1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  * Copyright (c) 2016-2019, 2020-2021 Tracey Emery <tracey@traceyemery.net>
4  * Copyright (c) 2004, 2005 Esben Norby <norby@openbsd.org>
5  * Copyright (c) 2004 Ryan McBride <mcbride@openbsd.org>
6  * Copyright (c) 2002, 2003, 2004 Henning Brauer <henning@openbsd.org>
7  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
8  * Copyright (c) 2001 Daniel Hartmeier.  All rights reserved.
9  * Copyright (c) 2001 Theo de Raadt.  All rights reserved.
10  *
11  * Permission to use, copy, modify, and distribute this software for any
12  * purpose with or without fee is hereby granted, provided that the above
13  * copyright notice and this permission notice appear in all copies.
14  *
15  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
16  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
17  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
18  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
19  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
20  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
21  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
22  */
23 
24 %{
25 #include <sys/time.h>
26 #include <sys/types.h>
27 #include <sys/queue.h>
28 #include <sys/stat.h>
29 
30 #include <ctype.h>
31 #include <err.h>
32 #include <errno.h>
33 #include <event.h>
34 #include <imsg.h>
35 #include <limits.h>
36 #include <stdarg.h>
37 #include <stdlib.h>
38 #include <stdio.h>
39 #include <string.h>
40 #include <syslog.h>
41 #include <unistd.h>
42 
43 #include "got_error.h"
44 #include "got_path.h"
45 #include "got_reference.h"
46 
47 #include "log.h"
48 #include "gotd.h"
49 #include "auth.h"
50 #include "listen.h"
51 
52 TAILQ_HEAD(files, file)		 files = TAILQ_HEAD_INITIALIZER(files);
53 static struct file {
54 	TAILQ_ENTRY(file)	 entry;
55 	FILE			*stream;
56 	char			*name;
57 	int			 lineno;
58 	int			 errors;
59 } *file;
60 struct file	*newfile(const char *, int, int);
61 static void	 closefile(struct file *);
62 int		 check_file_secrecy(int, const char *);
63 int		 yyparse(void);
64 int		 yylex(void);
65 int		 yyerror(const char *, ...)
66     __attribute__((__format__ (printf, 1, 2)))
67     __attribute__((__nonnull__ (1)));
68 int		 kw_cmp(const void *, const void *);
69 int		 lookup(char *);
70 int		 lgetc(int);
71 int		 lungetc(int);
72 int		 findeol(void);
73 
74 TAILQ_HEAD(symhead, sym)	 symhead = TAILQ_HEAD_INITIALIZER(symhead);
75 struct sym {
76 	TAILQ_ENTRY(sym)	 entry;
77 	int			 used;
78 	int			 persist;
79 	char			*nam;
80 	char			*val;
81 };
82 
83 int	 symset(const char *, const char *, int);
84 char	*symget(const char *);
85 
86 static int		 errors;
87 
88 static struct gotd		*gotd;
89 static struct gotd_repo		*new_repo;
90 static int			 conf_limit_user_connections(const char *, int);
91 static struct gotd_repo		*conf_new_repo(const char *);
92 static void			 conf_new_access_rule(struct gotd_repo *,
93 				    enum gotd_access, int, char *);
94 static int			 conf_protect_ref_namespace(char **,
95 				    struct got_pathlist_head *, char *);
96 static int			 conf_protect_tag_namespace(struct gotd_repo *,
97 				    char *);
98 static int			 conf_protect_branch_namespace(
99 				    struct gotd_repo *, char *);
