path: root/daemon.c
AgeCommit message (Collapse)Author
2005-12-04[PATCH] daemon.c and path.enter_repo(): revamp path validation.Junio C Hamano
The whitelist of git-daemon is checked against return value from enter_repo(), and enter_repo() used to return the value obtained from getcwd() to avoid directory aliasing issues as discussed earier (mid October 2005). Unfortunately, it did not go well as we hoped. For example, /pub on a public machine is a symlink to its real mountpoint, and it is understandable that the administrator does not want to adjust the whitelist every time /pub needs to point at a different partition for storage allcation or whatever reasons. Being able to keep using /pub/scm as the whitelist is a desirable property. So this version of enter_repo() reports what it used to chdir() and validate, but does not use getcwd() to canonicalize the directory name. When it sees a user relative path ~user/path, it internally resolves it to try chdir() there, but it still reports ~user/path (possibly after appending .git if allowed to do so, in which case it would report ~user/path.git). What this means is that if a whitelist wants to allow a user relative path, it needs to say "~" (for all users) or list user home directories like "~alice" "~bob". And no, you cannot say /home if the advertised way to access user home directories are ~alice,~bob, etc. The whole point of this is to avoid unnecessary aliasing issues. Anyway, because of this, daemon needs to do a bit more work to guard itself. Namely, it needs to make sure that the accessor does not try to exploit its leading path match rule by inserting /../ in the middle or hanging /.. at the end. I resurrected the belts and suspender paranoia code HPA did for this purpose. This check cannot be done in the enter_repo() unconditionally, because there are valid callers of enter_repo() that want to honor /../; authorized users coming over ssh to run send-pack and fetch-pack should be allowed to do so. Signed-off-by: Junio C Hamano <>
2005-11-21git-daemon not listening when compiled with -DNO_IPV6Paul Serice
git-daemon was not listening when compiled with -DNO_IPV6. socksetup() was not returning socket count when compiled with -DNO_IPV6. Signed-off-by: Paul Serice <> Signed-off-by: Junio C Hamano <>
2005-11-21daemon: further tweaks.Junio C Hamano
- Do validation only on canonicalized paths - Run upload-pack with "." as repository argument Signed-off-by: Junio C Hamano <>
2005-11-21git-daemon support for user-relative paths.Andreas Ericsson
Dropped a fair amount of reundant code in favour of the library code in path.c Added option --strict-paths with documentation, with backwards compatibility for whitelist entries with symlinks. Everything that worked earlier still works insofar as I have remembered testing it. Signed-off-by: Andreas Ericsson <> Signed-off-by: Junio C Hamano <>
2005-11-17daemon.c: fix arg parsing bugsAndreas Ericsson
Allow --init-timeout and --timeout to be specified without falling through to usage(). Make sure openlog() is called even if implied by --inetd, or messages will be sent to wherever LOG_USER ends up. Signed-off-by: Andreas Ericsson <> Signed-off-by: Junio C Hamano <>
2005-11-15git-daemon: --inetd implies --syslogAndreas Ericsson
Otherwise nothing is logged anywhere, which is a Bad Thing. Signed-off-by: Andreas Ericsson <> Signed-off-by: Junio C Hamano <>
2005-10-26fix daemon.c to compile on OpenBSDRandal L. Schwartz
I can confirm that the following patch lets the current origin compile on OpenBSD. If you could apply this until you sort out the rest of the namespace issue, I would be happy. Thanks. Signed-off-by: Junio C Hamano <>
2005-10-21Merge branch 'fixes'Junio C Hamano
2005-10-21daemon.c: remove trailing whitespace.Junio C Hamano
Signed-off-by: Junio C Hamano <>
2005-10-21Fix git-daemon argument-parsing bugH. Peter Anvin
Fix stupid bug in parsing the --init-timeout option. Signed-off-by: H. Peter Anvin <> Signed-off-by: Junio C Hamano <>
2005-10-21git-daemon poll() spinning out of controlJens Axboe
With the '0' timeout given to poll, it returns instantly without any events on my system, causing git-daemon to consume all the CPU time. Use -1 as the timeout so poll() only returns in case of EINTR or actually events being available. Signed-off-by: Jens Axboe <> Signed-off-by: Junio C Hamano <>
