2012-01-07 12:42:45 +01:00
|
|
|
#!/bin/sh
|
|
|
|
|
|
|
|
test_description='test fetching over git protocol'
|
|
|
|
. ./test-lib.sh
|
|
|
|
|
|
|
|
. "$TEST_DIRECTORY"/lib-git-daemon.sh
|
|
|
|
start_git_daemon
|
|
|
|
|
2016-02-14 10:26:29 +01:00
|
|
|
check_verbose_connect () {
|
|
|
|
grep -F "Looking up 127.0.0.1 ..." stderr &&
|
|
|
|
grep -F "Connecting to 127.0.0.1 (port " stderr &&
|
|
|
|
grep -F "done." stderr
|
|
|
|
}
|
|
|
|
|
2012-01-07 12:42:45 +01:00
|
|
|
test_expect_success 'setup repository' '
|
2013-01-16 03:05:08 +01:00
|
|
|
git config push.default matching &&
|
2012-01-07 12:42:45 +01:00
|
|
|
echo content >file &&
|
|
|
|
git add file &&
|
|
|
|
git commit -m one
|
|
|
|
'
|
|
|
|
|
|
|
|
test_expect_success 'create git-accessible bare repository' '
|
|
|
|
mkdir "$GIT_DAEMON_DOCUMENT_ROOT_PATH/repo.git" &&
|
|
|
|
(cd "$GIT_DAEMON_DOCUMENT_ROOT_PATH/repo.git" &&
|
|
|
|
git --bare init &&
|
|
|
|
: >git-daemon-export-ok
|
|
|
|
) &&
|
|
|
|
git remote add public "$GIT_DAEMON_DOCUMENT_ROOT_PATH/repo.git" &&
|
|
|
|
git push public master:master
|
|
|
|
'
|
|
|
|
|
|
|
|
test_expect_success 'clone git repository' '
|
2016-02-14 10:26:29 +01:00
|
|
|
git clone -v "$GIT_DAEMON_URL/repo.git" clone 2>stderr &&
|
|
|
|
check_verbose_connect &&
|
2012-01-07 12:42:45 +01:00
|
|
|
test_cmp file clone/file
|
|
|
|
'
|
|
|
|
|
|
|
|
test_expect_success 'fetch changes via git protocol' '
|
|
|
|
echo content >>file &&
|
|
|
|
git commit -a -m two &&
|
|
|
|
git push public &&
|
2016-02-14 10:26:29 +01:00
|
|
|
(cd clone && git pull -v) 2>stderr &&
|
|
|
|
check_verbose_connect &&
|
2012-01-07 12:42:45 +01:00
|
|
|
test_cmp file clone/file
|
|
|
|
'
|
|
|
|
|
2016-02-14 10:26:29 +01:00
|
|
|
test_expect_success 'no-op fetch -v stderr is as expected' '
|
|
|
|
(cd clone && git fetch -v) 2>stderr &&
|
|
|
|
check_verbose_connect
|
|
|
|
'
|
|
|
|
|
|
|
|
test_expect_success 'no-op fetch without "-v" is quiet' '
|
|
|
|
(cd clone && git fetch) 2>stderr &&
|
|
|
|
! test -s stderr
|
|
|
|
'
|
|
|
|
|
2013-10-21 19:54:11 +02:00
|
|
|
test_expect_success 'remote detects correct HEAD' '
|
2012-01-07 12:42:45 +01:00
|
|
|
git push public master:other &&
|
|
|
|
(cd clone &&
|
|
|
|
git remote set-head -d origin &&
|
|
|
|
git remote set-head -a origin &&
|
|
|
|
git symbolic-ref refs/remotes/origin/HEAD > output &&
|
|
|
|
echo refs/remotes/origin/master > expect &&
|
|
|
|
test_cmp expect output
|
|
|
|
)
|
|
|
|
'
|
|
|
|
|
|
|
|
test_expect_success 'prepare pack objects' '
|
|
|
|
cp -R "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo.git "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo_pack.git &&
|
|
|
|
(cd "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo_pack.git &&
