git.oblomov.eu Git - git/blob - daemon.c

   1 #include "cache.h"
   2 #include "pkt-line.h"
   3 #include "exec_cmd.h"
   4
   5 #include <syslog.h>
   6
   7 #ifndef HOST_NAME_MAX
   8 #define HOST_NAME_MAX 256
   9 #endif
  10
  11 #ifndef NI_MAXSERV
  12 #define NI_MAXSERV 32
  13 #endif
  14
  15 static int log_syslog;
  16 static int verbose;
  17 static int reuseaddr;
  18
  19 static const char daemon_usage[] =
  20 "git daemon [--verbose] [--syslog] [--export-all]\n"
  21 "           [--timeout=n] [--init-timeout=n] [--max-connections=n]\n"
  22 "           [--strict-paths] [--base-path=path] [--base-path-relaxed]\n"
  23 "           [--user-path | --user-path=path]\n"
  24 "           [--interpolated-path=path]\n"
  25 "           [--reuseaddr] [--detach] [--pid-file=file]\n"
  26 "           [--[enable|disable|allow-override|forbid-override]=service]\n"
  27 "           [--inetd | [--listen=host_or_ipaddr] [--port=n]\n"
  28 "                      [--user=user [--group=group]]\n"
  29 "           [directory...]";
  30
  31 /* List of acceptable pathname prefixes */
  32 static char **ok_paths;
  33 static int strict_paths;
  34
  35 /* If this is set, git-daemon-export-ok is not required */
  36 static int export_all_trees;
  37
  38 /* Take all paths relative to this one if non-NULL */
  39 static char *base_path;
  40 static char *interpolated_path;
  41 static int base_path_relaxed;
  42
  43 /* Flag indicating client sent extra args. */
  44 static int saw_extended_args;
  45
  46 /* If defined, ~user notation is allowed and the string is inserted
  47  * after ~user/.  E.g. a request to git://host/~alice/frotz would
  48  * go to /home/alice/pub_git/frotz with --user-path=pub_git.
  49  */
  50 static const char *user_path;
  51
  52 /* Timeout, and initial timeout */
  53 static unsigned int timeout;
  54 static unsigned int init_timeout;
  55
  56 static char *hostname;
  57 static char *canon_hostname;
  58 static char *ip_address;
  59 static char *tcp_port;
  60
  61 static void logreport(int priority, const char *err, va_list params)
  62 {
  63         if (log_syslog) {
  64                 char buf[1024];
  65                 vsnprintf(buf, sizeof(buf), err, params);
  66                 syslog(priority, "%s", buf);
  67         } else {
  68                 /*
  69                  * Since stderr is set to linebuffered mode, the
  70                  * logging of different processes will not overlap
  71                  */
  72                 fprintf(stderr, "[%"PRIuMAX"] ", (uintmax_t)getpid());
  73                 vfprintf(stderr, err, params);
  74                 fputc('\n', stderr);
  75         }
  76 }
  77
  78 static void logerror(const char *err, ...)
  79 {
  80         va_list params;
  81         va_start(params, err);
  82         logreport(LOG_ERR, err, params);
  83         va_end(params);
  84 }
  85
  86 static void loginfo(const char *err, ...)
  87 {
  88         va_list params;
  89         if (!verbose)
  90                 return;
  91         va_start(params, err);
  92         logreport(LOG_INFO, err, params);
  93         va_end(params);
  94 }
  95
  96 static void NORETURN daemon_die(const char *err, va_list params)
  97 {
  98         logreport(LOG_ERR, err, params);
  99         exit(1);
 100 }
 101
 102 static int avoid_alias(char *p)
 103 {
 104         int sl, ndot;
 105
 106         /*
 107          * This resurrects the belts and suspenders paranoia check by HPA
 108          * done in <435560F7.4080006@zytor.com> thread, now enter_repo()
 109          * does not do getcwd() based path canonicalizations.
 110          *
 111          * sl becomes true immediately after seeing '/' and continues to
 112          * be true as long as dots continue after that without intervening
 113          * non-dot character.
 114          */
 115         if (!p || (*p != '/' && *p != '~'))
 116                 return -1;
 117         sl = 1; ndot = 0;
 118         p++;
 119
 120         while (1) {
 121                 char ch = *p++;
 122                 if (sl) {
 123                         if (ch == '.')
