1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  * Copyright (c) 2016-2019, 2020-2021 Tracey Emery <tracey@traceyemery.net>
4  * Copyright (c) 2004, 2005 Esben Norby <norby@openbsd.org>
5  * Copyright (c) 2004 Ryan McBride <mcbride@openbsd.org>
6  * Copyright (c) 2002, 2003, 2004 Henning Brauer <henning@openbsd.org>
7  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
8  * Copyright (c) 2001 Daniel Hartmeier.  All rights reserved.
9  * Copyright (c) 2001 Theo de Raadt.  All rights reserved.
10  *
11  * Permission to use, copy, modify, and distribute this software for any
12  * purpose with or without fee is hereby granted, provided that the above
13  * copyright notice and this permission notice appear in all copies.
14  *
15  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
16  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
17  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
18  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
19  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
20  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
21  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
22  */
23 
24 %{
25 #include "got_compat.h"
26 
27 #include <sys/time.h>
28 #include <sys/types.h>
29 #include <sys/queue.h>
30 #include <sys/stat.h>
31 
32 #include <ctype.h>
33 #include <err.h>
34 #include <errno.h>
35 #include <event.h>
36 #include <imsg.h>
37 #include <limits.h>
38 #include <pwd.h>
39 #include <stdarg.h>
40 #include <stdlib.h>
41 #include <stdio.h>
42 #include <string.h>
43 #include <syslog.h>
44 #include <unistd.h>
45 
46 #include "got_error.h"
47 #include "got_path.h"
48 #include "got_reference.h"
49 
50 #include "log.h"
51 #include "gotd.h"
52 #include "auth.h"
53 #include "listen.h"
54 
55 TAILQ_HEAD(files, file)		 files = TAILQ_HEAD_INITIALIZER(files);
56 static struct file {
57 	TAILQ_ENTRY(file)	 entry;
58 	FILE			*stream;
59 	char			*name;
60 	int			 lineno;
61 	int			 errors;
62 } *file;
63 struct file	*newfile(const char *, int, int);
64 static void	 closefile(struct file *);
65 int		 check_file_secrecy(int, const char *);
66 int		 yyparse(void);
67 int		 yylex(void);
68 int		 yyerror(const char *, ...)
69     __attribute__((__format__ (printf, 1, 2)))
70     __attribute__((__nonnull__ (1)));
71 int		 kw_cmp(const void *, const void *);
72 int		 lookup(char *);
73 int		 lgetc(int);
74 int		 lungetc(int);
75 int		 findeol(void);
76 static char	*port_sprintf(int);
77 
78 TAILQ_HEAD(symhead, sym)	 symhead = TAILQ_HEAD_INITIALIZER(symhead);
79 struct sym {
80 	TAILQ_ENTRY(sym)	 entry;
81 	int			 used;
82 	int			 persist;
83 	char			*nam;
84 	char			*val;
85 };
86 
87 int	 symset(const char *, const char *, int);
88 char	*symget(const char *);
89 
90 static int		 errors;
91 
92 static struct gotd		*gotd;
93 static struct gotd_repo		*new_repo;
94 static int			 conf_limit_user_connections(const char *, int);
95 static struct gotd_repo		*conf_new_repo(const char *);
96 static void			 conf_new_access_rule(struct gotd_repo *,
97 				    enum gotd_access, int, char *);
98 static int			 conf_protect_ref_namespace(char **,
99 				    struct got_pathlist_head *, char *);
100 static int			 conf_protect_tag_namespace(struct gotd_repo *,
101 				    char *);
102 static int			 conf_protect_branch_namespace(
103 				    struct gotd_repo *, char *);
104 static int			 conf_protect_branch(struct gotd_repo *,
105 				    char *);
106 static int			 conf_notify_branch(struct gotd_repo *,
107 				    char *);
108 static int			 conf_notify_ref_namespace(struct gotd_repo *,
109 				    char *);
110 static int			 conf_notify_email(struct gotd_repo *,
111 				    char *, char *, char *, char *, char *);
112 static int			 conf_notify_http(struct gotd_repo *,
113 				    char *, char *, char *);
114 static enum gotd_procid		 gotd_proc_id;
115 
116 typedef struct {
117 	union {
118 		long long	 number;
119 		char		*string;
120 		struct timeval	 tv;
121 	} v;
122 	int lineno;
123 } YYSTYPE;
124 
125 %}
126 
127 %token	PATH ERROR LISTEN ON USER REPOSITORY PERMIT DENY
128 %token	RO RW CONNECTION LIMIT REQUEST TIMEOUT
129 %token	PROTECT NAMESPACE BRANCH TAG REFERENCE RELAY PORT
130 %token	NOTIFY EMAIL FROM REPLY TO URL PASSWORD
131 
132 %token	<v.string>	STRING
133 %token	<v.number>	NUMBER
134 %type	<v.tv>		timeout
135 
136 %%
137 
138 grammar		:
139 		| grammar '\n'
140 		| grammar varset '\n'
141 		| grammar main '\n'
142 		| grammar repository '\n'
143 		;
144 
145 varset		: STRING '=' STRING	{
146 			char *s = $1;
147 			while (*s++) {
148 				if (isspace((unsigned char)*s)) {
149 					yyerror("macro name cannot contain "
150 					    "whitespace");
151 					free($1);
152 					free($3);
153 					YYERROR;
154 				}
155 			}
156 			if (symset($1, $3, 0) == -1)
157 				fatal("cannot store variable");
158 			free($1);
159 			free($3);
160 		}
161 		;
162 
163 timeout		: NUMBER {
164 			if ($1 < 0) {
165 				yyerror("invalid timeout: %lld", $1);
166 				YYERROR;
167 			}
168 			$$.tv_sec = $1;
169 			$$.tv_usec = 0;
170 		}
171 		| STRING {
172 			const char	*errstr;
173 			const char	*type = "seconds";
174 			size_t		 len;
175 			int		 mul = 1;
176 
177 			if (*$1 == '\0') {
178 				yyerror("invalid number of seconds: %s", $1);
179 				free($1);
180 				YYERROR;
181 			}
182 
183 			len = strlen($1);
184 			switch ($1[len - 1]) {
185 			case 'S':
186 			case 's':
187 				$1[len - 1] = '\0';
188 				break;
189 			case 'M':
190 			case 'm':
191 				type = "minutes";
192 				mul = 60;
193 				$1[len - 1] = '\0';
194 				break;
195 			case 'H':
196 			case 'h':
197 				type = "hours";
198 				mul = 60 * 60;
199 				$1[len - 1] = '\0';
200 				break;
201 			}
202 
203 			$$.tv_usec = 0;
204 			$$.tv_sec = strtonum($1, 0, INT_MAX / mul, &errstr);
205 			if (errstr) {
206 				yyerror("number of %s is %s: %s", type,
207 				    errstr, $1);
208 				free($1);
209 				YYERROR;
210 			}
211 
212 			$$.tv_sec *= mul;
213 			free($1);
214 		}
215 		;
216 