|
|
|
|
git --bare repack -a -d
|
|
|
|
)
|
|
|
|
'
|
|
|
|
|
|
|
|
test_expect_success 'fetch notices corrupt pack' '
|
|
|
|
cp -R "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo_pack.git "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo_bad1.git &&
|
|
|
|
(cd "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo_bad1.git &&
|
2016-01-04 10:10:48 +01:00
|
|
|
p=$(ls objects/pack/pack-*.pack) &&
|
2012-01-07 12:42:45 +01:00
|
|
|
chmod u+w $p &&
|
|
|
|
printf %0256d 0 | dd of=$p bs=256 count=1 seek=1 conv=notrunc
|
|
|
|
) &&
|
|
|
|
mkdir repo_bad1.git &&
|
|
|
|
(cd repo_bad1.git &&
|
|
|
|
git --bare init &&
|
|
|
|
test_must_fail git --bare fetch "$GIT_DAEMON_URL/repo_bad1.git" &&
|
2016-01-04 10:10:48 +01:00
|
|
|
test 0 = $(ls objects/pack/pack-*.pack | wc -l)
|
2012-01-07 12:42:45 +01:00
|
|
|
)
|
|
|
|
'
|
|
|
|
|
|
|
|
test_expect_success 'fetch notices corrupt idx' '
|
|
|
|
cp -R "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo_pack.git "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo_bad2.git &&
|
|
|
|
(cd "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo_bad2.git &&
|
2016-01-04 10:10:48 +01:00
|
|
|
p=$(ls objects/pack/pack-*.idx) &&
|
2012-01-07 12:42:45 +01:00
|
|
|
chmod u+w $p &&
|
|
|
|
printf %0256d 0 | dd of=$p bs=256 count=1 seek=1 conv=notrunc
|
|
|
|
) &&
|
|
|
|
mkdir repo_bad2.git &&
|
|
|
|
(cd repo_bad2.git &&
|
|
|
|
git --bare init &&
|
|
|
|
test_must_fail git --bare fetch "$GIT_DAEMON_URL/repo_bad2.git" &&
|
2016-01-04 10:10:48 +01:00
|
|
|
test 0 = $(ls objects/pack | wc -l)
|
2012-01-07 12:42:45 +01:00
|
|
|
)
|
|
|
|
'
|
|
|
|
|
|
|
|
test_remote_error()
|
|
|
|
{
|
|
|
|
do_export=YesPlease
|
|
|
|
while test $# -gt 0
|
|
|
|
do
|
|
|
|
case $1 in
|
|
|
|
-x)
|
|
|
|
shift
|
|
|
|
chmod -x "$GIT_DAEMON_DOCUMENT_ROOT_PATH/repo.git"
|
|
|
|
;;
|
|
|
|
-n)
|
|
|
|
shift
|
|
|
|
do_export=
|
|
|
|
;;
|
|
|
|
*)
|
|
|
|
break
|
|
|
|
esac
|
|
|
|
done
|
|
|
|
|
2012-04-24 09:50:04 +02:00
|
|
|
msg=$1
|
|
|
|
shift
|
2012-01-07 12:42:45 +01:00
|
|
|
cmd=$1
|
2012-04-24 09:50:04 +02:00
|
|
|
shift
|
|
|
|
repo=$1
|
|
|
|
shift || error "invalid number of arguments"
|
2012-01-07 12:42:45 +01:00
|
|
|
|
|
|
|
if test -x "$GIT_DAEMON_DOCUMENT_ROOT_PATH/$repo"
|
|
|
|
then
|
|
|
|
if test -n "$do_export"
|
|
|
|
then
|
|
|
|
: >"$GIT_DAEMON_DOCUMENT_ROOT_PATH/$repo/git-daemon-export-ok"
|
|
|
|
else
|
|
|
|
rm -f "$GIT_DAEMON_DOCUMENT_ROOT_PATH/$repo/git-daemon-export-ok"
|
|
|
|
fi
|
|
|
|
fi
|
|
|
|
|
2012-04-24 09:50:04 +02:00
|
|
|
test_must_fail git "$cmd" "$GIT_DAEMON_URL/$repo" "$@" 2>output &&
|
2013-10-21 19:54:12 +02:00
|
|
|
test_i18ngrep "fatal: remote error: $msg: /$repo" output &&
|
2012-01-07 12:42:45 +01:00
|
|
|
ret=$?