 124                                 ndot++;
 125                         else if (ch == '/') {
 126                                 if (ndot < 3)
 127                                         /* reject //, /./ and /../ */
 128                                         return -1;
 129                                 ndot = 0;
 130                         }
 131                         else if (ch == 0) {
 132                                 if (0 < ndot && ndot < 3)
 133                                         /* reject /.$ and /..$ */
 134                                         return -1;
 135                                 return 0;
 136                         }
 137                         else
 138                                 sl = ndot = 0;
 139                 }
 140                 else if (ch == 0)
 141                         return 0;
 142                 else if (ch == '/') {
 143                         sl = 1;
 144                         ndot = 0;
 145                 }
 146         }
 147 }
 148
 149 static char *path_ok(char *directory)
 150 {
 151         static char rpath[PATH_MAX];
 152         static char interp_path[PATH_MAX];
 153         char *path;
 154         char *dir;
 155
 156         dir = directory;
 157
 158         if (avoid_alias(dir)) {
 159                 logerror("'%s': aliased", dir);
 160                 return NULL;
 161         }
 162
 163         if (*dir == '~') {
 164                 if (!user_path) {
 165                         logerror("'%s': User-path not allowed", dir);
 166                         return NULL;
 167                 }
 168                 if (*user_path) {
 169                         /* Got either "~alice" or "~alice/foo";
 170                          * rewrite them to "~alice/%s" or
 171                          * "~alice/%s/foo".
 172                          */
 173                         int namlen, restlen = strlen(dir);
 174                         char *slash = strchr(dir, '/');
 175                         if (!slash)
 176                                 slash = dir + restlen;
 177                         namlen = slash - dir;
 178                         restlen -= namlen;
 179                         loginfo("userpath <%s>, request <%s>, namlen %d, restlen %d, slash <%s>", user_path, dir, namlen, restlen, slash);
 180                         snprintf(rpath, PATH_MAX, "%.*s/%s%.*s",
 181                                  namlen, dir, user_path, restlen, slash);
 182                         dir = rpath;
 183                 }
 184         }
 185         else if (interpolated_path && saw_extended_args) {
 186                 struct strbuf expanded_path = STRBUF_INIT;
 187                 struct strbuf_expand_dict_entry dict[] = {
 188                         { "H", hostname },
 189                         { "CH", canon_hostname },
 190                         { "IP", ip_address },
 191                         { "P", tcp_port },
 192                         { "D", directory },
 193                         { "%", "%" },
 194                         { NULL }
 195                 };
 196
 197                 if (*dir != '/') {
 198                         /* Allow only absolute */
 199                         logerror("'%s': Non-absolute path denied (interpolated-path active)", dir);
 200                         return NULL;
 201                 }
 202
 203                 strbuf_expand(&expanded_path, interpolated_path,
 204                                 strbuf_expand_dict_cb, &dict);
 205                 strlcpy(interp_path, expanded_path.buf, PATH_MAX);
 206                 strbuf_release(&expanded_path);
 207                 loginfo("Interpolated dir '%s'", interp_path);
 208
 209                 dir = interp_path;
 210         }
 211         else if (base_path) {
 212                 if (*dir != '/') {
 213                         /* Allow only absolute */
 214                         logerror("'%s': Non-absolute path denied (base-path active)", dir);
 215                         return NULL;
 216                 }
 217                 snprintf(rpath, PATH_MAX, "%s%s", base_path, dir);
 218                 dir = rpath;
 219         }
 220
 221         path = enter_repo(dir, strict_paths);
 222         if (!path && base_path && base_path_relaxed) {
 223                 /*
 224                  * if we fail and base_path_relaxed is enabled, try without
 225                  * prefixing the base path
 226                  */
 227                 dir = directory;
 228                 path = enter_repo(dir, strict_paths);
 229         }
 230
 231         if (!path) {
 232                 logerror("'%s' does not appear to be a git repository", dir);
 233                 return NULL;
 234         }
 235
 236         if ( ok_paths && *ok_paths ) {
 237                 char **pp;
 238                 int pathlen = strlen(path);
 239
 240                 /* The validation is done on the paths after enter_repo
 241                  * appends optional {.git,.git/.git} and friends, but
 242                  * it does not use getcwd().  So if your /pub is
 243                  * a symlink to /mnt/pub, you can whitelist /pub and
 244                  * do not have to say /mnt/pub.
 245                  * Do not say /pub/.
 246                  */
 247                 for ( pp = ok_paths ; *pp ; pp++ ) {
 248                         int len = strlen(*pp);
 249                         if (len <= pathlen &&
 250                             !memcmp(*pp, path, len) &&
 251                             (path[len] == '\0' ||
 252                              (!strict_paths && path[len] == '/')))
 253                                 return path;
 254                 }
 255         }
 256         else {
 257                 /* be backwards compatible */
 258                 if (!strict_paths)
 259                         return path;
 260         }
 261
 262         logerror("'%s': not in whitelist", path);
 263         return NULL;            /* Fallthrough. Deny by default */
 264 }
 265
 266 typedef int (*daemon_service_fn)(void);
 267 struct daemon_service {
 268         const char *name;
 269         const char *config_name;
 270         daemon_service_fn fn;
 271         int enabled;
 272         int overridable;
 273 };
 274
 275 static struct daemon_service *service_looking_at;
 276 static int service_enabled;
 277
 278 static int git_daemon_config(const char *var, const char *value, void *cb)
 279 {
 280         if (!prefixcmp(var, "daemon.") &&
 281             !strcmp(var + 7, service_looking_at->config_name)) {
 282                 service_enabled = git_config_bool(var, value);
 283                 return 0;
 284         }
 285
 286         /* we are not interested in parsing any other configuration here */
 287         return 0;
 288 }
 289
 290 static int run_service(char *dir, struct daemon_service *service)
 291 {
 292         const char *path;
 293         int enabled = service->enabled;
 294
 295         loginfo("Request %s for '%s'", service->name, dir);
 296
 297         if (!enabled && !service->overridable) {
 298                 logerror("'%s': service not enabled.", service->name);
 299                 errno = EACCES;
 300                 return -1;
 301         }
 302
 303         if (!(path = path_ok(dir)))
 304                 return -1;
 305
 306         /*
 307          * Security on the cheap.
