Commit graph

157 commits

Author SHA1 Message Date
René Scharfe
a47551c382 daemon: deglobalize variable 'directory'
Remove the global variable 'directory' and pass it as a parameter of
the two functions that use it instead, (almost) restoring their
interface to how it was before 49ba83fb67.

Signed-off-by: Rene Scharfe <rene.scharfe@lsrfire.ath.cx>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-23 19:56:36 -08:00
René Scharfe
d433ed0bb4 daemon: inline fill_in_extra_table_entries()
Having fill_in_extra_table_entries() as a separate function has no
advantage -- a function with no parameters and return values might as
well be an anonymous block of code.  Its name still refers to the table
of interpolate() which has been removed earlier, so it's better to
inline it at its only call site.

Signed-off-by: Rene Scharfe <rene.scharfe@lsrfire.ath.cx>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-23 19:56:26 -08:00
René Scharfe
9d7ca66746 daemon: use strbuf_expand() instead of interpolate()
Signed-off-by: Rene Scharfe <rene.scharfe@lsrfire.ath.cx>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-11-23 19:56:06 -08:00
Joey Hess
53ffb878a9 git-daemon: set REMOTE_ADDR to client address
This allows hooks like pre-receive to look at the client's IP
address.

Of course the IP address can't be used to get strong security;
git-daemon isn't the right thing to use if you need that. However,
basic IP address checking can be good enough in some situations.

REMOTE_ADDR is the same environment variable used to communicate the
client's address to CGI scripts.

Signed-off-by: Joey Hess <joey@kitenet.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-10-24 16:34:01 -07:00
Shawn O. Pearce
1ad6d46235 Merge branch 'jc/alternate-push'
* jc/alternate-push:
  push: receiver end advertises refs from alternate repositories
  push: prepare sender to receive extended ref information from the receiver
  receive-pack: make it a builtin
  is_directory(): a generic helper function
2008-09-25 09:39:24 -07:00
Junio C Hamano
90b4a71c49 is_directory(): a generic helper function
A simple "grep -e stat --and -e S_ISDIR" revealed there are many
open-coded implementations of this function.

Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-09-09 09:27:45 -07:00
Junio C Hamano
48196afd28 daemon.c: avoid setlinebuf()
This function is outside POSIX (Linux and recent BSD have it).  Replace it
with setvbuf() which is POSIX.

I am not sure about the value this patch passes as size argument to
setvbuf(), though.  I know the call this patch makes is equivalent to
calling setlinebuf() with GNU libc, but POSIX itself leaves what happens
to the size argument quite vague, saying only "otherwise [i.e. when buf is
a null pointer], size _may_ determine the size of a buffer allocated by
the setvbuf() function."  If passing size=0 causes stdio to allocate very
small buffer, and while stdio tries to line buffer the output, it might
make it to fail to buffer an entire line, causing early flushing of the
stream.

Even if that turns out to be a problem on minorority platforms, we won't
know it until the issue actually hurts them, so let's push this change out
and see what happens.

Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-09-06 20:23:32 -07:00
David Soria Parra
85e7283069 cast pid_t's to uintmax_t to improve portability
Some systems (like e.g. OpenSolaris) define pid_t as long,
therefore all our sprintf that use %i/%d cause a compiler warning
beacuse of the implicit long->int cast. To make sure that
we fit the limits, we display pids as PRIuMAX and cast them explicitly
to uintmax_t.

Signed-off-by: David Soria Parra <dsp@php.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-08-31 16:56:22 -07:00
Junio C Hamano
460c201039 daemon.c: minor style fixup
* "else" on the same line as "}" that closes corresponding "if (...) {";

 * multi-line comments begin with "/*\n";

 * sizeof, even it is not a function, is written as "sizeof(...)";

 * no need to check x?alloc() return value -- it would have died;

 * "if (...) { ... }" that covers the whole function body can be dedented
   by returning from the function early with "if (!...) return;";

 * SP on each side of an operator, i.e. "a > 0", not "a>0";

Also removes stale comment describing how remove_child() used to do its
thing.

Signed-off-by: Junio C Hamano <gitster@pobox.com>:

Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-08-25 22:49:49 -07:00
Stephen R. van den Berg
3bd62c2176 git-daemon: rewrite kindergarden, new option --max-connections
Get rid of the fixed array of children and make max-connections
dynamic and configurable.
Fix the killing code to actually kill the newest connections from
duplicate IP-addresses.
Avoid forking if too busy already.

Signed-off-by: Stephen R. van den Berg <srb@cuci.nl>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-08-17 17:43:53 -07:00
Stephen R. van den Berg
695605b508 git-daemon: Simplify dead-children reaping logic
Move almost all code out of the child_handler() into check_dead_children().
The fact that systemcalls get interrupted by signals allows us to
make the SIGCHLD signal handler almost a no-op by simply running
check_dead_children() right before waiting on poll().