|
|
|
|
chmod +x "$GIT_DAEMON_DOCUMENT_ROOT_PATH/repo.git"
|
|
|
|
(exit $ret)
|
|
|
|
}
|
|
|
|
|
|
|
|
msg="access denied or repository not exported"
|
2012-04-24 09:50:04 +02:00
|
|
|
test_expect_success 'clone non-existent' "test_remote_error '$msg' clone nowhere.git "
|
|
|
|
test_expect_success 'push disabled' "test_remote_error '$msg' push repo.git master"
|
|
|
|
test_expect_success 'read access denied' "test_remote_error -x '$msg' fetch repo.git "
|
|
|
|
test_expect_success 'not exported' "test_remote_error -n '$msg' fetch repo.git "
|
2012-01-07 12:42:45 +01:00
|
|
|
|
|
|
|
stop_git_daemon
|
|
|
|
start_git_daemon --informative-errors
|
|
|
|
|
2012-04-24 09:50:04 +02:00
|
|
|
test_expect_success 'clone non-existent' "test_remote_error 'no such repository' clone nowhere.git "
|
|
|
|
test_expect_success 'push disabled' "test_remote_error 'service not enabled' push repo.git master"
|
|
|
|
test_expect_success 'read access denied' "test_remote_error -x 'no such repository' fetch repo.git "
|
|
|
|
test_expect_success 'not exported' "test_remote_error -n 'repository not exported' fetch repo.git "
|
2012-01-07 12:42:45 +01:00
|
|
|
|
2015-02-17 09:40:57 +01:00
|
|
|
stop_git_daemon
|
|
|
|
start_git_daemon --interpolated-path="$GIT_DAEMON_DOCUMENT_ROOT_PATH/%H%D"
|
|
|
|
|
|
|
|
test_expect_success 'access repo via interpolated hostname' '
|
|
|
|
repo="$GIT_DAEMON_DOCUMENT_ROOT_PATH/localhost/interp.git" &&
|
|
|
|
git init --bare "$repo" &&
|
|
|
|
git push "$repo" HEAD &&
|
|
|
|
>"$repo"/git-daemon-export-ok &&
|
|
|
|
GIT_OVERRIDE_VIRTUAL_HOST=localhost \
|
2018-01-25 01:55:05 +01:00
|
|
|
git ls-remote "$GIT_DAEMON_URL/interp.git" &&
|
2015-02-17 09:40:57 +01:00
|
|
|
GIT_OVERRIDE_VIRTUAL_HOST=LOCALHOST \
|
2018-01-25 01:55:05 +01:00
|
|
|
git ls-remote "$GIT_DAEMON_URL/interp.git"
|
2015-02-17 09:40:57 +01:00
|
|
|
'
|
|
|
|
|
daemon: sanitize incoming virtual hostname
We use the daemon_avoid_alias function to make sure that the
pathname the user gives us is sane. However, after applying
that check, we might then interpolate the path using a
string given by the server admin, but which may contain more
untrusted data from the client. We should be sure to
sanitize this data, as well.
We cannot use daemon_avoid_alias here, as it is more strict
than we need in requiring a leading '/'. At the same time,
we can be much more strict here. We are interpreting a
hostname, which should not contain slashes or excessive runs
of dots, as those things are not allowed in DNS names.
Note that in addition to cleansing the hostname field, we
must check the "canonical hostname" (%CH) as well as the
port (%P), which we take as a raw string. For the canonical
hostname, this comes from an actual DNS lookup on the
accessed IP, which makes it a much less likely vector for
problems. But it does not hurt to sanitize it in the same
way. Unfortunately we cannot test this case easily, as it
would involve a custom hostname lookup.
We do not need to check %IP, as it comes straight from
inet_ntop, so must have a sane form.
