULL, *trc = NULL;
775 	struct repo_tag *rt = NULL, *trt = NULL;
776 
777 	TAILQ_FOREACH_SAFE(rc, &t->repo_commits, entry, trc) {
778 		TAILQ_REMOVE(&t->repo_commits, rc, entry);
779 		gotweb_free_repo_commit(rc);
780 	}
781 	TAILQ_FOREACH_SAFE(rt, &t->repo_tags, entry, trt) {
782 		TAILQ_REMOVE(&t->repo_tags, rt, entry);
783 		gotweb_free_repo_tag(rt);
784 	}
785 	gotweb_free_repo_dir(t->repo_dir);
786 	gotweb_free_querystring(t->qs);
787 	free(t->more_id);
788 	free(t->next_id);
789 	free(t->prev_id);
790 	free(t);
791 }
792 
793 void
794 gotweb_get_navs(struct request *c, struct gotweb_url *prev, int *have_prev,
795     struct gotweb_url *next, int *have_next)
796 {
797 	struct transport *t = c->t;
798 	struct querystring *qs = t->qs;
799 	struct server *srv = c->srv;
800 
801 	*have_prev = *have_next = 0;
802 
803 	switch(qs->action) {
804 	case INDEX:
805 		if (qs->index_page > 0) {
806 			*have_prev = 1;
807 			*prev = (struct gotweb_url){
808 				.action = -1,
809 				.index_page = qs->index_page - 1,
810 				.page = -1,
811 			};
812 		}
813 		if (t->next_disp == srv->max_repos_display &&
814 		    t->repos_total != (qs->index_page + 1) *
815 		    srv->max_repos_display) {
816 			*have_next = 1;
817 			*next = (struct gotweb_url){
818 				.action = -1,
819 				.index_page = qs->index_page + 1,
820 				.page = -1,
821 			};
822 		}
823 		break;
824 	case TAGS:
825 		if (t->prev_id && qs->commit != NULL &&
826 		    strcmp(qs->commit, t->prev_id) != 0) {
827 			*have_prev = 1;
828 			*prev = (struct gotweb_url){
829 				.action = TAGS,
830 				.index_page = -1,
831 				.page = qs->page - 1,
832 				.path = qs->path,
833 				.commit = t->prev_id,
834 				.headref = qs->headref,
835 			};
836 		}
837 		if (t->next_id) {
838 			*have_next = 1;
839 			*next = (struct gotweb_url){
840 				.action = TAGS,
841 				.index_page = -1,
842 				.page = qs->page + 1,
843 				.path = qs->path,
844 				.commit = t->next_id,
845 				.headref = qs->headref,
846 			};
847 		}
848 		break;
849 	}
850 }
851 
852 static const struct got_error *
853 gotweb_render_index(struct request *c)
854 {
855 	const struct got_error *error = NULL;
856 	struct server *srv = c->srv;
857 	struct transport *t = c->t;
858 	struct querystring *qs = t->qs;
859 	struct repo_dir *repo_dir = NULL;
860 	struct dirent **sd_dent = NULL;
861 	unsigned int d_cnt, d_i, d_disp = 0;
862 	unsigned int d_skipped = 0;
863 	int type;
864 
865 	d_cnt = scandir(srv->repos_path, &sd_dent, NULL, alphasort);
866 	if (d_cnt == -1) {
867 		sd_dent = NULL;
868 		error = got_error_from_errno2("scandir", srv->repos_path);
869 		goto done;
870 	}
871 
872 	if (gotweb_render_repo_table_hdr(c->tp) == -1)
873 		goto done;
874 
875 	for (d_i = 0; d_i < d_cnt; d_i++) {
876 		if (srv->max_repos > 0 && t->prev_disp == srv->max_repos)
877 			break;
878 
879 		if (strcmp(sd_dent[d_i]->d_name, ".") == 0 ||
880 		    strcmp(sd_dent[d_i]->d_name, "..") == 0) {
881 			d_skipped++;
882 			continue;
883 		}
884 
885 		error = got_path_dirent_type(&type, srv->repos_path,
886 		    sd_dent[d_i]);
887 		if (error)
888 			goto done;