100 static int			 conf_protect_branch(struct gotd_repo *,
101 				    char *);
102 static enum gotd_procid		 gotd_proc_id;
103 
104 typedef struct {
105 	union {
106 		long long	 number;
107 		char		*string;
108 		struct timeval	 tv;
109 	} v;
110 	int lineno;
111 } YYSTYPE;
112 
113 %}
114 
115 %token	PATH ERROR LISTEN ON USER REPOSITORY PERMIT DENY
116 %token	RO RW CONNECTION LIMIT REQUEST TIMEOUT
117 %token	PROTECT NAMESPACE BRANCH TAG
118 
119 %token	<v.string>	STRING
120 %token	<v.number>	NUMBER
121 %type	<v.tv>		timeout
122 
123 %%
124 
125 grammar		:
126 		| grammar '\n'
127 		| grammar main '\n'
128 		| grammar repository '\n'
129 		;
130 
131 timeout		: NUMBER {
132 			if ($1 < 0) {
133 				yyerror("invalid timeout: %lld", $1);
134 				YYERROR;
135 			}
136 			$$.tv_sec = $1;
137 			$$.tv_usec = 0;
138 		}
139 		| STRING {
140 			const char	*errstr;
141 			const char	*type = "seconds";
142 			size_t		 len;
143 			int		 mul = 1;
144 
145 			if (*$1 == '\0') {
146 				yyerror("invalid number of seconds: %s", $1);
147 				free($1);
148 				YYERROR;
149 			}
150 
151 			len = strlen($1);
152 			switch ($1[len - 1]) {
153 			case 'S':
154 			case 's':
155 				$1[len - 1] = '\0';
156 				break;
157 			case 'M':
158 			case 'm':
159 				type = "minutes";
160 				mul = 60;
161 				$1[len - 1] = '\0';
162 				break;
163 			case 'H':
164 			case 'h':
165 				type = "hours";
166 				mul = 60 * 60;
167 				$1[len - 1] = '\0';
168 				break;
169 			}
170 
171 			$$.tv_usec = 0;
172 			$$.tv_sec = strtonum($1, 0, INT_MAX / mul, &errstr);
173 			if (errstr) {
174 				yyerror("number of %s is %s: %s", type,
175 				    errstr, $1);
176 				free($1);
177 				YYERROR;
178 			}
179 
180 			$$.tv_sec *= mul;
181 			free($1);
182 		}
183 		;
184 
185 main		: LISTEN ON STRING {
186 			if (!got_path_is_absolute($3))
187 				yyerror("bad unix socket path \"%s\": "
188 				    "must be an absolute path", $3);
189 
190 			if (gotd_proc_id == PROC_LISTEN) {
191 				if (strlcpy(gotd->unix_socket_path, $3,
192 				    sizeof(gotd->unix_socket_path)) >=
193 				    sizeof(gotd->unix_socket_path)) {
194 					yyerror("%s: unix socket path too long",
195 					    __func__);
196 					free($3);
197 					YYERROR;
198 				}
199 			}
200 			free($3);
201 		}
202 		| USER STRING {
203 			if (strlcpy(gotd->user_name, $2,
204 			    sizeof(gotd->user_name)) >=
205 			    sizeof(gotd->user_name)) {
206 				yyerror("%s: user name too long", __func__);
207 				free($2);
208 				YYERROR;
209 			}
210 			free($2);
211 		}
212 		| connection
213 		;
214 
215 connection	: CONNECTION '{' optnl conflags_l '}'
216 		| CONNECTION conflags
217 
218 conflags_l	: conflags optnl conflags_l
219 		| conflags optnl
220 		;
221 
222 conflags	: REQUEST TIMEOUT timeout		{
223 			if ($3.tv_sec <= 0) {
224 				yyerror("invalid timeout: %lld", $3.tv_sec);
225 				YYERROR;
226 			}
227 			memcpy(&gotd->request_timeout, &$3,
228 			    sizeof(gotd->request_timeout));
229 		}
230 		| LIMIT USER STRING NUMBER	{
231 			if (gotd_proc_id == PROC_LISTEN &&
232 			    conf_limit_user_connections($3, $4) == -1) {
233 				free($3);
234 				YYERROR;
235 			}
236 			free($3);
237 		}
238 		;
239 
240 protect		: PROTECT '{' optnl protectflags_l '}'