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2015-02-17 20:09:24 +01:00
|
|
|
test_expect_success 'hostname cannot break out of directory' '
|
|
|
|
repo="$GIT_DAEMON_DOCUMENT_ROOT_PATH/../escape.git" &&
|
|
|
|
git init --bare "$repo" &&
|
|
|
|
git push "$repo" HEAD &&
|
|
|
|
>"$repo"/git-daemon-export-ok &&
|
|
|
|
test_must_fail \
|
|
|
|
env GIT_OVERRIDE_VIRTUAL_HOST=.. \
|
2018-01-25 01:55:05 +01:00
|
|
|
git ls-remote "$GIT_DAEMON_URL/escape.git"
|
daemon: sanitize incoming virtual hostname
We use the daemon_avoid_alias function to make sure that the
pathname the user gives us is sane. However, after applying
that check, we might then interpolate the path using a
string given by the server admin, but which may contain more
untrusted data from the client. We should be sure to
sanitize this data, as well.
We cannot use daemon_avoid_alias here, as it is more strict
than we need in requiring a leading '/'. At the same time,
we can be much more strict here. We are interpreting a
hostname, which should not contain slashes or excessive runs
of dots, as those things are not allowed in DNS names.
Note that in addition to cleansing the hostname field, we
must check the "canonical hostname" (%CH) as well as the
port (%P), which we take as a raw string. For the canonical
hostname, this comes from an actual DNS lookup on the
accessed IP, which makes it a much less likely vector for
problems. But it does not hurt to sanitize it in the same
way. Unfortunately we cannot test this case easily, as it
would involve a custom hostname lookup.
We do not need to check %IP, as it comes straight from
inet_ntop, so must have a sane form.
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2015-02-17 20:09:24 +01:00
|
|
|
'
|
|
|
|
|
2018-01-25 01:56:20 +01:00
|
|
|
test_expect_success 'daemon log records all attributes' '
|
daemon: fix off-by-one in logging extended attributes
If receive a request like:
git-upload-pack /foo.git\0host=localhost
we mark the offset of the NUL byte as "len", and then log
the bytes after the NUL with a "%.*s" placeholder, using
"pktlen - len" as the length, and "line + len + 1" as the
start of the string.
This is off-by-one, since the start of the string skips past
the separating NUL byte, but the adjusted length includes
it. Fortunately this doesn't actually read past the end of
the buffer, since "%.*s" will stop when it hits a NUL. And
regardless of what is in the buffer, packet_read() will
always add an extra NUL terminator for safety.
As an aside, the git.git client sends an extra NUL after a
"host" field, too, so we'd generally hit that one first, not
the one added by packet_read(). You can see this in the test
output which reports 15 bytes, even though the string has
only 14 bytes of visible data. But the point is that even a
client sending unusual data could not get us to read past
the end of the buffer, so this is purely a cosmetic fix.
Reported-by: Michael Haggerty <mhagger@alum.mit.edu>
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2018-01-25 01:56:07 +01:00
|
|
|
cat >expect <<-\EOF &&
|
2018-01-25 01:56:20 +01:00
|
|
|
Extended attribute "host": localhost
|
|
|
|
Extended attribute "protocol": version=1
|
daemon: fix off-by-one in logging extended attributes
If receive a request like:
git-upload-pack /foo.git\0host=localhost
we mark the offset of the NUL byte as "len", and then log
the bytes after the NUL with a "%.*s" placeholder, using
"pktlen - len" as the length, and "line + len + 1" as the
start of the string.
This is off-by-one, since the start of the string skips past
the separating NUL byte, but the adjusted length includes
it. Fortunately this doesn't actually read past the end of
the buffer, since "%.*s" will stop when it hits a NUL. And
regardless of what is in the buffer, packet_read() will
always add an extra NUL terminator for safety.
As an aside, the git.git client sends an extra NUL after a
"host" field, too, so we'd generally hit that one first, not
the one added by packet_read(). You can see this in the test
output which reports 15 bytes, even though the string has
only 14 bytes of visible data. But the point is that even a
client sending unusual data could not get us to read past
the end of the buffer, so this is purely a cosmetic fix.
