1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  * Copyright (c) 2016-2019, 2020-2021 Tracey Emery <tracey@traceyemery.net>
4  * Copyright (c) 2004, 2005 Esben Norby <norby@openbsd.org>
5  * Copyright (c) 2004 Ryan McBride <mcbride@openbsd.org>
6  * Copyright (c) 2002, 2003, 2004 Henning Brauer <henning@openbsd.org>
7  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
8  * Copyright (c) 2001 Daniel Hartmeier.  All rights reserved.
9  * Copyright (c) 2001 Theo de Raadt.  All rights reserved.
10  *
11  * Permission to use, copy, modify, and distribute this software for any
12  * purpose with or without fee is hereby granted, provided that the above
13  * copyright notice and this permission notice appear in all copies.
14  *
15  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
16  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
17  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
18  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
19  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
20  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
21  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
22  */
23 
24 %{
25 #include <sys/time.h>
26 #include <sys/types.h>
27 #include <sys/queue.h>
28 #include <sys/stat.h>
29 
30 #include <ctype.h>
31 #include <err.h>
32 #include <errno.h>
33 #include <event.h>
34 #include <imsg.h>
35 #include <limits.h>
36 #include <pwd.h>
37 #include <sha1.h>
38 #include <sha2.h>
39 #include <stdarg.h>
40 #include <stdlib.h>
41 #include <stdio.h>
42 #include <string.h>
43 #include <syslog.h>
44 #include <unistd.h>
45 
46 #include "got_error.h"
47 #include "got_path.h"
48 #include "got_reference.h"
49 
50 #include "log.h"
51 #include "gotd.h"
52 #include "auth.h"
53 #include "listen.h"
54 
55 TAILQ_HEAD(files, file)		 files = TAILQ_HEAD_INITIALIZER(files);
56 static struct file {
57 	TAILQ_ENTRY(file)	 entry;
58 	FILE			*stream;
59 	char			*name;
60 	int			 lineno;
61 	int			 errors;
62 } *file;
63 struct file	*newfile(const char *, int, int);
64 static void	 closefile(struct file *);
65 int		 check_file_secrecy(int, const char *);
66 int		 yyparse(void);
67 int		 yylex(void);
68 int		 yyerror(const char *, ...)
69     __attribute__((__format__ (printf, 1, 2)))
70     __attribute__((__nonnull__ (1)));
71 int		 kw_cmp(const void *, const void *);
72 int		 lookup(char *);
73 int		 lgetc(int);
74 int		 lungetc(int);
75 int		 findeol(void);
76 static char	*port_sprintf(int);
77 
78 TAILQ_HEAD(symhead, sym)	 symhead = TAILQ_HEAD_INITIALIZER(symhead);
79 struct sym {
80 	TAILQ_ENTRY(sym)	 entry;
81 	int			 used;
82 	int			 persist;
83 	char			*nam;
84 	char			*val;
85 };
86 
87 int	 symset(const char *, const char *, int);
88 char	*symget(const char *);
89 
90 static int		 errors;
91 
92 static struct gotd		*gotd;
93 static struct gotd_repo		*new_repo;
94 static int			 conf_limit_user_connections(const char *, int);
95 static struct gotd_repo		*conf_new_repo(const char *);
96 static void			 conf_new_access_rule(struct gotd_repo *,
97 				    enum gotd_access, int, char *);
98 static int			 conf_protect_ref_namespace(char **,
99 				    struct got_pathlist_head *, char *);
100 static int			 conf_protect_tag_namespace(struct gotd_repo *,
101 				    char *);
102 static int			 conf_protect_branch_namespace(
103 				    struct gotd_repo *, char *);
104 static int			 conf_protect_branch(struct gotd_repo *,
105 				    char *);
106 static int			 conf_notify_branch(struct gotd_repo *,
107 				    char *);
108 static int			 conf_notify_ref_namespace(struct gotd_repo *,
109 				    char *);
110 static int			 conf_notify_email(struct gotd_repo *,
111 				    char *, char *, char *, char *, char *);
112 static int			 conf_notify_http(struct gotd_repo *,
113 				    char *, char *, char *, int);
114 static enum gotd_procid		 gotd_proc_id;
115 
116 typedef struct {
117 	union {
118 		long long	 number;
119 		char		*string;
120 		struct timeval	 tv;
121 	} v;
122 	int lineno;
123 } YYSTYPE;
124 
125 %}
126 
127 %token	PATH ERROR LISTEN ON USER REPOSITORY PERMIT DENY
128 %token	RO RW CONNECTION LIMIT REQUEST TIMEOUT
129 %token	PROTECT NAMESPACE BRANCH TAG REFERENCE RELAY PORT
130 %token	NOTIFY EMAIL FROM REPLY TO URL PASSWORD INSECURE
131 
132 %token	<v.string>	STRING
133 %token	<v.number>	NUMBER
134 %type	<v.tv>		timeout
135 
136 %%
137 
138 grammar		:
139 		| grammar '\n'
140 		| grammar varset '\n'
141 		| grammar main '\n'
142 		| grammar repository '\n'
143 		;
144 
145 varset		: STRING '=' STRING	{
146 			char *s = $1;
147 			while (*s++) {
148 				if (isspace((unsigned char)*s)) {
149 					yyerror("macro name cannot contain "
150 					    "whitespace");
151 					free($1);
152 					free($3);
153 					YYERROR;
154 				}
155 			}
156 			if (symset($1, $3, 0) == -1)
157 				fatal("cannot store variable");
158 			free($1);
159 			free($3);
160 		}
161 		;
162 
163 timeout		: NUMBER {
164 			if ($1 < 0) {
165 				yyerror("invalid timeout: %lld", $1);
166 				YYERROR;
167 			}
168 			$$.tv_sec = $1;
169 			$$.tv_usec = 0;
170 		}
171 		| STRING {
172 			const char	*errstr;
173 			const char	*type = "seconds";
174 			size_t		 len;
175 			int		 mul = 1;
176 
177 			if (*$1 == '\0') {
178 				yyerror("invalid number of seconds: %s", $1);
179 				free($1);
180 				YYERROR;
181 			}
182 
183 			len = strlen($1);
184 			switch ($1[len - 1]) {
185 			case 'S':
186 			case 's':
187 				$1[len - 1] = '\0';
188 				break;
189 			case 'M':
190 			case 'm':
191 				type = "minutes";
192 				mul = 60;
193 				$1[len - 1] = '\0';
194 				break;
195 			case 'H':
196 			case 'h':
197 				type = "hours";
198 				mul = 60 * 60;
199 				$1[len - 1] = '\0';
200 				break;
201 			}
202 
203 			$$.tv_usec = 0;
204 			$$.tv_sec = strtonum($1, 0, INT_MAX / mul, &errstr);
205 			if (errstr) {
206 				yyerror("number of %s is %s: %s", type,
207 				    errstr, $1);
208 				free($1);
209 				YYERROR;
210 			}
211 
212 			$$.tv_sec *= mul;
213 			free($1);
214 		}
215 		;
216 
217 main		: LISTEN ON STRING {
218 			if (!got_path_is_absolute($3))
219 				yyerror("bad unix socket path \"%s\": "
