http.go 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433
  1. // Copyright 2017 The Gogs Authors. All rights reserved.
  2. // Use of this source code is governed by a MIT-style
  3. // license that can be found in the LICENSE file.
  4. package repo
  5. import (
  6. "bytes"
  7. "compress/gzip"
  8. "fmt"
  9. "net/http"
  10. "os"
  11. "os/exec"
  12. "path"
  13. "path/filepath"
  14. "strconv"
  15. "strings"
  16. "time"
  17. "gopkg.in/macaron.v1"
  18. log "unknwon.dev/clog/v2"
  19. "gogs.io/gogs/internal/conf"
  20. "gogs.io/gogs/internal/db"
  21. "gogs.io/gogs/internal/lazyregexp"
  22. "gogs.io/gogs/internal/tool"
  23. )
  24. type HTTPContext struct {
  25. *macaron.Context
  26. OwnerName string
  27. OwnerSalt string
  28. RepoID int64
  29. RepoName string
  30. AuthUser *db.User
  31. }
  32. // askCredentials responses HTTP header and status which informs client to provide credentials.
  33. func askCredentials(c *macaron.Context, status int, text string) {
  34. c.Header().Set("WWW-Authenticate", "Basic realm=\".\"")
  35. c.Error(status, text)
  36. }
  37. func HTTPContexter() macaron.Handler {
  38. return func(c *macaron.Context) {
  39. if len(conf.HTTP.AccessControlAllowOrigin) > 0 {
  40. // Set CORS headers for browser-based git clients
  41. c.Header().Set("Access-Control-Allow-Origin", conf.HTTP.AccessControlAllowOrigin)
  42. c.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization, User-Agent")
  43. // Handle preflight OPTIONS request
  44. if c.Req.Method == "OPTIONS" {
  45. c.Status(http.StatusOK)
  46. return
  47. }
  48. }
  49. ownerName := c.Params(":username")
  50. repoName := strings.TrimSuffix(c.Params(":reponame"), ".git")
  51. repoName = strings.TrimSuffix(repoName, ".wiki")
  52. isPull := c.Query("service") == "git-upload-pack" ||
  53. strings.HasSuffix(c.Req.URL.Path, "git-upload-pack") ||
  54. c.Req.Method == "GET"
  55. owner, err := db.Users.GetByUsername(ownerName)
  56. if err != nil {
  57. if db.IsErrUserNotExist(err) {
  58. c.Status(http.StatusNotFound)
  59. } else {
  60. c.Status(http.StatusInternalServerError)
  61. log.Error("Failed to get user [name: %s]: %v", ownerName, err)
  62. }
  63. return
  64. }
  65. repo, err := db.Repos.GetByName(owner.ID, repoName)
  66. if err != nil {
  67. if db.IsErrRepoNotExist(err) {
  68. c.Status(http.StatusNotFound)
  69. } else {
  70. c.Status(http.StatusInternalServerError)
  71. log.Error("Failed to get repository [owner_id: %d, name: %s]: %v", owner.ID, repoName, err)
  72. }
  73. return
  74. }
  75. // Authentication is not required for pulling from public repositories.
  76. if isPull && !repo.IsPrivate && !conf.Auth.RequireSigninView {
  77. c.Map(&HTTPContext{
  78. Context: c,
  79. })
  80. return
  81. }
  82. // In case user requested a wrong URL and not intended to access Git objects.
  83. action := c.Params("*")
  84. if !strings.Contains(action, "git-") &&
  85. !strings.Contains(action, "info/") &&
  86. !strings.Contains(action, "HEAD") &&
  87. !strings.Contains(action, "objects/") {
  88. c.NotFound()
  89. return
  90. }
  91. // Handle HTTP Basic Authentication
  92. authHead := c.Req.Header.Get("Authorization")
  93. if len(authHead) == 0 {
  94. askCredentials(c, http.StatusUnauthorized, "")
  95. return
  96. }
  97. auths := strings.Fields(authHead)
  98. if len(auths) != 2 || auths[0] != "Basic" {
  99. askCredentials(c, http.StatusUnauthorized, "")
  100. return
  101. }
  102. authUsername, authPassword, err := tool.BasicAuthDecode(auths[1])
  103. if err != nil {
  104. askCredentials(c, http.StatusUnauthorized, "")
  105. return
  106. }
  107. authUser, err := db.Users.Authenticate(authUsername, authPassword, -1)
  108. if err != nil && !db.IsErrUserNotExist(err) {
  109. c.Status(http.StatusInternalServerError)
  110. log.Error("Failed to authenticate user [name: %s]: %v", authUsername, err)
  111. return
  112. }
  113. // If username and password combination failed, try again using username as a token.