889 		if (type != DT_DIR) {
890 			d_skipped++;
891 			continue;
892 		}
893 
894 		if (qs->index_page > 0 && (qs->index_page *
895 		    srv->max_repos_display) > t->prev_disp) {
896 			t->prev_disp++;
897 			continue;
898 		}
899 
900 		error = gotweb_init_repo_dir(&repo_dir, sd_dent[d_i]->d_name);
901 		if (error)
902 			goto done;
903 
904 		error = gotweb_load_got_path(c, repo_dir);
905 		if (error && error->code == GOT_ERR_NOT_GIT_REPO) {
906 			error = NULL;
907 			gotweb_free_repo_dir(repo_dir);
908 			repo_dir = NULL;
909 			d_skipped++;
910 			continue;
911 		}
912 		if (error && error->code != GOT_ERR_LONELY_PACKIDX)
913 			goto done;
914 
915 		d_disp++;
916 		t->prev_disp++;
917 
918 		if (gotweb_render_repo_fragment(c->tp, repo_dir) == -1)
919 			goto done;
920 
921 		gotweb_free_repo_dir(repo_dir);
922 		repo_dir = NULL;
923 		t->next_disp++;
924 		if (d_disp == srv->max_repos_display)
925 			break;
926 	}
927 	t->repos_total = d_cnt - d_skipped;
928 
929 	if (srv->max_repos_display == 0)
930 		goto done;
931 	if (srv->max_repos > 0 && srv->max_repos < srv->max_repos_display)
932 		goto done;
933 	if (t->repos_total <= srv->max_repos ||
934 	    t->repos_total <= srv->max_repos_display)
935 		goto done;
936 
937 	if (gotweb_render_navs(c->tp) == -1)
938 		goto done;
939 done:
940 	if (sd_dent) {
941 		for (d_i = 0; d_i < d_cnt; d_i++)
942 			free(sd_dent[d_i]);
943 		free(sd_dent);
944 	}
945 	return error;
946 }
947 
948 static inline int
949 should_urlencode(int c)
950 {
951 	if (c <= ' ' || c >= 127)
952 		return 1;
953 
954 	switch (c) {
955 		/* gen-delim */
956 	case ':':
957 	case '/':
958 	case '?':
959 	case '#':
960 	case '[':
961 	case ']':
962 	case '@':
963 		/* sub-delims */
964 	case '!':
965 	case '$':
966 	case '&':
967 	case '\'':
968 	case '(':
969 	case ')':
970 	case '*':
971 	case '+':
972 	case ',':
973 	case ';':
974 	case '=':
975 		/* needed because the URLs are embedded into the HTML */
976 	case '\"':
977 		return 1;
978 	default:
979 		return 0;
980 	}
981 }
982 
983 static char *
984 gotweb_urlencode(const char *str)
985 {
986 	const char *s;
987 	char *escaped;
988 	size_t i, len;
989 	int a, b;
990 
991 	len = 0;
992 	for (s = str; *s; ++s) {
993 		len++;
994 		if (should_urlencode(*s))
995 			len += 2;
996 	}
997 
998 	escaped = calloc(1, len + 1);
999 	if (escaped == NULL)
1000 		return NULL;
1001 
1002 	i = 0;
1003 	for (s = str; *s; ++s) {
1004 		if (should_urlencode(*s)) {
1005 			a = (*s & 0xF0) >> 4;
1006 			b = (*s & 0x0F);
1007 
1008 			escaped[i++] = '%';
1009 			escaped[i++] = a <= 9 ? ('0' + a) : ('7' + a);
1010 			escaped[i++] = b <= 9 ? ('0' + b) : ('7' + b);
1011 		} else
1012 			escaped[i++] = *s;
1013 	}
1014 
1015 	return escaped;
1016 }
1017 
1018 const char *
1019 gotweb_action_name(int action)
1020 {
1021 	switch (action) {
1022 	case BLAME:
1023 		return "blame";
1024 	case BLOB:
1025 		return "blob";
1026 	case BLOBRAW:
1027 		return "blobraw";
1028 	case BRIEFS:
1029 		return "briefs";
1030 	case COMMITS:
1031 		return "commits";
1032 	case DIFF:
1033 		return "diff";