In case some systems do not interrupt systemcalls upon signal receipt,
all zombies will eventually be collected before the next poll() cycle.

Signed-off-by: Stephen R. van den Berg <srb@cuci.nl>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-08-17 17:43:53 -07:00
Stephen R. van den Berg
6a992e9e1d git-daemon: use LOG_PID, simplify logging code
Make git-daemon use LOG_PID like most daemons, instead of prepending the
pid to the message ourselves, when using syslog(3).

Simplify the logging code by setting stderr to line buffered, instead of
building a single string and writing it out with a single write(2).

Give an extra log message at the daemon start-up.

Signed-off-by: Stephen R. van den Berg <srb@cuci.nl>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-08-17 17:43:53 -07:00
Stephen R. van den Berg
df0daf8ac0 git-daemon: call logerror() instead of error()
Use logerror(), not error(), so that the messages won't be lost,
especially when running the daemon with its log sent to the syslog
facility.

Signed-off-by: Stephen R. van den Berg <srb@cuci.nl>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-08-17 17:43:53 -07:00
Stephen R. van den Berg
bd7b371e9c git-daemon: SysV needs the signal handler reinstated.
Fixes the bug on (amongst others) Solaris that only the first
child ever is reaped.

Signed-off-by: Stephen R. van den Berg <srb@cuci.nl>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-08-12 15:41:08 -07:00
Johannes Schindelin
f9bbefc701 git daemon: avoid waking up too often
To avoid waking up unnecessarily, a pipe is set up that is only ever
written to by child_handler(), when a child disconnects, as suggested
per Junio.

This avoids waking up the main process every second to see if a child
was disconnected.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-07-23 16:57:14 -07:00
Stephan Beyer
1b1dd23f2d Make usage strings dash-less
When you misuse a git command, you are shown the usage string.
But this is currently shown in the dashed form.  So if you just
copy what you see, it will not work, when the dashed form
is no longer supported.

This patch makes git commands show the dash-less version.

For shell scripts that do not specify OPTIONS_SPEC, git-sh-setup.sh
generates a dash-less usage string now.

Signed-off-by: Stephan Beyer <s-beyer@gmx.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-07-13 14:12:48 -07:00
Johannes Schindelin
a5a9126bb4 git daemon: avoid calling syslog() from a signal handler
Signal handlers should never call syslog(), as that can raise signals
of its own.

Instead, call the syslog() from the master process.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-07-06 19:10:31 -07:00
Johannes Schindelin
ef90d6d420 Provide git_config with a callback-data parameter
git_config() only had a function parameter, but no callback data
parameter.  This assumes that all callback functions only modify
global variables.

With this patch, every callback gets a void * parameter, and it is hoped
that this will help the libification effort.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-05-14 12:34:44 -07:00
Johannes Sixt
2063207156 daemon: ensure that base-path is an existing directory
Any request to the daemon would fail if base-path (if specified) is not
a directory. We now check for this condition early.

Signed-off-by: Johannes Sixt <johannes.sixt@telecom.at>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-02-27 14:47:36 -08:00
Johannes Sixt
22665bbaab daemon: send more error messages to the syslog
There were a number of die() calls before the syslog was opened; hence,
these error messages would have been sent to /dev/null in detached mode.
Now we install the daemon-specific die routine before any error message is
generated so that these messages go to the syslog.

Signed-off-by: Johannes Sixt <johannes.sixt@telecom.at>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2008-02-27 14:47:36 -08:00
Junio C Hamano
f3fa183802 Style: place opening brace of a function definition at column 1
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2007-11-08 15:35:32 -08:00
Gerrit Pape
c67359be45 git-daemon: fix remote port number in log entry
The port number in struct sockaddr_in needs to be converted from network
byte order to host byte order (on some architectures).

Signed-off-by: Gerrit Pape <pape@smarden.org>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2007-11-05 18:39:18 -08:00
Patrick Welche
415e7b877c Define NI_MAXSERV if not defined by operating system
I found I needed NI_MAXSERV as it is defined in netdb.h, which is
not included by daemon.c.  Rather than including the whole header
we can define a reasonable fallback value.

Signed-off-by: Shawn O. Pearce <spearce@spearce.org>
2007-10-18 21:04:44 -04:00
Jens Axboe
73a7a65663 --base-path-relaxed option
I switched git.kernel.dk to --base-path a few minutes ago, to get rid of
a /data/git postfix in the posted urls. But transitioning is tricky,
since now all old paths will fail miserably.

So I added this --base-path-relaxed option, that will make git-daemon
try the absolute path without prefixing --base-path before giving up.
With this in place and --base-path-relaxed added, both my new url of

    git://git.kernel.dk/linux-2.6-block.git

and the old

    git://git.kernel.dk/data/git/linux-2.6-block.git

work fine.

Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2007-08-01 00:37:23 -07:00
Pierre Habouzit
52fae7de4e Missing statics.
Signed-off-by: Pierre Habouzit <madcoder@debian.org>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2007-06-08 02:37:19 -07:00
Junio C Hamano
a6080a0a44 War on whitespace
This uses "git-apply --whitespace=strip" to fix whitespace errors that have
crept in to our source files over time.  There are a few files that need
to have trailing whitespaces (most notably, test vectors).  The results
still passes the test, and build result in Documentation/ area is unchanged.

Signed-off-by: Junio C Hamano <gitster@pobox.com>
2007-06-07 00:04:01 -07:00
Jim Meyering
bc4e7d0358 git-daemon: don't ignore pid-file write failure
Note: since the consequence of failure is to call die,
I don't bother to close "f".

Signed-off-by: Jim Meyering <jim@meyering.net>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2007-05-21 18:34:14 -07:00
Junio C Hamano
599065a3bb prefixcmp(): fix-up mechanical conversion.
Previous step converted use of strncmp() with literal string
mechanically even when the result is only used as a boolean:

    if (!strncmp("foo", arg, 3)) ==> if (!(-prefixcmp(arg, "foo")))

This step manually cleans them up to read:

    if (!prefixcmp(arg, "foo"))

Signed-off-by: Junio C Hamano <junkio@cox.net>
2007-02-20 22:03:15 -08:00
Junio C Hamano
cc44c7655f Mechanical conversion to use prefixcmp()
This mechanically converts strncmp() to use prefixcmp(), but only when
the parameters match specific patterns, so that they can be verified
easily.  Leftover from this will be fixed in a separate step, including
idiotic conversions like

    if (!strncmp("foo", arg, 3))

  =>

    if (!(-prefixcmp(arg, "foo")))

This was done by using this script in px.perl

   #!/usr/bin/perl -i.bak -p
   if (/strncmp\(([^,]+), "([^\\"]*)", (\d+)\)/ && (length($2) == $3)) {
           s|strncmp\(([^,]+), "([^\\"]*)", (\d+)\)|prefixcmp($1, "$2")|;
   }
   if (/strncmp\("([^\\"]*)", ([^,]+), (\d+)\)/ && (length($1) == $3)) {
           s|strncmp\("([^\\"]*)", ([^,]+), (\d+)\)|(-prefixcmp($2, "$1"))|;
   }

and running:

   $ git grep -l strncmp -- '*.c' | xargs perl px.perl

Signed-off-by: Junio C Hamano <junkio@cox.net>
2007-02-20 22:03:15 -08:00
Alexandre Julliard
20276889d6 git-daemon: Avoid leaking the listening sockets into child processes.
This makes it possible to restart git-daemon even if some children are
still running.

Signed-off-by: Alexandre Julliard <julliard@winehq.org>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2007-02-14 10:25:41 -08:00
Pavel Roskin
3dff5379bf Assorted typo fixes
Signed-off-by: Junio C Hamano <junkio@cox.net>
2007-02-03 21:49:54 -08:00
Linus Torvalds
4b3b1e1e48 git-push through git protocol
This allows pushing over the git:// protocol, and while it's not
authenticated, it could make sense from within a firewalled
setup where nobody but trusted internal people can reach the git
port.  git-daemon is possibly easier and faster to set up in the
kind of situation where you set up git instead of CVS inside a
company.

"git-receive-pack" is disabled by default, so you need to enable it
explicitly by starting git-daemon with the "--enable=receive-pack"
command line argument, or by having your config enable it automatically.

Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2007-01-28 12:31:56 -08:00
Andy Whitcroft
93822c2239 short i/o: fix calls to write to use xwrite or write_in_full
We have a number of badly checked write() calls.  Often we are
expecting write() to write exactly the size we requested or fail,
this fails to handle interrupts or short writes.  Switch to using
the new write_in_full().  Otherwise we at a minimum need to check
for EINTR and EAGAIN, where this is appropriate use xwrite().

Note, the changes to config handling are much larger and handled
in the next patch in the sequence.

Signed-off-by: Andy Whitcroft <apw@shadowen.org>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2007-01-08 15:44:47 -08:00
Junio C Hamano
85023577a8 simplify inclusion of system header files.
This is a mechanical clean-up of the way *.c files include
system header files.

 (1) sources under compat/, platform sha-1 implementations, and
     xdelta code are exempt from the following rules;

 (2) the first #include must be "git-compat-util.h" or one of
     our own header file that includes it first (e.g. config.h,
     builtin.h, pkt-line.h);

 (3) system headers that are included in "git-compat-util.h"
     need not be included in individual C source files.

 (4) "git-compat-util.h" does not have to include subsystem
     specific header files (e.g. expat.h).

Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-12-20 09:51:35 -08:00
Junio C Hamano
83543a24c3 daemon: do not die on older clients.
In the older times, the clients did not say which host they were trying
to connect, and the code we recently added did not quite handle the
older clients correctly.

Noticed by Simon Arlott.

Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-10-23 18:26:05 -07:00
Alex Riesen
100690b6e8 fix daemon.c compilation for NO_IPV6=1
Signed-off-by: Alex Riesen <raa.lkml@gmail.com>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-09-28 18:22:37 -07:00
Johannes Schindelin
695dffe2ef daemon: default to 256 for HOST_NAME_MAX if it is not defined
Signed-off-by: Johannes Schindelin <Johannes.Schindelin@gmx.de>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-09-28 09:14:09 -07:00
Jon Loeliger
eb30aed7c6 Removed memory leaks from interpolation table uses.
Clarified that parse_extra_args()s results in interpolation
table entries.  Removed a few trailing whitespace occurrences.

Signed-off-by: Jon Loeliger <jdl@jdl.com>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-09-27 18:00:53 -07:00
Jon Loeliger
dd4676299d Cleaned up git-daemon virtual hosting support.
Standardized on lowercase hostnames from client.

Added interpolation values for the IP address, port and
canonical hostname of the server as it is contacted and
named by the client and passed in via the extended args.

Added --listen=host_or_ipaddr option suport.  Renamed port
variable as "listen_port" correspondingly as well.

Documented mutual exclusivity of --inetd option with
    --user, --group, --listen and --port options.

Added compat/inet_pton.c from Paul Vixie as needed.

Small memory leaks need to be cleaned up still.

Signed-off-by: Jon Loeliger <jdl@jdl.com>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-09-27 18:00:52 -07:00
Jon Loeliger
49ba83fb67 Add virtualization support to git-daemon
Signed-off-by: Jon Loeliger
Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-09-20 11:15:39 -07:00
Franck Bui-Huu
39345a216f Add git-upload-archive
This command implements the git archive protocol on the server
side. This command is not intended to be used by the end user.
Underlying git-archive command line options are sent over the
protocol from "git-archive --remote=...", just like upload-tar
currently does with "git-tar-tree=...".

As for "git-archive" command implementation, this new command
does not execute any existing "git-{tar,zip}-tree" but rely
on the archive API defined by "git-archive" patch. Hence we
get 2 good points:

 - "git-archive" and "git-upload-archive" share all option
   parsing code.

 - All kind of git-upload-{tar,zip} can be deprecated.

Signed-off-by: Franck Bui-Huu <vagabon.xyz@gmail.com>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-09-09 11:57:37 -07:00
Junio C Hamano
d9edcbd606 Revert "daemon: add upload-tar service."
This reverts parts of commit 74c0cc2 and part of commit 355f541.

Franck and Rene are working on a unified upload-archive which
would supersede this when done, so better not to get in their
way.

Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-09-07 02:36:31 -07:00
Junio C Hamano
74c0cc21a5 daemon: add upload-tar service.
This allows clients to ask for tarballs with:

	git tar-tree --remote=git://server/repo refname

By default, the upload-tar service is not enabled.  To enable
it server-wide, the server can be started with:

	git-daemon --enable=upload-tar

This service is by default overridable per repostiory, so
alternatively, a repository can define "daemon.uploadtar = true"
to enable it.

Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-08-27 23:32:37 -07:00
Junio C Hamano
d819e4e682 daemon: prepare for multiple services.
This adds an infrastructure to selectively enable and disable
more than one services in git-daemon.  Currently upload-pack
service, which serves the git-fetch-pack and git-peek-remote
clients, is the only service that is defined.

Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-08-27 23:32:36 -07:00
Junio C Hamano
d5d0a0e748 Merge branch 'ts/daemon'
* ts/daemon:
  Added support for dropping privileges to git-daemon.
2006-08-27 17:51:42 -07:00
Jonas Fonseca
83572c1a91 Use xrealloc instead of realloc
Change places that use realloc, without a proper error path, to instead use
xrealloc. Drop an erroneous error path in the daemon code that used errno
in the die message in favour of the simpler xrealloc.

Signed-off-by: Jonas Fonseca <fonseca@diku.dk>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-08-26 17:54:06 -07:00
Tilman Sauerbeck
678dac6b45 Added support for dropping privileges to git-daemon.
Signed-off-by: Tilman Sauerbeck <tilman@code-monkey.de>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-08-22 16:40:40 -07:00
David Rientjes
96f1e58f52 remove unnecessary initializations
[jc: I needed to hand merge the changes to the updated codebase,
 so the result needs to be checked.]