241 		| PROTECT protectflags
242 
243 protectflags_l	: protectflags optnl protectflags_l
244 		| protectflags optnl
245 		;
246 
247 protectflags	: TAG NAMESPACE STRING {
248 			if (gotd_proc_id == PROC_GOTD ||
249 			    gotd_proc_id == PROC_REPO_WRITE) {
250 				if (conf_protect_tag_namespace(new_repo, $3)) {
251 					free($3);
252 					YYERROR;
253 				}
254 			}
255 			free($3);
256 		}
257 		| BRANCH NAMESPACE STRING {
258 			if (gotd_proc_id == PROC_GOTD ||
259 			    gotd_proc_id == PROC_REPO_WRITE) {
260 				if (conf_protect_branch_namespace(new_repo,
261 				    $3)) {
262 					free($3);
263 					YYERROR;
264 				}
265 			}
266 			free($3);
267 		}
268 		| BRANCH STRING {
269 			if (gotd_proc_id == PROC_GOTD ||
270 			    gotd_proc_id == PROC_REPO_WRITE) {
271 				if (conf_protect_branch(new_repo, $2)) {
272 					free($2);
273 					YYERROR;
274 				}
275 			}
276 			free($2);
277 		}
278 		;
279 
280 repository	: REPOSITORY STRING {
281 			struct gotd_repo *repo;
282 
283 			TAILQ_FOREACH(repo, &gotd->repos, entry) {
284 				if (strcmp(repo->name, $2) == 0) {
285 					yyerror("duplicate repository '%s'", $2);
286 					free($2);
287 					YYERROR;
288 				}
289 			}
290 
291 			if (gotd_proc_id == PROC_GOTD ||
292 			    gotd_proc_id == PROC_AUTH ||
293 			    gotd_proc_id == PROC_REPO_WRITE) {
294 				new_repo = conf_new_repo($2);
295 			}
296 			free($2);
297 		} '{' optnl repoopts2 '}' {
298 		}
299 		;
300 
301 repoopts1	: PATH STRING {
302 			if (gotd_proc_id == PROC_GOTD ||
303 			    gotd_proc_id == PROC_AUTH ||
304 			    gotd_proc_id == PROC_REPO_WRITE) {
305 				if (!got_path_is_absolute($2)) {
306 					yyerror("%s: path %s is not absolute",
307 					    __func__, $2);
308 					free($2);
309 					YYERROR;
310 				}
311 				if (realpath($2, new_repo->path) == NULL) {
312 					yyerror("realpath %s: %s", $2,
313 					    strerror(errno));
314 					/*
315 					 * Give admin a chance to create
316 					 * missing repositories at run-time.
317 					 */
318 					if (errno != ENOENT) {
319 						free($2);
320 						YYERROR;
321 					} else if (strlcpy(new_repo->path, $2,
322 					    sizeof(new_repo->path)) >=
323 					    sizeof(new_repo->path))
324 						yyerror("path too long");
325 				}
326 			}
327 			free($2);
328 		}
329 		| PERMIT RO STRING {
330 			if (gotd_proc_id == PROC_AUTH) {
331 				conf_new_access_rule(new_repo,
332 				    GOTD_ACCESS_PERMITTED, GOTD_AUTH_READ, $3);
333 			} else
334 				free($3);
335 		}
336 		| PERMIT RW STRING {
337 			if (gotd_proc_id == PROC_AUTH) {
338 				conf_new_access_rule(new_repo,
339 				    GOTD_ACCESS_PERMITTED,
340 				    GOTD_AUTH_READ | GOTD_AUTH_WRITE, $3);
341 			} else
342 				free($3);
343 		}
344 		| DENY STRING {
345 			if (gotd_proc_id == PROC_AUTH) {
346 				conf_new_access_rule(new_repo,
347 				    GOTD_ACCESS_DENIED, 0, $2);
348 			} else
349 				free($2);
350 		}
351 		| protect
352 		;
353 
354 repoopts2	: repoopts2 repoopts1 nl
355 		| repoopts1 optnl
356 		;
357 
358 nl		: '\n' optnl
359 		;
360 
361 optnl		: '\n' optnl		/* zero or more newlines */
362 		| /* empty */
363 		;
364 
365 %%
366 
367 struct keywords {
368 	const char	*k_name;
369 	int		 k_val;
370 };
371 
372 int
373 yyerror(const char *fmt, ...)