Reported-by: Michael Haggerty <mhagger@alum.mit.edu>
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2018-01-25 01:56:07 +01:00
|
|
|
EOF
|
|
|
|
>daemon.log &&
|
|
|
|
GIT_OVERRIDE_VIRTUAL_HOST=localhost \
|
2018-01-25 01:56:20 +01:00
|
|
|
git -c protocol.version=1 \
|
|
|
|
ls-remote "$GIT_DAEMON_URL/interp.git" &&
|
daemon: fix off-by-one in logging extended attributes
If receive a request like:
git-upload-pack /foo.git\0host=localhost
we mark the offset of the NUL byte as "len", and then log
the bytes after the NUL with a "%.*s" placeholder, using
"pktlen - len" as the length, and "line + len + 1" as the
start of the string.
This is off-by-one, since the start of the string skips past
the separating NUL byte, but the adjusted length includes
it. Fortunately this doesn't actually read past the end of
the buffer, since "%.*s" will stop when it hits a NUL. And
regardless of what is in the buffer, packet_read() will
always add an extra NUL terminator for safety.
As an aside, the git.git client sends an extra NUL after a
"host" field, too, so we'd generally hit that one first, not
the one added by packet_read(). You can see this in the test
output which reports 15 bytes, even though the string has
only 14 bytes of visible data. But the point is that even a
client sending unusual data could not get us to read past
the end of the buffer, so this is purely a cosmetic fix.
Reported-by: Michael Haggerty <mhagger@alum.mit.edu>
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2018-01-25 01:56:07 +01:00
|
|
|
grep -i extended.attribute daemon.log | cut -d" " -f2- >actual &&
|
|
|
|
test_cmp expect actual
|
|
|
|
'
|
|
|
|
|
daemon: fix length computation in newline stripping
When git-daemon gets a pktline request, we strip off any
trailing newline, replacing it with a NUL. Clients prior to
5ad312bede (in git v1.4.0) would send:
git-upload-pack repo.git\n
and we need to strip it off to understand their request.
After 5ad312bede, we send the host attribute but no newline,
like:
git-upload-pack repo.git\0host=example.com\0
Both of these are parsed correctly by git-daemon. But if
some client were to combine the two:
git-upload-pack repo.git\n\0host=example.com\0
we don't parse it correctly. The problem is that we use the
"len" variable to record the position of the NUL separator,
but then decrement it when we strip the newline. So we start
with:
git-upload-pack repo.git\n\0host=example.com\0
^-- len
and end up with:
git-upload-pack repo.git\0\0host=example.com\0
^-- len
This is arguably correct, since "len" tells us the length of
the initial string, but we don't actually use it for that.
What we do use it for is finding the offset of the extended
attributes; they used to be at len+1, but are now at len+2.
We can solve that by just leaving "len" where it is. We
don't have to care about the length of the shortened string,
since we just treat it like a C string.
No version of Git ever produced such a string, but it seems
like the daemon code meant to handle this case (and it seems
like a reasonable thing for somebody to do in a 3rd-party
implementation).
Reported-by: Michael Haggerty <mhagger@alum.mit.edu>
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2018-01-25 01:58:54 +01:00
|
|
|
test_expect_success FAKENC 'hostname interpolation works after LF-stripping' '
|
|
|
|
{
|
|
|
|
printf "git-upload-pack /interp.git\n\0host=localhost" | packetize
|
|
|
|
printf "0000"
|
|
|
|
} >input &&
|
|
|
|
fake_nc "$GIT_DAEMON_HOST_PORT" <input >output &&
|
|
|
|
depacketize <output >output.raw &&
|
|
|
|
|
|
|
|
# just pick out the value of master, which avoids any protocol
|
|
|
|
# particulars
|
|
|
|
perl -lne "print \$1 if m{^(\\S+) refs/heads/master}" <output.raw >actual &&
|
|
|
|
git -C "$repo" rev-parse master >expect &&
|
|
|
|
test_cmp expect actual
|
|
|
|
'
|
|
|
|
|
2012-01-07 12:42:45 +01:00
|
|
|
stop_git_daemon
|
|
|
|
test_done
|