Signed-off-by: David Rientjes <rientjes@google.com>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-08-15 21:22:20 -07:00
Matthias Lederhofer
6c35119ac7 daemon: documentation for --reuseaddr, --detach and --pid-file
Signed-off-by: Matthias Lederhofer <matled@gmx.net>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-07-27 13:55:31 -07:00
Matthias Lederhofer
a5262768e1 daemon: new option --detach to run git-daemon in background
Signed-off-by: Matthias Lederhofer <matled@gmx.net>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-07-13 21:50:46 -07:00
Matthias Lederhofer
45ed5d7f4c daemon: new option --pid-file=<path> to store the pid
Signed-off-by: Matthias Lederhofer <matled@gmx.net>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-07-13 21:50:41 -07:00
Matthias Lederhofer
258e93a155 daemon: if one of the standard fds is missing open it to /dev/null
Signed-off-by: Matthias Lederhofer <matled@gmx.net>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-07-13 21:50:20 -07:00
Matthias Lederhofer
ad8b4f56b5 daemon: use a custom die routine with syslog
Removed the git-daemon prefix from die() because no other call to die
does this.

Signed-off-by: Matthias Lederhofer <matled@gmx.net>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-07-13 21:50:14 -07:00
Timo Hirvonen
554fe20d80 Make some strings const
Signed-off-by: Timo Hirvonen <tihirvon@gmail.com>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-06-28 03:24:37 -07:00
Junio C Hamano
78831b40d6 Merge branch 'jc/upload-corrupt' into next
* jc/upload-corrupt:
  daemon: send stderr to /dev/null instead of closing.
2006-06-21 16:38:11 -07:00
Junio C Hamano
ba0012c367 daemon: send stderr to /dev/null instead of closing.
Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-06-21 16:37:48 -07:00
Junio C Hamano
ad9f72a704 Merge branch 'master' into next
* master:
  checkout -f: do not leave untracked working tree files.
  Log peer address when git-daemon called from inetd
2006-06-21 01:24:45 -07:00
David Woodhouse
5b276ee4fb Log peer address when git-daemon called from inetd
When we run git-daemon from inetd, even with the --verbose option, it
doesn't log the peer address. That logic was only in the standalone
daemon code -- move it to the execute() function instead. Tested with
both IPv6 and Legacy IP clients, in both inetd and daemon mode.

Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Acked-by: Jon Loeliger <jdl@jdl.com>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-06-20 22:19:29 -07:00
Junio C Hamano
f0b7367cb1 Restore SIGCHLD to SIG_DFL where we care about waitpid().
It was reported that under one implementation of socks client
"git clone" fails with "error: waitpid failed (No child processes)",
because "git" is spawned after setting SIGCHLD to SIG_IGN.

Arguably it may be a broken setting, but we should protect
ourselves so that we can get reliable results from waitpid() for
the children we care about.

This patch resets SIGCHLD to SIG_DFL in three places:

 - connect.c::git_connect() - initiators of git native
   protocol transfer are covered with this.

 - daemon.c::main() - obviously.

 - merge-index.c::main() - obviously.

There are other programs that do fork() but do not waitpid():
http-push, imap-send.  upload-pack does not either, but in the
case of that program, each of the forked halves runs exec()
another program, so this change would not have much effect
there.

Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-06-19 18:44:58 -07:00
Jon Loeliger
5ad312bede Refactor git_tcp_connect() functions a little.
Add client side sending of "\0host=%s\0" extended
arg for git native protocol, backwards compatibly.

Signed-off-by: Jon Loeliger <jdl@jdl.com>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-06-06 21:44:39 -07:00
Serge E. Hallyn
0032d548db socksetup: don't return on set_reuse_addr() error
The set_reuse_addr() error case was the only error case in
socklist() where we returned rather than continued.  Not sure
why.  Either we must free the socklist, or continue.  This patch
continues on error.

Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-04-18 14:39:28 -07:00
Junio C Hamano
603968d22b daemon: extend user-relative path notation.
Earlier, we made --base-path to automatically forbid
user-relative paths, which was probably a mistake.  This
introduces --user-path (or --user-path=path) option to control
the use of user-relative paths independently.  The latter form
of the option can be used to restrict accesses to a part of each
user's home directory, similar to "public_html" some webservers
supports.

If we're invoked with --user-path=FOO option, then a URL of the
form git://~USER/PATH/... resolves to the path HOME/FOO/PATH/...,
where HOME is USER's home directory.

[jc: This is much reworked by me so bugs are mine, but the
 original patch was done by Mark Wooding.]

Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-02-05 16:51:01 -08:00
Mark Wooding
1955fabf41 daemon: Set SO_REUSEADDR on listening sockets.
Without this, you can silently lose the ability to receive IPv4
connections if you stop and restart the daemon.

[jc: tweaked code organization a bit and made this controllable
 from a command line option.]

