Blame

Date:
Message:
introduce gotd(8), a Git repository server reachable via ssh(1) This is an initial barebones implementation which provides the absolute minimum of functionality required to serve got(1) and git(1) clients. Basic fetch/send functionality has been tested and seems to work here, but this server is not yet expected to be stable. More testing is welcome. See the man pages for setup instructions. The current design uses one reader and one writer process per repository, which will have to be extended to N readers and N writers in the future. At startup, each process will chroot(2) into its assigned repository. This works because gotd(8) can only be started as root, and will then fork+exec, chroot, and privdrop. At present the parent process runs with the following pledge(2) promises: "stdio rpath wpath cpath proc getpw sendfd recvfd fattr flock unix unveil" The parent is the only process able to modify the repository in a way that becomes visible to Git clients. The parent uses unveil(2) to restrict its view of the filesystem to /tmp and the repositories listed in the configuration file gotd.conf(5). Per-repository chroot(2) processes use "stdio rpath sendfd recvfd". The writer defers to the parent for modifying references in the repository to point at newly uploaded commits. The reader is fine without such help, because Git repositories can be read without having to create any lock-files. gotd(8) requires a dedicated user ID, which should own repositories on the filesystem, and a separate secondary group, which should not have filesystem-level repository access, and must be allowed access to the gotd(8) socket. To obtain Git repository access, users must be members of this secondary group, and must have their login shell set to gotsh(1). gotsh(1) connects to the gotd(8) socket and speaks Git-protocol towards the client on the other end of the SSH connection. gotsh(1) is not an interactive command shell. At present, authenticated clients are granted read/write access to all repositories and all references (except for the "refs/got/" and the "refs/remotes/" namespaces, which are already being protected from modification). While complicated access control mechanism are not a design goal, making it possible to safely offer anonymous Git repository access over ssh(1) is on the road map.
Actions:
History | Blob | Raw File
  1 13b2bc37 2022-10-23 stsp /*

  2 13b2bc37 2022-10-23 stsp  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>

  3 13b2bc37 2022-10-23 stsp  *

  4 13b2bc37 2022-10-23 stsp  * Permission to use, copy, modify, and distribute this software for any

  5 13b2bc37 2022-10-23 stsp  * purpose with or without fee is hereby granted, provided that the above

  6 13b2bc37 2022-10-23 stsp  * copyright notice and this permission notice appear in all copies.

  7 13b2bc37 2022-10-23 stsp  *

  8 13b2bc37 2022-10-23 stsp  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

  9 13b2bc37 2022-10-23 stsp  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

 10 13b2bc37 2022-10-23 stsp  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

 11 13b2bc37 2022-10-23 stsp  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

 12 13b2bc37 2022-10-23 stsp  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

 13 13b2bc37 2022-10-23 stsp  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

 14 13b2bc37 2022-10-23 stsp  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

 15 13b2bc37 2022-10-23 stsp  */

 16 13b2bc37 2022-10-23 stsp 

 17 13b2bc37 2022-10-23 stsp #include <sys/queue.h>

 18 13b2bc37 2022-10-23 stsp #include <sys/types.h>

 19 13b2bc37 2022-10-23 stsp #include <sys/uio.h>

 20 13b2bc37 2022-10-23 stsp 

 21 13b2bc37 2022-10-23 stsp #include <errno.h>

 22 13b2bc37 2022-10-23 stsp #include <event.h>

 23 13b2bc37 2022-10-23 stsp #include <imsg.h>

 24 13b2bc37 2022-10-23 stsp #include <limits.h>

 25 13b2bc37 2022-10-23 stsp #include <poll.h>

 26 13b2bc37 2022-10-23 stsp #include <sha1.h>

 27 13b2bc37 2022-10-23 stsp #include <stdio.h>

 28 13b2bc37 2022-10-23 stsp #include <string.h>

 29 13b2bc37 2022-10-23 stsp #include <unistd.h>

 30 13b2bc37 2022-10-23 stsp 

 31 13b2bc37 2022-10-23 stsp #include "got_error.h"

 32 13b2bc37 2022-10-23 stsp 

 33 13b2bc37 2022-10-23 stsp #include "got_lib_poll.h"

 34 13b2bc37 2022-10-23 stsp 

 35 13b2bc37 2022-10-23 stsp #include "gotd.h"

 36 13b2bc37 2022-10-23 stsp 

 37 13b2bc37 2022-10-23 stsp const struct got_error *

 38 13b2bc37 2022-10-23 stsp gotd_imsg_recv_error(uint32_t *client_id, struct imsg *imsg)