374 {
375 	va_list ap;
376 	char *msg;
377 
378 	file->errors++;
379 	va_start(ap, fmt);
380 	if (vasprintf(&msg, fmt, ap) == -1)
381 		fatalx("yyerror vasprintf");
382 	va_end(ap);
383 	logit(LOG_CRIT, "%s:%d: %s", file->name, yylval.lineno, msg);
384 	free(msg);
385 	return (0);
386 }
387 
388 int
389 kw_cmp(const void *k, const void *e)
390 {
391 	return (strcmp(k, ((const struct keywords *)e)->k_name));
392 }
393 
394 int
395 lookup(char *s)
396 {
397 	/* This has to be sorted always. */
398 	static const struct keywords keywords[] = {
399 		{ "branch",			BRANCH },
400 		{ "connection",			CONNECTION },
401 		{ "deny",			DENY },
402 		{ "limit",			LIMIT },
403 		{ "listen",			LISTEN },
404 		{ "namespace",			NAMESPACE },
405 		{ "on",				ON },
406 		{ "path",			PATH },
407 		{ "permit",			PERMIT },
408 		{ "protect",			PROTECT },
409 		{ "repository",			REPOSITORY },
410 		{ "request",			REQUEST },
411 		{ "ro",				RO },
412 		{ "rw",				RW },
413 		{ "tag",			TAG },
414 		{ "timeout",			TIMEOUT },
415 		{ "user",			USER },
416 	};
417 	const struct keywords *p;
418 
419 	p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]),
420 	    sizeof(keywords[0]), kw_cmp);
421 
422 	if (p)
423 		return (p->k_val);
424 	else
425 		return (STRING);
426 }
427 
428 #define MAXPUSHBACK	128
429 
430 unsigned char *parsebuf;
431 int parseindex;
432 unsigned char pushback_buffer[MAXPUSHBACK];
433 int pushback_index = 0;
434 
435 int
436 lgetc(int quotec)
437 {
438 	int c, next;
439 
440 	if (parsebuf) {
441 		/* Read character from the parsebuffer instead of input. */
442 		if (parseindex >= 0) {
443 			c = parsebuf[parseindex++];
444 			if (c != '\0')
445 				return (c);
446 			parsebuf = NULL;
447 		} else
448 			parseindex++;
449 	}
450 
451 	if (pushback_index)
452 		return (pushback_buffer[--pushback_index]);
453 
454 	if (quotec) {
455 		c = getc(file->stream);
456 		if (c == EOF)
457 			yyerror("reached end of file while parsing "
458 			    "quoted string");
459 		return (c);
460 	}
461 
462 	c = getc(file->stream);
463 	while (c == '\\') {
464 		next = getc(file->stream);
465 		if (next != '\n') {
466 			c = next;
467 			break;
468 		}
469 		yylval.lineno = file->lineno;
470 		file->lineno++;
471 		c = getc(file->stream);
472 	}
473 
474 	return (c);
475 }
476 
477 int
478 lungetc(int c)
479 {
480 	if (c == EOF)
481 		return (EOF);
482 	if (parsebuf) {
483 		parseindex--;
484 		if (parseindex >= 0)
485 			return (c);
486 	}
487 	if (pushback_index < MAXPUSHBACK-1)
488 		return (pushback_buffer[pushback_index++] = c);
489 	else
490 		return (EOF);
491 }
492 
493 int
494 findeol(void)
495 {
496 	int c;
497 
498 	parsebuf = NULL;
499 
500 	/* Skip to either EOF or the first real EOL. */
501 	while (1) {
502 		if (pushback_index)
503 			c = pushback_buffer[--pushback_index];
504 		else
505 			c = lgetc(0);
506 		if (c == '\n') {
507 			file->lineno++;
508 			break;
509 		}
510 		if (c == EOF)
511 			break;
512 	}
513 	return (ERROR);
514 }
515 
516 int
517 yylex(void)
518 {
519 	unsigned char buf[8096];
520 	unsigned char *p, *val;
521 	int quotec, next, c;
522 	int token;
523 
524 top:
525 	p = buf;
526 	c = lgetc(0);
527 	while (c == ' ' || c == '\t')
528 		c = lgetc(0); /* nothing */
529 
530 	yylval.lineno = file->lineno;
531 	if (c == '#') {
532 		c = lgetc(0);
533 		while (c != '\n' && c != EOF)
534 			c = lgetc(0); /* nothing */
535 	}
536 	if (c == '$' && parsebuf == NULL) {
537 		while (1) {
538 			c = lgetc(0);
539 			if (c == EOF)
540 				return (0);
541 
542 			if (p + 1 >= buf + sizeof(buf) - 1) {
543 				yyerror("string too long");
544 				return (findeol());