217 main		: LISTEN ON STRING {
218 			if (!got_path_is_absolute($3))
219 				yyerror("bad unix socket path \"%s\": "
220 				    "must be an absolute path", $3);
221 
222 			if (gotd_proc_id == PROC_LISTEN) {
223 				if (strlcpy(gotd->unix_socket_path, $3,
224 				    sizeof(gotd->unix_socket_path)) >=
225 				    sizeof(gotd->unix_socket_path)) {
226 					yyerror("%s: unix socket path too long",
227 					    __func__);
228 					free($3);
229 					YYERROR;
230 				}
231 			}
232 			free($3);
233 		}
234 		| USER STRING {
235 			if (strlcpy(gotd->user_name, $2,
236 			    sizeof(gotd->user_name)) >=
237 			    sizeof(gotd->user_name)) {
238 				yyerror("%s: user name too long", __func__);
239 				free($2);
240 				YYERROR;
241 			}
242 			free($2);
243 		}
244 		| connection
245 		;
246 
247 connection	: CONNECTION '{' optnl conflags_l '}'
248 		| CONNECTION conflags
249 
250 conflags_l	: conflags optnl conflags_l
251 		| conflags optnl
252 		;
253 
254 conflags	: REQUEST TIMEOUT timeout		{
255 			if ($3.tv_sec <= 0) {
256 				yyerror("invalid timeout: %lld",
257 				    (long long)$3.tv_sec);
258 				YYERROR;
259 			}
260 			memcpy(&gotd->request_timeout, &$3,
261 			    sizeof(gotd->request_timeout));
262 		}
263 		| LIMIT USER STRING NUMBER	{
264 			if (gotd_proc_id == PROC_LISTEN &&
265 			    conf_limit_user_connections($3, $4) == -1) {
266 				free($3);
267 				YYERROR;
268 			}
269 			free($3);
270 		}
271 		;
272 
273 protect		: PROTECT '{' optnl protectflags_l '}'
274 		| PROTECT protectflags
275 
276 protectflags_l	: protectflags optnl protectflags_l
277 		| protectflags optnl
278 		;
279 
280 protectflags	: TAG NAMESPACE STRING {
281 			if (gotd_proc_id == PROC_GOTD ||
282 			    gotd_proc_id == PROC_REPO_WRITE) {
283 				if (conf_protect_tag_namespace(new_repo, $3)) {
284 					free($3);
285 					YYERROR;
286 				}
287 			}
288 			free($3);
289 		}
290 		| BRANCH NAMESPACE STRING {
291 			if (gotd_proc_id == PROC_GOTD ||
292 			    gotd_proc_id == PROC_REPO_WRITE) {
293 				if (conf_protect_branch_namespace(new_repo,
294 				    $3)) {
295 					free($3);
296 					YYERROR;
297 				}
298 			}
299 			free($3);
300 		}
301 		| BRANCH STRING {
302 			if (gotd_proc_id == PROC_GOTD ||
303 			    gotd_proc_id == PROC_REPO_WRITE) {
304 				if (conf_protect_branch(new_repo, $2)) {
305 					free($2);
306 					YYERROR;
307 				}
308 			}
309 			free($2);
310 		}
311 		;
312 
313 notify		: NOTIFY '{' optnl notifyflags_l '}'
314 		| NOTIFY notifyflags
315 
316 notifyflags_l	: notifyflags optnl notifyflags_l
317 		| notifyflags optnl
318 		;
319 
320 notifyflags	: BRANCH STRING {
321 			if (gotd_proc_id == PROC_GOTD ||
322 			    gotd_proc_id == PROC_SESSION_WRITE ||
323 			    gotd_proc_id == PROC_NOTIFY) {
324 				if (conf_notify_branch(new_repo, $2)) {
325 					free($2);
326 					YYERROR;
327 				}
328 			}
329 			free($2);
330 		}
331 		| REFERENCE NAMESPACE STRING {
332 			if (gotd_proc_id == PROC_GOTD ||
333 			    gotd_proc_id == PROC_SESSION_WRITE ||
334 			    gotd_proc_id == PROC_NOTIFY) {
335 				if (conf_notify_ref_namespace(new_repo, $3)) {
336 					free($3);
337 					YYERROR;
338 				}
339 			}
340 			free($3);
341 		}
342 		| EMAIL TO STRING {
343 			if (gotd_proc_id == PROC_GOTD ||
344 			    gotd_proc_id == PROC_SESSION_WRITE ||
345 			    gotd_proc_id == PROC_NOTIFY) {
346 				if (conf_notify_email(new_repo, NULL, $3,
347 				    NULL, NULL, NULL)) {
348 					free($3);
349 					YYERROR;
350 				}
351 			}
352 			free($3);
353 		}
354 		| EMAIL FROM STRING TO STRING {
355 			if (gotd_proc_id == PROC_GOTD ||
356 			    gotd_proc_id == PROC_SESSION_WRITE ||
357 			    gotd_proc_id == PROC_NOTIFY) {
358 				if (conf_notify_email(new_repo, $3, $5,
359 				    NULL, NULL, NULL)) {
360 					free($3);
361 					free($5);
362 					YYERROR;
363 				}
364 			}
365 			free($3);
366 			free($5);
367 		}
368 		| EMAIL TO STRING REPLY TO STRING {
369 			if (gotd_proc_id == PROC_GOTD ||
370 			    gotd_proc_id == PROC_SESSION_WRITE ||
371 			    gotd_proc_id == PROC_NOTIFY) {
372 				if (conf_notify_email(new_repo, NULL, $3,
373 				    $6, NULL, NULL)) {
374 					free($3);
375 					free($6);
376 					YYERROR;
377 				}
378 			}
379 			free($3);
380 			free($6);
381 		}
382 		| EMAIL FROM STRING TO STRING REPLY TO STRING {
383 			if (gotd_proc_id == PROC_GOTD ||
384 			    gotd_proc_id == PROC_SESSION_WRITE ||
385 			    gotd_proc_id == PROC_NOTIFY) {
386 				if (conf_notify_email(new_repo, $3, $5,
387 				    $8, NULL, NULL)) {
388 					free($3);
389 					free($5);
390 					free($8);
391 					YYERROR;
392 				}
393 			}
394 			free($3);
395 			free($5);
396 			free($8);
397 		}
398 		| EMAIL TO STRING RELAY STRING {
399 			if (gotd_proc_id == PROC_GOTD ||
400 			    gotd_proc_id == PROC_SESSION_WRITE ||
401 			    gotd_proc_id == PROC_NOTIFY) {
402 				if (conf_notify_email(new_repo, NULL, $3,
403 				    NULL, $5, NULL)) {
404 					free($3);
405 					free($5);
406 					YYERROR;
407 				}
408 			}
409 			free($3);
410 			free($5);
411 		}
412 		| EMAIL FROM STRING TO STRING RELAY STRING {
413 			if (gotd_proc_id == PROC_GOTD ||
414 			    gotd_proc_id == PROC_SESSION_WRITE ||
415 			    gotd_proc_id == PROC_NOTIFY) {
416 				if (conf_notify_email(new_repo, $3, $5,
417 				    NULL, $7, NULL)) {
418 					free($3);
419 					free($5);
420 					free($7);
421 					YYERROR;
422 				}
423 			}
424 			free($3);
425 			free($5);
426 			free($7);
427 		}
428 		| EMAIL TO STRING REPLY TO STRING RELAY STRING {
429 			if (gotd_proc_id == PROC_GOTD ||
430 			    gotd_proc_id == PROC_SESSION_WRITE ||
431 			    gotd_proc_id == PROC_NOTIFY) {
432 				if (conf_notify_email(new_repo, NULL, $3,
433 				    $6, $8, NULL)) {
434 					free($3);
435 					free($6);
436 					free($8);
437 					YYERROR;
438 				}
439 			}
440 			free($3);
441 			free($6);
442 			free($8);
443 		}
444 		| EMAIL FROM STRING TO STRING REPLY TO STRING RELAY STRING {
445 			if (gotd_proc_id == PROC_GOTD ||