1034 	case ERR:
1035 		return "err";
1036 	case INDEX:
1037 		return "index";
1038 	case SUMMARY:
1039 		return "summary";
1040 	case TAG:
1041 		return "tag";
1042 	case TAGS:
1043 		return "tags";
1044 	case TREE:
1045 		return "tree";
1046 	case RSS:
1047 		return "rss";
1048 	default:
1049 		return NULL;
1050 	}
1051 }
1052 
1053 int
1054 gotweb_render_url(struct request *c, struct gotweb_url *url)
1055 {
1056 	const char *sep = "?", *action;
1057 	char *tmp;
1058 	int r;
1059 
1060 	action = gotweb_action_name(url->action);
1061 	if (action != NULL) {
1062 		if (fcgi_printf(c, "?action=%s", action) == -1)
1063 			return -1;
1064 		sep = "&";
1065 	}
1066 
1067 	if (url->commit) {
1068 		if (fcgi_printf(c, "%scommit=%s", sep, url->commit) == -1)
1069 			return -1;
1070 		sep = "&";
1071 	}
1072 
1073 	if (url->previd) {
1074 		if (fcgi_printf(c, "%sprevid=%s", sep, url->previd) == -1)
1075 			return -1;
1076 		sep = "&";
1077 	}
1078 
1079 	if (url->prevset) {
1080 		if (fcgi_printf(c, "%sprevset=%s", sep, url->prevset) == -1)
1081 			return -1;
1082 		sep = "&";
1083 	}
1084 
1085 	if (url->file) {
1086 		tmp = gotweb_urlencode(url->file);
1087 		if (tmp == NULL)
1088 			return -1;
1089 		r = fcgi_printf(c, "%sfile=%s", sep, tmp);
1090 		free(tmp);
1091 		if (r == -1)
1092 			return -1;
1093 		sep = "&";
1094 	}
1095 
1096 	if (url->folder) {
1097 		tmp = gotweb_urlencode(url->folder);
1098 		if (tmp == NULL)
1099 			return -1;
1100 		r = fcgi_printf(c, "%sfolder=%s", sep, tmp);
1101 		free(tmp);
1102 		if (r == -1)
1103 			return -1;
1104 		sep = "&";
1105 	}
1106 
1107 	if (url->headref) {
1108 		tmp = gotweb_urlencode(url->headref);
1109 		if (tmp == NULL)
1110 			return -1;
1111 		r = fcgi_printf(c, "%sheadref=%s", sep, url->headref);
1112 		free(tmp);
1113 		if (r == -1)
1114 			return -1;
1115 		sep = "&";
1116 	}
1117 
1118 	if (url->index_page != -1) {
1119 		if (fcgi_printf(c, "%sindex_page=%d", sep,
1120 		    url->index_page) == -1)
1121 			return -1;
1122 		sep = "&";
1123 	}
1124 
1125 	if (url->path) {
1126 		tmp = gotweb_urlencode(url->path);
1127 		if (tmp == NULL)
1128 			return -1;
1129 		r = fcgi_printf(c, "%spath=%s", sep, tmp);
1130 		free(tmp);
1131 		if (r == -1)
1132 			return -1;
1133 		sep = "&";
1134 	}
1135 
1136 	if (url->page != -1) {
1137 		if (fcgi_printf(c, "%spage=%d", sep, url->page) == -1)
1138 			return -1;
1139 		sep = "&";
1140 	}
1141 
1142 	return 0;
1143 }
1144 
1145 int
1146 gotweb_render_absolute_url(struct request *c, struct gotweb_url *url)
1147 {
1148 	struct template	*tp = c->tp;
1149 	const char	*proto = c->https ? "https" : "http";
1150 
1151 	if (fcgi_puts(tp, proto) == -1 ||
1152 	    fcgi_puts(tp, "://") == -1 ||
1153 	    tp_htmlescape(tp, c->server_name) == -1 ||
1154 	    tp_htmlescape(tp, c->document_uri) == -1)
1155 		return -1;
1156 
1157 	return gotweb_render_url(c, url);
1158 }
1159 
1160 static struct got_repository *
1161 find_cached_repo(struct server *srv, const char *path)
1162 {
1163 	int i;
1164 
1165 	for (i = 0; i < srv->ncached_repos; i++) {
1166 		if (strcmp(srv->cached_repos[i].path, path) == 0)
