2 * Copyright (c) 2018, 2019 Ori Bernstein <ori@openbsd.org>
3 * Copyright (c) 2021 Stefan Sperling <stsp@openbsd.org>
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 #include "got_compat.h"
20 #include <sys/queue.h>
21 #include <sys/types.h>
22 #include <sys/socket.h>
37 #include "got_error.h"
39 #include "got_object.h"
41 #include "got_compat.h"
43 #include "got_lib_dial.h"
44 #include "got_lib_delta.h"
45 #include "got_lib_object.h"
46 #include "got_lib_privsep.h"
50 #define nitems(_a) (sizeof((_a)) / sizeof((_a)[0]))
54 #define ssizeof(_x) ((ssize_t)(sizeof(_x)))
58 #define MIN(_a,_b) ((_a) < (_b) ? (_a) : (_b))
61 #ifndef GOT_DIAL_PATH_SSH
62 #define GOT_DIAL_PATH_SSH "/usr/bin/ssh"
66 #define GOT_DEFAULT_GIT_PORT 9418
67 #define GOT_DEFAULT_GIT_PORT_STR "9418"
69 const struct got_error *
70 got_dial_apply_unveil(const char *proto)
72 if (strcmp(proto, "git+ssh") == 0 || strcmp(proto, "ssh") == 0) {
73 if (unveil(GOT_DIAL_PATH_SSH, "x") != 0) {
74 return got_error_from_errno2("unveil",
79 if (strstr(proto, "http") != NULL) {
80 if (unveil(GOT_PATH_PROG_FETCH_HTTP, "x") != 0) {
81 return got_error_from_errno2("unveil",
82 GOT_PATH_PROG_FETCH_HTTP);
90 hassuffix(const char *base, const char *suf)
96 if (ns <= nb && strcmp(base + (nb - ns), suf) == 0)
101 const struct got_error *
102 got_dial_parse_uri(char **proto, char **host, char **port,
103 char **server_path, char **repo_name, const char *uri)
105 const struct got_error *err = NULL;
108 *proto = *host = *port = *server_path = *repo_name = NULL;
110 p = strstr(uri, "://");
112 /* Try parsing Git's "scp" style URL syntax. */
113 *proto = strdup("ssh");
114 if (*proto == NULL) {
115 err = got_error_from_errno("strdup");
121 err = got_error(GOT_ERR_PARSE_URI);
124 /* No slashes allowed before first colon. */
127 err = got_error(GOT_ERR_PARSE_URI);
130 *host = strndup(s, q - s);
132 err = got_error_from_errno("strndup");
135 if ((*host)[0] == '\0') {
136 err = got_error(GOT_ERR_PARSE_URI);
141 *proto = strndup(uri, p - uri);
142 if (*proto == NULL) {
143 err = got_error_from_errno("strndup");
149 if (p == NULL || strlen(p) == 1) {
150 err = got_error(GOT_ERR_PARSE_URI);
154 q = memchr(s, ':', p - s);
156 *host = strndup(s, q - s);
158 err = got_error_from_errno("strndup");
161 if ((*host)[0] == '\0') {
162 err = got_error(GOT_ERR_PARSE_URI);
165 *port = strndup(q + 1, p - (q + 1));
167 err = got_error_from_errno("strndup");
170 if ((*port)[0] == '\0') {
171 err = got_error(GOT_ERR_PARSE_URI);
175 *host = strndup(s, p - s);
177 err = got_error_from_errno("strndup");
180 if ((*host)[0] == '\0') {
181 err = got_error(GOT_ERR_PARSE_URI);
187 while (p[0] == '/' && (p[1] == '/' || p[1] == '~'))
189 *server_path = strdup(p);
190 if (*server_path == NULL) {
191 err = got_error_from_errno("strdup");
194 got_path_strip_trailing_slashes(*server_path);
195 if ((*server_path)[0] == '\0') {
196 err = got_error(GOT_ERR_PARSE_URI);
200 err = got_path_basename(repo_name, *server_path);
203 if (hassuffix(*repo_name, ".git"))
204 (*repo_name)[strlen(*repo_name) - 4] = '\0';
205 if ((*repo_name)[0] == '\0')
206 err = got_error(GOT_ERR_PARSE_URI);
224 * Escape a given path for the shell which will be started by sshd.