220 				    "must be an absolute path", $3);
221 
222 			if (gotd_proc_id == PROC_LISTEN) {
223 				if (strlcpy(gotd->unix_socket_path, $3,
224 				    sizeof(gotd->unix_socket_path)) >=
225 				    sizeof(gotd->unix_socket_path)) {
226 					yyerror("%s: unix socket path too long",
227 					    __func__);
228 					free($3);
229 					YYERROR;
230 				}
231 			}
232 			free($3);
233 		}
234 		| USER STRING {
235 			if (strlcpy(gotd->user_name, $2,
236 			    sizeof(gotd->user_name)) >=
237 			    sizeof(gotd->user_name)) {
238 				yyerror("%s: user name too long", __func__);
239 				free($2);
240 				YYERROR;
241 			}
242 			free($2);
243 		}
244 		| connection
245 		;
246 
247 connection	: CONNECTION '{' optnl conflags_l '}'
248 		| CONNECTION conflags
249 
250 conflags_l	: conflags optnl conflags_l
251 		| conflags optnl
252 		;
253 
254 conflags	: REQUEST TIMEOUT timeout		{
255 			if ($3.tv_sec <= 0) {
256 				yyerror("invalid timeout: %lld",
257 				    (long long)$3.tv_sec);
258 				YYERROR;
259 			}
260 			memcpy(&gotd->request_timeout, &$3,
261 			    sizeof(gotd->request_timeout));
262 		}
263 		| LIMIT USER STRING NUMBER	{
264 			if (gotd_proc_id == PROC_LISTEN &&
265 			    conf_limit_user_connections($3, $4) == -1) {
266 				free($3);
267 				YYERROR;
268 			}
269 			free($3);
270 		}
271 		;
272 
273 protect		: PROTECT '{' optnl protectflags_l '}'
274 		| PROTECT protectflags
275 
276 protectflags_l	: protectflags optnl protectflags_l
277 		| protectflags optnl
278 		;
279 
280 protectflags	: TAG NAMESPACE STRING {
281 			if (gotd_proc_id == PROC_GOTD ||
282 			    gotd_proc_id == PROC_REPO_WRITE) {
283 				if (conf_protect_tag_namespace(new_repo, $3)) {
284 					free($3);
285 					YYERROR;
286 				}
287 			}
288 			free($3);
289 		}
290 		| BRANCH NAMESPACE STRING {
291 			if (gotd_proc_id == PROC_GOTD ||
292 			    gotd_proc_id == PROC_REPO_WRITE) {
293 				if (conf_protect_branch_namespace(new_repo,
294 				    $3)) {
295 					free($3);
296 					YYERROR;
297 				}
298 			}
299 			free($3);
300 		}
301 		| BRANCH STRING {
302 			if (gotd_proc_id == PROC_GOTD ||
303 			    gotd_proc_id == PROC_REPO_WRITE) {
304 				if (conf_protect_branch(new_repo, $2)) {
305 					free($2);
306 					YYERROR;
307 				}
308 			}
309 			free($2);
310 		}
311 		;
312 
313 notify		: NOTIFY '{' optnl notifyflags_l '}'
314 		| NOTIFY notifyflags
315 
316 notifyflags_l	: notifyflags optnl notifyflags_l
317 		| notifyflags optnl
318 		;
319 
320 notifyflags	: BRANCH STRING {
321 			if (gotd_proc_id == PROC_GOTD ||
322 			    gotd_proc_id == PROC_SESSION_WRITE ||
323 			    gotd_proc_id == PROC_NOTIFY) {
324 				if (conf_notify_branch(new_repo, $2)) {
325 					free($2);
326 					YYERROR;
327 				}
328 			}
329 			free($2);
330 		}
331 		| REFERENCE NAMESPACE STRING {
332 			if (gotd_proc_id == PROC_GOTD ||
333 			    gotd_proc_id == PROC_SESSION_WRITE ||
334 			    gotd_proc_id == PROC_NOTIFY) {
335 				if (conf_notify_ref_namespace(new_repo, $3)) {
336 					free($3);
337 					YYERROR;
338 				}
339 			}
340 			free($3);
341 		}
342 		| EMAIL TO STRING {
343 			if (gotd_proc_id == PROC_GOTD ||
344 			    gotd_proc_id == PROC_SESSION_WRITE ||
345 			    gotd_proc_id == PROC_NOTIFY) {
346 				if (conf_notify_email(new_repo, NULL, $3,
347 				    NULL, NULL, NULL)) {
348 					free($3);
349 					YYERROR;
350 				}
351 			}
352 			free($3);
353 		}
354 		| EMAIL FROM STRING TO STRING {
355 			if (gotd_proc_id == PROC_GOTD ||
356 			    gotd_proc_id == PROC_SESSION_WRITE ||
357 			    gotd_proc_id == PROC_NOTIFY) {
358 				if (conf_notify_email(new_repo, $3, $5,
359 				    NULL, NULL, NULL)) {
360 					free($3);
361 					free($5);
362 					YYERROR;
363 				}
364 			}
365 			free($3);
366 			free($5);
367 		}
368 		| EMAIL TO STRING REPLY TO STRING {
369 			if (gotd_proc_id == PROC_GOTD ||
370 			    gotd_proc_id == PROC_SESSION_WRITE ||
371 			    gotd_proc_id == PROC_NOTIFY) {
372 				if (conf_notify_email(new_repo, NULL, $3,
373 				    $6, NULL, NULL)) {
374 					free($3);
375 					free($6);
376 					YYERROR;
377 				}
378 			}
379 			free($3);
380 			free($6);
381 		}
382 		| EMAIL FROM STRING TO STRING REPLY TO STRING {
383 			if (gotd_proc_id == PROC_GOTD ||
384 			    gotd_proc_id == PROC_SESSION_WRITE ||
385 			    gotd_proc_id == PROC_NOTIFY) {
386 				if (conf_notify_email(new_repo, $3, $5,
387 				    $8, NULL, NULL)) {
388 					free($3);
389 					free($5);
390 					free($8);
391 					YYERROR;
392 				}
393 			}
394 			free($3);
395 			free($5);
396 			free($8);
397 		}
398 		| EMAIL TO STRING RELAY STRING {
399 			if (gotd_proc_id == PROC_GOTD ||
400 			    gotd_proc_id == PROC_SESSION_WRITE ||
401 			    gotd_proc_id == PROC_NOTIFY) {
402 				if (conf_notify_email(new_repo, NULL, $3,
403 				    NULL, $5, NULL)) {
404 					free($3);
405 					free($5);
406 					YYERROR;
407 				}
408 			}
409 			free($3);
410 			free($5);
411 		}
412 		| EMAIL FROM STRING TO STRING RELAY STRING {
413 			if (gotd_proc_id == PROC_GOTD ||
414 			    gotd_proc_id == PROC_SESSION_WRITE ||
415 			    gotd_proc_id == PROC_NOTIFY) {
416 				if (conf_notify_email(new_repo, $3, $5,
417 				    NULL, $7, NULL)) {
418 					free($3);
419 					free($5);
420 					free($7);
421 					YYERROR;
422 				}
423 			}
424 			free($3);
425 			free($5);
426 			free($7);
427 		}
428 		| EMAIL TO STRING REPLY TO STRING RELAY STRING {
429 			if (gotd_proc_id == PROC_GOTD ||
430 			    gotd_proc_id == PROC_SESSION_WRITE ||
431 			    gotd_proc_id == PROC_NOTIFY) {
432 				if (conf_notify_email(new_repo, NULL, $3,
433 				    $6, $8, NULL)) {
434 					free($3);
435 					free($6);
436 					free($8);
437 					YYERROR;
438 				}
439 			}
440 			free($3);
441 			free($6);
442 			free($8);
443 		}
444 		| EMAIL FROM STRING TO STRING REPLY TO STRING RELAY STRING {
445 			if (gotd_proc_id == PROC_GOTD ||
446 			    gotd_proc_id == PROC_SESSION_WRITE ||
447 			    gotd_proc_id == PROC_NOTIFY) {
448 				if (conf_notify_email(new_repo, $3, $5,
449 				    $8, $10, NULL)) {
450 					free($3);
451 					free($5);
452 					free($8);
453 					free($10);
454 					YYERROR;
455 				}
456 			}