1167 			return srv->cached_repos[i].repo;
1168 	}
1169 
1170 	return NULL;
1171 }
1172 
1173 static const struct got_error *
1174 cache_repo(struct got_repository **new, struct server *srv,
1175     struct repo_dir *repo_dir, struct socket *sock)
1176 {
1177 	const struct got_error *error = NULL;
1178 	struct got_repository *repo;
1179 	struct cached_repo *cr;
1180 	int evicted = 0;
1181 
1182 	if (srv->ncached_repos >= GOTWEBD_REPO_CACHESIZE) {
1183 		cr = &srv->cached_repos[srv->ncached_repos - 1];
1184 		error = got_repo_close(cr->repo);
1185 		memset(cr, 0, sizeof(*cr));
1186 		srv->ncached_repos--;
1187 		if (error)
1188 			return error;
1189 		memmove(&srv->cached_repos[1], &srv->cached_repos[0],
1190 		    srv->ncached_repos * sizeof(srv->cached_repos[0]));
1191 		cr = &srv->cached_repos[0];
1192 		evicted = 1;
1193 	} else {
1194 		cr = &srv->cached_repos[srv->ncached_repos];
1195 	}
1196 
1197 	error = got_repo_open(&repo, repo_dir->path, NULL, sock->pack_fds);
1198 	if (error) {
1199 		if (evicted) {
1200 			memmove(&srv->cached_repos[0], &srv->cached_repos[1],
1201 			    srv->ncached_repos * sizeof(srv->cached_repos[0]));
1202 		}
1203 		return error;
1204 	}
1205 
1206 	if (strlcpy(cr->path, repo_dir->path, sizeof(cr->path))
1207 	    >= sizeof(cr->path)) {
1208 		if (evicted) {
1209 			memmove(&srv->cached_repos[0], &srv->cached_repos[1],
1210 			    srv->ncached_repos * sizeof(srv->cached_repos[0]));
1211 		}
1212 		return got_error(GOT_ERR_NO_SPACE);
1213 	}
1214 
1215 	cr->repo = repo;
1216 	srv->ncached_repos++;
1217 	*new = repo;
1218 	return NULL;
1219 }
1220 
1221 static const struct got_error *
1222 gotweb_load_got_path(struct request *c, struct repo_dir *repo_dir)
1223 {
1224 	const struct got_error *error = NULL;
1225 	struct socket *sock = c->sock;
1226 	struct server *srv = c->srv;
1227 	struct transport *t = c->t;
1228 	struct got_repository *repo = NULL;
1229 	DIR *dt;
1230 	char *dir_test;
1231 
1232 	if (asprintf(&dir_test, "%s/%s/%s", srv->repos_path, repo_dir->name,
1233 	    GOTWEB_GIT_DIR) == -1)
1234 		return got_error_from_errno("asprintf");
1235 
1236 	dt = opendir(dir_test);
1237 	if (dt == NULL) {
1238 		free(dir_test);
1239 	} else {
1240 		repo_dir->path = dir_test;
1241 		dir_test = NULL;
1242 		goto done;
1243 	}
1244 
1245 	if (asprintf(&dir_test, "%s/%s", srv->repos_path,
1246 	    repo_dir->name) == -1)
1247 		return got_error_from_errno("asprintf");
1248 
1249 	dt = opendir(dir_test);
1250 	if (dt == NULL) {
1251 		error = got_error_path(repo_dir->name, GOT_ERR_NOT_GIT_REPO);
1252 		goto err;
1253 	} else {
1254 		repo_dir->path = dir_test;
1255 		dir_test = NULL;
1256 	}
1257 
1258 done:
1259 	if (srv->respect_exportok &&
1260 	    faccessat(dirfd(dt), "git-daemon-export-ok", F_OK, 0) == -1) {
1261 		error = got_error_path(repo_dir->name, GOT_ERR_NOT_GIT_REPO);
1262 		goto err;
1263 	}
1264 
1265 	repo = find_cached_repo(srv, repo_dir->path);
1266 	if (repo == NULL) {
1267 		error = cache_repo(&repo, srv, repo_dir, sock);
1268 		if (error)
1269 			goto err;
1270 	}
1271 	t->repo = repo;