 308          *
 309          * We want a readable HEAD, usable "objects" directory, and
 310          * a "git-daemon-export-ok" flag that says that the other side
 311          * is ok with us doing this.
 312          *
 313          * path_ok() uses enter_repo() and does whitelist checking.
 314          * We only need to make sure the repository is exported.
 315          */
 316
 317         if (!export_all_trees && access("git-daemon-export-ok", F_OK)) {
 318                 logerror("'%s': repository not exported.", path);
 319                 errno = EACCES;
 320                 return -1;
 321         }
 322
 323         if (service->overridable) {
 324                 service_looking_at = service;
 325                 service_enabled = -1;
 326                 git_config(git_daemon_config, NULL);
 327                 if (0 <= service_enabled)
 328                         enabled = service_enabled;
 329         }
 330         if (!enabled) {
 331                 logerror("'%s': service not enabled for '%s'",
 332                          service->name, path);
 333                 errno = EACCES;
 334                 return -1;
 335         }
 336
 337         /*
 338          * We'll ignore SIGTERM from now on, we have a
 339          * good client.
 340          */
 341         signal(SIGTERM, SIG_IGN);
 342
 343         return service->fn();
 344 }
 345
 346 static int upload_pack(void)
 347 {
 348         /* Timeout as string */
 349         char timeout_buf[64];
 350
 351         snprintf(timeout_buf, sizeof timeout_buf, "--timeout=%u", timeout);
 352
 353         /* git-upload-pack only ever reads stuff, so this is safe */
 354         execl_git_cmd("upload-pack", "--strict", timeout_buf, ".", NULL);
 355         return -1;
 356 }
 357
 358 static int upload_archive(void)
 359 {
 360         execl_git_cmd("upload-archive", ".", NULL);
 361         return -1;
 362 }
 363
 364 static int receive_pack(void)
 365 {
 366         execl_git_cmd("receive-pack", ".", NULL);
 367         return -1;
 368 }
 369
 370 static struct daemon_service daemon_service[] = {
 371         { "upload-archive", "uploadarch", upload_archive, 0, 1 },
 372         { "upload-pack", "uploadpack", upload_pack, 1, 1 },
 373         { "receive-pack", "receivepack", receive_pack, 0, 1 },
 374 };
 375
 376 static void enable_service(const char *name, int ena)
 377 {
 378         int i;
 379         for (i = 0; i < ARRAY_SIZE(daemon_service); i++) {
 380                 if (!strcmp(daemon_service[i].name, name)) {
 381                         daemon_service[i].enabled = ena;
 382                         return;
 383                 }
 384         }
 385         die("No such service %s", name);
 386 }
 387
 388 static void make_service_overridable(const char *name, int ena)
 389 {
 390         int i;
 391         for (i = 0; i < ARRAY_SIZE(daemon_service); i++) {
 392                 if (!strcmp(daemon_service[i].name, name)) {
 393                         daemon_service[i].overridable = ena;
 394                         return;
 395                 }
 396         }
 397         die("No such service %s", name);
 398 }
 399
 400 static char *xstrdup_tolower(const char *str)
 401 {
 402         char *p, *dup = xstrdup(str);
 403         for (p = dup; *p; p++)
 404                 *p = tolower(*p);
 405         return dup;
 406 }
 407
 408 /*
 409  * Read the host as supplied by the client connection.
 410  */
 411 static void parse_host_arg(char *extra_args, int buflen)
 412 {
 413         char *val;
 414         int vallen;
 415         char *end = extra_args + buflen;
 416
 417         if (extra_args < end && *extra_args) {
 418                 saw_extended_args = 1;
 419                 if (strncasecmp("host=", extra_args, 5) == 0) {
 420                         val = extra_args + 5;
 421                         vallen = strlen(val) + 1;
 422                         if (*val) {
 423                                 /* Split <host>:<port> at colon. */
 424                                 char *host = val;
 425                                 char *port = strrchr(host, ':');
 426                                 if (port) {
 427                                         *port = 0;
 428                                         port++;
 429                                         free(tcp_port);
 430                                         tcp_port = xstrdup(port);
 431                                 }
 432                                 free(hostname);
 433                                 hostname = xstrdup_tolower(host);
 434                         }
 435
 436                         /* On to the next one */
 437                         extra_args = val + vallen;
 438                 }
 439                 if (extra_args < end && *extra_args)
 440                         die("Invalid request");
 441         }
 442
 443         /*
 444          * Locate canonical hostname and its IP address.