 39 13b2bc37 2022-10-23 stsp {

 40 13b2bc37 2022-10-23 stsp 	struct gotd_imsg_error ierr;

 41 13b2bc37 2022-10-23 stsp 	size_t datalen;

 42 13b2bc37 2022-10-23 stsp 

 43 13b2bc37 2022-10-23 stsp 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;

 44 13b2bc37 2022-10-23 stsp 	if (datalen != sizeof(ierr))

 45 13b2bc37 2022-10-23 stsp 		return got_error(GOT_ERR_PRIVSEP_LEN);

 46 13b2bc37 2022-10-23 stsp 	memcpy(&ierr, imsg->data, sizeof(ierr));

 47 13b2bc37 2022-10-23 stsp 

 48 13b2bc37 2022-10-23 stsp 	if (client_id)

 49 13b2bc37 2022-10-23 stsp 		*client_id = ierr.client_id;

 50 13b2bc37 2022-10-23 stsp 

 51 13b2bc37 2022-10-23 stsp 	if (ierr.code == GOT_ERR_ERRNO)

 52 13b2bc37 2022-10-23 stsp 		errno = ierr.errno_code;

 53 13b2bc37 2022-10-23 stsp 

 54 13b2bc37 2022-10-23 stsp 	return got_error_msg(ierr.code, ierr.msg);

 55 13b2bc37 2022-10-23 stsp }

 56 13b2bc37 2022-10-23 stsp 

 57 13b2bc37 2022-10-23 stsp const struct got_error *

 58 13b2bc37 2022-10-23 stsp gotd_imsg_flush(struct imsgbuf *ibuf)

 59 13b2bc37 2022-10-23 stsp {

 60 13b2bc37 2022-10-23 stsp 	const struct got_error *err;

 61 13b2bc37 2022-10-23 stsp 

 62 13b2bc37 2022-10-23 stsp 	err = got_poll_fd(ibuf->fd, POLLOUT, INFTIM);

 63 13b2bc37 2022-10-23 stsp 	if (err)

 64 13b2bc37 2022-10-23 stsp 		return err;

 65 13b2bc37 2022-10-23 stsp 

 66 13b2bc37 2022-10-23 stsp 	if (imsg_flush(ibuf) == -1) {

 67 13b2bc37 2022-10-23 stsp 		imsg_clear(ibuf);

 68 13b2bc37 2022-10-23 stsp 		return got_error_from_errno("imsg_flush");

 69 13b2bc37 2022-10-23 stsp 	}

 70 13b2bc37 2022-10-23 stsp 

 71 13b2bc37 2022-10-23 stsp 	return NULL;

 72 13b2bc37 2022-10-23 stsp }

 73 13b2bc37 2022-10-23 stsp 

 74 13b2bc37 2022-10-23 stsp const struct got_error *

 75 13b2bc37 2022-10-23 stsp gotd_imsg_recv(struct imsg *imsg, struct imsgbuf *ibuf, size_t min_datalen)

 76 13b2bc37 2022-10-23 stsp {

 77 13b2bc37 2022-10-23 stsp 	ssize_t n;

 78 13b2bc37 2022-10-23 stsp 

 79 13b2bc37 2022-10-23 stsp 	n = imsg_get(ibuf, imsg);

 80 13b2bc37 2022-10-23 stsp 	if (n == -1)

 81 13b2bc37 2022-10-23 stsp 		return got_error_from_errno("imsg_get");

 82 13b2bc37 2022-10-23 stsp 

 83 13b2bc37 2022-10-23 stsp 	if (n == 0) {

 84 13b2bc37 2022-10-23 stsp 		n = imsg_read(ibuf);

 85 13b2bc37 2022-10-23 stsp 		if (n == -1) {

 86 13b2bc37 2022-10-23 stsp 			if (errno == EAGAIN)

 87 13b2bc37 2022-10-23 stsp 				return got_error(GOT_ERR_PRIVSEP_READ);

 88 13b2bc37 2022-10-23 stsp 			return got_error_from_errno("imsg_read");

 89 13b2bc37 2022-10-23 stsp 		}

 90 13b2bc37 2022-10-23 stsp 		if (n == 0)

 91 13b2bc37 2022-10-23 stsp 			return got_error(GOT_ERR_EOF);

 92 13b2bc37 2022-10-23 stsp 		n = imsg_get(ibuf, imsg);