1272 	error = gotweb_get_repo_description(&repo_dir->description, srv,
1273 	    repo_dir->path, dirfd(dt));
1274 	if (error)
1275 		goto err;
1276 	error = got_get_repo_owner(&repo_dir->owner, c);
1277 	if (error)
1278 		goto err;
1279 	error = got_get_repo_age(&repo_dir->age, c, NULL);
1280 	if (error)
1281 		goto err;
1282 	error = gotweb_get_clone_url(&repo_dir->url, srv, repo_dir->path,
1283 	    dirfd(dt));
1284 err:
1285 	free(dir_test);
1286 	if (dt != NULL && closedir(dt) == EOF && error == NULL)
1287 		error = got_error_from_errno("closedir");
1288 	return error;
1289 }
1290 
1291 static const struct got_error *
1292 gotweb_init_repo_dir(struct repo_dir **repo_dir, const char *dir)
1293 {
1294 	const struct got_error *error;
1295 
1296 	*repo_dir = calloc(1, sizeof(**repo_dir));
1297 	if (*repo_dir == NULL)
1298 		return got_error_from_errno("calloc");
1299 
1300 	if (asprintf(&(*repo_dir)->name, "%s", dir) == -1) {
1301 		error = got_error_from_errno("asprintf");
1302 		free(*repo_dir);
1303 		*repo_dir = NULL;
1304 		return error;
1305 	}
1306 	(*repo_dir)->owner = NULL;
1307 	(*repo_dir)->description = NULL;
1308 	(*repo_dir)->url = NULL;
1309 	(*repo_dir)->path = NULL;
1310 
1311 	return NULL;
1312 }
1313 
1314 static const struct got_error *
1315 gotweb_get_repo_description(char **description, struct server *srv,
1316     const char *dirpath, int dir)
1317 {
1318 	const struct got_error *error = NULL;
1319 	struct stat sb;
1320 	int fd = -1;
1321 	off_t len;
1322 
1323 	*description = NULL;
1324 	if (srv->show_repo_description == 0)
1325 		return NULL;
1326 
1327 	fd = openat(dir, "description", O_RDONLY);
1328 	if (fd == -1) {
1329 		if (errno != ENOENT && errno != EACCES) {
1330 			error = got_error_from_errno_fmt("openat %s/%s",
1331 			    dirpath, "description");
1332 		}
1333 		goto done;
1334 	}
1335 
1336 	if (fstat(fd, &sb) == -1) {
1337 		error = got_error_from_errno_fmt("fstat %s/%s",
1338 		    dirpath, "description");
1339 		goto done;
1340 	}
1341 
1342 	len = sb.st_size;
1343 	if (len > GOTWEBD_MAXDESCRSZ - 1)
1344 		len = GOTWEBD_MAXDESCRSZ - 1;
1345 
1346 	*description = calloc(len + 1, sizeof(**description));
1347 	if (*description == NULL) {
1348 		error = got_error_from_errno("calloc");
1349 		goto done;
1350 	}
1351 
1352 	if (read(fd, *description, len) == -1)
1353 		error = got_error_from_errno("read");
1354 done:
1355 	if (fd != -1 && close(fd) == -1 && error == NULL)
1356 		error = got_error_from_errno("close");
1357 	return error;
1358 }
1359 
1360 static const struct got_error *
1361 gotweb_get_clone_url(char **url, struct server *srv, const char *dirpath,
1362     int dir)
1363 {
1364 	const struct got_error *error = NULL;
1365 	struct stat sb;
1366 	int fd = -1;
1367 	off_t len;
1368 
1369 	*url = NULL;
1370 	if (srv->show_repo_cloneurl == 0)
1371 		return NULL;
1372 
1373 	fd = openat(dir, "cloneurl", O_RDONLY);
1374 	if (fd == -1) {
1375 		if (errno != ENOENT && errno != EACCES) {
1376 			error = got_error_from_errno_fmt("openat %s/%s",
1377 			    dirpath, "cloneurl");
1378 		}
1379 		goto done;