Signed-off-by: Mark Wooding <mdw@distorted.org.uk>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-02-05 16:51:01 -08:00
Junio C Hamano
363f24c936 daemon: do not forbid user relative paths unconditionally under --base-path
Using base-path to relocate the server public space does not
have anything to do with allowing or forbidding user relative
paths.

Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-02-05 16:51:01 -08:00
Mark Wooding
1fda3d557b daemon: Provide missing argument for logerror() call.
Could cause a crash if --base-path set.  Unlikely to be a security the
concern: message doesn't go to the client, so we can't leak anything
(except by dumping core), and we've already forked, so it's not a denial
of service.

Signed-off-by: Mark Wooding <mdw@distorted.org.uk>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-02-03 23:33:20 -08:00
Michal Ostrowski
77cb17e940 Exec git programs without using PATH.
The git suite may not be in PATH (and thus programs such as
git-send-pack could not exec git-rev-list).  Thus there is a need for
logic that will locate these programs.  Modifying PATH is not
desirable as it result in behavior differing from the user's
intentions, as we may end up prepending "/usr/bin" to PATH.

- git C programs will use exec*_git_cmd() APIs to exec sub-commands.
- exec*_git_cmd() will execute a git program by searching for it in
  the following directories:
	1. --exec-path (as used by "git")
	2. The GIT_EXEC_PATH environment variable.
	3. $(gitexecdir) as set in Makefile (default value $(bindir)).
- git wrapper will modify PATH as before to enable shell scripts to
  invoke "git-foo" commands.

Ideally, shell scripts should use the git wrapper to become independent
of PATH, and then modifying PATH will not be necessary.

[jc: with minor updates after a brief review.]

Signed-off-by: Michal Ostrowski <mostrows@watson.ibm.com>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-01-13 16:49:01 -08:00
Petr Baudis
b21c31c9a5 git-daemon --base-path
Tommi Virtanen expressed a wish on #git to be able to use short and elegant
git URLs by making git-daemon 'root' in a given directory. This patch
implements this, causing git-daemon to interpret all paths relative to
the given base path if any is given.

Signed-off-by: Petr Baudis <pasky@suse.cz>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2006-01-07 21:43:02 -08:00
Junio C Hamano
d79374c7b5 [PATCH] daemon.c and path.enter_repo(): revamp path validation.
The whitelist of git-daemon is checked against return value from
enter_repo(), and enter_repo() used to return the value obtained
from getcwd() to avoid directory aliasing issues as discussed
earier (mid October 2005).

Unfortunately, it did not go well as we hoped.

For example, /pub on a kernel.org public machine is a symlink to
its real mountpoint, and it is understandable that the
administrator does not want to adjust the whitelist every time
/pub needs to point at a different partition for storage
allcation or whatever reasons.  Being able to keep using
/pub/scm as the whitelist is a desirable property.

So this version of enter_repo() reports what it used to chdir()
and validate, but does not use getcwd() to canonicalize the
directory name.  When it sees a user relative path ~user/path,
it internally resolves it to try chdir() there, but it still
reports ~user/path (possibly after appending .git if allowed to
do so, in which case it would report ~user/path.git).

What this means is that if a whitelist wants to allow a user
relative path, it needs to say "~" (for all users) or list user
home directories like "~alice" "~bob".  And no, you cannot say
/home if the advertised way to access user home directories are
~alice,~bob, etc.  The whole point of this is to avoid
unnecessary aliasing issues.

Anyway, because of this, daemon needs to do a bit more work to
guard itself.  Namely, it needs to make sure that the accessor
does not try to exploit its leading path match rule by inserting
/../ in the middle or hanging /.. at the end.  I resurrected the
belts and suspender paranoia code HPA did for this purpose.

This check cannot be done in the enter_repo() unconditionally,
because there are valid callers of enter_repo() that want to
honor /../; authorized users coming over ssh to run send-pack
and fetch-pack should be allowed to do so.

Signed-off-by: Junio C Hamano <junkio@cox.net>
2005-12-03 23:17:42 -08:00
Paul Serice
f35230fb11 git-daemon not listening when compiled with -DNO_IPV6
git-daemon was not listening when compiled with -DNO_IPV6.
socksetup() was not returning socket count when compiled with -DNO_IPV6.

Signed-off-by: Paul Serice <paul@serice.net>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2005-11-21 14:36:43 -08:00
Junio C Hamano
ce335fe04f daemon: further tweaks.
- Do validation only on canonicalized paths
 - Run upload-pack with "." as repository argument

Signed-off-by: Junio C Hamano <junkio@cox.net>
2005-11-21 13:47:00 -08:00
Andreas Ericsson
4dbd135279 git-daemon support for user-relative paths.
Dropped a fair amount of reundant code in favour of the library code
in path.c

Added option --strict-paths with documentation, with backwards
compatibility for whitelist entries with symlinks.

Everything that worked earlier still works insofar as I have
remembered testing it.