446 			    gotd_proc_id == PROC_SESSION_WRITE ||
447 			    gotd_proc_id == PROC_NOTIFY) {
448 				if (conf_notify_email(new_repo, $3, $5,
449 				    $8, $10, NULL)) {
450 					free($3);
451 					free($5);
452 					free($8);
453 					free($10);
454 					YYERROR;
455 				}
456 			}
457 			free($3);
458 			free($5);
459 			free($8);
460 			free($10);
461 		}
462 		| EMAIL TO STRING RELAY STRING PORT STRING {
463 			if (gotd_proc_id == PROC_GOTD ||
464 			    gotd_proc_id == PROC_SESSION_WRITE ||
465 			    gotd_proc_id == PROC_NOTIFY) {
466 				if (conf_notify_email(new_repo, NULL, $3,
467 				    NULL, $5, $7)) {
468 					free($3);
469 					free($5);
470 					free($7);
471 					YYERROR;
472 				}
473 			}
474 			free($3);
475 			free($5);
476 			free($7);
477 		}
478 		| EMAIL FROM STRING TO STRING RELAY STRING PORT STRING {
479 			if (gotd_proc_id == PROC_GOTD ||
480 			    gotd_proc_id == PROC_SESSION_WRITE ||
481 			    gotd_proc_id == PROC_NOTIFY) {
482 				if (conf_notify_email(new_repo, $3, $5,
483 				    NULL, $7, $9)) {
484 					free($3);
485 					free($5);
486 					free($7);
487 					free($9);
488 					YYERROR;
489 				}
490 			}
491 			free($3);
492 			free($5);
493 			free($7);
494 			free($9);
495 		}
496 		| EMAIL TO STRING REPLY TO STRING RELAY STRING PORT STRING {
497 			if (gotd_proc_id == PROC_GOTD ||
498 			    gotd_proc_id == PROC_SESSION_WRITE ||
499 			    gotd_proc_id == PROC_NOTIFY) {
500 				if (conf_notify_email(new_repo, NULL, $3,
501 				    $6, $8, $10)) {
502 					free($3);
503 					free($6);
504 					free($8);
505 					free($10);
506 					YYERROR;
507 				}
508 			}
509 			free($3);
510 			free($6);
511 			free($8);
512 			free($10);
513 		}
514 		| EMAIL FROM STRING TO STRING REPLY TO STRING RELAY STRING PORT STRING {
515 			if (gotd_proc_id == PROC_GOTD ||
516 			    gotd_proc_id == PROC_SESSION_WRITE ||
517 			    gotd_proc_id == PROC_NOTIFY) {
518 				if (conf_notify_email(new_repo, $3, $5,
519 				    $8, $10, $12)) {
520 					free($3);
521 					free($5);
522 					free($8);
523 					free($10);
524 					free($12);
525 					YYERROR;
526 				}
527 			}
528 			free($3);
529 			free($5);
530 			free($8);
531 			free($10);
532 			free($12);
533 		}
534 		| EMAIL TO STRING RELAY STRING PORT NUMBER {
535 			if (gotd_proc_id == PROC_GOTD ||
536 			    gotd_proc_id == PROC_SESSION_WRITE ||
537 			    gotd_proc_id == PROC_NOTIFY) {
538 				if (conf_notify_email(new_repo, NULL, $3,
539 				    NULL, $5, port_sprintf($7))) {
540 					free($3);
541 					free($5);
542 					YYERROR;
543 				}
544 			}
545 			free($3);
546 			free($5);
547 		}
548 		| EMAIL FROM STRING TO STRING RELAY STRING PORT NUMBER {
549 			if (gotd_proc_id == PROC_GOTD ||
550 			    gotd_proc_id == PROC_SESSION_WRITE ||
551 			    gotd_proc_id == PROC_NOTIFY) {
552 				if (conf_notify_email(new_repo, $3, $5,
553 				    NULL, $7, port_sprintf($9))) {
554 					free($3);
555 					free($5);
556 					free($7);
557 					YYERROR;
558 				}
559 			}
560 			free($3);
561 			free($5);
562 			free($7);
563 		}
564 		| EMAIL TO STRING REPLY TO STRING RELAY STRING PORT NUMBER {
565 			if (gotd_proc_id == PROC_GOTD ||
566 			    gotd_proc_id == PROC_SESSION_WRITE ||
567 			    gotd_proc_id == PROC_NOTIFY) {
568 				if (conf_notify_email(new_repo, NULL, $3,
569 				    $6, $8, port_sprintf($10))) {
570 					free($3);
571 					free($6);
572 					free($8);
573 					YYERROR;
574 				}
575 			}
576 			free($3);
577 			free($6);
578 			free($8);
579 		}
580 		| EMAIL FROM STRING TO STRING REPLY TO STRING RELAY STRING PORT NUMBER {
581 			if (gotd_proc_id == PROC_GOTD ||
582 			    gotd_proc_id == PROC_SESSION_WRITE ||
583 			    gotd_proc_id == PROC_NOTIFY) {
584 				if (conf_notify_email(new_repo, $3, $5,
585 				    $8, $10, port_sprintf($12))) {
586 					free($3);
587 					free($5);
588 					free($8);
589 					free($10);
590 					YYERROR;
591 				}
592 			}
593 			free($3);
594 			free($5);
595 			free($8);
596 			free($10);
597 		}
598 		| URL STRING {
599 			if (gotd_proc_id == PROC_GOTD ||
600 			    gotd_proc_id == PROC_SESSION_WRITE ||
601 			    gotd_proc_id == PROC_NOTIFY) {
602 				if (conf_notify_http(new_repo, $2, NULL,
603 				    NULL)) {
604 					free($2);
605 					YYERROR;
606 				}
607 			}
608 			free($2);
609 		}
610 		| URL STRING USER STRING PASSWORD STRING {
611 			if (gotd_proc_id == PROC_GOTD ||
612 			    gotd_proc_id == PROC_SESSION_WRITE ||
613 			    gotd_proc_id == PROC_NOTIFY) {
614 				if (conf_notify_http(new_repo, $2, $4, $6)) {
615 					free($2);
616 					free($4);
617 					free($6);
618 					YYERROR;
619 				}
620 			}
621 			free($2);
622 			free($4);
623 			free($6);
624 		}
625 		;
626 	
627 repository	: REPOSITORY STRING {
628 			struct gotd_repo *repo;
629 
630 			TAILQ_FOREACH(repo, &gotd->repos, entry) {
631 				if (strcmp(repo->name, $2) == 0) {
632 					yyerror("duplicate repository '%s'", $2);
633 					free($2);
634 					YYERROR;
635 				}
636 			}
637 
638 			if (gotd_proc_id == PROC_GOTD ||
639 			    gotd_proc_id == PROC_AUTH ||
640 			    gotd_proc_id == PROC_REPO_WRITE ||
641 			    gotd_proc_id == PROC_SESSION_WRITE ||
642 			    gotd_proc_id == PROC_GITWRAPPER |
643 			    gotd_proc_id == PROC_NOTIFY) {
644 				new_repo = conf_new_repo($2);
645 			}
646 			free($2);
647 		} '{' optnl repoopts2 '}' {
648 		}
649 		;
650 
651 repoopts1	: PATH STRING {
652 			if (gotd_proc_id == PROC_GOTD ||
653 			    gotd_proc_id == PROC_AUTH ||
654 			    gotd_proc_id == PROC_REPO_WRITE ||
655 			    gotd_proc_id == PROC_SESSION_WRITE ||
656 			    gotd_proc_id == PROC_GITWRAPPER ||
657 			    gotd_proc_id == PROC_NOTIFY) {
658 				if (!got_path_is_absolute($2)) {
659 					yyerror("%s: path %s is not absolute",
660 					    __func__, $2);
661 					free($2);
662 					YYERROR;
663 				}
664 				if (realpath($2, new_repo->path) == NULL) {
665 					/*
666 					 * To give admins a chance to create
667 					 * missing repositories at run-time
668 					 * we only warn about ENOENT here.