 445          */
 446         if (hostname) {
 447 #ifndef NO_IPV6
 448                 struct addrinfo hints;
 449                 struct addrinfo *ai;
 450                 int gai;
 451                 static char addrbuf[HOST_NAME_MAX + 1];
 452
 453                 memset(&hints, 0, sizeof(hints));
 454                 hints.ai_flags = AI_CANONNAME;
 455
 456                 gai = getaddrinfo(hostname, NULL, &hints, &ai);
 457                 if (!gai) {
 458                         struct sockaddr_in *sin_addr = (void *)ai->ai_addr;
 459
 460                         inet_ntop(AF_INET, &sin_addr->sin_addr,
 461                                   addrbuf, sizeof(addrbuf));
 462                         free(ip_address);
 463                         ip_address = xstrdup(addrbuf);
 464
 465                         free(canon_hostname);
 466                         canon_hostname = xstrdup(ai->ai_canonname ?
 467                                                  ai->ai_canonname : ip_address);
 468
 469                         freeaddrinfo(ai);
 470                 }
 471 #else
 472                 struct hostent *hent;
 473                 struct sockaddr_in sa;
 474                 char **ap;
 475                 static char addrbuf[HOST_NAME_MAX + 1];
 476
 477                 hent = gethostbyname(hostname);
 478
 479                 ap = hent->h_addr_list;
 480                 memset(&sa, 0, sizeof sa);
 481                 sa.sin_family = hent->h_addrtype;
 482                 sa.sin_port = htons(0);
 483                 memcpy(&sa.sin_addr, *ap, hent->h_length);
 484
 485                 inet_ntop(hent->h_addrtype, &sa.sin_addr,
 486                           addrbuf, sizeof(addrbuf));
 487
 488                 free(canon_hostname);
 489                 canon_hostname = xstrdup(hent->h_name);
 490                 free(ip_address);
 491                 ip_address = xstrdup(addrbuf);
 492 #endif
 493         }
 494 }
 495
 496
 497 static int execute(struct sockaddr *addr)
 498 {
 499         static char line[1000];
 500         int pktlen, len, i;
 501
 502         if (addr) {
 503                 char addrbuf[256] = "";
 504                 int port = -1;
 505
 506                 if (addr->sa_family == AF_INET) {
 507                         struct sockaddr_in *sin_addr = (void *) addr;
 508                         inet_ntop(addr->sa_family, &sin_addr->sin_addr, addrbuf, sizeof(addrbuf));
 509                         port = ntohs(sin_addr->sin_port);
 510 #ifndef NO_IPV6
 511                 } else if (addr && addr->sa_family == AF_INET6) {
 512                         struct sockaddr_in6 *sin6_addr = (void *) addr;
 513
 514                         char *buf = addrbuf;
 515                         *buf++ = '['; *buf = '\0'; /* stpcpy() is cool */
 516                         inet_ntop(AF_INET6, &sin6_addr->sin6_addr, buf, sizeof(addrbuf) - 1);
 517                         strcat(buf, "]");
 518
 519                         port = ntohs(sin6_addr->sin6_port);
 520 #endif
 521                 }
 522                 loginfo("Connection from %s:%d", addrbuf, port);
 523                 setenv("REMOTE_ADDR", addrbuf, 1);
 524         }
 525         else {
 526                 unsetenv("REMOTE_ADDR");
 527         }
 528
 529         alarm(init_timeout ? init_timeout : timeout);
 530         pktlen = packet_read_line(0, line, sizeof(line));
 531         alarm(0);
 532
 533         len = strlen(line);
 534         if (pktlen != len)
 535                 loginfo("Extended attributes (%d bytes) exist <%.*s>",
 536                         (int) pktlen - len,
 537                         (int) pktlen - len, line + len + 1);
 538         if (len && line[len-1] == '\n') {
 539                 line[--len] = 0;
 540                 pktlen--;
 541         }
 542
 543         free(hostname);
 544         free(canon_hostname);
 545         free(ip_address);
 546         free(tcp_port);
 547         hostname = canon_hostname = ip_address = tcp_port = NULL;
 548
 549         if (len != pktlen)
 550                 parse_host_arg(line + len + 1, pktlen - len - 1);
 551
 552         for (i = 0; i < ARRAY_SIZE(daemon_service); i++) {
 553                 struct daemon_service *s = &(daemon_service[i]);
 554                 int namelen = strlen(s->name);
 555                 if (!prefixcmp(line, "git-") &&
 556                     !strncmp(s->name, line + 4, namelen) &&
 557                     line[namelen + 4] == ' ') {
 558                         /*
 559                          * Note: The directory here is probably context sensitive,
 560                          * and might depend on the actual service being performed.