  114. if authUser == nil {
  115. token, err := db.AccessTokens.GetBySHA(authUsername)
  116. if err != nil {
  117. if db.IsErrAccessTokenNotExist(err) {
  118. askCredentials(c, http.StatusUnauthorized, "")
  119. } else {
  120. c.Status(http.StatusInternalServerError)
  121. log.Error("Failed to get access token [sha: %s]: %v", authUsername, err)
  122. }
  123. return
  124. }
  125. if err = db.AccessTokens.Save(token); err != nil {
  126. log.Error("Failed to update access token: %v", err)
  127. }
  128. authUser, err = db.Users.GetByID(token.UserID)
  129. if err != nil {
  130. // Once we found token, we're supposed to find its related user,
  131. // thus any error is unexpected.
  132. c.Status(http.StatusInternalServerError)
  133. log.Error("Failed to get user [id: %d]: %v", token.UserID, err)
  134. return
  135. }
  136. } else if authUser.IsEnabledTwoFactor() {
  137. askCredentials(c, http.StatusUnauthorized, `User with two-factor authentication enabled cannot perform HTTP/HTTPS operations via plain username and password
  138. Please create and use personal access token on user settings page`)
  139. return
  140. }
  141. log.Trace("[Git] Authenticated user: %s", authUser.Name)
  142. mode := db.AccessModeWrite
  143. if isPull {
  144. mode = db.AccessModeRead
  145. }
  146. if !db.Perms.Authorize(authUser.ID, repo, mode) {
  147. askCredentials(c, http.StatusForbidden, "User permission denied")
  148. return
  149. }
  150. if !isPull && repo.IsMirror {
  151. c.Error(http.StatusForbidden, "Mirror repository is read-only")
  152. return
  153. }
  154. c.Map(&HTTPContext{
  155. Context: c,
  156. OwnerName: ownerName,
  157. OwnerSalt: owner.Salt,
  158. RepoID: repo.ID,
  159. RepoName: repoName,
  160. AuthUser: authUser,
  161. })
  162. }
  163. }
  164. type serviceHandler struct {
  165. w http.ResponseWriter
  166. r *http.Request
  167. dir string
  168. file string
  169. authUser *db.User
  170. ownerName string
  171. ownerSalt string
  172. repoID int64
  173. repoName string
  174. }
  175. func (h *serviceHandler) setHeaderNoCache() {
  176. h.w.Header().Set("Expires", "Fri, 01 Jan 1980 00:00:00 GMT")
  177. h.w.Header().Set("Pragma", "no-cache")
  178. h.w.Header().Set("Cache-Control", "no-cache, max-age=0, must-revalidate")
  179. }
  180. func (h *serviceHandler) setHeaderCacheForever() {
  181. now := time.Now().Unix()
  182. expires := now + 31536000
  183. h.w.Header().Set("Date", fmt.Sprintf("%d", now))
  184. h.w.Header().Set("Expires", fmt.Sprintf("%d", expires))
  185. h.w.Header().Set("Cache-Control", "public, max-age=31536000")
  186. }
  187. func (h *serviceHandler) sendFile(contentType string) {
  188. reqFile := path.Join(h.dir, h.file)
  189. fi, err := os.Stat(reqFile)
  190. if os.IsNotExist(err) {
  191. h.w.WriteHeader(http.StatusNotFound)
  192. return
  193. }
  194. h.w.Header().Set("Content-Type", contentType)
  195. h.w.Header().Set("Content-Length", fmt.Sprintf("%d", fi.Size()))
  196. h.w.Header().Set("Last-Modified", fi.ModTime().Format(http.TimeFormat))
  197. http.ServeFile(h.w, h.r, reqFile)
  198. }
  199. func serviceRPC(h serviceHandler, service string) {
  200. defer h.r.Body.Close()
  201. if h.r.Header.Get("Content-Type") != fmt.Sprintf("application/x-git-%s-request", service) {
  202. h.w.WriteHeader(http.StatusUnauthorized)
  203. return
  204. }
  205. h.w.Header().Set("Content-Type", fmt.Sprintf("application/x-git-%s-result", service))
  206. var (
  207. reqBody = h.r.Body
  208. err error
  209. )
  210. // Handle GZIP
  211. if h.r.Header.Get("Content-Encoding") == "gzip" {
  212. reqBody, err = gzip.NewReader(reqBody)
  213. if err != nil {
  214. log.Error("HTTP.Get: fail to create gzip reader: %v", err)
  215. h.w.WriteHeader(http.StatusInternalServerError)
  216. return
  217. }
  218. }
  219. var stderr bytes.Buffer
  220. cmd := exec.Command("git", service, "--stateless-rpc", h.dir)
  221. if service == "receive-pack" {
  222. cmd.Env = append(os.Environ(), db.ComposeHookEnvs(db.ComposeHookEnvsOptions{
  223. AuthUser: h.authUser,
  224. OwnerName: h.ownerName,
  225. OwnerSalt: h.ownerSalt,
  226. RepoID: h.repoID,
  227. RepoName: h.repoName,
  228. RepoPath: h.dir,
  229. })...)