545 			}
546 			if (isalnum(c) || c == '_') {
547 				*p++ = c;
548 				continue;
549 			}
550 			*p = '\0';
551 			lungetc(c);
552 			break;
553 		}
554 		val = symget(buf);
555 		if (val == NULL) {
556 			yyerror("macro '%s' not defined", buf);
557 			return (findeol());
558 		}
559 		parsebuf = val;
560 		parseindex = 0;
561 		goto top;
562 	}
563 
564 	switch (c) {
565 	case '\'':
566 	case '"':
567 		quotec = c;
568 		while (1) {
569 			c = lgetc(quotec);
570 			if (c == EOF)
571 				return (0);
572 			if (c == '\n') {
573 				file->lineno++;
574 				continue;
575 			} else if (c == '\\') {
576 				next = lgetc(quotec);
577 				if (next == EOF)
578 					return (0);
579 				if (next == quotec || c == ' ' || c == '\t')
580 					c = next;
581 				else if (next == '\n') {
582 					file->lineno++;
583 					continue;
584 				} else
585 					lungetc(next);
586 			} else if (c == quotec) {
587 				*p = '\0';
588 				break;
589 			} else if (c == '\0') {
590 				yyerror("syntax error");
591 				return (findeol());
592 			}
593 			if (p + 1 >= buf + sizeof(buf) - 1) {
594 				yyerror("string too long");
595 				return (findeol());
596 			}
597 			*p++ = c;
598 		}
599 		yylval.v.string = strdup(buf);
600 		if (yylval.v.string == NULL)
601 			err(1, "yylex: strdup");
602 		return (STRING);
603 	}
604 
605 #define allowed_to_end_number(x) \
606 	(isspace(x) || x == ')' || x ==',' || x == '/' || x == '}' || x == '=')
607 
608 	if (c == '-' || isdigit(c)) {
609 		do {
610 			*p++ = c;
611 			if ((unsigned)(p-buf) >= sizeof(buf)) {
612 				yyerror("string too long");
613 				return (findeol());
614 			}
615 			c = lgetc(0);
616 		} while (c != EOF && isdigit(c));
617 		lungetc(c);
618 		if (p == buf + 1 && buf[0] == '-')
619 			goto nodigits;
620 		if (c == EOF || allowed_to_end_number(c)) {
621 			const char *errstr = NULL;
622 
623 			*p = '\0';
624 			yylval.v.number = strtonum(buf, LLONG_MIN,
625 			    LLONG_MAX, &errstr);
626 			if (errstr) {
627 				yyerror("\"%s\" invalid number: %s",
628 				    buf, errstr);
629 				return (findeol());
630 			}
631 			return (NUMBER);
632 		} else {
633 nodigits:
634 			while (p > buf + 1)
635 				lungetc(*--p);
636 			c = *--p;
637 			if (c == '-')
638 				return (c);
639 		}
640 	}
641 
642 #define allowed_in_string(x) \
643 	(isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \
644 	x != '{' && x != '}' && \
645 	x != '!' && x != '=' && x != '#' && \
646 	x != ','))
647 
648 	if (isalnum(c) || c == ':' || c == '_') {
649 		do {
650 			*p++ = c;
651 			if ((unsigned)(p-buf) >= sizeof(buf)) {
652 				yyerror("string too long");
653 				return (findeol());
654 			}
655 			c = lgetc(0);
656 		} while (c != EOF && (allowed_in_string(c)));
657 		lungetc(c);
658 		*p = '\0';
659 		token = lookup(buf);
660 		if (token == STRING) {
661 			yylval.v.string = strdup(buf);
662 			if (yylval.v.string == NULL)
663 				err(1, "yylex: strdup");
664 		}
665 		return (token);
666 	}
667 	if (c == '\n') {
668 		yylval.lineno = file->lineno;
669 		file->lineno++;
670 	}
671 	if (c == EOF)
672 		return (0);
673 	return (c);
674 }
675 
676 int
677 check_file_secrecy(int fd, const char *fname)
678 {
679 	struct stat st;
680 
681 	if (fstat(fd, &st)) {
682 		log_warn("cannot stat %s", fname);
683 		return (-1);
684 	}
685 	if (st.st_uid != 0 && st.st_uid != getuid()) {
686 		log_warnx("%s: owner not root or current user", fname);
687 		return (-1);
688 	}
689 	if (st.st_mode & (S_IWGRP | S_IXGRP | S_IRWXO)) {
690 		log_warnx("%s: group writable or world read/writable", fname);
691 		return (-1);
692 	}
693 	return (0);
694 }
695 