Signed-off-by: Andreas Ericsson <ae@op5.se>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2005-11-21 13:47:00 -08:00
Andreas Ericsson
a8883288fa daemon.c: fix arg parsing bugs
Allow --init-timeout and --timeout to be specified without falling
through to usage().

Make sure openlog() is called even if implied by --inetd, or messages
will be sent to wherever LOG_USER ends up.

Signed-off-by: Andreas Ericsson <ae@op5.se>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2005-11-16 20:34:26 -08:00
Andreas Ericsson
bce8230d5d git-daemon: --inetd implies --syslog
Otherwise nothing is logged anywhere, which is a Bad Thing.

Signed-off-by: Andreas Ericsson <ae@op5.se>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2005-11-15 00:19:32 -08:00
Randal L. Schwartz
979e32fa14 fix daemon.c to compile on OpenBSD
I can confirm that the following patch lets the current origin
compile on OpenBSD.  If you could apply this until you sort out the
rest of the namespace issue, I would be happy.  Thanks.

Signed-off-by: Junio C Hamano <junkio@cox.net>
2005-10-25 17:37:59 -07:00
Junio C Hamano
4ae22d96fe Merge branch 'fixes' 2005-10-20 23:21:50 -07:00
Junio C Hamano
a935c39727 daemon.c: remove trailing whitespace.
Signed-off-by: Junio C Hamano <junkio@cox.net>
2005-10-20 23:19:36 -07:00
H. Peter Anvin
54e31a205c Fix git-daemon argument-parsing bug
Fix stupid bug in parsing the --init-timeout option.

Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2005-10-20 22:46:03 -07:00
Jens Axboe
7872e05567 git-daemon poll() spinning out of control
With the '0' timeout given to poll, it returns instantly without any
events on my system, causing git-daemon to consume all the CPU time. Use
-1 as the timeout so poll() only returns in case of EINTR or actually
events being available.

Signed-off-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2005-10-20 21:26:31 -07:00
H. Peter Anvin
960deccb26 git-daemon: timeout, eliminate double DWIM
It turns out that not only did git-daemon do DWIM, but git-upload-pack
does as well.  This is bad; security checks have to be performed *after*
canonicalization, not before.

Additionally, the current git-daemon can be trivially DoSed by spewing
SYNs at the target port.

This patch adds a --strict option to git-upload-pack to disable all
DWIM, a --timeout option to git-daemon and git-upload-pack, and an
--init-timeout option to git-daemon (which is typically set to a much
lower value, since the initial request should come immediately from the
client.)

Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2005-10-19 14:27:01 -07:00
H. Peter Anvin
3e04c62daa revised^2: git-daemon extra paranoia, and path DWIM
This patch adds some extra paranoia to the git-daemon filename test.  In
particular, it now rejects pathnames containing //; it also adds a
redundant test for pathname absoluteness (belts and suspenders.)

A single / at the end of the path is still permitted, however, and the
.git and /.git append DWIM stuff is now handled in an integrated manner,
which means the resulting path will always be subjected to pathname checks.

Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2005-10-18 18:26:52 -07:00
Linus Torvalds
230f13225d Create object subdirectories on demand
This makes it possible to have a "sparse" git object subdirectory
structure, something that has become much more attractive now that people
use pack-files all the time.

As a result of pack-files, a git object directory doesn't necessarily have
any individual objects lying around, and in that case it's just wasting
space to keep the empty first-level object directories around: on many
filesystems the 256 empty directories will be aboue 1MB of diskspace.

Even more importantly, after you re-pack a project that _used_ to be
unpacked, you could be left with huge directories that no longer contain
anything, but that waste space and take time to look through.

With this change, "git prune-packed" can just do an rmdir() on the
directories, and they'll get removed if empty, and re-created on demand.

This patch also tries to fix up "write_sha1_from_fd()" to use the new
common infrastructure for creating the object files, closing a hole where
we might otherwise leave half-written objects in the object database.

[jc: I unoptimized the part that really removes the fan-out directories
 to ease transition.  init-db still wastes 1MB of diskspace to hold 256
 empty fan-outs, and prune-packed rmdir()'s the grown but empty directories,
 but runs mkdir() immediately after that -- reducing the saving from 150KB
 to 146KB.  These parts will be re-introduced when everybody has the
 on-demand capability.]

Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2005-10-08 15:54:01 -07:00
H. Peter Anvin
9220282a9c Move signal setting into service_loop() 2005-09-30 11:01:57 -07:00
H. Peter Anvin
7626e49e9f socklen_t is unsigned int on most Linux platforms 2005-09-30 10:48:21 -07:00
H. Peter Anvin
1b4713fb9e Use xmalloc/xcalloc 2005-09-30 10:47:50 -07:00
H. Peter Anvin
d6b89e7bf8 Don't need <alloca.h> 2005-09-30 10:46:42 -07:00
H. Peter Anvin
300b4801b7 Merge with master.kernel.org:/pub/scm/git/git.git 2005-09-30 10:44:21 -07:00
Pavel Roskin
cdda474525 [PATCH] Make logerror() and loginfo() static
Make logerror() and loginfo() static

logerror() and loginfo() in daemon.c are never declared and never called
from other files, therefore they should be declared static.  Found by
sparse.