669 					 *
670 					 * And ignore 'permission denied' when
671 					 * running in gitwrapper. Users may be
672 					 * able to access this repository via
673 					 * gotd regardless.
674 					 */
675 					if (errno == ENOENT) {
676 						yyerror("realpath %s: %s", $2,
677 						    strerror(errno));
678 					} else if (errno != EACCES ||
679 					    gotd_proc_id != PROC_GITWRAPPER) {
680 						yyerror("realpath %s: %s", $2,
681 						    strerror(errno));
682 						free($2);
683 						YYERROR;
684 					}
685 
686 					if (strlcpy(new_repo->path, $2,
687 					    sizeof(new_repo->path)) >=
688 					    sizeof(new_repo->path))
689 						yyerror("path too long");
690 				}
691 			}
692 			free($2);
693 		}
694 		| PERMIT RO STRING {
695 			if (gotd_proc_id == PROC_AUTH) {
696 				conf_new_access_rule(new_repo,
697 				    GOTD_ACCESS_PERMITTED, GOTD_AUTH_READ, $3);
698 			} else
699 				free($3);
700 		}
701 		| PERMIT RW STRING {
702 			if (gotd_proc_id == PROC_AUTH) {
703 				conf_new_access_rule(new_repo,
704 				    GOTD_ACCESS_PERMITTED,
705 				    GOTD_AUTH_READ | GOTD_AUTH_WRITE, $3);
706 			} else
707 				free($3);
708 		}
709 		| DENY STRING {
710 			if (gotd_proc_id == PROC_AUTH) {
711 				conf_new_access_rule(new_repo,
712 				    GOTD_ACCESS_DENIED, 0, $2);
713 			} else
714 				free($2);
715 		}
716 		| protect
717 		| notify
718 		;
719 
720 repoopts2	: repoopts2 repoopts1 nl
721 		| repoopts1 optnl
722 		;
723 
724 nl		: '\n' optnl
725 		;
726 
727 optnl		: '\n' optnl		/* zero or more newlines */
728 		| /* empty */
729 		;
730 
731 %%
732 
733 struct keywords {
734 	const char	*k_name;
735 	int		 k_val;
736 };
737 
738 int
739 yyerror(const char *fmt, ...)
740 {
741 	va_list ap;
742 	char *msg;
743 
744 	file->errors++;
745 	va_start(ap, fmt);
746 	if (vasprintf(&msg, fmt, ap) == -1)
747 		fatalx("yyerror vasprintf");
748 	va_end(ap);
749 	logit(LOG_CRIT, "%s:%d: %s", file->name, yylval.lineno, msg);
750 	free(msg);
751 	return (0);
752 }
753 
754 int
755 kw_cmp(const void *k, const void *e)
756 {
757 	return (strcmp(k, ((const struct keywords *)e)->k_name));
758 }
759 
760 int
761 lookup(char *s)
762 {
763 	/* This has to be sorted always. */
764 	static const struct keywords keywords[] = {
765 		{ "branch",			BRANCH },
766 		{ "connection",			CONNECTION },
767 		{ "deny",			DENY },
768 		{ "email",			EMAIL },
769 		{ "from",			FROM },
770 		{ "limit",			LIMIT },
771 		{ "listen",			LISTEN },
772 		{ "namespace",			NAMESPACE },
773 		{ "notify",			NOTIFY },
774 		{ "on",				ON },
775 		{ "password",			PASSWORD },
776 		{ "path",			PATH },
777 		{ "permit",			PERMIT },
778 		{ "port",			PORT },
779 		{ "protect",			PROTECT },
780 		{ "reference",			REFERENCE },
781 		{ "relay",			RELAY },
782 		{ "reply",			REPLY },
783 		{ "repository",			REPOSITORY },
784 		{ "request",			REQUEST },
785 		{ "ro",				RO },
786 		{ "rw",				RW },
787 		{ "tag",			TAG },
788 		{ "timeout",			TIMEOUT },
789 		{ "to",				TO },
790 		{ "url",			URL },
791 		{ "user",			USER },
792 	};
793 	const struct keywords *p;
794 
795 	p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]),
796 	    sizeof(keywords[0]), kw_cmp);
797 
798 	if (p)
799 		return (p->k_val);
800 	else
801 		return (STRING);
802 }
803 
804 #define MAXPUSHBACK	128
805 
806 unsigned char *parsebuf;
807 int parseindex;
808 unsigned char pushback_buffer[MAXPUSHBACK];
809 int pushback_index = 0;
810 
811 int
812 lgetc(int quotec)
813 {
814 	int c, next;
815 
816 	if (parsebuf) {
817 		/* Read character from the parsebuffer instead of input. */
818 		if (parseindex >= 0) {
819 			c = parsebuf[parseindex++];
820 			if (c != '\0')
821 				return (c);
822 			parsebuf = NULL;
823 		} else
824 			parseindex++;
825 	}
826 
827 	if (pushback_index)
828 		return (pushback_buffer[--pushback_index]);
829 
830 	if (quotec) {
831 		c = getc(file->stream);
832 		if (c == EOF)
833 			yyerror("reached end of file while parsing "
834 			    "quoted string");
835 		return (c);
836 	}
837 
838 	c = getc(file->stream);
839 	while (c == '\\') {
840 		next = getc(file->stream);
841 		if (next != '\n') {
842 			c = next;
843 			break;
844 		}
845 		yylval.lineno = file->lineno;
846 		file->lineno++;
847 		c = getc(file->stream);
848 	}
849 
850 	return (c);
851 }
852 
853 int
854 lungetc(int c)
855 {
856 	if (c == EOF)
857 		return (EOF);
858 	if (parsebuf) {
859 		parseindex--;
860 		if (parseindex >= 0)
861 			return (c);
862 	}
863 	if (pushback_index < MAXPUSHBACK-1)
864 		return (pushback_buffer[pushback_index++] = c);
865 	else
866 		return (EOF);
867 }
868 
869 int
870 findeol(void)
871 {
872 	int c;
873 
874 	parsebuf = NULL;
875 
876 	/* Skip to either EOF or the first real EOL. */
877 	while (1) {
878 		if (pushback_index)
879 			c = pushback_buffer[--pushback_index];
880 		else
881 			c = lgetc(0);
882 		if (c == '\n') {
883 			file->lineno++;
884 			break;
885 		}
886 		if (c == EOF)
887 			break;
888 	}
889 	return (ERROR);
890 }
891 
892 int
893 yylex(void)
894 {
895 	unsigned char buf[8096];
896 	unsigned char *p, *val;
897 	int quotec, next, c;
898 	int token;
899 
900 top:
901 	p = buf;
902 	c = lgetc(0);
903 	while (c == ' ' || c == '\t')
904 		c = lgetc(0); /* nothing */
905 
906 	yylval.lineno = file->lineno;
907 	if (c == '#') {
908 		c = lgetc(0);
909 		while (c != '\n' && c != EOF)
910 			c = lgetc(0); /* nothing */
911 	}
912 	if (c == '$' && parsebuf == NULL) {
913 		while (1) {
914 			c = lgetc(0);
915 			if (c == EOF)
916 				return (0);
917 
918 			if (p + 1 >= buf + sizeof(buf) - 1) {
919 				yyerror("string too long");
920 				return (findeol());
921 			}
922 			if (isalnum(c) || c == '_') {
923 				*p++ = c;
924 				continue;
925 			}
926 			*p = '\0';
927 			lungetc(c);
928 			break;
929 		}
930 		val = symget(buf);
931 		if (val == NULL) {
932 			yyerror("macro '%s' not defined", buf);
933 			return (findeol());
934 		}
935 		parsebuf = val;
936 		parseindex = 0;
