http.go 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423
  1. // Copyright 2017 The Gogs Authors. All rights reserved.
  2. // Use of this source code is governed by a MIT-style
  3. // license that can be found in the LICENSE file.
  4. package repo
  5. import (
  6. "bytes"
  7. "compress/gzip"
  8. "fmt"
  9. "net/http"
  10. "os"
  11. "os/exec"
  12. "path"
  13. "regexp"
  14. "strconv"
  15. "strings"
  16. "time"
  17. "github.com/Unknwon/com"
  18. log "gopkg.in/clog.v1"
  19. "gopkg.in/macaron.v1"
  20. "github.com/gogits/gogs/models"
  21. "github.com/gogits/gogs/modules/base"
  22. "github.com/gogits/gogs/modules/context"
  23. "github.com/gogits/gogs/modules/setting"
  24. )
  25. const (
  26. ENV_AUTH_USER_ID = "GOGS_AUTH_USER_ID"
  27. ENV_AUTH_USER_NAME = "GOGS_AUTH_USER_NAME"
  28. ENV_REPO_OWNER_NAME = "GOGS_REPO_OWNER_NAME"
  29. ENV_REPO_OWNER_SALT_MD5 = "GOGS_REPO_OWNER_SALT_MD5"
  30. ENV_REPO_ID = "GOGS_REPO_ID"
  31. ENV_REPO_NAME = "GOGS_REPO_NAME"
  32. ENV_REPO_CUSTOM_HOOKS_PATH = "GOGS_REPO_CUSTOM_HOOKS_PATH"
  33. )
  34. type HTTPContext struct {
  35. *context.Context
  36. OwnerName string
  37. OwnerSalt string
  38. RepoID int64
  39. RepoName string
  40. AuthUser *models.User
  41. }
  42. func HTTPContexter() macaron.Handler {
  43. return func(ctx *context.Context) {
  44. ownerName := ctx.Params(":username")
  45. repoName := strings.TrimSuffix(ctx.Params(":reponame"), ".git")
  46. repoName = strings.TrimSuffix(repoName, ".wiki")
  47. isPull := ctx.Query("service") == "git-upload-pack" ||
  48. strings.HasSuffix(ctx.Req.URL.Path, "git-upload-pack") ||
  49. ctx.Req.Method == "GET"
  50. owner, err := models.GetUserByName(ownerName)
  51. if err != nil {
  52. ctx.NotFoundOrServerError("GetUserByName", models.IsErrUserNotExist, err)
  53. return
  54. }
  55. repo, err := models.GetRepositoryByName(owner.ID, repoName)
  56. if err != nil {
  57. ctx.NotFoundOrServerError("GetRepositoryByName", models.IsErrRepoNotExist, err)
  58. return
  59. }
  60. // Authentication is not required for pulling from public repositories.
  61. if isPull && !repo.IsPrivate && !setting.Service.RequireSignInView {
  62. ctx.Map(&HTTPContext{
  63. Context: ctx,
  64. })
  65. return
  66. }
  67. // Handle HTTP Basic Authentication
  68. authHead := ctx.Req.Header.Get("Authorization")
  69. if len(authHead) == 0 {
  70. ctx.Resp.Header().Set("WWW-Authenticate", "Basic realm=\".\"")
  71. ctx.Error(http.StatusUnauthorized)
  72. return
  73. }
  74. auths := strings.Fields(authHead)
  75. if len(auths) != 2 || auths[0] != "Basic" {
  76. ctx.Error(http.StatusUnauthorized)
  77. return
  78. }
  79. authUsername, authPassword, err := base.BasicAuthDecode(auths[1])
  80. if err != nil {
  81. ctx.Error(http.StatusUnauthorized)
  82. return
  83. }
  84. authUser, err := models.UserSignIn(authUsername, authPassword)
  85. if err != nil && !models.IsErrUserNotExist(err) {
  86. ctx.Handle(http.StatusInternalServerError, "UserSignIn", err)
  87. return
  88. }
  89. // If username and password combination failed, try again using username as a token.