457 			free($3);
458 			free($5);
459 			free($8);
460 			free($10);
461 		}
462 		| EMAIL TO STRING RELAY STRING PORT STRING {
463 			if (gotd_proc_id == PROC_GOTD ||
464 			    gotd_proc_id == PROC_SESSION_WRITE ||
465 			    gotd_proc_id == PROC_NOTIFY) {
466 				if (conf_notify_email(new_repo, NULL, $3,
467 				    NULL, $5, $7)) {
468 					free($3);
469 					free($5);
470 					free($7);
471 					YYERROR;
472 				}
473 			}
474 			free($3);
475 			free($5);
476 			free($7);
477 		}
478 		| EMAIL FROM STRING TO STRING RELAY STRING PORT STRING {
479 			if (gotd_proc_id == PROC_GOTD ||
480 			    gotd_proc_id == PROC_SESSION_WRITE ||
481 			    gotd_proc_id == PROC_NOTIFY) {
482 				if (conf_notify_email(new_repo, $3, $5,
483 				    NULL, $7, $9)) {
484 					free($3);
485 					free($5);
486 					free($7);
487 					free($9);
488 					YYERROR;
489 				}
490 			}
491 			free($3);
492 			free($5);
493 			free($7);
494 			free($9);
495 		}
496 		| EMAIL TO STRING REPLY TO STRING RELAY STRING PORT STRING {
497 			if (gotd_proc_id == PROC_GOTD ||
498 			    gotd_proc_id == PROC_SESSION_WRITE ||
499 			    gotd_proc_id == PROC_NOTIFY) {
500 				if (conf_notify_email(new_repo, NULL, $3,
501 				    $6, $8, $10)) {
502 					free($3);
503 					free($6);
504 					free($8);
505 					free($10);
506 					YYERROR;
507 				}
508 			}
509 			free($3);
510 			free($6);
511 			free($8);
512 			free($10);
513 		}
514 		| EMAIL FROM STRING TO STRING REPLY TO STRING RELAY STRING PORT STRING {
515 			if (gotd_proc_id == PROC_GOTD ||
516 			    gotd_proc_id == PROC_SESSION_WRITE ||
517 			    gotd_proc_id == PROC_NOTIFY) {
518 				if (conf_notify_email(new_repo, $3, $5,
519 				    $8, $10, $12)) {
520 					free($3);
521 					free($5);
522 					free($8);
523 					free($10);
524 					free($12);
525 					YYERROR;
526 				}
527 			}
528 			free($3);
529 			free($5);
530 			free($8);
531 			free($10);
532 			free($12);
533 		}
534 		| EMAIL TO STRING RELAY STRING PORT NUMBER {
535 			if (gotd_proc_id == PROC_GOTD ||
536 			    gotd_proc_id == PROC_SESSION_WRITE ||
537 			    gotd_proc_id == PROC_NOTIFY) {
538 				if (conf_notify_email(new_repo, NULL, $3,
539 				    NULL, $5, port_sprintf($7))) {
540 					free($3);
541 					free($5);
542 					YYERROR;
543 				}
544 			}
545 			free($3);
546 			free($5);
547 		}
548 		| EMAIL FROM STRING TO STRING RELAY STRING PORT NUMBER {
549 			if (gotd_proc_id == PROC_GOTD ||
550 			    gotd_proc_id == PROC_SESSION_WRITE ||
551 			    gotd_proc_id == PROC_NOTIFY) {
552 				if (conf_notify_email(new_repo, $3, $5,
553 				    NULL, $7, port_sprintf($9))) {
554 					free($3);
555 					free($5);
556 					free($7);
557 					YYERROR;
558 				}
559 			}
560 			free($3);
561 			free($5);
562 			free($7);
563 		}
564 		| EMAIL TO STRING REPLY TO STRING RELAY STRING PORT NUMBER {
565 			if (gotd_proc_id == PROC_GOTD ||
566 			    gotd_proc_id == PROC_SESSION_WRITE ||
567 			    gotd_proc_id == PROC_NOTIFY) {
568 				if (conf_notify_email(new_repo, NULL, $3,
569 				    $6, $8, port_sprintf($10))) {
570 					free($3);
571 					free($6);
572 					free($8);
573 					YYERROR;
574 				}
575 			}
576 			free($3);
577 			free($6);
578 			free($8);
579 		}
580 		| EMAIL FROM STRING TO STRING REPLY TO STRING RELAY STRING PORT NUMBER {
581 			if (gotd_proc_id == PROC_GOTD ||
582 			    gotd_proc_id == PROC_SESSION_WRITE ||
583 			    gotd_proc_id == PROC_NOTIFY) {
584 				if (conf_notify_email(new_repo, $3, $5,
585 				    $8, $10, port_sprintf($12))) {
586 					free($3);
587 					free($5);
588 					free($8);
589 					free($10);
590 					YYERROR;
591 				}
592 			}
593 			free($3);
594 			free($5);
595 			free($8);
596 			free($10);
597 		}
598 		| URL STRING {
599 			if (gotd_proc_id == PROC_GOTD ||
600 			    gotd_proc_id == PROC_SESSION_WRITE ||
601 			    gotd_proc_id == PROC_NOTIFY) {
602 				if (conf_notify_http(new_repo, $2, NULL,
603 				    NULL, 0)) {
604 					free($2);
605 					YYERROR;
606 				}
607 			}
608 			free($2);
609 		}
610 		| URL STRING USER STRING PASSWORD STRING {
611 			if (gotd_proc_id == PROC_GOTD ||
612 			    gotd_proc_id == PROC_SESSION_WRITE ||
613 			    gotd_proc_id == PROC_NOTIFY) {
614 				if (conf_notify_http(new_repo, $2, $4, $6, 0)) {
615 					free($2);
616 					free($4);
617 					free($6);
618 					YYERROR;
619 				}
620 			}
621 			free($2);
622 			free($4);
623 			free($6);
624 		}
625 		| URL STRING USER STRING PASSWORD STRING INSECURE {
626 			if (gotd_proc_id == PROC_GOTD ||
627 			    gotd_proc_id == PROC_SESSION_WRITE ||
628 			    gotd_proc_id == PROC_NOTIFY) {
629 				if (conf_notify_http(new_repo, $2, $4, $6, 1)) {
630 					free($2);
631 					free($4);
632 					free($6);
633 					YYERROR;
634 				}
635 			}
636 			free($2);
637 			free($4);
638 			free($6);
639 		}
640 		;
641 	
642 repository	: REPOSITORY STRING {
643 			struct gotd_repo *repo;
644 
645 			TAILQ_FOREACH(repo, &gotd->repos, entry) {
646 				if (strcmp(repo->name, $2) == 0) {
647 					yyerror("duplicate repository '%s'", $2);
648 					free($2);
649 					YYERROR;
650 				}
651 			}
652 
653 			if (gotd_proc_id == PROC_GOTD ||
654 			    gotd_proc_id == PROC_AUTH ||
655 			    gotd_proc_id == PROC_REPO_WRITE ||
656 			    gotd_proc_id == PROC_SESSION_WRITE ||
657 			    gotd_proc_id == PROC_GITWRAPPER |
658 			    gotd_proc_id == PROC_NOTIFY) {
659 				new_repo = conf_new_repo($2);
660 			}
661 			free($2);
662 		} '{' optnl repoopts2 '}' {
663 		}
664 		;
665 
666 repoopts1	: PATH STRING {
667 			if (gotd_proc_id == PROC_GOTD ||
668 			    gotd_proc_id == PROC_AUTH ||
669 			    gotd_proc_id == PROC_REPO_WRITE ||
670 			    gotd_proc_id == PROC_SESSION_WRITE ||
671 			    gotd_proc_id == PROC_GITWRAPPER ||
672 			    gotd_proc_id == PROC_NOTIFY) {
673 				if (!got_path_is_absolute($2)) {
674 					yyerror("%s: path %s is not absolute",
675 					    __func__, $2);
676 					free($2);
677 					YYERROR;
678 				}
679 				if (realpath($2, new_repo->path) == NULL) {
680 					/*
681 					 * To give admins a chance to create
682 					 * missing repositories at run-time
683 					 * we only warn about ENOENT here.