937 		goto top;
938 	}
939 
940 	switch (c) {
941 	case '\'':
942 	case '"':
943 		quotec = c;
944 		while (1) {
945 			c = lgetc(quotec);
946 			if (c == EOF)
947 				return (0);
948 			if (c == '\n') {
949 				file->lineno++;
950 				continue;
951 			} else if (c == '\\') {
952 				next = lgetc(quotec);
953 				if (next == EOF)
954 					return (0);
955 				if (next == quotec || c == ' ' || c == '\t')
956 					c = next;
957 				else if (next == '\n') {
958 					file->lineno++;
959 					continue;
960 				} else
961 					lungetc(next);
962 			} else if (c == quotec) {
963 				*p = '\0';
964 				break;
965 			} else if (c == '\0') {
966 				yyerror("syntax error");
967 				return (findeol());
968 			}
969 			if (p + 1 >= buf + sizeof(buf) - 1) {
970 				yyerror("string too long");
971 				return (findeol());
972 			}
973 			*p++ = c;
974 		}
975 		yylval.v.string = strdup(buf);
976 		if (yylval.v.string == NULL)
977 			err(1, "yylex: strdup");
978 		return (STRING);
979 	}
980 
981 #define allowed_to_end_number(x) \
982 	(isspace(x) || x == ')' || x ==',' || x == '/' || x == '}' || x == '=')
983 
984 	if (c == '-' || isdigit(c)) {
985 		do {
986 			*p++ = c;
987 			if ((unsigned)(p-buf) >= sizeof(buf)) {
988 				yyerror("string too long");
989 				return (findeol());
990 			}
991 			c = lgetc(0);
992 		} while (c != EOF && isdigit(c));
993 		lungetc(c);
994 		if (p == buf + 1 && buf[0] == '-')
995 			goto nodigits;
996 		if (c == EOF || allowed_to_end_number(c)) {
997 			const char *errstr = NULL;
998 
999 			*p = '\0';
1000 			yylval.v.number = strtonum(buf, LLONG_MIN,
1001 			    LLONG_MAX, &errstr);
1002 			if (errstr) {
1003 				yyerror("\"%s\" invalid number: %s",
1004 				    buf, errstr);
1005 				return (findeol());
1006 			}
1007 			return (NUMBER);
1008 		} else {
1009 nodigits:
1010 			while (p > buf + 1)
1011 				lungetc(*--p);
1012 			c = *--p;
1013 			if (c == '-')
1014 				return (c);
1015 		}
1016 	}
1017 
1018 #define allowed_in_string(x) \
1019 	(isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \
1020 	x != '{' && x != '}' && \
1021 	x != '!' && x != '=' && x != '#' && \
1022 	x != ','))
1023 
1024 	if (isalnum(c) || c == ':' || c == '_') {
1025 		do {
1026 			*p++ = c;
1027 			if ((unsigned)(p-buf) >= sizeof(buf)) {
1028 				yyerror("string too long");
1029 				return (findeol());
1030 			}
1031 			c = lgetc(0);
1032 		} while (c != EOF && (allowed_in_string(c)));
1033 		lungetc(c);
1034 		*p = '\0';
1035 		token = lookup(buf);
1036 		if (token == STRING) {
1037 			yylval.v.string = strdup(buf);
1038 			if (yylval.v.string == NULL)
1039 				err(1, "yylex: strdup");
1040 		}
1041 		return (token);
1042 	}
1043 	if (c == '\n') {
1044 		yylval.lineno = file->lineno;
1045 		file->lineno++;
1046 	}
1047 	if (c == EOF)
1048 		return (0);
1049 	return (c);
1050 }
1051 
1052 int
1053 check_file_secrecy(int fd, const char *fname)
1054 {
1055 	struct stat st;
1056 
1057 	if (fstat(fd, &st)) {
1058 		log_warn("cannot stat %s", fname);
1059 		return (-1);
1060 	}
1061 	if (st.st_uid != 0 && st.st_uid != getuid()) {
1062 		log_warnx("%s: owner not root or current user", fname);
1063 		return (-1);
1064 	}
1065 	if (st.st_mode & (S_IWGRP | S_IXGRP | S_IRWXO)) {
1066 		log_warnx("%s: group writable or world read/writable", fname);
1067 		return (-1);
1068 	}
1069 	return (0);
1070 }
1071 
1072 struct file *
1073 newfile(const char *name, int secret, int required)
1074 {
1075 	struct file *nfile;
1076 
1077 	nfile = calloc(1, sizeof(struct file));
1078 	if (nfile == NULL) {
1079 		log_warn("calloc");
1080 		return (NULL);
1081 	}
1082 	nfile->name = strdup(name);
1083 	if (nfile->name == NULL) {
1084 		log_warn("strdup");
1085 		free(nfile);
1086 		return (NULL);
1087 	}
1088 	nfile->stream = fopen(nfile->name, "r");
1089 	if (nfile->stream == NULL) {
1090 		if (required)
1091 			log_warn("open %s", nfile->name);
1092 		free(nfile->name);
1093 		free(nfile);
1094 		return (NULL);
1095 	} else if (secret &&
1096 	    check_file_secrecy(fileno(nfile->stream), nfile->name)) {
1097 		fclose(nfile->stream);
1098 		free(nfile->name);
1099 		free(nfile);
1100 		return (NULL);
1101 	}
1102 	nfile->lineno = 1;
1103 	return (nfile);
1104 }
1105 
1106 static void
1107 closefile(struct file *xfile)
1108 {
1109 	fclose(xfile->stream);
1110 	free(xfile->name);
1111 	free(xfile);
1112 }
1113 
1114 int
1115 parse_config(const char *filename, enum gotd_procid proc_id,
1116     struct gotd *env)
1117 {
1118 	struct sym *sym, *next;
1119 	struct gotd_repo *repo;
1120 	int require_config_file = (proc_id != PROC_GITWRAPPER);
1121 
1122 	memset(env, 0, sizeof(*env));
1123 
1124 	gotd = env;
1125 	gotd_proc_id = proc_id;
1126 	TAILQ_INIT(&gotd->repos);
1127 
1128 	/* Apply default values. */
1129 	if (strlcpy(gotd->unix_socket_path, GOTD_UNIX_SOCKET,
1130 	    sizeof(gotd->unix_socket_path)) >= sizeof(gotd->unix_socket_path)) {
1131 		fprintf(stderr, "%s: unix socket path too long", __func__);
1132 		return -1;
1133 	}
1134 	if (strlcpy(gotd->user_name, GOTD_USER,
1135 	    sizeof(gotd->user_name)) >= sizeof(gotd->user_name)) {
1136 		fprintf(stderr, "%s: user name too long", __func__);
1137 		return -1;
1138 	}
1139 
1140 	gotd->request_timeout.tv_sec = GOTD_DEFAULT_REQUEST_TIMEOUT;
1141 	gotd->request_timeout.tv_usec = 0;
1142 
1143 	file = newfile(filename, 0, require_config_file);
1144 	if (file == NULL)
1145 		return require_config_file ? -1 : 0;
1146 
1147 	yyparse();
1148 	errors = file->errors;
1149 	closefile(file);
1150 
1151 	/* Free macros and check which have not been used. */
1152 	TAILQ_FOREACH_SAFE(sym, &symhead, entry, next) {
1153 		if ((gotd->verbosity > 1) && !sym->used)
1154 			fprintf(stderr, "warning: macro '%s' not used\n",
1155 			    sym->nam);
1156 		if (!sym->persist) {
1157 			free(sym->nam);
1158 			free(sym->val);
1159 			TAILQ_REMOVE(&symhead, sym, entry);
1160 			free(sym);
1161 		}
1162 	}
1163 
1164 	if (errors)