  90. if authUser == nil {
  91. token, err := models.GetAccessTokenBySHA(authUsername)
  92. if err != nil {
  93. if models.IsErrAccessTokenEmpty(err) || models.IsErrAccessTokenNotExist(err) {
  94. ctx.Error(http.StatusUnauthorized)
  95. } else {
  96. ctx.Handle(http.StatusInternalServerError, "GetAccessTokenBySHA", err)
  97. }
  98. return
  99. }
  100. token.Updated = time.Now()
  101. authUser, err = models.GetUserByID(token.UID)
  102. if err != nil {
  103. // Once we found token, we're supposed to find its related user,
  104. // thus any error is unexpected.
  105. ctx.Handle(http.StatusInternalServerError, "GetUserByID", err)
  106. return
  107. }
  108. }
  109. mode := models.ACCESS_MODE_WRITE
  110. if isPull {
  111. mode = models.ACCESS_MODE_READ
  112. }
  113. has, err := models.HasAccess(authUser, repo, mode)
  114. if err != nil {
  115. ctx.Handle(http.StatusInternalServerError, "HasAccess", err)
  116. return
  117. } else if !has {
  118. ctx.HandleText(http.StatusForbidden, "User permission denied")
  119. return
  120. }
  121. if !isPull && repo.IsMirror {
  122. ctx.HandleText(http.StatusForbidden, "Mirror repository is read-only")
  123. return
  124. }
  125. ctx.Map(&HTTPContext{
  126. Context: ctx,
  127. OwnerName: ownerName,
  128. OwnerSalt: owner.Salt,
  129. RepoID: repo.ID,
  130. RepoName: repoName,
  131. AuthUser: authUser,
  132. })
  133. }
  134. }
  135. type serviceHandler struct {
  136. w http.ResponseWriter
  137. r *http.Request
  138. dir string
  139. file string
  140. authUser *models.User
  141. ownerName string
  142. ownerSalt string
  143. repoID int64
  144. repoName string
  145. }
  146. func (h *serviceHandler) setHeaderNoCache() {
  147. h.w.Header().Set("Expires", "Fri, 01 Jan 1980 00:00:00 GMT")
  148. h.w.Header().Set("Pragma", "no-cache")
  149. h.w.Header().Set("Cache-Control", "no-cache, max-age=0, must-revalidate")
  150. }
  151. func (h *serviceHandler) setHeaderCacheForever() {
  152. now := time.Now().Unix()
  153. expires := now + 31536000
  154. h.w.Header().Set("Date", fmt.Sprintf("%d", now))
  155. h.w.Header().Set("Expires", fmt.Sprintf("%d", expires))
  156. h.w.Header().Set("Cache-Control", "public, max-age=31536000")
  157. }
  158. func (h *serviceHandler) sendFile(contentType string) {
  159. reqFile := path.Join(h.dir, h.file)
  160. fi, err := os.Stat(reqFile)
  161. if os.IsNotExist(err) {
  162. h.w.WriteHeader(http.StatusNotFound)
  163. return
  164. }
  165. h.w.Header().Set("Content-Type", contentType)
  166. h.w.Header().Set("Content-Length", fmt.Sprintf("%d", fi.Size()))
  167. h.w.Header().Set("Last-Modified", fi.ModTime().Format(http.TimeFormat))
  168. http.ServeFile(h.w, h.r, reqFile)
  169. }
  170. type ComposeHookEnvsOptions struct {
  171. AuthUser *models.User
  172. OwnerName string
  173. OwnerSalt string
  174. RepoID int64
  175. RepoName string
  176. RepoPath string
  177. }
  178. func ComposeHookEnvs(opts ComposeHookEnvsOptions) []string {
  179. envs := []string{
  180. "SSH_ORIGINAL_COMMAND=1",
  181. ENV_AUTH_USER_ID + "=" + com.ToStr(opts.AuthUser.ID),
  182. ENV_AUTH_USER_NAME + "=" + opts.AuthUser.Name,
  183. ENV_REPO_OWNER_NAME + "=" + opts.OwnerName,
  184. ENV_REPO_OWNER_SALT_MD5 + "=" + base.EncodeMD5(opts.OwnerSalt),
  185. ENV_REPO_ID + "=" + com.ToStr(opts.RepoID),
  186. ENV_REPO_NAME + "=" + opts.RepoName,
  187. ENV_REPO_CUSTOM_HOOKS_PATH + "=" + path.Join(opts.RepoPath, "custom_hooks"),
  188. }
  189. return envs
  190. }
  191. func serviceRPC(h serviceHandler, service string) {
  192. defer h.r.Body.Close()
  193. if h.r.Header.Get("Content-Type") != fmt.Sprintf("application/x-git-%s-request", service) {
  194. h.w.WriteHeader(http.StatusUnauthorized)
  195. return
  196. }
  197. h.w.Header().Set("Content-Type", fmt.Sprintf("application/x-git-%s-result", service))
  198. var (
  199. reqBody = h.r.Body
  200. err error
  201. )
  202. // Handle GZIP.