 561                          */
 562                         return run_service(line + namelen + 5, s);
 563                 }
 564         }
 565
 566         logerror("Protocol error: '%s'", line);
 567         return -1;
 568 }
 569
 570 static int max_connections = 32;
 571
 572 static unsigned int live_children;
 573
 574 static struct child {
 575         struct child *next;
 576         pid_t pid;
 577         struct sockaddr_storage address;
 578 } *firstborn;
 579
 580 static void add_child(pid_t pid, struct sockaddr *addr, int addrlen)
 581 {
 582         struct child *newborn, **cradle;
 583
 584         /*
 585          * This must be xcalloc() -- we'll compare the whole sockaddr_storage
 586          * but individual address may be shorter.
 587          */
 588         newborn = xcalloc(1, sizeof(*newborn));
 589         live_children++;
 590         newborn->pid = pid;
 591         memcpy(&newborn->address, addr, addrlen);
 592         for (cradle = &firstborn; *cradle; cradle = &(*cradle)->next)
 593                 if (!memcmp(&(*cradle)->address, &newborn->address,
 594                             sizeof(newborn->address)))
 595                         break;
 596         newborn->next = *cradle;
 597         *cradle = newborn;
 598 }
 599
 600 static void remove_child(pid_t pid)
 601 {
 602         struct child **cradle, *blanket;
 603
 604         for (cradle = &firstborn; (blanket = *cradle); cradle = &blanket->next)
 605                 if (blanket->pid == pid) {
 606                         *cradle = blanket->next;
 607                         live_children--;
 608                         free(blanket);
 609                         break;
 610                 }
 611 }
 612
 613 /*
 614  * This gets called if the number of connections grows
 615  * past "max_connections".
 616  *
 617  * We kill the newest connection from a duplicate IP.
 618  */
 619 static void kill_some_child(void)
 620 {
 621         const struct child *blanket, *next;
 622
 623         if (!(blanket = firstborn))
 624                 return;
 625
 626         for (; (next = blanket->next); blanket = next)
 627                 if (!memcmp(&blanket->address, &next->address,
 628                             sizeof(next->address))) {
 629                         kill(blanket->pid, SIGTERM);
 630                         break;
 631                 }
 632 }
 633
 634 static void check_dead_children(void)
 635 {
 636         int status;
 637         pid_t pid;
 638
 639         while ((pid = waitpid(-1, &status, WNOHANG)) > 0) {
 640                 const char *dead = "";
 641                 remove_child(pid);
 642                 if (!WIFEXITED(status) || (WEXITSTATUS(status) > 0))
 643                         dead = " (with error)";
 644                 loginfo("[%"PRIuMAX"] Disconnected%s", (uintmax_t)pid, dead);
 645         }
 646 }
 647
 648 static void handle(int incoming, struct sockaddr *addr, int addrlen)
 649 {
 650         pid_t pid;
 651
 652         if (max_connections && live_children >= max_connections) {
 653                 kill_some_child();
 654                 sleep(1);  /* give it some time to die */
 655                 check_dead_children();
 656                 if (live_children >= max_connections) {
 657                         close(incoming);
 658                         logerror("Too many children, dropping connection");
 659                         return;
 660                 }
 661         }
 662
 663         if ((pid = fork())) {
 664                 close(incoming);
 665                 if (pid < 0) {
 666                         logerror("Couldn't fork %s", strerror(errno));
 667                         return;
 668                 }
 669
 670                 add_child(pid, addr, addrlen);
 671                 return;
 672         }
 673
 674         dup2(incoming, 0);
 675         dup2(incoming, 1);
 676         close(incoming);
 677
 678         exit(execute(addr));
 679 }
 680
 681 static void child_handler(int signo)
 682 {
 683         /*
 684          * Otherwise empty handler because systemcalls will get interrupted
 685          * upon signal receipt
 686          * SysV needs the handler to be rearmed
 687          */
 688         signal(SIGCHLD, child_handler);
 689 }
 690
 691 static int set_reuse_addr(int sockfd)
 692 {
 693         int on = 1;
 694
 695         if (!reuseaddr)
 696                 return 0;
 697         return setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR,
 698                           &on, sizeof(on));
 699 }
 700
 701 #ifndef NO_IPV6
 702
 703 static int socksetup(char *listen_addr, int listen_port, int **socklist_p)
 704 {
 705         int socknum = 0, *socklist = NULL;
 706         int maxfd = -1;
 707         char pbuf[NI_MAXSERV];
 708         struct addrinfo hints, *ai0, *ai;
 709         int gai;
 710         long flags;
 711
 712         sprintf(pbuf, "%d", listen_port);
 713         memset(&hints, 0, sizeof(hints));
 714         hints.ai_family = AF_UNSPEC;
 715         hints.ai_socktype = SOCK_STREAM;
 716         hints.ai_protocol = IPPROTO_TCP;
 717         hints.ai_flags = AI_PASSIVE;
 718
 719         gai = getaddrinfo(listen_addr, pbuf, &hints, &ai0);