684 					 *
685 					 * And ignore 'permission denied' when
686 					 * running in gitwrapper. Users may be
687 					 * able to access this repository via
688 					 * gotd regardless.
689 					 */
690 					if (errno == ENOENT) {
691 						yyerror("realpath %s: %s", $2,
692 						    strerror(errno));
693 					} else if (errno != EACCES ||
694 					    gotd_proc_id != PROC_GITWRAPPER) {
695 						yyerror("realpath %s: %s", $2,
696 						    strerror(errno));
697 						free($2);
698 						YYERROR;
699 					}
700 
701 					if (strlcpy(new_repo->path, $2,
702 					    sizeof(new_repo->path)) >=
703 					    sizeof(new_repo->path))
704 						yyerror("path too long");
705 				}
706 			}
707 			free($2);
708 		}
709 		| PERMIT RO STRING {
710 			if (gotd_proc_id == PROC_AUTH) {
711 				conf_new_access_rule(new_repo,
712 				    GOTD_ACCESS_PERMITTED, GOTD_AUTH_READ, $3);
713 			} else
714 				free($3);
715 		}
716 		| PERMIT RW STRING {
717 			if (gotd_proc_id == PROC_AUTH) {
718 				conf_new_access_rule(new_repo,
719 				    GOTD_ACCESS_PERMITTED,
720 				    GOTD_AUTH_READ | GOTD_AUTH_WRITE, $3);
721 			} else
722 				free($3);
723 		}
724 		| DENY STRING {
725 			if (gotd_proc_id == PROC_AUTH) {
726 				conf_new_access_rule(new_repo,
727 				    GOTD_ACCESS_DENIED, 0, $2);
728 			} else
729 				free($2);
730 		}
731 		| protect
732 		| notify
733 		;
734 
735 repoopts2	: repoopts2 repoopts1 nl
736 		| repoopts1 optnl
737 		;
738 
739 nl		: '\n' optnl
740 		;
741 
742 optnl		: '\n' optnl		/* zero or more newlines */
743 		| /* empty */
744 		;
745 
746 %%
747 
748 struct keywords {
749 	const char	*k_name;
750 	int		 k_val;
751 };
752 
753 int
754 yyerror(const char *fmt, ...)
755 {
756 	va_list ap;
757 	char *msg;
758 
759 	file->errors++;
760 	va_start(ap, fmt);
761 	if (vasprintf(&msg, fmt, ap) == -1)
762 		fatalx("yyerror vasprintf");
763 	va_end(ap);
764 	logit(LOG_CRIT, "%s:%d: %s", file->name, yylval.lineno, msg);
765 	free(msg);
766 	return (0);
767 }
768 
769 int
770 kw_cmp(const void *k, const void *e)
771 {
772 	return (strcmp(k, ((const struct keywords *)e)->k_name));
773 }
774 
775 int
776 lookup(char *s)
777 {
778 	/* This has to be sorted always. */
779 	static const struct keywords keywords[] = {
780 		{ "branch",			BRANCH },
781 		{ "connection",			CONNECTION },
782 		{ "deny",			DENY },
783 		{ "email",			EMAIL },
784 		{ "from",			FROM },
785 		{ "insecure",			INSECURE },
786 		{ "limit",			LIMIT },
787 		{ "listen",			LISTEN },
788 		{ "namespace",			NAMESPACE },
789 		{ "notify",			NOTIFY },
790 		{ "on",				ON },
791 		{ "password",			PASSWORD },
792 		{ "path",			PATH },
793 		{ "permit",			PERMIT },
794 		{ "port",			PORT },
795 		{ "protect",			PROTECT },
796 		{ "reference",			REFERENCE },
797 		{ "relay",			RELAY },
798 		{ "reply",			REPLY },
799 		{ "repository",			REPOSITORY },
800 		{ "request",			REQUEST },
801 		{ "ro",				RO },
802 		{ "rw",				RW },
803 		{ "tag",			TAG },
804 		{ "timeout",			TIMEOUT },
805 		{ "to",				TO },
806 		{ "url",			URL },
807 		{ "user",			USER },
808 	};
809 	const struct keywords *p;
810 
811 	p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]),
812 	    sizeof(keywords[0]), kw_cmp);
813 
814 	if (p)
815 		return (p->k_val);
816 	else
817 		return (STRING);
818 }
819 
820 #define MAXPUSHBACK	128
821 
822 unsigned char *parsebuf;
823 int parseindex;
824 unsigned char pushback_buffer[MAXPUSHBACK];
825 int pushback_index = 0;
826 
827 int
828 lgetc(int quotec)
829 {
830 	int c, next;
831 
832 	if (parsebuf) {
833 		/* Read character from the parsebuffer instead of input. */
834 		if (parseindex >= 0) {
835 			c = parsebuf[parseindex++];
836 			if (c != '\0')
837 				return (c);
838 			parsebuf = NULL;
839 		} else
840 			parseindex++;
841 	}
842 
843 	if (pushback_index)
844 		return (pushback_buffer[--pushback_index]);
845 
846 	if (quotec) {
847 		c = getc(file->stream);
848 		if (c == EOF)
849 			yyerror("reached end of file while parsing "
850 			    "quoted string");
851 		return (c);
852 	}
853 
854 	c = getc(file->stream);
855 	while (c == '\\') {
856 		next = getc(file->stream);
857 		if (next != '\n') {
858 			c = next;
859 			break;
860 		}
861 		yylval.lineno = file->lineno;
862 		file->lineno++;
863 		c = getc(file->stream);
864 	}
865 
866 	return (c);
867 }
868 
869 int
870 lungetc(int c)
871 {
872 	if (c == EOF)
873 		return (EOF);
874 	if (parsebuf) {
875 		parseindex--;
876 		if (parseindex >= 0)
877 			return (c);
878 	}
879 	if (pushback_index < MAXPUSHBACK-1)
880 		return (pushback_buffer[pushback_index++] = c);
881 	else
882 		return (EOF);
883 }
884 
885 int
886 findeol(void)
887 {
888 	int c;
889 
890 	parsebuf = NULL;
891 
892 	/* Skip to either EOF or the first real EOL. */
893 	while (1) {
894 		if (pushback_index)
895 			c = pushback_buffer[--pushback_index];
896 		else
897 			c = lgetc(0);
898 		if (c == '\n') {
899 			file->lineno++;
900 			break;
901 		}
902 		if (c == EOF)
903 			break;
904 	}
905 	return (ERROR);
906 }
907 
908 int
909 yylex(void)
910 {
911 	unsigned char buf[8096];
912 	unsigned char *p, *val;
913 	int quotec, next, c;
914 	int token;
915 
916 top:
917 	p = buf;
918 	c = lgetc(0);
919 	while (c == ' ' || c == '\t')
920 		c = lgetc(0); /* nothing */
921 
922 	yylval.lineno = file->lineno;
923 	if (c == '#') {
924 		c = lgetc(0);
925 		while (c != '\n' && c != EOF)
926 			c = lgetc(0); /* nothing */
927 	}
928 	if (c == '$' && parsebuf == NULL) {
929 		while (1) {
930 			c = lgetc(0);
931 			if (c == EOF)
932 				return (0);
933 
934 			if (p + 1 >= buf + sizeof(buf) - 1) {
935 				yyerror("string too long");
936 				return (findeol());
937 			}
938 			if (isalnum(c) || c == '_') {
939 				*p++ = c;
940 				continue;
941 			}
942 			*p = '\0';
943 			lungetc(c);
944 			break;
945 		}
946 		val = symget(buf);
947 		if (val == NULL) {
948 			yyerror("macro '%s' not defined", buf);
949 			return (findeol());
950 		}
951 		parsebuf = val;
952 		parseindex = 0;
953 		goto top;
954 	}
955 
956 	switch (c) {
957 	case '\'':