225 * In particular, git-shell is known to require single-quote characters
226 * around its repository path argument and will refuse to run otherwise.
228 static const struct got_error *
229 escape_path(char *buf, size_t bufsize, const char *path)
240 while (*p != '\0' && (q - buf < bufsize)) {
241 /* git escapes ! too */
242 if (*p != '\'' && *p != '!') {
247 if (q - buf + 4 >= bufsize)
255 if (*p == '\0' && (q - buf + 1 < bufsize)) {
261 return got_error_fmt(GOT_ERR_NO_SPACE, "overlong path: %s", path);
264 const struct got_error *
265 got_dial_ssh(pid_t *newpid, int *newfd, const char *host,
266 const char *port, const char *path, const char *command, int verbosity)
268 const struct got_error *error = NULL;
271 char escaped_path[PATH_MAX];
272 const char *argv[11];
278 error = escape_path(escaped_path, sizeof(escaped_path), path);
282 argv[i++] = GOT_DIAL_PATH_SSH;
285 argv[i++] = (char *)port;
287 if (verbosity == -1) {
290 /* ssh(1) allows up to 3 "-v" options. */
291 for (j = 0; j < MIN(3, verbosity); j++)
295 argv[i++] = (char *)host;
296 argv[i++] = (char *)cmd;
297 argv[i++] = (char *)escaped_path;
299 assert(i <= nitems(argv));
301 if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pfd) == -1)
302 return got_error_from_errno("socketpair");
306 error = got_error_from_errno("fork");
310 } else if (pid == 0) {
311 if (close(pfd[1]) == -1)
313 if (dup2(pfd[0], 0) == -1)
315 if (dup2(pfd[0], 1) == -1)
317 if (strlcpy(cmd, command, sizeof(cmd)) >= sizeof(cmd))
319 if (execv(GOT_DIAL_PATH_SSH, (char *const *)argv) == -1)
320 err(1, "execv %s", GOT_DIAL_PATH_SSH);
321 abort(); /* not reached */
323 if (close(pfd[0]) == -1)
324 return got_error_from_errno("close");
331 const struct got_error *
332 got_dial_git(int *newfd, const char *host, const char *port,
333 const char *path, const char *command)
335 const struct got_error *err = NULL;
336 struct addrinfo hints, *servinfo, *p;
338 int fd = -1, len, r, eaicode;
343 port = GOT_DEFAULT_GIT_PORT_STR;
345 memset(&hints, 0, sizeof hints);
346 hints.ai_family = AF_UNSPEC;
347 hints.ai_socktype = SOCK_STREAM;
348 eaicode = getaddrinfo(host, port, &hints, &servinfo);
351 snprintf(msg, sizeof(msg), "%s: %s", host,
352 gai_strerror(eaicode));
353 return got_error_msg(GOT_ERR_ADDRINFO, msg);
356 for (p = servinfo; p != NULL; p = p->ai_next) {
357 if ((fd = socket(p->ai_family, p->ai_socktype,
358 p->ai_protocol)) == -1)
360 if (connect(fd, p->ai_addr, p->ai_addrlen) == 0) {
364 err = got_error_from_errno("connect");
367 freeaddrinfo(servinfo);
371 if (asprintf(&cmd, "%s %s", command, path) == -1) {
372 err = got_error_from_errno("asprintf");
375 len = 4 + strlen(cmd) + 1 + strlen("host=") + strlen(host) + 1;
376 r = dprintf(fd, "%04x%s%chost=%s%c", len, cmd, '\0', host, '\0');
378 err = got_error_from_errno("dprintf");
389 const struct got_error *
390 got_dial_http(pid_t *newpid, int *newfd, const char *host,