696 struct file *
697 newfile(const char *name, int secret, int required)
698 {
699 	struct file *nfile;
700 
701 	nfile = calloc(1, sizeof(struct file));
702 	if (nfile == NULL) {
703 		log_warn("calloc");
704 		return (NULL);
705 	}
706 	nfile->name = strdup(name);
707 	if (nfile->name == NULL) {
708 		log_warn("strdup");
709 		free(nfile);
710 		return (NULL);
711 	}
712 	nfile->stream = fopen(nfile->name, "r");
713 	if (nfile->stream == NULL) {
714 		if (required)
715 			log_warn("open %s", nfile->name);
716 		free(nfile->name);
717 		free(nfile);
718 		return (NULL);
719 	} else if (secret &&
720 	    check_file_secrecy(fileno(nfile->stream), nfile->name)) {
721 		fclose(nfile->stream);
722 		free(nfile->name);
723 		free(nfile);
724 		return (NULL);
725 	}
726 	nfile->lineno = 1;
727 	return (nfile);
728 }
729 
730 static void
731 closefile(struct file *xfile)
732 {
733 	fclose(xfile->stream);
734 	free(xfile->name);
735 	free(xfile);
736 }
737 
738 int
739 parse_config(const char *filename, enum gotd_procid proc_id,
740     struct gotd *env, int require_config_file)
741 {
742 	struct sym *sym, *next;
743 	struct gotd_repo *repo;
744 
745 	memset(env, 0, sizeof(*env));
746 
747 	gotd = env;
748 	gotd_proc_id = proc_id;
749 	TAILQ_INIT(&gotd->repos);
750 
751 	/* Apply default values. */
752 	if (strlcpy(gotd->unix_socket_path, GOTD_UNIX_SOCKET,
753 	    sizeof(gotd->unix_socket_path)) >= sizeof(gotd->unix_socket_path)) {
754 		fprintf(stderr, "%s: unix socket path too long", __func__);
755 		return -1;
756 	}
757 	if (strlcpy(gotd->user_name, GOTD_USER,
758 	    sizeof(gotd->user_name)) >= sizeof(gotd->user_name)) {
759 		fprintf(stderr, "%s: user name too long", __func__);
760 		return -1;
761 	}
762 
763 	gotd->request_timeout.tv_sec = GOTD_DEFAULT_REQUEST_TIMEOUT;
764 	gotd->request_timeout.tv_usec = 0;
765 
766 	file = newfile(filename, 0, require_config_file);
767 	if (file == NULL)
768 		return require_config_file ? -1 : 0;
769 
770 	yyparse();
771 	errors = file->errors;
772 	closefile(file);
773 
774 	/* Free macros and check which have not been used. */
775 	TAILQ_FOREACH_SAFE(sym, &symhead, entry, next) {
776 		if ((gotd->verbosity > 1) && !sym->used)
777 			fprintf(stderr, "warning: macro '%s' not used\n",
778 			    sym->nam);
779 		if (!sym->persist) {
780 			free(sym->nam);
781 			free(sym->val);
782 			TAILQ_REMOVE(&symhead, sym, entry);
783 			free(sym);
784 		}
785 	}
786 
787 	if (errors)
788 		return (-1);
789 
790 	TAILQ_FOREACH(repo, &gotd->repos, entry) {
791 		if (repo->path[0] == '\0') {
792 			log_warnx("repository \"%s\": no path provided in "
793 			    "configuration file", repo->name);
794 			return (-1);
795 		}
796 	}
797 
798 	if (proc_id == PROC_GOTD && TAILQ_EMPTY(&gotd->repos)) {
799 		log_warnx("no repository defined in configuration file");
800 		return (-1);
801 	}
802 
803 	return (0);
804 }
805 
806 static int
807 uid_connection_limit_cmp(const void *pa, const void *pb)
808 {
809 	const struct gotd_uid_connection_limit *a = pa, *b = pb;
810 
811 	if (a->uid < b->uid)
812 		return -1;
813 	else if (a->uid > b->uid);
814 		return 1;
815 
816 	return 0;
817 }
818 
819 static int
820 conf_limit_user_connections(const char *user, int maximum)
821 {
822 	uid_t uid;
823 	struct gotd_uid_connection_limit *limit;
824 	size_t nlimits;
825 
826 	if (maximum < 1) {
827 		yyerror("max connections cannot be smaller 1");
828 		return -1;
829 	}
830 	if (maximum > GOTD_MAXCLIENTS) {
831 		yyerror("max connections must be <= %d", GOTD_MAXCLIENTS);
832 		return -1;
833 	}
834 
835 	if (gotd_auth_parseuid(user, &uid) == -1) {