 93 13b2bc37 2022-10-23 stsp 		if (n == -1)

 94 13b2bc37 2022-10-23 stsp 			return got_error_from_errno("imsg_get");

 95 13b2bc37 2022-10-23 stsp 	}

 96 13b2bc37 2022-10-23 stsp 

 97 13b2bc37 2022-10-23 stsp 	if (imsg->hdr.len < IMSG_HEADER_SIZE + min_datalen)

 98 13b2bc37 2022-10-23 stsp 		return got_error(GOT_ERR_PRIVSEP_LEN);

 99 13b2bc37 2022-10-23 stsp 

100 13b2bc37 2022-10-23 stsp 	return NULL;

101 13b2bc37 2022-10-23 stsp }

102 13b2bc37 2022-10-23 stsp 

103 13b2bc37 2022-10-23 stsp const struct got_error *

104 13b2bc37 2022-10-23 stsp gotd_imsg_poll_recv(struct imsg *imsg, struct imsgbuf *ibuf, size_t min_datalen)

105 13b2bc37 2022-10-23 stsp {

106 13b2bc37 2022-10-23 stsp 	const struct got_error *err = NULL;

107 13b2bc37 2022-10-23 stsp 

108 13b2bc37 2022-10-23 stsp 	for (;;) {

109 13b2bc37 2022-10-23 stsp 		err = gotd_imsg_recv(imsg, ibuf, min_datalen);

110 13b2bc37 2022-10-23 stsp 		if (err == NULL || err->code != GOT_ERR_PRIVSEP_READ)

111 13b2bc37 2022-10-23 stsp 			return err;

112 13b2bc37 2022-10-23 stsp 

113 13b2bc37 2022-10-23 stsp 		err = got_poll_fd(ibuf->fd, POLLIN, INFTIM);

114 13b2bc37 2022-10-23 stsp 		if (err)

115 13b2bc37 2022-10-23 stsp 			break;

116 13b2bc37 2022-10-23 stsp 	}

117 13b2bc37 2022-10-23 stsp 

118 13b2bc37 2022-10-23 stsp 	return err;

119 13b2bc37 2022-10-23 stsp }

120 13b2bc37 2022-10-23 stsp 

121 13b2bc37 2022-10-23 stsp int

122 13b2bc37 2022-10-23 stsp gotd_imsg_send_error(struct imsgbuf *ibuf, uint32_t peerid,

123 13b2bc37 2022-10-23 stsp     uint32_t client_id, const struct got_error *err)

124 13b2bc37 2022-10-23 stsp {

125 13b2bc37 2022-10-23 stsp 	const struct got_error *flush_err;

126 13b2bc37 2022-10-23 stsp 	struct gotd_imsg_error ierr;

127 13b2bc37 2022-10-23 stsp 	int ret;

128 13b2bc37 2022-10-23 stsp 

129 13b2bc37 2022-10-23 stsp 	ierr.code = err->code;

130 13b2bc37 2022-10-23 stsp 	if (err->code == GOT_ERR_ERRNO)

131 13b2bc37 2022-10-23 stsp 		ierr.errno_code = errno;

132 13b2bc37 2022-10-23 stsp 	else

133 13b2bc37 2022-10-23 stsp 		ierr.errno_code = 0;

134 13b2bc37 2022-10-23 stsp 	ierr.client_id = client_id;

135 13b2bc37 2022-10-23 stsp 	strlcpy(ierr.msg, err->msg, sizeof(ierr.msg));

136 13b2bc37 2022-10-23 stsp 

137 13b2bc37 2022-10-23 stsp 	ret = imsg_compose(ibuf, GOTD_IMSG_ERROR, peerid, getpid(), -1,

138 13b2bc37 2022-10-23 stsp 	    &ierr, sizeof(ierr));

139 13b2bc37 2022-10-23 stsp 	if (ret == -1)

140 13b2bc37 2022-10-23 stsp 		return -1;

141 13b2bc37 2022-10-23 stsp 

142 13b2bc37 2022-10-23 stsp 	flush_err = gotd_imsg_flush(ibuf);

143 13b2bc37 2022-10-23 stsp 	if (flush_err)

144 13b2bc37 2022-10-23 stsp 		return -1;

145 13b2bc37 2022-10-23 stsp 

146 13b2bc37 2022-10-23 stsp 	return 0;