Signed-off-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2005-09-29 22:47:40 -07:00
Peter Anvin
e72456bb67 Remove variables not needed when using poll 2005-09-28 18:01:55 -07:00
Peter Anvin
6573faff34 NO_IPV6 support for git daemon 2005-09-28 17:26:44 -07:00
H. Peter Anvin
47888f0f31 Restore chdir(".git") 2005-09-27 08:49:40 -07:00
H. Peter Anvin
4ae9568269 Support a modicum of path validation, and allow an export all trees option. 2005-09-26 19:10:55 -07:00
Petr Baudis
da38641d7c [PATCH] Rename daemon.c's lognotice() to loginfo()
The syslog code logs with severity LOG_INFO in the loginfo() function, so make
things less confusing.

Signed-off-by: Petr Baudis <pasky@suse.cz>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2005-09-24 11:20:45 -07:00
Petr Baudis
9048fe1c50 [PATCH] git-daemon --syslog to log through syslog
Well, this makes it even more clear that we need the packet reader and
friends to use the daemon logging code. :/  Therefore, we at least indicate
in the "Disconnect" log message if the child process exitted with an error
code or not.

Idea by Linus.

Signed-off-by: Petr Baudis <pasky@suse.cz>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2005-09-24 11:20:45 -07:00
Junio C Hamano
1bedd4ca21 daemon.c: pid_t is not int.
Reported by Morten Welinder <mwelinder@gmail.com>.

Signed-off-by: Junio C Hamano <junkio@cox.net>
2005-09-23 23:26:55 -07:00
Petr Baudis
f8ff0c0641 [PATCH] Verbose git-daemon logging
This patch makes git-daemon --verbose log some useful things on stderr -
in particular connects, disconnects and upload requests, and in such a
way to be able to trace a particular session. Some more errors are now
also logged (even when --verbose is not passed). It is still not perfect
since messages produced by the non-daemon-specific code are obviously
not formatted properly.

[jc: With minor fix up in the log line truncation, and
 use of write(2) as suggested by Linus.]

Signed-off-by: Petr Baudis <pasky@suse.cz>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2005-09-22 18:00:28 -07:00
Junio C Hamano
7fa090844f Use int instead of socklen_t
This should work around the compilation problem Johannes Schindelin
and others had on Mac OS/X.

Quoting Linus:

    Any operating system where socklen_t is anything else than "int" is
    terminally broken. The people who introduced that typedef were confused,
    and I actually had to argue with them that it was fundamentally wrong:
    there is no other valid type than "int" that makes sense for it.

Signed-off-by: Junio C Hamano <junkio@cox.net>
2005-09-11 18:55:20 -07:00
lars.doelle@on-line.de
7c3693f1f2 [PATCH] git-daemon --inetd
git-daemon using inetd. does not work properly. inetd routes stderr onto the
network line just like stdout, which was apparently not expected to be so.

As the result of this, the stream is closed by the receiver, because some
"Packing %d objects\n" originating from pack_objects is first reported over
the line instead of the expected pack_header, and so the SIGNATURE test
fails.  Here is a workaround.

Signed-off-by: Junio C Hamano <junkio@cox.net>
2005-09-07 22:08:30 -07:00
Jason Riedy
3cd6ecda4a Include sys/time.h in daemon.c.
Some systems and feature levels want sys/time.h for fd_set
functionality.

Signed-off-by: Jason Riedy <ejr@cs.berkeley.edu>
2005-08-23 20:41:12 -07:00
Junio C Hamano
1eef0b33c6 daemon.c: squelch error message from EINTR
Every time after servicing the connection, select() first fails
with EINTR and ends up waiting for one second before serving the
next client.  The sleep() was placed by the original author per
suggestion from the list to avoid spinning on failing select,
but at least this EINTR situation should not result in "at most
one client per second" service limit.

I am not sure if this is the right fix, but WTH.  The king
penguin says that serious people would run the daemon under
inetd anyway, and I agree with that.

Signed-off-by: Junio C Hamano <junkio@cox.net>
2005-08-05 01:27:13 -07:00
Linus Torvalds
4d8fa916c9 [PATCH] Fix sparse warnings
A few sparse warnings have crept in again since I checked last time:
undeclared variables with global scope.

Fix them by marking the private variables properly "static".

Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Junio C Hamano <junkio@cox.net>
2005-08-01 13:28:58 -07:00