836 		yyerror("%s: no such user", user);
837 		return -1;
838 	}
839 
840 	limit = gotd_find_uid_connection_limit(gotd->connection_limits,
841 	    gotd->nconnection_limits, uid);
842 	if (limit) {
843 		limit->max_connections = maximum;
844 		return 0;
845 	}
846 
847 	limit = gotd->connection_limits;
848 	nlimits = gotd->nconnection_limits + 1;
849 	limit = reallocarray(limit, nlimits, sizeof(*limit));
850 	if (limit == NULL)
851 		fatal("reallocarray");
852 
853 	limit[nlimits - 1].uid = uid;
854 	limit[nlimits - 1].max_connections = maximum;
855 
856 	gotd->connection_limits = limit;
857 	gotd->nconnection_limits = nlimits;
858 	qsort(gotd->connection_limits, gotd->nconnection_limits,
859 	    sizeof(gotd->connection_limits[0]), uid_connection_limit_cmp);
860 
861 	return 0;
862 }
863 
864 static struct gotd_repo *
865 conf_new_repo(const char *name)
866 {
867 	struct gotd_repo *repo;
868 
869 	if (name[0] == '\0') {
870 		fatalx("syntax error: empty repository name found in %s",
871 		    file->name);
872 	}
873 
874 	if (strchr(name, '\n') != NULL)
875 		fatalx("repository names must not contain linefeeds: %s", name);
876 
877 	repo = calloc(1, sizeof(*repo));
878 	if (repo == NULL)
879 		fatalx("%s: calloc", __func__);
880 
881 	STAILQ_INIT(&repo->rules);
882 	TAILQ_INIT(&repo->protected_tag_namespaces);
883 	TAILQ_INIT(&repo->protected_branch_namespaces);
884 	TAILQ_INIT(&repo->protected_branches);
885 
886 	if (strlcpy(repo->name, name, sizeof(repo->name)) >=
887 	    sizeof(repo->name))
888 		fatalx("%s: strlcpy", __func__);
889 
890 	TAILQ_INSERT_TAIL(&gotd->repos, repo, entry);
891 	gotd->nrepos++;
892 
893 	return repo;
894 };
895 
896 static void
897 conf_new_access_rule(struct gotd_repo *repo, enum gotd_access access,
898     int authorization, char *identifier)
899 {
900 	struct gotd_access_rule *rule;
901 
902 	rule = calloc(1, sizeof(*rule));
903 	if (rule == NULL)
904 		fatal("calloc");
905 
906 	rule->access = access;
907 	rule->authorization = authorization;
908 	rule->identifier = identifier;
909 
910 	STAILQ_INSERT_TAIL(&repo->rules, rule, entry);
911 }
912 
913 static int
914 refname_is_valid(char *refname)
915 {
916 	if (strlen(refname) < 5 || strncmp(refname, "refs/", 5) != 0) {
917 		yyerror("reference name must begin with \"refs/\": %s",
918 		    refname);
919 		return 0;
920 	}
921 
922 	if (!got_ref_name_is_valid(refname)) {
923 		yyerror("invalid reference name: %s", refname);
924 		return 0;
925 	}
926 
927 	return 1;
928 }
929 
930 static int
931 conf_protect_ref_namespace(char **new, struct got_pathlist_head *refs,
932     char *namespace)
933 {
934 	const struct got_error *error;
935 	struct got_pathlist_entry *pe;
936 	char *s;
937 
938 	*new = NULL;
939 
940 	got_path_strip_trailing_slashes(namespace);
941 	if (!refname_is_valid(namespace))
942 		return -1;
943 	if (asprintf(&s, "%s/", namespace) == -1) {
944 		yyerror("asprintf: %s", strerror(errno));
945 		return -1;
946 	}
947 
948 	error = got_pathlist_insert(&pe, refs, s, NULL);
949 	if (error || pe == NULL) {
950 		free(s);
951 		if (error)
952 			yyerror("got_pathlist_insert: %s", error->msg);
953 		else
954 			yyerror("duplicate protected namespace %s", namespace);
955 		return -1;
956 	}
957 
958 	*new = s;
959 	return 0;
960 }
961 
962 static int
963 conf_protect_tag_namespace(struct gotd_repo *repo, char *namespace)
964 {
965 	struct got_pathlist_entry *pe;
966 	char *new;
967 
968 	if (conf_protect_ref_namespace(&new, &repo->protected_tag_namespaces,
969 	    namespace) == -1)
970 		return -1;
971 
972 	TAILQ_FOREACH(pe, &repo->protected_branch_namespaces, entry) {