1165 		return (-1);
1166 
1167 	TAILQ_FOREACH(repo, &gotd->repos, entry) {
1168 		if (repo->path[0] == '\0') {
1169 			log_warnx("repository \"%s\": no path provided in "
1170 			    "configuration file", repo->name);
1171 			return (-1);
1172 		}
1173 	}
1174 
1175 	if (proc_id == PROC_GOTD && TAILQ_EMPTY(&gotd->repos)) {
1176 		log_warnx("no repository defined in configuration file");
1177 		return (-1);
1178 	}
1179 
1180 	return (0);
1181 }
1182 
1183 static int
1184 uid_connection_limit_cmp(const void *pa, const void *pb)
1185 {
1186 	const struct gotd_uid_connection_limit *a = pa, *b = pb;
1187 
1188 	if (a->uid < b->uid)
1189 		return -1;
1190 	else if (a->uid > b->uid);
1191 		return 1;
1192 
1193 	return 0;
1194 }
1195 
1196 static int
1197 conf_limit_user_connections(const char *user, int maximum)
1198 {
1199 	uid_t uid;
1200 	struct gotd_uid_connection_limit *limit;
1201 	size_t nlimits;
1202 
1203 	if (maximum < 1) {
1204 		yyerror("max connections cannot be smaller 1");
1205 		return -1;
1206 	}
1207 	if (maximum > GOTD_MAXCLIENTS) {
1208 		yyerror("max connections must be <= %d", GOTD_MAXCLIENTS);
1209 		return -1;
1210 	}
1211 
1212 	if (gotd_parseuid(user, &uid) == -1) {
1213 		yyerror("%s: no such user", user);
1214 		return -1;
1215 	}
1216 
1217 	limit = gotd_find_uid_connection_limit(gotd->connection_limits,
1218 	    gotd->nconnection_limits, uid);
1219 	if (limit) {
1220 		limit->max_connections = maximum;
1221 		return 0;
1222 	}
1223 
1224 	limit = gotd->connection_limits;
1225 	nlimits = gotd->nconnection_limits + 1;
1226 	limit = reallocarray(limit, nlimits, sizeof(*limit));
1227 	if (limit == NULL)
1228 		fatal("reallocarray");
1229 
1230 	limit[nlimits - 1].uid = uid;
1231 	limit[nlimits - 1].max_connections = maximum;
1232 
1233 	gotd->connection_limits = limit;
1234 	gotd->nconnection_limits = nlimits;
1235 	qsort(gotd->connection_limits, gotd->nconnection_limits,
1236 	    sizeof(gotd->connection_limits[0]), uid_connection_limit_cmp);
1237 
1238 	return 0;
1239 }
1240 
1241 static struct gotd_repo *
1242 conf_new_repo(const char *name)
1243 {
1244 	struct gotd_repo *repo;
1245 
1246 	if (name[0] == '\0') {
1247 		fatalx("syntax error: empty repository name found in %s",
1248 		    file->name);
1249 	}
1250 
1251 	if (strchr(name, '\n') != NULL)
1252 		fatalx("repository names must not contain linefeeds: %s", name);
1253 
1254 	repo = calloc(1, sizeof(*repo));
1255 	if (repo == NULL)
1256 		fatalx("%s: calloc", __func__);
1257 
1258 	STAILQ_INIT(&repo->rules);
1259 	TAILQ_INIT(&repo->protected_tag_namespaces);
1260 	TAILQ_INIT(&repo->protected_branch_namespaces);
1261 	TAILQ_INIT(&repo->protected_branches);
1262 	TAILQ_INIT(&repo->protected_branches);
1263 	TAILQ_INIT(&repo->notification_refs);
1264 	TAILQ_INIT(&repo->notification_ref_namespaces);
1265 	STAILQ_INIT(&repo->notification_targets);
1266 
1267 	if (strlcpy(repo->name, name, sizeof(repo->name)) >=
1268 	    sizeof(repo->name))
1269 		fatalx("%s: strlcpy", __func__);
1270 
1271 	TAILQ_INSERT_TAIL(&gotd->repos, repo, entry);
1272 	gotd->nrepos++;
1273 
1274 	return repo;
1275 };
1276 
1277 static void
1278 conf_new_access_rule(struct gotd_repo *repo, enum gotd_access access,
1279     int authorization, char *identifier)
1280 {
1281 	struct gotd_access_rule *rule;
1282 
1283 	rule = calloc(1, sizeof(*rule));
1284 	if (rule == NULL)
1285 		fatal("calloc");
1286 
1287 	rule->access = access;
1288 	rule->authorization = authorization;
1289 	rule->identifier = identifier;
1290 
1291 	STAILQ_INSERT_TAIL(&repo->rules, rule, entry);
1292 }
1293 
1294 static int
1295 refname_is_valid(char *refname)
1296 {
1297 	if (strncmp(refname, "refs/", 5) != 0) {
1298 		yyerror("reference name must begin with \"refs/\": %s",
1299 		    refname);
1300 		return 0;
1301 	}
1302 
1303 	if (!got_ref_name_is_valid(refname)) {
1304 		yyerror("invalid reference name: %s", refname);
1305 		return 0;
1306 	}
1307 
1308 	return 1;
1309 }
1310 
1311 static int
1312 conf_protect_ref_namespace(char **new, struct got_pathlist_head *refs,
1313     char *namespace)
1314 {
1315 	const struct got_error *error;
1316 	struct got_pathlist_entry *pe;
1317 	char *s;
1318 
1319 	*new = NULL;
1320 
1321 	got_path_strip_trailing_slashes(namespace);
1322 	if (!refname_is_valid(namespace))
1323 		return -1;
1324 	if (asprintf(&s, "%s/", namespace) == -1) {
1325 		yyerror("asprintf: %s", strerror(errno));
1326 		return -1;
1327 	}
1328 
1329 	error = got_pathlist_insert(&pe, refs, s, NULL);
1330 	if (error || pe == NULL) {
1331 		free(s);
1332 		if (error)
1333 			yyerror("got_pathlist_insert: %s", error->msg);
1334 		else
1335 			yyerror("duplicate protected namespace %s", namespace);
1336 		return -1;
1337 	}
1338 
1339 	*new = s;
1340 	return 0;
1341 }
1342 
1343 static int
1344 conf_protect_tag_namespace(struct gotd_repo *repo, char *namespace)
1345 {
1346 	struct got_pathlist_entry *pe;
1347 	char *new;
1348 
1349 	if (conf_protect_ref_namespace(&new, &repo->protected_tag_namespaces,
1350 	    namespace) == -1)
1351 		return -1;
1352 
1353 	TAILQ_FOREACH(pe, &repo->protected_branch_namespaces, entry) {
1354 		if (strcmp(pe->path, new) == 0) {
1355 			yyerror("duplicate protected namespace %s", namespace);
1356 			return -1;
1357 		}
1358 	}
1359 
1360 	return 0;
1361 }
1362 
1363 static int
1364 conf_protect_branch_namespace(struct gotd_repo *repo, char *namespace)
1365 {
1366 	struct got_pathlist_entry *pe;
1367 	char *new;
1368 
1369 	if (conf_protect_ref_namespace(&new,
1370 	    &repo->protected_branch_namespaces, namespace) == -1)
1371 		return -1;
1372 
1373 	TAILQ_FOREACH(pe, &repo->protected_tag_namespaces, entry) {
1374 		if (strcmp(pe->path, new) == 0) {
1375 			yyerror("duplicate protected namespace %s", namespace);
1376 			return -1;
1377 		}
1378 	}
1379 
1380 	return 0;
1381 }
1382 
1383 static int
1384 conf_protect_branch(struct gotd_repo *repo, char *branchname)
1385 {