  203. if h.r.Header.Get("Content-Encoding") == "gzip" {
  204. reqBody, err = gzip.NewReader(reqBody)
  205. if err != nil {
  206. log.Error(2, "HTTP.Get: fail to create gzip reader: %v", err)
  207. h.w.WriteHeader(http.StatusInternalServerError)
  208. return
  209. }
  210. }
  211. var stderr bytes.Buffer
  212. cmd := exec.Command("git", service, "--stateless-rpc", h.dir)
  213. if service == "receive-pack" {
  214. cmd.Env = append(os.Environ(), ComposeHookEnvs(ComposeHookEnvsOptions{
  215. AuthUser: h.authUser,
  216. OwnerName: h.ownerName,
  217. OwnerSalt: h.ownerSalt,
  218. RepoID: h.repoID,
  219. RepoName: h.repoName,
  220. RepoPath: h.dir,
  221. })...)
  222. }
  223. cmd.Dir = h.dir
  224. cmd.Stdout = h.w
  225. cmd.Stderr = &stderr
  226. cmd.Stdin = reqBody
  227. if err = cmd.Run(); err != nil {
  228. log.Error(2, "HTTP.serviceRPC: fail to serve RPC '%s': %v - %s", service, err, stderr)
  229. h.w.WriteHeader(http.StatusInternalServerError)
  230. return
  231. }
  232. }
  233. func serviceUploadPack(h serviceHandler) {
  234. serviceRPC(h, "upload-pack")
  235. }
  236. func serviceReceivePack(h serviceHandler) {
  237. serviceRPC(h, "receive-pack")
  238. }
  239. func getServiceType(r *http.Request) string {
  240. serviceType := r.FormValue("service")
  241. if !strings.HasPrefix(serviceType, "git-") {
  242. return ""
  243. }
  244. return strings.TrimPrefix(serviceType, "git-")
  245. }
  246. // FIXME: use process module
  247. func gitCommand(dir string, args ...string) []byte {
  248. cmd := exec.Command("git", args...)
  249. cmd.Dir = dir
  250. out, err := cmd.Output()
  251. if err != nil {
  252. log.Error(2, fmt.Sprintf("Git: %v - %s", err, out))
  253. }
  254. return out
  255. }
  256. func updateServerInfo(dir string) []byte {
  257. return gitCommand(dir, "update-server-info")
  258. }
  259. func packetWrite(str string) []byte {
  260. s := strconv.FormatInt(int64(len(str)+4), 16)
  261. if len(s)%4 != 0 {
  262. s = strings.Repeat("0", 4-len(s)%4) + s
  263. }
  264. return []byte(s + str)
  265. }
  266. func getInfoRefs(h serviceHandler) {
  267. h.setHeaderNoCache()
  268. service := getServiceType(h.r)
  269. if service != "upload-pack" && service != "receive-pack" {
  270. updateServerInfo(h.dir)
  271. h.sendFile("text/plain; charset=utf-8")
  272. return
  273. }
  274. refs := gitCommand(h.dir, service, "--stateless-rpc", "--advertise-refs", ".")