391 const char *port, const char *path, int verbosity, int tls)
393 const struct got_error *error = NULL;
402 port = tls ? "443" : "80";
404 argv[i++] = GOT_PATH_PROG_FETCH_HTTP;
407 else if (verbosity > 0)
410 argv[i++] = tls ? "https" : "http";
415 assert(i <= nitems(argv));
417 if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pfd) == -1)
418 return got_error_from_errno("socketpair");
422 error = got_error_from_errno("fork");
426 } else if (pid == 0) {
427 if (close(pfd[1]) == -1)
429 if (dup2(pfd[0], 0) == -1)
431 if (dup2(pfd[0], 1) == -1)
433 if (execv(GOT_PATH_PROG_FETCH_HTTP, (char *const *)argv) == -1)
434 err(1, "execv %s", GOT_PATH_PROG_FETCH_HTTP);
435 abort(); /* not reached */
437 if (close(pfd[0]) == -1)
438 return got_error_from_errno("close");
445 const struct got_error *
446 got_dial_parse_command(char **command, char **repo_path, const char *gitcmd)
448 const struct got_error *err = NULL;
449 size_t len, cmdlen, pathlen;
450 char *path0 = NULL, *path, *abspath = NULL, *canonpath = NULL;
456 len = strlen(gitcmd);
458 if (len >= strlen(GOT_DIAL_CMD_SEND) &&
459 strncmp(gitcmd, GOT_DIAL_CMD_SEND,
460 strlen(GOT_DIAL_CMD_SEND)) == 0)
461 cmdlen = strlen(GOT_DIAL_CMD_SEND);
462 else if (len >= strlen(GOT_DIAL_CMD_FETCH) &&
463 strncmp(gitcmd, GOT_DIAL_CMD_FETCH,
464 strlen(GOT_DIAL_CMD_FETCH)) == 0)
465 cmdlen = strlen(GOT_DIAL_CMD_FETCH);
467 return got_error(GOT_ERR_BAD_PACKET);
469 if (len <= cmdlen + 1 || gitcmd[cmdlen] != ' ')
470 return got_error(GOT_ERR_BAD_PACKET);
472 if (memchr(&gitcmd[cmdlen + 1], '\0', len - cmdlen) == NULL)
473 return got_error(GOT_ERR_BAD_PATH);
475 /* Forbid linefeeds in paths, like Git does. */
476 if (memchr(&gitcmd[cmdlen + 1], '\n', len - cmdlen) != NULL)
477 return got_error(GOT_ERR_BAD_PATH);
479 path0 = strdup(&gitcmd[cmdlen + 1]);
481 return got_error_from_errno("strdup");
483 pathlen = strlen(path);
486 * Git clients send a shell command.
487 * Trim spaces and quotes around the path.
489 while (path[0] == '\'' || path[0] == '\"' || path[0] == ' ') {
493 while (pathlen > 0 &&
494 (path[pathlen - 1] == '\'' || path[pathlen - 1] == '\"' ||
495 path[pathlen - 1] == ' ')) {
496 path[pathlen - 1] = '\0';
500 /* Deny an empty repository path. */
501 if (path[0] == '\0' || got_path_is_root_dir(path)) {
502 err = got_error(GOT_ERR_NOT_GIT_REPO);
506 if (asprintf(&abspath, "/%s", path) == -1) {
507 err = got_error_from_errno("asprintf");
510 pathlen = strlen(abspath);
511 canonpath = malloc(pathlen + 1);
512 if (canonpath == NULL) {
513 err = got_error_from_errno("malloc");
516 err = got_canonpath(abspath, canonpath, pathlen + 1);
521 while (relpath[0] == '/')
523 *repo_path = strdup(relpath);
524 if (*repo_path == NULL) {
525 err = got_error_from_errno("strdup");
528 *command = strndup(gitcmd, cmdlen);
529 if (*command == NULL)
530 err = got_error_from_errno("strndup");