147 13b2bc37 2022-10-23 stsp }

148 13b2bc37 2022-10-23 stsp 

149 13b2bc37 2022-10-23 stsp int

150 13b2bc37 2022-10-23 stsp gotd_imsg_send_error_event(struct gotd_imsgev *iev, uint32_t peerid,

151 13b2bc37 2022-10-23 stsp     uint32_t client_id, const struct got_error *err)

152 13b2bc37 2022-10-23 stsp {

153 13b2bc37 2022-10-23 stsp 	struct gotd_imsg_error ierr;

154 13b2bc37 2022-10-23 stsp 	int ret;

155 13b2bc37 2022-10-23 stsp 

156 13b2bc37 2022-10-23 stsp 	ierr.code = err->code;

157 13b2bc37 2022-10-23 stsp 	if (err->code == GOT_ERR_ERRNO)

158 13b2bc37 2022-10-23 stsp 		ierr.errno_code = errno;

159 13b2bc37 2022-10-23 stsp 	else

160 13b2bc37 2022-10-23 stsp 		ierr.errno_code = 0;

161 13b2bc37 2022-10-23 stsp 	ierr.client_id = client_id;

162 13b2bc37 2022-10-23 stsp 	strlcpy(ierr.msg, err->msg, sizeof(ierr.msg));

163 13b2bc37 2022-10-23 stsp 

164 13b2bc37 2022-10-23 stsp 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_ERROR, peerid, -1,

165 13b2bc37 2022-10-23 stsp 	    &ierr, sizeof(ierr));

166 13b2bc37 2022-10-23 stsp 	if (ret == -1)

167 13b2bc37 2022-10-23 stsp 		return -1;

168 13b2bc37 2022-10-23 stsp 

169 13b2bc37 2022-10-23 stsp 	return 0;

170 13b2bc37 2022-10-23 stsp }

171 13b2bc37 2022-10-23 stsp 

172 13b2bc37 2022-10-23 stsp void

173 13b2bc37 2022-10-23 stsp gotd_imsg_event_add(struct gotd_imsgev *iev)

174 13b2bc37 2022-10-23 stsp {

175 13b2bc37 2022-10-23 stsp 	iev->events = EV_READ;

176 13b2bc37 2022-10-23 stsp 	if (iev->ibuf.w.queued)

177 13b2bc37 2022-10-23 stsp 		iev->events |= EV_WRITE;

178 13b2bc37 2022-10-23 stsp 

179 13b2bc37 2022-10-23 stsp 	event_del(&iev->ev);

180 13b2bc37 2022-10-23 stsp 	event_set(&iev->ev, iev->ibuf.fd, iev->events, iev->handler, iev);

181 13b2bc37 2022-10-23 stsp 	event_add(&iev->ev, NULL);

182 13b2bc37 2022-10-23 stsp }

183 13b2bc37 2022-10-23 stsp 

184 13b2bc37 2022-10-23 stsp int

185 13b2bc37 2022-10-23 stsp gotd_imsg_compose_event(struct gotd_imsgev *iev, uint16_t type, uint32_t peerid,

186 13b2bc37 2022-10-23 stsp     int fd, void *data, uint16_t datalen)

187 13b2bc37 2022-10-23 stsp {

188 13b2bc37 2022-10-23 stsp 	int ret;

189 13b2bc37 2022-10-23 stsp 

190 13b2bc37 2022-10-23 stsp 	ret = imsg_compose(&iev->ibuf, type, peerid, getpid(), fd,

191 13b2bc37 2022-10-23 stsp 	    data, datalen);

192 13b2bc37 2022-10-23 stsp 	if (ret != -1)

193 13b2bc37 2022-10-23 stsp 		gotd_imsg_event_add(iev);

194 13b2bc37 2022-10-23 stsp 

195 13b2bc37 2022-10-23 stsp 	return ret;

196 13b2bc37 2022-10-23 stsp }

197 13b2bc37 2022-10-23 stsp 

198 13b2bc37 2022-10-23 stsp int

199 13b2bc37 2022-10-23 stsp gotd_imsg_forward(struct gotd_imsgev *iev, struct imsg *imsg, int fd)

200 13b2bc37 2022-10-23 stsp {

201 13b2bc37 2022-10-23 stsp 	return gotd_imsg_compose_event(iev, imsg->hdr.type, imsg->hdr.peerid,

202 13b2bc37 2022-10-23 stsp 	    fd, imsg->data, imsg->hdr.len - IMSG_HEADER_SIZE);

203 13b2bc37 2022-10-23 stsp }