  275. h.w.Header().Set("Content-Type", fmt.Sprintf("application/x-git-%s-advertisement", service))
  276. h.w.WriteHeader(http.StatusOK)
  277. h.w.Write(packetWrite("# service=git-" + service + "\n"))
  278. h.w.Write([]byte("0000"))
  279. h.w.Write(refs)
  280. }
  281. func getTextFile(h serviceHandler) {
  282. h.setHeaderNoCache()
  283. h.sendFile("text/plain")
  284. }
  285. func getInfoPacks(h serviceHandler) {
  286. h.setHeaderCacheForever()
  287. h.sendFile("text/plain; charset=utf-8")
  288. }
  289. func getLooseObject(h serviceHandler) {
  290. h.setHeaderCacheForever()
  291. h.sendFile("application/x-git-loose-object")
  292. }
  293. func getPackFile(h serviceHandler) {
  294. h.setHeaderCacheForever()
  295. h.sendFile("application/x-git-packed-objects")
  296. }
  297. func getIdxFile(h serviceHandler) {
  298. h.setHeaderCacheForever()
  299. h.sendFile("application/x-git-packed-objects-toc")
  300. }
  301. var routes = []struct {
  302. reg *regexp.Regexp
  303. method string
  304. handler func(serviceHandler)
  305. }{
  306. {regexp.MustCompile("(.*?)/git-upload-pack$"), "POST", serviceUploadPack},
  307. {regexp.MustCompile("(.*?)/git-receive-pack$"), "POST", serviceReceivePack},
  308. {regexp.MustCompile("(.*?)/info/refs$"), "GET", getInfoRefs},
  309. {regexp.MustCompile("(.*?)/HEAD$"), "GET", getTextFile},
  310. {regexp.MustCompile("(.*?)/objects/info/alternates$"), "GET", getTextFile},
  311. {regexp.MustCompile("(.*?)/objects/info/http-alternates$"), "GET", getTextFile},
  312. {regexp.MustCompile("(.*?)/objects/info/packs$"), "GET", getInfoPacks},
  313. {regexp.MustCompile("(.*?)/objects/info/[^/]*$"), "GET", getTextFile},
  314. {regexp.MustCompile("(.*?)/objects/[0-9a-f]{2}/[0-9a-f]{38}$"), "GET", getLooseObject},
  315. {regexp.MustCompile("(.*?)/objects/pack/pack-[0-9a-f]{40}\\.pack$"), "GET", getPackFile},
  316. {regexp.MustCompile("(.*?)/objects/pack/pack-[0-9a-f]{40}\\.idx$"), "GET", getIdxFile},
  317. }
  318. func getGitRepoPath(dir string) (string, error) {
  319. if !strings.HasSuffix(dir, ".git") {
  320. dir += ".git"
  321. }
  322. filename := path.Join(setting.RepoRootPath, dir)
  323. if _, err := os.Stat(filename); os.IsNotExist(err) {
  324. return "", err
  325. }
  326. return filename, nil
  327. }
  328. func HTTP(ctx *HTTPContext) {
  329. for _, route := range routes {
  330. reqPath := strings.ToLower(ctx.Req.URL.Path)
  331. m := route.reg.FindStringSubmatch(reqPath)
  332. if m == nil {
  333. continue
  334. }
  335. // We perform check here because routes matched in cmd/web.go is wider than needed,
  336. // but we only want to output this message only if user is really trying to access
  337. // Git HTTP endpoints.
  338. if setting.Repository.DisableHTTPGit {
  339. ctx.HandleText(http.StatusForbidden, "Interacting with repositories by HTTP protocol is not disabled")
  340. return
  341. }
  342. if route.method != ctx.Req.Method {
  343. ctx.NotFound()
  344. return
  345. }
  346. file := strings.TrimPrefix(reqPath, m[1]+"/")
  347. dir, err := getGitRepoPath(m[1])
  348. if err != nil {
  349. log.Warn("HTTP.getGitRepoPath: %v", err)
  350. ctx.NotFound()
  351. return
  352. }
  353. route.handler(serviceHandler{
  354. w: ctx.Resp,
  355. r: ctx.Req.Request,
  356. dir: dir,
  357. file: file,
  358. authUser: ctx.AuthUser,
  359. ownerName: ctx.OwnerName,
  360. ownerSalt: ctx.OwnerSalt,
  361. repoID: ctx.RepoID,
  362. repoName: ctx.RepoName,
  363. })
  364. return
  365. }
  366. ctx.NotFound()
  367. }