958 	case '"':
959 		quotec = c;
960 		while (1) {
961 			c = lgetc(quotec);
962 			if (c == EOF)
963 				return (0);
964 			if (c == '\n') {
965 				file->lineno++;
966 				continue;
967 			} else if (c == '\\') {
968 				next = lgetc(quotec);
969 				if (next == EOF)
970 					return (0);
971 				if (next == quotec || c == ' ' || c == '\t')
972 					c = next;
973 				else if (next == '\n') {
974 					file->lineno++;
975 					continue;
976 				} else
977 					lungetc(next);
978 			} else if (c == quotec) {
979 				*p = '\0';
980 				break;
981 			} else if (c == '\0') {
982 				yyerror("syntax error");
983 				return (findeol());
984 			}
985 			if (p + 1 >= buf + sizeof(buf) - 1) {
986 				yyerror("string too long");
987 				return (findeol());
988 			}
989 			*p++ = c;
990 		}
991 		yylval.v.string = strdup(buf);
992 		if (yylval.v.string == NULL)
993 			err(1, "yylex: strdup");
994 		return (STRING);
995 	}
996 
997 #define allowed_to_end_number(x) \
998 	(isspace(x) || x == ')' || x ==',' || x == '/' || x == '}' || x == '=')
999 
1000 	if (c == '-' || isdigit(c)) {
1001 		do {
1002 			*p++ = c;
1003 			if ((unsigned)(p-buf) >= sizeof(buf)) {
1004 				yyerror("string too long");
1005 				return (findeol());
1006 			}
1007 			c = lgetc(0);
1008 		} while (c != EOF && isdigit(c));
1009 		lungetc(c);
1010 		if (p == buf + 1 && buf[0] == '-')
1011 			goto nodigits;
1012 		if (c == EOF || allowed_to_end_number(c)) {
1013 			const char *errstr = NULL;
1014 
1015 			*p = '\0';
1016 			yylval.v.number = strtonum(buf, LLONG_MIN,
1017 			    LLONG_MAX, &errstr);
1018 			if (errstr) {
1019 				yyerror("\"%s\" invalid number: %s",
1020 				    buf, errstr);
1021 				return (findeol());
1022 			}
1023 			return (NUMBER);
1024 		} else {
1025 nodigits:
1026 			while (p > buf + 1)
1027 				lungetc(*--p);
1028 			c = *--p;
1029 			if (c == '-')
1030 				return (c);
1031 		}
1032 	}
1033 
1034 #define allowed_in_string(x) \
1035 	(isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \
1036 	x != '{' && x != '}' && \
1037 	x != '!' && x != '=' && x != '#' && \
1038 	x != ','))
1039 
1040 	if (isalnum(c) || c == ':' || c == '_') {
1041 		do {
1042 			*p++ = c;
1043 			if ((unsigned)(p-buf) >= sizeof(buf)) {
1044 				yyerror("string too long");
1045 				return (findeol());
1046 			}
1047 			c = lgetc(0);
1048 		} while (c != EOF && (allowed_in_string(c)));
1049 		lungetc(c);
1050 		*p = '\0';
1051 		token = lookup(buf);
1052 		if (token == STRING) {
1053 			yylval.v.string = strdup(buf);
1054 			if (yylval.v.string == NULL)
1055 				err(1, "yylex: strdup");
1056 		}
1057 		return (token);
1058 	}
1059 	if (c == '\n') {
1060 		yylval.lineno = file->lineno;
1061 		file->lineno++;
1062 	}
1063 	if (c == EOF)
1064 		return (0);
1065 	return (c);
1066 }
1067 
1068 int
1069 check_file_secrecy(int fd, const char *fname)
1070 {
1071 	struct stat st;
1072 
1073 	if (fstat(fd, &st)) {
1074 		log_warn("cannot stat %s", fname);
1075 		return (-1);
1076 	}
1077 	if (st.st_uid != 0 && st.st_uid != getuid()) {
1078 		log_warnx("%s: owner not root or current user", fname);
1079 		return (-1);
1080 	}
1081 	if (st.st_mode & (S_IWGRP | S_IXGRP | S_IRWXO)) {
1082 		log_warnx("%s: group writable or world read/writable", fname);
1083 		return (-1);
1084 	}
1085 	return (0);
1086 }
1087 
1088 struct file *
1089 newfile(const char *name, int secret, int required)
1090 {
1091 	struct file *nfile;
1092 
1093 	nfile = calloc(1, sizeof(struct file));
1094 	if (nfile == NULL) {
1095 		log_warn("calloc");
1096 		return (NULL);
1097 	}
1098 	nfile->name = strdup(name);
1099 	if (nfile->name == NULL) {
1100 		log_warn("strdup");
1101 		free(nfile);
1102 		return (NULL);
1103 	}
1104 	nfile->stream = fopen(nfile->name, "r");
1105 	if (nfile->stream == NULL) {
1106 		if (required)
1107 			log_warn("open %s", nfile->name);
1108 		free(nfile->name);
1109 		free(nfile);
1110 		return (NULL);
1111 	} else if (secret &&
1112 	    check_file_secrecy(fileno(nfile->stream), nfile->name)) {
1113 		fclose(nfile->stream);
1114 		free(nfile->name);
1115 		free(nfile);
1116 		return (NULL);
1117 	}
1118 	nfile->lineno = 1;
1119 	return (nfile);
1120 }
1121 
1122 static void
1123 closefile(struct file *xfile)
1124 {
1125 	fclose(xfile->stream);
1126 	free(xfile->name);
1127 	free(xfile);
1128 }
1129 
1130 int
1131 parse_config(const char *filename, enum gotd_procid proc_id,
1132     struct gotd *env)
1133 {
1134 	struct sym *sym, *next;
1135 	struct gotd_repo *repo;
1136 	int require_config_file = (proc_id != PROC_GITWRAPPER);
1137 
1138 	memset(env, 0, sizeof(*env));
1139 
1140 	gotd = env;
1141 	gotd_proc_id = proc_id;
1142 	TAILQ_INIT(&gotd->repos);
1143 
1144 	/* Apply default values. */
1145 	if (strlcpy(gotd->unix_socket_path, GOTD_UNIX_SOCKET,
1146 	    sizeof(gotd->unix_socket_path)) >= sizeof(gotd->unix_socket_path)) {
1147 		fprintf(stderr, "%s: unix socket path too long", __func__);
1148 		return -1;
1149 	}
1150 	if (strlcpy(gotd->user_name, GOTD_USER,
1151 	    sizeof(gotd->user_name)) >= sizeof(gotd->user_name)) {
1152 		fprintf(stderr, "%s: user name too long", __func__);
1153 		return -1;
1154 	}
1155 
1156 	gotd->request_timeout.tv_sec = GOTD_DEFAULT_REQUEST_TIMEOUT;
1157 	gotd->request_timeout.tv_usec = 0;
1158 
1159 	file = newfile(filename, 0, require_config_file);
1160 	if (file == NULL)
1161 		return require_config_file ? -1 : 0;
1162 
1163 	yyparse();
1164 	errors = file->errors;
1165 	closefile(file);
1166 
1167 	/* Free macros and check which have not been used. */
1168 	TAILQ_FOREACH_SAFE(sym, &symhead, entry, next) {
1169 		if ((gotd->verbosity > 1) && !sym->used)
1170 			fprintf(stderr, "warning: macro '%s' not used\n",
1171 			    sym->nam);
1172 		if (!sym->persist) {
1173 			free(sym->nam);
1174 			free(sym->val);
1175 			TAILQ_REMOVE(&symhead, sym, entry);
1176 			free(sym);
1177 		}
1178 	}
1179 
1180 	if (errors)
1181 		return (-1);
1182 
1183 	TAILQ_FOREACH(repo, &gotd->repos, entry) {
1184 		if (repo->path[0] == '\0') {