 720         if (gai)
 721                 die("getaddrinfo() failed: %s", gai_strerror(gai));
 722
 723         for (ai = ai0; ai; ai = ai->ai_next) {
 724                 int sockfd;
 725
 726                 sockfd = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
 727                 if (sockfd < 0)
 728                         continue;
 729                 if (sockfd >= FD_SETSIZE) {
 730                         logerror("Socket descriptor too large");
 731                         close(sockfd);
 732                         continue;
 733                 }
 734
 735 #ifdef IPV6_V6ONLY
 736                 if (ai->ai_family == AF_INET6) {
 737                         int on = 1;
 738                         setsockopt(sockfd, IPPROTO_IPV6, IPV6_V6ONLY,
 739                                    &on, sizeof(on));
 740                         /* Note: error is not fatal */
 741                 }
 742 #endif
 743
 744                 if (set_reuse_addr(sockfd)) {
 745                         close(sockfd);
 746                         continue;
 747                 }
 748
 749                 if (bind(sockfd, ai->ai_addr, ai->ai_addrlen) < 0) {
 750                         close(sockfd);
 751                         continue;       /* not fatal */
 752                 }
 753                 if (listen(sockfd, 5) < 0) {
 754                         close(sockfd);
 755                         continue;       /* not fatal */
 756                 }
 757
 758                 flags = fcntl(sockfd, F_GETFD, 0);
 759                 if (flags >= 0)
 760                         fcntl(sockfd, F_SETFD, flags | FD_CLOEXEC);
 761
 762                 socklist = xrealloc(socklist, sizeof(int) * (socknum + 1));
 763                 socklist[socknum++] = sockfd;
 764
 765                 if (maxfd < sockfd)
 766                         maxfd = sockfd;
 767         }
 768
 769         freeaddrinfo(ai0);
 770
 771         *socklist_p = socklist;
 772         return socknum;
 773 }
 774
 775 #else /* NO_IPV6 */
 776
 777 static int socksetup(char *listen_addr, int listen_port, int **socklist_p)
 778 {
 779         struct sockaddr_in sin;
 780         int sockfd;
 781         long flags;
 782
 783         memset(&sin, 0, sizeof sin);
 784         sin.sin_family = AF_INET;
 785         sin.sin_port = htons(listen_port);
 786
 787         if (listen_addr) {
 788                 /* Well, host better be an IP address here. */
 789                 if (inet_pton(AF_INET, listen_addr, &sin.sin_addr.s_addr) <= 0)
 790                         return 0;
 791         } else {
 792                 sin.sin_addr.s_addr = htonl(INADDR_ANY);
 793         }
 794
 795         sockfd = socket(AF_INET, SOCK_STREAM, 0);
 796         if (sockfd < 0)
 797                 return 0;
 798
 799         if (set_reuse_addr(sockfd)) {
 800                 close(sockfd);
 801                 return 0;
 802         }
 803
 804         if ( bind(sockfd, (struct sockaddr *)&sin, sizeof sin) < 0 ) {
 805                 close(sockfd);
 806                 return 0;
 807         }
 808
 809         if (listen(sockfd, 5) < 0) {
 810                 close(sockfd);
 811                 return 0;
 812         }
 813
 814         flags = fcntl(sockfd, F_GETFD, 0);
 815         if (flags >= 0)
 816                 fcntl(sockfd, F_SETFD, flags | FD_CLOEXEC);
 817
 818         *socklist_p = xmalloc(sizeof(int));
 819         **socklist_p = sockfd;
 820         return 1;
 821 }
 822
 823 #endif
 824
 825 static int service_loop(int socknum, int *socklist)
 826 {
 827         struct pollfd *pfd;
 828         int i;
 829
 830         pfd = xcalloc(socknum, sizeof(struct pollfd));
 831
 832         for (i = 0; i < socknum; i++) {
 833                 pfd[i].fd = socklist[i];
 834                 pfd[i].events = POLLIN;
 835         }
 836
 837         signal(SIGCHLD, child_handler);
 838
 839         for (;;) {
 840                 int i;
 841
 842                 check_dead_children();
 843
 844                 if (poll(pfd, socknum, -1) < 0) {
 845                         if (errno != EINTR) {
 846                                 logerror("Poll failed, resuming: %s",
 847                                       strerror(errno));
 848                                 sleep(1);
 849                         }
 850                         continue;
 851                 }
 852
 853                 for (i = 0; i < socknum; i++) {
 854                         if (pfd[i].revents & POLLIN) {
 855                                 struct sockaddr_storage ss;
 856                                 unsigned int sslen = sizeof(ss);
 857                                 int incoming = accept(pfd[i].fd, (struct sockaddr *)&ss, &sslen);
 858                                 if (incoming < 0) {
 859                                         switch (errno) {
 860                                         case EAGAIN:
 861                                         case EINTR:
 862                                         case ECONNABORTED:
 863                                                 continue;
 864                                         default:
 865                                                 die("accept returned %s", strerror(errno));
 866                                         }
 867                                 }
 868                                 handle(incoming, (struct sockaddr *)&ss, sslen);
 869                         }
 870                 }
 871         }
 872 }
 873
 874 /* if any standard file descriptor is missing open it to /dev/null */
 875 static void sanitize_stdfds(void)
 876 {
 877         int fd = open("/dev/null", O_RDWR, 0);
 878         while (fd != -1 && fd < 2)
 879                 fd = dup(fd);
 880         if (fd == -1)
 881                 die("open /dev/null or dup failed: %s", strerror(errno));
 882         if (fd > 2)
 883                 close(fd);
 884 }
 885
 886 static void daemonize(void)
 887 {
 888         switch (fork()) {
 889                 case 0:
 890                         break;
 891                 case -1:
 892                         die("fork failed: %s", strerror(errno));
 893                 default:
 894                         exit(0);
 895         }
 896         if (setsid() == -1)
 897                 die("setsid failed: %s", strerror(errno));
 898         close(0);
 899         close(1);
 900         close(2);
 901         sanitize_stdfds();
 902 }
 903
 904 static void store_pid(const char *path)
 905 {
 906         FILE *f = fopen(path, "w");
 907         if (!f)
 908                 die("cannot open pid file %s: %s", path, strerror(errno));
 909         if (fprintf(f, "%"PRIuMAX"\n", (uintmax_t) getpid()) < 0 || fclose(f) != 0)
 910                 die("failed to write pid file %s: %s", path, strerror(errno));
 911 }
 912
 913 static int serve(char *listen_addr, int listen_port, struct passwd *pass, gid_t gid)
 914 {
 915         int socknum, *socklist;
 916
 917         socknum = socksetup(listen_addr, listen_port, &socklist);
 918         if (socknum == 0)
 919                 die("unable to allocate any listen sockets on host %s port %u",
 920                     listen_addr, listen_port);
 921
 922         if (pass && gid &&
 923             (initgroups(pass->pw_name, gid) || setgid (gid) ||
 924              setuid(pass->pw_uid)))
 925                 die("cannot drop privileges");
 926
 927         return service_loop(socknum, socklist);
 928 }
 929
 930 int main(int argc, char **argv)
 931 {
 932         int listen_port = 0;
 933         char *listen_addr = NULL;
 934         int inetd_mode = 0;
 935         const char *pid_file = NULL, *user_name = NULL, *group_name = NULL;
 936         int detach = 0;
 937         struct passwd *pass = NULL;
 938         struct group *group;
 939         gid_t gid = 0;
 940         int i;
 941
 942         git_extract_argv0_path(argv[0]);
 943
 944         for (i = 1; i < argc; i++) {
 945                 char *arg = argv[i];
 946
 947                 if (!prefixcmp(arg, "--listen=")) {
 948                         listen_addr = xstrdup_tolower(arg + 9);
 949                         continue;
 950                 }
 951                 if (!prefixcmp(arg, "--port=")) {
 952                         char *end;
 953                         unsigned long n;
 954                         n = strtoul(arg+7, &end, 0);
 955                         if (arg[7] && !*end) {
 956                                 listen_port = n;
 957                                 continue;
 958                         }
 959                 }
 960                 if (!strcmp(arg, "--inetd")) {
 961                         inetd_mode = 1;
 962                         log_syslog = 1;
 963                         continue;
 964                 }
 965                 if (!strcmp(arg, "--verbose")) {
 966                         verbose = 1;
 967                         continue;
 968                 }
 969                 if (!strcmp(arg, "--syslog")) {
 970                         log_syslog = 1;
 971                         continue;
 972                 }
 973                 if (!strcmp(arg, "--export-all")) {
 974                         export_all_trees = 1;
 975                         continue;
 976                 }
 977                 if (!prefixcmp(arg, "--timeout=")) {
 978                         timeout = atoi(arg+10);
 979                         continue;
 980                 }
 981                 if (!prefixcmp(arg, "--init-timeout=")) {
 982                         init_timeout = atoi(arg+15);
 983                         continue;
 984                 }
 985                 if (!prefixcmp(arg, "--max-connections=")) {
 986                         max_connections = atoi(arg+18);
 987                         if (max_connections < 0)
 988                                 max_connections = 0;            /* unlimited */
 989                         continue;
 990                 }
 991                 if (!strcmp(arg, "--strict-paths")) {
 992                         strict_paths = 1;
 993                         continue;
 994                 }
 995                 if (!prefixcmp(arg, "--base-path=")) {
 996                         base_path = arg+12;
 997                         continue;
 998                 }
 999                 if (!strcmp(arg, "--base-path-relaxed")) {