1380 	}
1381 
1382 	if (fstat(fd, &sb) == -1) {
1383 		error = got_error_from_errno_fmt("fstat %s/%s",
1384 		    dirpath, "cloneurl");
1385 		goto done;
1386 	}
1387 
1388 	len = sb.st_size;
1389 	if (len > GOTWEBD_MAXCLONEURLSZ - 1)
1390 		len = GOTWEBD_MAXCLONEURLSZ - 1;
1391 
1392 	*url = calloc(len + 1, sizeof(**url));
1393 	if (*url == NULL) {
1394 		error = got_error_from_errno("calloc");
1395 		goto done;
1396 	}
1397 
1398 	if (read(fd, *url, len) == -1)
1399 		error = got_error_from_errno("read");
1400 done:
1401 	if (fd != -1 && close(fd) == -1 && error == NULL)
1402 		error = got_error_from_errno("close");
1403 	return error;
1404 }
1405 
1406 int
1407 gotweb_render_age(struct template *tp, time_t committer_time, int ref_tm)
1408 {
1409 	struct request *c = tp->tp_arg;
1410 	struct tm tm;
1411 	long long diff_time;
1412 	const char *years = "years ago", *months = "months ago";
1413 	const char *weeks = "weeks ago", *days = "days ago";
1414 	const char *hours = "hours ago",  *minutes = "minutes ago";
1415 	const char *seconds = "seconds ago", *now = "right now";
1416 	char *s;
1417 	char datebuf[64];
1418 	size_t r;
1419 
1420 	switch (ref_tm) {
1421 	case TM_DIFF:
1422 		diff_time = time(NULL) - committer_time;
1423 		if (diff_time > 60 * 60 * 24 * 365 * 2) {
1424 			if (fcgi_printf(c, "%lld %s",
1425 			    (diff_time / 60 / 60 / 24 / 365), years) == -1)
1426 				return -1;
1427 		} else if (diff_time > 60 * 60 * 24 * (365 / 12) * 2) {
1428 			if (fcgi_printf(c, "%lld %s",
1429 			    (diff_time / 60 / 60 / 24 / (365 / 12)),
1430 			    months) == -1)
1431 				return -1;
1432 		} else if (diff_time > 60 * 60 * 24 * 7 * 2) {
1433 			if (fcgi_printf(c, "%lld %s",
1434 			    (diff_time / 60 / 60 / 24 / 7), weeks) == -1)
1435 				return -1;
1436 		} else if (diff_time > 60 * 60 * 24 * 2) {
1437 			if (fcgi_printf(c, "%lld %s",
1438 			    (diff_time / 60 / 60 / 24), days) == -1)
1439 				return -1;
1440 		} else if (diff_time > 60 * 60 * 2) {
1441 			if (fcgi_printf(c, "%lld %s",
1442 			    (diff_time / 60 / 60), hours) == -1)
1443 				return -1;
1444 		} else if (diff_time > 60 * 2) {
1445 			if (fcgi_printf(c, "%lld %s", (diff_time / 60),
1446 			    minutes) == -1)
1447 				return -1;
1448 		} else if (diff_time > 2) {
1449 			if (fcgi_printf(c, "%lld %s", diff_time,
1450 			    seconds) == -1)
1451 				return -1;
1452 		} else {
1453 			if (fcgi_puts(tp, now) == -1)
1454 				return -1;
1455 		}
1456 		break;
1457 	case TM_LONG:
1458 		if (gmtime_r(&committer_time, &tm) == NULL)
1459 			return -1;
1460 
1461 		s = asctime_r(&tm, datebuf);
1462 		if (s == NULL)
1463 			return -1;
1464 
1465 		if (fcgi_puts(tp, datebuf) == -1 ||
1466 		    fcgi_puts(tp, " UTC") == -1)
1467 			return -1;
1468 		break;
1469 	case TM_RFC822:
1470 		if (gmtime_r(&committer_time, &tm) == NULL)
1471 			return -1;
1472 
1473 		r = strftime(datebuf, sizeof(datebuf),
1474 		    "%a, %d %b %Y %H:%M:%S GMT", &tm);
1475 		if (r == 0)
1476 			return -1;
1477 
1478 		if (fcgi_puts(tp, datebuf) == -1)
1479 			return -1;
1480 		break;
1481 	}
1482 	return 0;
1483 }