1185 			log_warnx("repository \"%s\": no path provided in "
1186 			    "configuration file", repo->name);
1187 			return (-1);
1188 		}
1189 	}
1190 
1191 	if (proc_id == PROC_GOTD && TAILQ_EMPTY(&gotd->repos)) {
1192 		log_warnx("no repository defined in configuration file");
1193 		return (-1);
1194 	}
1195 
1196 	return (0);
1197 }
1198 
1199 static int
1200 uid_connection_limit_cmp(const void *pa, const void *pb)
1201 {
1202 	const struct gotd_uid_connection_limit *a = pa, *b = pb;
1203 
1204 	if (a->uid < b->uid)
1205 		return -1;
1206 	else if (a->uid > b->uid);
1207 		return 1;
1208 
1209 	return 0;
1210 }
1211 
1212 static int
1213 conf_limit_user_connections(const char *user, int maximum)
1214 {
1215 	uid_t uid;
1216 	struct gotd_uid_connection_limit *limit;
1217 	size_t nlimits;
1218 
1219 	if (maximum < 1) {
1220 		yyerror("max connections cannot be smaller 1");
1221 		return -1;
1222 	}
1223 	if (maximum > GOTD_MAXCLIENTS) {
1224 		yyerror("max connections must be <= %d", GOTD_MAXCLIENTS);
1225 		return -1;
1226 	}
1227 
1228 	if (gotd_parseuid(user, &uid) == -1) {
1229 		yyerror("%s: no such user", user);
1230 		return -1;
1231 	}
1232 
1233 	limit = gotd_find_uid_connection_limit(gotd->connection_limits,
1234 	    gotd->nconnection_limits, uid);
1235 	if (limit) {
1236 		limit->max_connections = maximum;
1237 		return 0;
1238 	}
1239 
1240 	limit = gotd->connection_limits;
1241 	nlimits = gotd->nconnection_limits + 1;
1242 	limit = reallocarray(limit, nlimits, sizeof(*limit));
1243 	if (limit == NULL)
1244 		fatal("reallocarray");
1245 
1246 	limit[nlimits - 1].uid = uid;
1247 	limit[nlimits - 1].max_connections = maximum;
1248 
1249 	gotd->connection_limits = limit;
1250 	gotd->nconnection_limits = nlimits;
1251 	qsort(gotd->connection_limits, gotd->nconnection_limits,
1252 	    sizeof(gotd->connection_limits[0]), uid_connection_limit_cmp);
1253 
1254 	return 0;
1255 }
1256 
1257 static struct gotd_repo *
1258 conf_new_repo(const char *name)
1259 {
1260 	struct gotd_repo *repo;
1261 
1262 	if (name[0] == '\0') {
1263 		fatalx("syntax error: empty repository name found in %s",
1264 		    file->name);
1265 	}
1266 
1267 	if (strchr(name, '\n') != NULL)
1268 		fatalx("repository names must not contain linefeeds: %s", name);
1269 
1270 	repo = calloc(1, sizeof(*repo));
1271 	if (repo == NULL)
1272 		fatalx("%s: calloc", __func__);
1273 
1274 	STAILQ_INIT(&repo->rules);
1275 	TAILQ_INIT(&repo->protected_tag_namespaces);
1276 	TAILQ_INIT(&repo->protected_branch_namespaces);
1277 	TAILQ_INIT(&repo->protected_branches);
1278 	TAILQ_INIT(&repo->protected_branches);
1279 	TAILQ_INIT(&repo->notification_refs);
1280 	TAILQ_INIT(&repo->notification_ref_namespaces);
1281 	STAILQ_INIT(&repo->notification_targets);
1282 
1283 	if (strlcpy(repo->name, name, sizeof(repo->name)) >=
1284 	    sizeof(repo->name))
1285 		fatalx("%s: strlcpy", __func__);
1286 
1287 	TAILQ_INSERT_TAIL(&gotd->repos, repo, entry);
1288 	gotd->nrepos++;
1289 
1290 	return repo;
1291 };
1292 
1293 static void
1294 conf_new_access_rule(struct gotd_repo *repo, enum gotd_access access,
1295     int authorization, char *identifier)
1296 {
1297 	struct gotd_access_rule *rule;
1298 
1299 	rule = calloc(1, sizeof(*rule));
1300 	if (rule == NULL)
1301 		fatal("calloc");
1302 
1303 	rule->access = access;
1304 	rule->authorization = authorization;
1305 	rule->identifier = identifier;
1306 
1307 	STAILQ_INSERT_TAIL(&repo->rules, rule, entry);
1308 }
1309 
1310 static int
1311 refname_is_valid(char *refname)
1312 {
1313 	if (strncmp(refname, "refs/", 5) != 0) {
1314 		yyerror("reference name must begin with \"refs/\": %s",
1315 		    refname);
1316 		return 0;
1317 	}
1318 
1319 	if (!got_ref_name_is_valid(refname)) {
1320 		yyerror("invalid reference name: %s", refname);
1321 		return 0;
1322 	}
1323 
1324 	return 1;
1325 }
1326 
1327 static int
1328 conf_protect_ref_namespace(char **new, struct got_pathlist_head *refs,
1329     char *namespace)
1330 {
1331 	const struct got_error *error;
1332 	struct got_pathlist_entry *pe;
1333 	char *s;
1334 
1335 	*new = NULL;
1336 
1337 	got_path_strip_trailing_slashes(namespace);
1338 	if (!refname_is_valid(namespace))
1339 		return -1;
1340 	if (asprintf(&s, "%s/", namespace) == -1) {
1341 		yyerror("asprintf: %s", strerror(errno));
1342 		return -1;
1343 	}
1344 
1345 	error = got_pathlist_insert(&pe, refs, s, NULL);
1346 	if (error || pe == NULL) {
1347 		free(s);
1348 		if (error)
1349 			yyerror("got_pathlist_insert: %s", error->msg);
1350 		else
1351 			yyerror("duplicate protected namespace %s", namespace);
1352 		return -1;
1353 	}
1354 
1355 	*new = s;
1356 	return 0;
1357 }
1358 
1359 static int
1360 conf_protect_tag_namespace(struct gotd_repo *repo, char *namespace)
1361 {
1362 	struct got_pathlist_entry *pe;
1363 	char *new;
1364 
1365 	if (conf_protect_ref_namespace(&new, &repo->protected_tag_namespaces,
1366 	    namespace) == -1)
1367 		return -1;
1368 
1369 	TAILQ_FOREACH(pe, &repo->protected_branch_namespaces, entry) {
1370 		if (strcmp(pe->path, new) == 0) {
1371 			yyerror("duplicate protected namespace %s", namespace);
1372 			return -1;
1373 		}
1374 	}
1375 
1376 	return 0;
1377 }
1378 
1379 static int
1380 conf_protect_branch_namespace(struct gotd_repo *repo, char *namespace)
1381 {
1382 	struct got_pathlist_entry *pe;
1383 	char *new;
1384 
1385 	if (conf_protect_ref_namespace(&new,
1386 	    &repo->protected_branch_namespaces, namespace) == -1)
1387 		return -1;
1388 
1389 	TAILQ_FOREACH(pe, &repo->protected_tag_namespaces, entry) {
1390 		if (strcmp(pe->path, new) == 0) {
1391 			yyerror("duplicate protected namespace %s", namespace);
1392 			return -1;
1393 		}
1394 	}
1395 
1396 	return 0;
1397 }
1398 
1399 static int
1400 conf_protect_branch(struct gotd_repo *repo, char *branchname)
1401 {
1402 	const struct got_error *error;
1403 	struct got_pathlist_entry *new;
1404 	char *refname;
1405 
1406 	if (strncmp(branchname, "refs/heads/", 11) != 0) {
1407 		if (asprintf(&refname, "refs/heads/%s", branchname) == -1) {