1000                         base_path_relaxed = 1;
1001                         continue;
1002                 }
1003                 if (!prefixcmp(arg, "--interpolated-path=")) {
1004                         interpolated_path = arg+20;
1005                         continue;
1006                 }
1007                 if (!strcmp(arg, "--reuseaddr")) {
1008                         reuseaddr = 1;
1009                         continue;
1010                 }
1011                 if (!strcmp(arg, "--user-path")) {
1012                         user_path = "";
1013                         continue;
1014                 }
1015                 if (!prefixcmp(arg, "--user-path=")) {
1016                         user_path = arg + 12;
1017                         continue;
1018                 }
1019                 if (!prefixcmp(arg, "--pid-file=")) {
1020                         pid_file = arg + 11;
1021                         continue;
1022                 }
1023                 if (!strcmp(arg, "--detach")) {
1024                         detach = 1;
1025                         log_syslog = 1;
1026                         continue;
1027                 }
1028                 if (!prefixcmp(arg, "--user=")) {
1029                         user_name = arg + 7;
1030                         continue;
1031                 }
1032                 if (!prefixcmp(arg, "--group=")) {
1033                         group_name = arg + 8;
1034                         continue;
1035                 }
1036                 if (!prefixcmp(arg, "--enable=")) {
1037                         enable_service(arg + 9, 1);
1038                         continue;
1039                 }
1040                 if (!prefixcmp(arg, "--disable=")) {
1041                         enable_service(arg + 10, 0);
1042                         continue;
1043                 }
1044                 if (!prefixcmp(arg, "--allow-override=")) {
1045                         make_service_overridable(arg + 17, 1);
1046                         continue;
1047                 }
1048                 if (!prefixcmp(arg, "--forbid-override=")) {
1049                         make_service_overridable(arg + 18, 0);
1050                         continue;
1051                 }
1052                 if (!strcmp(arg, "--")) {
1053                         ok_paths = &argv[i+1];
1054                         break;
1055                 } else if (arg[0] != '-') {
1056                         ok_paths = &argv[i];
1057                         break;
1058                 }
1059
1060                 usage(daemon_usage);
1061         }
1062
1063         if (log_syslog) {
1064                 openlog("git-daemon", LOG_PID, LOG_DAEMON);
1065                 set_die_routine(daemon_die);
1066         } else
1067                 /* avoid splitting a message in the middle */
1068                 setvbuf(stderr, NULL, _IOLBF, 0);
1069
1070         if (inetd_mode && (group_name || user_name))
1071                 die("--user and --group are incompatible with --inetd");
1072
1073         if (inetd_mode && (listen_port || listen_addr))
1074                 die("--listen= and --port= are incompatible with --inetd");
1075         else if (listen_port == 0)
1076                 listen_port = DEFAULT_GIT_PORT;
1077
1078         if (group_name && !user_name)
1079                 die("--group supplied without --user");
1080
1081         if (user_name) {
1082                 pass = getpwnam(user_name);
1083                 if (!pass)
1084                         die("user not found - %s", user_name);
1085
1086                 if (!group_name)
1087                         gid = pass->pw_gid;
1088                 else {
1089                         group = getgrnam(group_name);
1090                         if (!group)
1091                                 die("group not found - %s", group_name);
1092
1093                         gid = group->gr_gid;
1094                 }
1095         }
1096
1097         if (strict_paths && (!ok_paths || !*ok_paths))
1098                 die("option --strict-paths requires a whitelist");
1099
1100         if (base_path && !is_directory(base_path))
1101                 die("base-path '%s' does not exist or is not a directory",
1102                     base_path);
1103
1104         if (inetd_mode) {
1105                 struct sockaddr_storage ss;
1106                 struct sockaddr *peer = (struct sockaddr *)&ss;
1107                 socklen_t slen = sizeof(ss);
1108
1109                 if (!freopen("/dev/null", "w", stderr))
1110                         die("failed to redirect stderr to /dev/null: %s",
1111                             strerror(errno));
1112
1113                 if (getpeername(0, peer, &slen))
1114                         peer = NULL;
1115
1116                 return execute(peer);
1117         }
1118
1119         if (detach) {
1120                 daemonize();
1121                 loginfo("Ready to rumble");
1122         }
1123         else
1124                 sanitize_stdfds();
1125
1126         if (pid_file)
1127                 store_pid(pid_file);
1128
1129         return serve(listen_addr, listen_port, pass, gid);
1130 }