2005-10-19git-daemon: timeout, eliminate double DWIMH. Peter Anvin
It turns out that not only did git-daemon do DWIM, but git-upload-pack does as well. This is bad; security checks have to be performed *after* canonicalization, not before. Additionally, the current git-daemon can be trivially DoSed by spewing SYNs at the target port. This patch adds a --strict option to git-upload-pack to disable all DWIM, a --timeout option to git-daemon and git-upload-pack, and an --init-timeout option to git-daemon (which is typically set to a much lower value, since the initial request should come immediately from the client.) Signed-off-by: H. Peter Anvin <> Signed-off-by: Junio C Hamano <>
2005-10-19revised^2: git-daemon extra paranoia, and path DWIMH. Peter Anvin
This patch adds some extra paranoia to the git-daemon filename test. In particular, it now rejects pathnames containing //; it also adds a redundant test for pathname absoluteness (belts and suspenders.) A single / at the end of the path is still permitted, however, and the .git and /.git append DWIM stuff is now handled in an integrated manner, which means the resulting path will always be subjected to pathname checks. Signed-off-by: H. Peter Anvin <> Signed-off-by: Junio C Hamano <>
2005-10-08Create object subdirectories on demandLinus Torvalds
This makes it possible to have a "sparse" git object subdirectory structure, something that has become much more attractive now that people use pack-files all the time. As a result of pack-files, a git object directory doesn't necessarily have any individual objects lying around, and in that case it's just wasting space to keep the empty first-level object directories around: on many filesystems the 256 empty directories will be aboue 1MB of diskspace. Even more importantly, after you re-pack a project that _used_ to be unpacked, you could be left with huge directories that no longer contain anything, but that waste space and take time to look through. With this change, "git prune-packed" can just do an rmdir() on the directories, and they'll get removed if empty, and re-created on demand. This patch also tries to fix up "write_sha1_from_fd()" to use the new common infrastructure for creating the object files, closing a hole where we might otherwise leave half-written objects in the object database. [jc: I unoptimized the part that really removes the fan-out directories to ease transition. init-db still wastes 1MB of diskspace to hold 256 empty fan-outs, and prune-packed rmdir()'s the grown but empty directories, but runs mkdir() immediately after that -- reducing the saving from 150KB to 146KB. These parts will be re-introduced when everybody has the on-demand capability.] Signed-off-by: Linus Torvalds <> Signed-off-by: Junio C Hamano <>
2005-09-30Move signal setting into service_loop()H. Peter Anvin
2005-09-30socklen_t is unsigned int on most Linux platformsH. Peter Anvin
2005-09-30Use xmalloc/xcallocH. Peter Anvin
2005-09-30Don't need <alloca.h>H. Peter Anvin
2005-09-30Merge with Peter Anvin
2005-09-30[PATCH] Make logerror() and loginfo() staticPavel Roskin
Make logerror() and loginfo() static logerror() and loginfo() in daemon.c are never declared and never called from other files, therefore they should be declared static. Found by sparse. Signed-off-by: Pavel Roskin <> Signed-off-by: Junio C Hamano <>
2005-09-29Remove variables not needed when using pollPeter Anvin
2005-09-29NO_IPV6 support for git daemonPeter Anvin
2005-09-27Restore chdir(".git")H. Peter Anvin
2005-09-27Support a modicum of path validation, and allow an export all trees option.H. Peter Anvin
2005-09-24[PATCH] Rename daemon.c's lognotice() to loginfo()Petr Baudis
The syslog code logs with severity LOG_INFO in the loginfo() function, so make things less confusing. Signed-off-by: Petr Baudis <> Signed-off-by: Junio C Hamano <>
2005-09-24[PATCH] git-daemon --syslog to log through syslogPetr Baudis
Well, this makes it even more clear that we need the packet reader and friends to use the daemon logging code. :/ Therefore, we at least indicate in the "Disconnect" log message if the child process exitted with an error code or not. Idea by Linus. Signed-off-by: Petr Baudis <> Signed-off-by: Junio C Hamano <>