1386 	const struct got_error *error;
1387 	struct got_pathlist_entry *new;
1388 	char *refname;
1389 
1390 	if (strncmp(branchname, "refs/heads/", 11) != 0) {
1391 		if (asprintf(&refname, "refs/heads/%s", branchname) == -1) {
1392 			yyerror("asprintf: %s", strerror(errno));
1393 			return -1;
1394 		}
1395 	} else {
1396 		refname = strdup(branchname);
1397 		if (refname == NULL) {
1398 			yyerror("strdup: %s", strerror(errno));
1399 			return -1;
1400 		}
1401 	}
1402 
1403 	if (!refname_is_valid(refname)) {
1404 		free(refname);
1405 		return -1;
1406 	}
1407 
1408 	error = got_pathlist_insert(&new, &repo->protected_branches,
1409 	    refname, NULL);
1410 	if (error || new == NULL) {
1411 		free(refname);
1412 		if (error)
1413 			yyerror("got_pathlist_insert: %s", error->msg);
1414 		else
1415 			yyerror("duplicate protect branch %s", branchname);
1416 		return -1;
1417 	}
1418 
1419 	return 0;
1420 }
1421 
1422 static int
1423 conf_notify_branch(struct gotd_repo *repo, char *branchname)
1424 {
1425 	const struct got_error *error;
1426 	struct got_pathlist_entry *pe;
1427 	char *refname;
1428 
1429 	if (strncmp(branchname, "refs/heads/", 11) != 0) {
1430 		if (asprintf(&refname, "refs/heads/%s", branchname) == -1) {
1431 			yyerror("asprintf: %s", strerror(errno));
1432 			return -1;
1433 		}
1434 	} else {
1435 		refname = strdup(branchname);
1436 		if (refname == NULL) {
1437 			yyerror("strdup: %s", strerror(errno));
1438 			return -1;
1439 		}
1440 	}
1441 
1442 	if (!refname_is_valid(refname)) {
1443 		free(refname);
1444 		return -1;
1445 	}
1446 
1447 	error = got_pathlist_insert(&pe, &repo->notification_refs,
1448 	    refname, NULL);
1449 	if (error) {
1450 		free(refname);
1451 		yyerror("got_pathlist_insert: %s", error->msg);
1452 		return -1;
1453 	}
1454 	if (pe == NULL)
1455 		free(refname);
1456 
1457 	return 0;
1458 }
1459 
1460 static int
1461 conf_notify_ref_namespace(struct gotd_repo *repo, char *namespace)
1462 {
1463 	const struct got_error *error;
1464 	struct got_pathlist_entry *pe;
1465 	char *s;
1466 
1467 	got_path_strip_trailing_slashes(namespace);
1468 	if (!refname_is_valid(namespace))
1469 		return -1;
1470 
1471 	if (asprintf(&s, "%s/", namespace) == -1) {
1472 		yyerror("asprintf: %s", strerror(errno));
1473 		return -1;
1474 	}
1475 
1476 	error = got_pathlist_insert(&pe, &repo->notification_ref_namespaces,
1477 	    s, NULL);
1478 	if (error) {
1479 		free(s);
1480 		yyerror("got_pathlist_insert: %s", error->msg);
1481 		return -1;
1482 	}
1483 	if (pe == NULL)
1484 		free(s);
1485 
1486 	return 0;
1487 }
1488 
1489 static int
1490 conf_notify_email(struct gotd_repo *repo, char *sender, char *recipient,
1491     char *responder, char *hostname, char *port)
1492 {
1493 	struct gotd_notification_target *target;
1494 
1495 	STAILQ_FOREACH(target, &repo->notification_targets, entry) {
1496 		if (target->type != GOTD_NOTIFICATION_VIA_EMAIL)
1497 			continue;
1498 		if (strcmp(target->conf.email.recipient, recipient) == 0) {
1499 			yyerror("duplicate email notification for '%s' in "
1500 			    "repository '%s'", recipient, repo->name);
1501 			return -1;
1502 		}
1503 	}
1504 
1505 	target = calloc(1, sizeof(*target));
1506 	if (target == NULL)
1507 		fatal("calloc");
1508 	target->type = GOTD_NOTIFICATION_VIA_EMAIL;
1509 	if (sender) {
1510 		target->conf.email.sender = strdup(sender);
1511 		if (target->conf.email.sender == NULL)
1512 			fatal("strdup");
1513 	}
1514 	target->conf.email.recipient = strdup(recipient);
1515 	if (target->conf.email.recipient == NULL)
1516 		fatal("strdup");
1517 	if (responder) {
1518 		target->conf.email.responder = strdup(responder);
1519 		if (target->conf.email.responder == NULL)
1520 			fatal("strdup");
1521 	}
1522 	if (hostname) {
1523 		target->conf.email.hostname = strdup(hostname);
1524 		if (target->conf.email.hostname == NULL)
1525 			fatal("strdup");
1526 	}
1527 	if (port) {
1528 		target->conf.email.port = strdup(port);
1529 		if (target->conf.email.port == NULL)
1530 			fatal("strdup");
1531 	}
1532 
1533 	STAILQ_INSERT_TAIL(&repo->notification_targets, target, entry);
1534 	return 0;
1535 }
1536 
1537 static int
1538 conf_notify_http(struct gotd_repo *repo, char *url, char *user, char *password)
1539 {
1540 	const struct got_error *error;
1541 	struct gotd_notification_target *target;
1542 	char *proto, *hostname, *port, *path;
1543 	int tls = 0, ret = 0;
1544 
1545 	error = gotd_parse_url(&proto, &hostname, &port, &path, url);
1546 	if (error) {
1547 		yyerror("invalid HTTP notification URL '%s' in "
1548 		    "repository '%s': %s", url, repo->name, error->msg);
1549 		return -1;
1550 	}
1551 
1552 	tls = !strcmp(proto, "https");
1553 
1554 	if (strcmp(proto, "http") != 0 && strcmp(proto, "https") != 0) {
1555 		yyerror("invalid protocol '%s' in notification URL '%s' in "
1556 		    "repository '%s", proto, url, repo->name);
1557 		ret = -1;
1558 		goto done;
1559 	}
1560 
1561 	if ((user != NULL && password == NULL) ||
1562 	    (user == NULL && password != NULL)) {
1563 		yyerror("missing username or password");
1564 		ret = -1;
1565 		goto done;
1566 	}
1567 
1568 	if (strcmp(proto, "http") == 0 && (user != NULL || password != NULL)) {
1569 		log_warnx("%s: WARNING: Using basic authentication over "
1570 		    "plaintext http:// will leak credentials; https:// is "
1571 		    "recommended for URL '%s'", getprogname(), url);
1572 	}
1573 
1574 	STAILQ_FOREACH(target, &repo->notification_targets, entry) {
1575 		if (target->type != GOTD_NOTIFICATION_VIA_HTTP)
1576 			continue;
1577 		if (target->conf.http.tls == tls &&
1578 		    !strcmp(target->conf.http.hostname, hostname) &&
1579 		    !strcmp(target->conf.http.port, port) &&
1580 		    !strcmp(target->conf.http.path, path)) {
1581 			yyerror("duplicate notification for URL '%s' in "
1582 			    "repository '%s'", url, repo->name);
1583 			ret = -1;
1584 			goto done;
1585 		}
1586 	}
1587 