1408 			yyerror("asprintf: %s", strerror(errno));
1409 			return -1;
1410 		}
1411 	} else {
1412 		refname = strdup(branchname);
1413 		if (refname == NULL) {
1414 			yyerror("strdup: %s", strerror(errno));
1415 			return -1;
1416 		}
1417 	}
1418 
1419 	if (!refname_is_valid(refname)) {
1420 		free(refname);
1421 		return -1;
1422 	}
1423 
1424 	error = got_pathlist_insert(&new, &repo->protected_branches,
1425 	    refname, NULL);
1426 	if (error || new == NULL) {
1427 		free(refname);
1428 		if (error)
1429 			yyerror("got_pathlist_insert: %s", error->msg);
1430 		else
1431 			yyerror("duplicate protect branch %s", branchname);
1432 		return -1;
1433 	}
1434 
1435 	return 0;
1436 }
1437 
1438 static int
1439 conf_notify_branch(struct gotd_repo *repo, char *branchname)
1440 {
1441 	const struct got_error *error;
1442 	struct got_pathlist_entry *pe;
1443 	char *refname;
1444 
1445 	if (strncmp(branchname, "refs/heads/", 11) != 0) {
1446 		if (asprintf(&refname, "refs/heads/%s", branchname) == -1) {
1447 			yyerror("asprintf: %s", strerror(errno));
1448 			return -1;
1449 		}
1450 	} else {
1451 		refname = strdup(branchname);
1452 		if (refname == NULL) {
1453 			yyerror("strdup: %s", strerror(errno));
1454 			return -1;
1455 		}
1456 	}
1457 
1458 	if (!refname_is_valid(refname)) {
1459 		free(refname);
1460 		return -1;
1461 	}
1462 
1463 	error = got_pathlist_insert(&pe, &repo->notification_refs,
1464 	    refname, NULL);
1465 	if (error) {
1466 		free(refname);
1467 		yyerror("got_pathlist_insert: %s", error->msg);
1468 		return -1;
1469 	}
1470 	if (pe == NULL)
1471 		free(refname);
1472 
1473 	return 0;
1474 }
1475 
1476 static int
1477 conf_notify_ref_namespace(struct gotd_repo *repo, char *namespace)
1478 {
1479 	const struct got_error *error;
1480 	struct got_pathlist_entry *pe;
1481 	char *s;
1482 
1483 	got_path_strip_trailing_slashes(namespace);
1484 	if (!refname_is_valid(namespace))
1485 		return -1;
1486 
1487 	if (asprintf(&s, "%s/", namespace) == -1) {
1488 		yyerror("asprintf: %s", strerror(errno));
1489 		return -1;
1490 	}
1491 
1492 	error = got_pathlist_insert(&pe, &repo->notification_ref_namespaces,
1493 	    s, NULL);
1494 	if (error) {
1495 		free(s);
1496 		yyerror("got_pathlist_insert: %s", error->msg);
1497 		return -1;
1498 	}
1499 	if (pe == NULL)
1500 		free(s);
1501 
1502 	return 0;
1503 }
1504 
1505 static int
1506 conf_notify_email(struct gotd_repo *repo, char *sender, char *recipient,
1507     char *responder, char *hostname, char *port)
1508 {
1509 	struct gotd_notification_target *target;
1510 
1511 	STAILQ_FOREACH(target, &repo->notification_targets, entry) {
1512 		if (target->type != GOTD_NOTIFICATION_VIA_EMAIL)
1513 			continue;
1514 		if (strcmp(target->conf.email.recipient, recipient) == 0) {
1515 			yyerror("duplicate email notification for '%s' in "
1516 			    "repository '%s'", recipient, repo->name);
1517 			return -1;
1518 		}
1519 	}
1520 
1521 	target = calloc(1, sizeof(*target));
1522 	if (target == NULL)
1523 		fatal("calloc");
1524 	target->type = GOTD_NOTIFICATION_VIA_EMAIL;
1525 	if (sender) {
1526 		target->conf.email.sender = strdup(sender);
1527 		if (target->conf.email.sender == NULL)
1528 			fatal("strdup");
1529 	}
1530 	target->conf.email.recipient = strdup(recipient);
1531 	if (target->conf.email.recipient == NULL)
1532 		fatal("strdup");
1533 	if (responder) {
1534 		target->conf.email.responder = strdup(responder);
1535 		if (target->conf.email.responder == NULL)
1536 			fatal("strdup");
1537 	}
1538 	if (hostname) {
1539 		target->conf.email.hostname = strdup(hostname);
1540 		if (target->conf.email.hostname == NULL)
1541 			fatal("strdup");
1542 	}
1543 	if (port) {
1544 		target->conf.email.port = strdup(port);
1545 		if (target->conf.email.port == NULL)
1546 			fatal("strdup");
1547 	}
1548 
1549 	STAILQ_INSERT_TAIL(&repo->notification_targets, target, entry);
1550 	return 0;
1551 }
1552 
1553 static int
1554 conf_notify_http(struct gotd_repo *repo, char *url, char *user, char *password,
1555     int insecure)
1556 {
1557 	const struct got_error *error;
1558 	struct gotd_notification_target *target;
1559 	char *proto, *hostname, *port, *path;
1560 	int tls = 0, ret = 0;
1561 
1562 	error = gotd_parse_url(&proto, &hostname, &port, &path, url);
1563 	if (error) {
1564 		yyerror("invalid HTTP notification URL '%s' in "
1565 		    "repository '%s': %s", url, repo->name, error->msg);
1566 		return -1;
1567 	}
1568 
1569 	tls = !strcmp(proto, "https");
1570 
1571 	if (strcmp(proto, "http") != 0 && strcmp(proto, "https") != 0) {
1572 		yyerror("invalid protocol '%s' in notification URL '%s' in "
1573 		    "repository '%s", proto, url, repo->name);
1574 		ret = -1;
1575 		goto done;
1576 	}
1577 
1578 	if (port == NULL) {
1579 		if (strcmp(proto, "http") == 0)
1580 			port = strdup("80");
1581 		if (strcmp(proto, "https") == 0)
1582 			port = strdup("443");
1583 		if (port == NULL) {
1584 			error = got_error_from_errno("strdup");
1585 			ret = -1;
1586 			goto done;
1587 		}
1588 	}
1589 
1590 	if ((user != NULL && password == NULL) ||
1591 	    (user == NULL && password != NULL)) {
1592 		yyerror("missing username or password");
1593 		ret = -1;
1594 		goto done;
1595 	}
1596 
1597 	if (!insecure && strcmp(proto, "http") == 0 &&
1598 	    (user != NULL || password != NULL)) {
1599 		yyerror("%s: HTTP notifications with basic authentication "
1600 		    "over plaintext HTTP will leak credentials; add the "
1601 		    "'insecure' config keyword if this is intentional", url);
1602 		ret = -1;
1603 		goto done;
1604 	}
1605 
1606 	STAILQ_FOREACH(target, &repo->notification_targets, entry) {
1607 		if (target->type != GOTD_NOTIFICATION_VIA_HTTP)
1608 			continue;
1609 		if (target->conf.http.tls == tls &&
1610 		    !strcmp(target->conf.http.hostname, hostname) &&
1611 		    !strcmp(target->conf.http.port, port) &&
1612 		    !strcmp(target->conf.http.path, path)) {
1613 			yyerror("duplicate notification for URL '%s' in "
1614 			    "repository '%s'", url, repo->name);