2005-09-24daemon.c: pid_t is not int.Junio C Hamano
Reported by Morten Welinder <>. Signed-off-by: Junio C Hamano <>
2005-09-23[PATCH] Verbose git-daemon loggingPetr Baudis
This patch makes git-daemon --verbose log some useful things on stderr - in particular connects, disconnects and upload requests, and in such a way to be able to trace a particular session. Some more errors are now also logged (even when --verbose is not passed). It is still not perfect since messages produced by the non-daemon-specific code are obviously not formatted properly. [jc: With minor fix up in the log line truncation, and use of write(2) as suggested by Linus.] Signed-off-by: Petr Baudis <> Signed-off-by: Junio C Hamano <>
2005-09-12Use int instead of socklen_tJunio C Hamano
This should work around the compilation problem Johannes Schindelin and others had on Mac OS/X. Quoting Linus: Any operating system where socklen_t is anything else than "int" is terminally broken. The people who introduced that typedef were confused, and I actually had to argue with them that it was fundamentally wrong: there is no other valid type than "int" that makes sense for it. Signed-off-by: Junio C Hamano <>
2005-09-08[PATCH] git-daemon
git-daemon using inetd. does not work properly. inetd routes stderr onto the network line just like stdout, which was apparently not expected to be so. As the result of this, the stream is closed by the receiver, because some "Packing %d objects\n" originating from pack_objects is first reported over the line instead of the expected pack_header, and so the SIGNATURE test fails. Here is a workaround. Signed-off-by: Junio C Hamano <>
2005-08-24Include sys/time.h in daemon.c.Jason Riedy
Some systems and feature levels want sys/time.h for fd_set functionality. Signed-off-by: Jason Riedy <>
2005-08-05daemon.c: squelch error message from EINTRJunio C Hamano
Every time after servicing the connection, select() first fails with EINTR and ends up waiting for one second before serving the next client. The sleep() was placed by the original author per suggestion from the list to avoid spinning on failing select, but at least this EINTR situation should not result in "at most one client per second" service limit. I am not sure if this is the right fix, but WTH. The king penguin says that serious people would run the daemon under inetd anyway, and I agree with that. Signed-off-by: Junio C Hamano <>
2005-08-01[PATCH] Fix sparse warningsLinus Torvalds
A few sparse warnings have crept in again since I checked last time: undeclared variables with global scope. Fix them by marking the private variables properly "static". Signed-off-by: Linus Torvalds <> Signed-off-by: Junio C Hamano <>
2005-07-28[PATCH] GIT: Listen on IPv6 as well, if available.YOSHIFUJI Hideaki
Signed-off-by: Hideaki YOSHIFUJI <> Signed-off-by: Junio C Hamano <>
2005-07-16Be slightly smarter about git-daemon client shutdownLinus Torvalds
Shut down connections that haven't even identified themselves as git clients first. That should get rid of people who just connect to the port and wait for something to happen.
2005-07-16git-daemon: actually remember the children we have outstandingLinus Torvalds
This is using a lockless approach that allows us to handle children dying without having to block SIGCHLD. Right now our "solution" to too many kids is pretty damn rough, but it at least shows what you can do.
2005-07-16git-daemon: keep track of childrenLinus Torvalds
We don't want them as zombies, and eventually we'll want to limit their number. Right now we just count them.
2005-07-15Add "--inetd" flag to git-daemonLinus Torvalds
All credit go to Alexey Nezhdanov <>, I just ended up re-implementing his idea.
2005-07-15git-daemon: re-organize code a bit for --inetd flagLinus Torvalds
Alexey Nezhdanov sent a patch that made git-daemon usable from inetd (ie where inetd has already done the accept on the new connection, the fork, and the setup of stdin/stdout). I wanted to organize the thing slightly differently, though.
2005-07-14Add a "git-daemon" that listens on a TCP portLinus Torvalds
.. and does a "git-upload-pack" on demand.