1588 	target = calloc(1, sizeof(*target));
1589 	if (target == NULL)
1590 		fatal("calloc");
1591 	target->type = GOTD_NOTIFICATION_VIA_HTTP;
1592 	target->conf.http.tls = tls;
1593 	target->conf.http.hostname = hostname;
1594 	target->conf.http.port = port;
1595 	target->conf.http.path = path;
1596 	hostname = port = path = NULL;
1597 
1598 	if (user) {
1599 		target->conf.http.user = strdup(user);
1600 		if (target->conf.http.user == NULL)
1601 			fatal("strdup");
1602 		target->conf.http.password = strdup(password);
1603 		if (target->conf.http.password == NULL)
1604 			fatal("strdup");
1605 	}	
1606 
1607 	STAILQ_INSERT_TAIL(&repo->notification_targets, target, entry);
1608 done:
1609 	free(proto);
1610 	free(hostname);
1611 	free(port);
1612 	free(path);
1613 	return ret;
1614 }
1615 
1616 int
1617 symset(const char *nam, const char *val, int persist)
1618 {
1619 	struct sym *sym;
1620 
1621 	TAILQ_FOREACH(sym, &symhead, entry) {
1622 		if (strcmp(nam, sym->nam) == 0)
1623 			break;
1624 	}
1625 
1626 	if (sym != NULL) {
1627 		if (sym->persist == 1)
1628 			return (0);
1629 		else {
1630 			free(sym->nam);
1631 			free(sym->val);
1632 			TAILQ_REMOVE(&symhead, sym, entry);
1633 			free(sym);
1634 		}
1635 	}
1636 	sym = calloc(1, sizeof(*sym));
1637 	if (sym == NULL)
1638 		return (-1);
1639 
1640 	sym->nam = strdup(nam);
1641 	if (sym->nam == NULL) {
1642 		free(sym);
1643 		return (-1);
1644 	}
1645 	sym->val = strdup(val);
1646 	if (sym->val == NULL) {
1647 		free(sym->nam);
1648 		free(sym);
1649 		return (-1);
1650 	}
1651 	sym->used = 0;
1652 	sym->persist = persist;
1653 	TAILQ_INSERT_TAIL(&symhead, sym, entry);
1654 	return (0);
1655 }
1656 
1657 char *
1658 symget(const char *nam)
1659 {
1660 	struct sym *sym;
1661 
1662 	TAILQ_FOREACH(sym, &symhead, entry) {
1663 		if (strcmp(nam, sym->nam) == 0) {
1664 			sym->used = 1;
1665 			return (sym->val);
1666 		}
1667 	}
1668 	return (NULL);
1669 }
1670 
1671 struct gotd_repo *
1672 gotd_find_repo_by_name(const char *repo_name, struct gotd_repolist *repos)
1673 {
1674 	struct gotd_repo *repo;
1675 	size_t namelen;
1676 
1677 	TAILQ_FOREACH(repo, repos, entry) {
1678 		namelen = strlen(repo->name);
1679 		if (strncmp(repo->name, repo_name, namelen) != 0)
1680 			continue;
1681 		if (repo_name[namelen] == '\0' ||
1682 		    strcmp(&repo_name[namelen], ".git") == 0)
1683 			return repo;
1684 	}
1685 
1686 	return NULL;
1687 }
1688 
1689 struct gotd_repo *
1690 gotd_find_repo_by_path(const char *repo_path, struct gotd *gotd)
1691 {
1692 	struct gotd_repo *repo;
1693 
1694 	TAILQ_FOREACH(repo, &gotd->repos, entry) {
1695 		if (strcmp(repo->path, repo_path) == 0)
1696 			return repo;
1697 	}
1698 
1699 	return NULL;
1700 }
1701 
1702 struct gotd_uid_connection_limit *
1703 gotd_find_uid_connection_limit(struct gotd_uid_connection_limit *limits,
1704     size_t nlimits, uid_t uid)
1705 {
1706 	/* This array is always sorted to allow for binary search. */
1707 	int i, left = 0, right = nlimits - 1;
1708 
1709 	while (left <= right) {
1710 		i = ((left + right) / 2);
1711 		if (limits[i].uid == uid)
1712 			return &limits[i];
1713 		if (limits[i].uid > uid)
1714 			left = i + 1;
1715 		else
1716 			right = i - 1;
1717 	}
1718 
1719 	return NULL;
1720 }
1721 
1722 int
1723 gotd_parseuid(const char *s, uid_t *uid)
1724 {
1725 	struct passwd *pw;
1726 	const char *errstr;
1727 
1728 	if ((pw = getpwnam(s)) != NULL) {
1729 		*uid = pw->pw_uid;
1730 		if (*uid == UID_MAX)
1731 			return -1;
1732 		return 0;
1733 	}
1734 	*uid = strtonum(s, 0, UID_MAX - 1, &errstr);
1735 	if (errstr)
1736 		return -1;
1737 	return 0;
1738 }
1739 
1740 const struct got_error *
1741 gotd_parse_url(char **proto, char **host, char **port,
1742     char **request_path, const char *url)
1743 {
1744 	const struct got_error *err = NULL;
1745 	char *s, *p, *q;
1746 
1747 	*proto = *host = *port = *request_path = NULL;
1748 
1749 	p = strstr(url, "://");
1750 	if (!p)
1751 		return got_error(GOT_ERR_PARSE_URI);
1752 
1753 	*proto = strndup(url, p - url);
1754 	if (*proto == NULL) {
1755 		err = got_error_from_errno("strndup");
1756 		goto done;
1757 	}
1758 	s = p + 3;
1759 
1760 	p = strstr(s, "/");
1761 	if (p == NULL) {
1762 		err = got_error(GOT_ERR_PARSE_URI);
1763 		goto done;
1764 	}
1765 
1766 	q = memchr(s, ':', p - s);
1767 	if (q) {
1768 		*host = strndup(s, q - s);
1769 		if (*host == NULL) {
1770 			err = got_error_from_errno("strndup");
1771 			goto done;
1772 		}
1773 		if ((*host)[0] == '\0') {
1774 			err = got_error(GOT_ERR_PARSE_URI);
1775 			goto done;
1776 		}
1777 		*port = strndup(q + 1, p - (q + 1));
1778 		if (*port == NULL) {
1779 			err = got_error_from_errno("strndup");
1780 			goto done;
1781 		}
1782 		if ((*port)[0] == '\0') {
1783 			err = got_error(GOT_ERR_PARSE_URI);
1784 			goto done;
1785 		}
1786 	} else {
1787 		*host = strndup(s, p - s);
1788 		if (*host == NULL) {
1789 			err = got_error_from_errno("strndup");
1790 			goto done;
1791 		}
1792 		if ((*host)[0] == '\0') {
1793 			err = got_error(GOT_ERR_PARSE_URI);
1794 			goto done;
1795 		}
1796 	}
1797 
1798 	while (p[0] == '/' && p[1] == '/')
1799 		p++;
1800 	*request_path = strdup(p);
1801 	if (*request_path == NULL) {
1802 		err = got_error_from_errno("strdup");
1803 		goto done;
1804 	}
1805 	if ((*request_path)[0] == '\0') {
1806 		err = got_error(GOT_ERR_PARSE_URI);
1807 		goto done;
1808 	}
1809 done:
1810 	if (err) {
1811 		free(*proto);
1812 		*proto = NULL;
1813 		free(*host);
1814 		*host = NULL;
1815 		free(*port);
1816 		*port = NULL;
1817 		free(*request_path);
1818 		*request_path = NULL;
1819 	}
1820 	return err;
1821 }
1822 
1823 static char *
1824 port_sprintf(int p)
1825 {
1826 	static char portno[32];
1827 	int n;
1828 
1829 	n = snprintf(portno, sizeof(portno), "%lld", (long long)p);
1830 	if (n < 0 || (size_t)n >= sizeof(portno))
1831 		fatalx("port number too long: %lld", (long long)p);
1832 
1833 	return portno;
1834 }