1615 			ret = -1;
1616 			goto done;
1617 		}
1618 	}
1619 
1620 	target = calloc(1, sizeof(*target));
1621 	if (target == NULL)
1622 		fatal("calloc");
1623 	target->type = GOTD_NOTIFICATION_VIA_HTTP;
1624 	target->conf.http.tls = tls;
1625 	target->conf.http.hostname = hostname;
1626 	target->conf.http.port = port;
1627 	target->conf.http.path = path;
1628 	hostname = port = path = NULL;
1629 
1630 	if (user) {
1631 		target->conf.http.user = strdup(user);
1632 		if (target->conf.http.user == NULL)
1633 			fatal("strdup");
1634 		target->conf.http.password = strdup(password);
1635 		if (target->conf.http.password == NULL)
1636 			fatal("strdup");
1637 	}	
1638 
1639 	STAILQ_INSERT_TAIL(&repo->notification_targets, target, entry);
1640 done:
1641 	free(proto);
1642 	free(hostname);
1643 	free(port);
1644 	free(path);
1645 	return ret;
1646 }
1647 
1648 int
1649 symset(const char *nam, const char *val, int persist)
1650 {
1651 	struct sym *sym;
1652 
1653 	TAILQ_FOREACH(sym, &symhead, entry) {
1654 		if (strcmp(nam, sym->nam) == 0)
1655 			break;
1656 	}
1657 
1658 	if (sym != NULL) {
1659 		if (sym->persist == 1)
1660 			return (0);
1661 		else {
1662 			free(sym->nam);
1663 			free(sym->val);
1664 			TAILQ_REMOVE(&symhead, sym, entry);
1665 			free(sym);
1666 		}
1667 	}
1668 	sym = calloc(1, sizeof(*sym));
1669 	if (sym == NULL)
1670 		return (-1);
1671 
1672 	sym->nam = strdup(nam);
1673 	if (sym->nam == NULL) {
1674 		free(sym);
1675 		return (-1);
1676 	}
1677 	sym->val = strdup(val);
1678 	if (sym->val == NULL) {
1679 		free(sym->nam);
1680 		free(sym);
1681 		return (-1);
1682 	}
1683 	sym->used = 0;
1684 	sym->persist = persist;
1685 	TAILQ_INSERT_TAIL(&symhead, sym, entry);
1686 	return (0);
1687 }
1688 
1689 char *
1690 symget(const char *nam)
1691 {
1692 	struct sym *sym;
1693 
1694 	TAILQ_FOREACH(sym, &symhead, entry) {
1695 		if (strcmp(nam, sym->nam) == 0) {
1696 			sym->used = 1;
1697 			return (sym->val);
1698 		}
1699 	}
1700 	return (NULL);
1701 }
1702 
1703 struct gotd_repo *
1704 gotd_find_repo_by_name(const char *repo_name, struct gotd_repolist *repos)
1705 {
1706 	struct gotd_repo *repo;
1707 	size_t namelen;
1708 
1709 	TAILQ_FOREACH(repo, repos, entry) {
1710 		namelen = strlen(repo->name);
1711 		if (strncmp(repo->name, repo_name, namelen) != 0)
1712 			continue;
1713 		if (repo_name[namelen] == '\0' ||
1714 		    strcmp(&repo_name[namelen], ".git") == 0)
1715 			return repo;
1716 	}
1717 
1718 	return NULL;
1719 }
1720 
1721 struct gotd_repo *
1722 gotd_find_repo_by_path(const char *repo_path, struct gotd *gotd)
1723 {
1724 	struct gotd_repo *repo;
1725 
1726 	TAILQ_FOREACH(repo, &gotd->repos, entry) {
1727 		if (strcmp(repo->path, repo_path) == 0)
1728 			return repo;
1729 	}
1730 
1731 	return NULL;
1732 }
1733 
1734 struct gotd_uid_connection_limit *
1735 gotd_find_uid_connection_limit(struct gotd_uid_connection_limit *limits,
1736     size_t nlimits, uid_t uid)
1737 {
1738 	/* This array is always sorted to allow for binary search. */
1739 	int i, left = 0, right = nlimits - 1;
1740 
1741 	while (left <= right) {
1742 		i = ((left + right) / 2);
1743 		if (limits[i].uid == uid)
1744 			return &limits[i];
1745 		if (limits[i].uid > uid)
1746 			left = i + 1;
1747 		else
1748 			right = i - 1;
1749 	}
1750 
1751 	return NULL;
1752 }
1753 
1754 int
1755 gotd_parseuid(const char *s, uid_t *uid)
1756 {
1757 	struct passwd *pw;
1758 	const char *errstr;
1759 
1760 	if ((pw = getpwnam(s)) != NULL) {
1761 		*uid = pw->pw_uid;
1762 		if (*uid == UID_MAX)
1763 			return -1;
1764 		return 0;
1765 	}
1766 	*uid = strtonum(s, 0, UID_MAX - 1, &errstr);
1767 	if (errstr)
1768 		return -1;
1769 	return 0;
1770 }
1771 
1772 const struct got_error *
1773 gotd_parse_url(char **proto, char **host, char **port,
1774     char **request_path, const char *url)
1775 {
1776 	const struct got_error *err = NULL;
1777 	char *s, *p, *q;
1778 
1779 	*proto = *host = *port = *request_path = NULL;
1780 
1781 	p = strstr(url, "://");
1782 	if (!p)
1783 		return got_error(GOT_ERR_PARSE_URI);
1784 
1785 	*proto = strndup(url, p - url);
1786 	if (*proto == NULL) {
1787 		err = got_error_from_errno("strndup");
1788 		goto done;
1789 	}
1790 	s = p + 3;
1791 
1792 	p = strstr(s, "/");
1793 	if (p == NULL) {
1794 		err = got_error(GOT_ERR_PARSE_URI);
1795 		goto done;
1796 	}
1797 
1798 	q = memchr(s, ':', p - s);
1799 	if (q) {
1800 		*host = strndup(s, q - s);
1801 		if (*host == NULL) {
1802 			err = got_error_from_errno("strndup");
1803 			goto done;
1804 		}
1805 		if ((*host)[0] == '\0') {
1806 			err = got_error(GOT_ERR_PARSE_URI);
1807 			goto done;
1808 		}
1809 		*port = strndup(q + 1, p - (q + 1));
1810 		if (*port == NULL) {
1811 			err = got_error_from_errno("strndup");
1812 			goto done;
1813 		}
1814 		if ((*port)[0] == '\0') {
1815 			err = got_error(GOT_ERR_PARSE_URI);
1816 			goto done;
1817 		}
1818 	} else {
1819 		*host = strndup(s, p - s);
1820 		if (*host == NULL) {
1821 			err = got_error_from_errno("strndup");
1822 			goto done;
1823 		}
1824 		if ((*host)[0] == '\0') {
1825 			err = got_error(GOT_ERR_PARSE_URI);
1826 			goto done;
1827 		}
1828 	}
1829 
1830 	while (p[0] == '/' && p[1] == '/')
1831 		p++;
1832 	*request_path = strdup(p);
1833 	if (*request_path == NULL) {
1834 		err = got_error_from_errno("strdup");
1835 		goto done;
1836 	}
1837 	if ((*request_path)[0] == '\0') {
1838 		err = got_error(GOT_ERR_PARSE_URI);
1839 		goto done;
1840 	}
1841 done:
1842 	if (err) {
1843 		free(*proto);
1844 		*proto = NULL;
1845 		free(*host);
1846 		*host = NULL;
1847 		free(*port);
1848 		*port = NULL;
1849 		free(*request_path);
1850 		*request_path = NULL;
1851 	}
1852 	return err;
1853 }
1854 
1855 static char *
1856 port_sprintf(int p)
1857 {
1858 	static char portno[32];
1859 	int n;
1860 
1861 	n = snprintf(portno, sizeof(portno), "%lld", (long long)p);
1862 	if (n < 0 || (size_t)n >= sizeof(portno))
1863 		fatalx("port number too long: %lld", (long long)p);
1864 
1865 	return portno;
1866 }