973 		if (strcmp(pe->path, new) == 0) {
974 			yyerror("duplicate protected namespace %s", namespace);
975 			return -1;
976 		}
977 	}
978 
979 	return 0;
980 }
981 
982 static int
983 conf_protect_branch_namespace(struct gotd_repo *repo, char *namespace)
984 {
985 	struct got_pathlist_entry *pe;
986 	char *new;
987 
988 	if (conf_protect_ref_namespace(&new,
989 	    &repo->protected_branch_namespaces, namespace) == -1)
990 		return -1;
991 
992 	TAILQ_FOREACH(pe, &repo->protected_tag_namespaces, entry) {
993 		if (strcmp(pe->path, new) == 0) {
994 			yyerror("duplicate protected namespace %s", namespace);
995 			return -1;
996 		}
997 	}
998 
999 	return 0;
1000 }
1001 
1002 static int
1003 conf_protect_branch(struct gotd_repo *repo, char *branchname)
1004 {
1005 	const struct got_error *error;
1006 	struct got_pathlist_entry *new;
1007 	char *refname;
1008 
1009 	if (strncmp(branchname, "refs/heads/", 11) != 0) {
1010 		if (asprintf(&refname, "refs/heads/%s", branchname) == -1) {
1011 			yyerror("asprintf: %s", strerror(errno));
1012 			return -1;
1013 		}
1014 	} else {
1015 		refname = strdup(branchname);
1016 		if (refname == NULL) {
1017 			yyerror("strdup: %s", strerror(errno));
1018 			return -1;
1019 		}
1020 	}
1021 
1022 	if (!refname_is_valid(refname)) {
1023 		free(refname);
1024 		return -1;
1025 	}
1026 
1027 	error = got_pathlist_insert(&new, &repo->protected_branches,
1028 	    refname, NULL);
1029 	if (error || new == NULL) {
1030 		free(refname);
1031 		if (error)
1032 			yyerror("got_pathlist_insert: %s", error->msg);
1033 		else
1034 			yyerror("duplicate protect branch %s", branchname);
1035 		return -1;
1036 	}
1037 
1038 	return 0;
1039 }
1040 
1041 int
1042 symset(const char *nam, const char *val, int persist)
1043 {
1044 	struct sym *sym;
1045 
1046 	TAILQ_FOREACH(sym, &symhead, entry) {
1047 		if (strcmp(nam, sym->nam) == 0)
1048 			break;
1049 	}
1050 
1051 	if (sym != NULL) {
1052 		if (sym->persist == 1)
1053 			return (0);
1054 		else {
1055 			free(sym->nam);
1056 			free(sym->val);
1057 			TAILQ_REMOVE(&symhead, sym, entry);
1058 			free(sym);
1059 		}
1060 	}
1061 	sym = calloc(1, sizeof(*sym));
1062 	if (sym == NULL)
1063 		return (-1);
1064 
1065 	sym->nam = strdup(nam);
1066 	if (sym->nam == NULL) {
1067 		free(sym);
1068 		return (-1);
1069 	}
1070 	sym->val = strdup(val);
1071 	if (sym->val == NULL) {
1072 		free(sym->nam);
1073 		free(sym);
1074 		return (-1);
1075 	}
1076 	sym->used = 0;
1077 	sym->persist = persist;
1078 	TAILQ_INSERT_TAIL(&symhead, sym, entry);
1079 	return (0);
1080 }
1081 
1082 char *
1083 symget(const char *nam)
1084 {
1085 	struct sym *sym;
1086 
1087 	TAILQ_FOREACH(sym, &symhead, entry) {
1088 		if (strcmp(nam, sym->nam) == 0) {
1089 			sym->used = 1;
1090 			return (sym->val);
1091 		}
1092 	}
1093 	return (NULL);
1094 }
1095 
1096 struct gotd_repo *
1097 gotd_find_repo_by_name(const char *repo_name, struct gotd *gotd)
1098 {
1099 	struct gotd_repo *repo;
1100 	size_t namelen;
1101 
1102 	TAILQ_FOREACH(repo, &gotd->repos, entry) {
1103 		namelen = strlen(repo->name);
1104 		if (strncmp(repo->name, repo_name, namelen) != 0)
1105 			continue;
1106 		if (repo_name[namelen] == '\0' ||
1107 		    strcmp(&repo_name[namelen], ".git") == 0)
1108 			return repo;
1109 	}
1110 
1111 	return NULL;
1112 }
1113 
1114 struct gotd_repo *
1115 gotd_find_repo_by_path(const char *repo_path, struct gotd *gotd)
1116 {
1117 	struct gotd_repo *repo;
1118 
1119 	TAILQ_FOREACH(repo, &gotd->repos, entry) {
1120 		if (strcmp(repo->path, repo_path) == 0)
1121 			return repo;
1122 	}
1123 
1124 	return NULL;
1125 }