It turns out that not only did git-daemon do DWIM, but git-upload-pack
does as well. This is bad; security checks have to be performed *after*
canonicalization, not before.
Additionally, the current git-daemon can be trivially DoSed by spewing
SYNs at the target port.
This patch adds a --strict option to git-upload-pack to disable all
DWIM, a --timeout option to git-daemon and git-upload-pack, and an
--init-timeout option to git-daemon (which is typically set to a much
lower value, since the initial request should come immediately from the
client.)
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Junio C Hamano <junkio@cox.net>
This patch adds some extra paranoia to the git-daemon filename test. In
particular, it now rejects pathnames containing //; it also adds a
redundant test for pathname absoluteness (belts and suspenders.)
A single / at the end of the path is still permitted, however, and the
.git and /.git append DWIM stuff is now handled in an integrated manner,
which means the resulting path will always be subjected to pathname checks.
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Junio C Hamano <junkio@cox.net>
This makes it possible to have a "sparse" git object subdirectory
structure, something that has become much more attractive now that people
use pack-files all the time.
As a result of pack-files, a git object directory doesn't necessarily have
any individual objects lying around, and in that case it's just wasting
space to keep the empty first-level object directories around: on many
filesystems the 256 empty directories will be aboue 1MB of diskspace.
Even more importantly, after you re-pack a project that _used_ to be
unpacked, you could be left with huge directories that no longer contain
anything, but that waste space and take time to look through.
With this change, "git prune-packed" can just do an rmdir() on the
directories, and they'll get removed if empty, and re-created on demand.
This patch also tries to fix up "write_sha1_from_fd()" to use the new
common infrastructure for creating the object files, closing a hole where
we might otherwise leave half-written objects in the object database.
[jc: I unoptimized the part that really removes the fan-out directories
to ease transition. init-db still wastes 1MB of diskspace to hold 256
empty fan-outs, and prune-packed rmdir()'s the grown but empty directories,
but runs mkdir() immediately after that -- reducing the saving from 150KB
to 146KB. These parts will be re-introduced when everybody has the
on-demand capability.]
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Junio C Hamano <junkio@cox.net>
Make logerror() and loginfo() static
logerror() and loginfo() in daemon.c are never declared and never called
from other files, therefore they should be declared static. Found by
sparse.
Signed-off-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: Junio C Hamano <junkio@cox.net>
The syslog code logs with severity LOG_INFO in the loginfo() function, so make
things less confusing.
Signed-off-by: Petr Baudis <pasky@suse.cz>
Signed-off-by: Junio C Hamano <junkio@cox.net>
Well, this makes it even more clear that we need the packet reader and
friends to use the daemon logging code. :/ Therefore, we at least indicate
in the "Disconnect" log message if the child process exitted with an error
code or not.
Idea by Linus.
Signed-off-by: Petr Baudis <pasky@suse.cz>
Signed-off-by: Junio C Hamano <junkio@cox.net>
This patch makes git-daemon --verbose log some useful things on stderr -
in particular connects, disconnects and upload requests, and in such a
way to be able to trace a particular session. Some more errors are now
also logged (even when --verbose is not passed). It is still not perfect
since messages produced by the non-daemon-specific code are obviously
not formatted properly.
[jc: With minor fix up in the log line truncation, and
use of write(2) as suggested by Linus.]
Signed-off-by: Petr Baudis <pasky@suse.cz>
Signed-off-by: Junio C Hamano <junkio@cox.net>
This should work around the compilation problem Johannes Schindelin
and others had on Mac OS/X.
Quoting Linus:
Any operating system where socklen_t is anything else than "int" is
terminally broken. The people who introduced that typedef were confused,
and I actually had to argue with them that it was fundamentally wrong:
there is no other valid type than "int" that makes sense for it.
Signed-off-by: Junio C Hamano <junkio@cox.net>
git-daemon using inetd. does not work properly. inetd routes stderr onto the
network line just like stdout, which was apparently not expected to be so.
As the result of this, the stream is closed by the receiver, because some
"Packing %d objects\n" originating from pack_objects is first reported over
the line instead of the expected pack_header, and so the SIGNATURE test
fails. Here is a workaround.
Signed-off-by: Junio C Hamano <junkio@cox.net>
Every time after servicing the connection, select() first fails
with EINTR and ends up waiting for one second before serving the
next client. The sleep() was placed by the original author per
suggestion from the list to avoid spinning on failing select,
but at least this EINTR situation should not result in "at most
one client per second" service limit.
I am not sure if this is the right fix, but WTH. The king
penguin says that serious people would run the daemon under
inetd anyway, and I agree with that.
Signed-off-by: Junio C Hamano <junkio@cox.net>
A few sparse warnings have crept in again since I checked last time:
undeclared variables with global scope.
Fix them by marking the private variables properly "static".
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Junio C Hamano <junkio@cox.net>
Shut down connections that haven't even identified themselves as git
clients first. That should get rid of people who just connect to the
port and wait for something to happen.
This is using a lockless approach that allows us to handle children
dying without having to block SIGCHLD.
Right now our "solution" to too many kids is pretty damn rough, but it
at least shows what you can do.
Alexey Nezhdanov sent a patch that made git-daemon usable from inetd (ie
where inetd has already done the accept on the new connection, the fork,
and the setup of stdin/stdout). I wanted to organize the thing slightly
differently, though.