  230. }
  231. cmd.Dir = h.dir
  232. cmd.Stdout = h.w
  233. cmd.Stderr = &stderr
  234. cmd.Stdin = reqBody
  235. if err = cmd.Run(); err != nil {
  236. log.Error("HTTP.serviceRPC: fail to serve RPC '%s': %v - %s", service, err, stderr.String())
  237. h.w.WriteHeader(http.StatusInternalServerError)
  238. return
  239. }
  240. }
  241. func serviceUploadPack(h serviceHandler) {
  242. serviceRPC(h, "upload-pack")
  243. }
  244. func serviceReceivePack(h serviceHandler) {
  245. serviceRPC(h, "receive-pack")
  246. }
  247. func getServiceType(r *http.Request) string {
  248. serviceType := r.FormValue("service")
  249. if !strings.HasPrefix(serviceType, "git-") {
  250. return ""
  251. }
  252. return strings.TrimPrefix(serviceType, "git-")
  253. }
  254. // FIXME: use process module
  255. func gitCommand(dir string, args ...string) []byte {
  256. cmd := exec.Command("git", args...)
  257. cmd.Dir = dir
  258. out, err := cmd.Output()
  259. if err != nil {
  260. log.Error(fmt.Sprintf("Git: %v - %s", err, out))
  261. }
  262. return out
  263. }
  264. func updateServerInfo(dir string) []byte {
  265. return gitCommand(dir, "update-server-info")
  266. }
  267. func packetWrite(str string) []byte {
  268. s := strconv.FormatInt(int64(len(str)+4), 16)
  269. if len(s)%4 != 0 {
  270. s = strings.Repeat("0", 4-len(s)%4) + s
  271. }
  272. return []byte(s + str)
  273. }
  274. func getInfoRefs(h serviceHandler) {
  275. h.setHeaderNoCache()
  276. service := getServiceType(h.r)
  277. if service != "upload-pack" && service != "receive-pack" {
  278. updateServerInfo(h.dir)
  279. h.sendFile("text/plain; charset=utf-8")
  280. return
  281. }
  282. refs := gitCommand(h.dir, service, "--stateless-rpc", "--advertise-refs", ".")
  283. h.w.Header().Set("Content-Type", fmt.Sprintf("application/x-git-%s-advertisement", service))
  284. h.w.WriteHeader(http.StatusOK)
  285. _, _ = h.w.Write(packetWrite("# service=git-" + service + "\n"))
  286. _, _ = h.w.Write([]byte("0000"))
  287. _, _ = h.w.Write(refs)
  288. }
  289. func getTextFile(h serviceHandler) {
  290. h.setHeaderNoCache()
  291. h.sendFile("text/plain")
  292. }
  293. func getInfoPacks(h serviceHandler) {
  294. h.setHeaderCacheForever()
  295. h.sendFile("text/plain; charset=utf-8")
  296. }
  297. func getLooseObject(h serviceHandler) {
  298. h.setHeaderCacheForever()
  299. h.sendFile("application/x-git-loose-object")
  300. }
  301. func getPackFile(h serviceHandler) {
  302. h.setHeaderCacheForever()
  303. h.sendFile("application/x-git-packed-objects")
  304. }
  305. func getIdxFile(h serviceHandler) {
  306. h.setHeaderCacheForever()
  307. h.sendFile("application/x-git-packed-objects-toc")
  308. }
  309. var routes = []struct {
  310. re *lazyregexp.Regexp
  311. method string
  312. handler func(serviceHandler)
  313. }{
  314. {lazyregexp.New("(.*?)/git-upload-pack$"), "POST", serviceUploadPack},
  315. {lazyregexp.New("(.*?)/git-receive-pack$"), "POST", serviceReceivePack},
  316. {lazyregexp.New("(.*?)/info/refs$"), "GET", getInfoRefs},
  317. {lazyregexp.New("(.*?)/HEAD$"), "GET", getTextFile},
  318. {lazyregexp.New("(.*?)/objects/info/alternates$"), "GET", getTextFile},
  319. {lazyregexp.New("(.*?)/objects/info/http-alternates$"), "GET", getTextFile},
  320. {lazyregexp.New("(.*?)/objects/info/packs$"), "GET", getInfoPacks},
  321. {lazyregexp.New("(.*?)/objects/info/[^/]*$"), "GET", getTextFile},
  322. {lazyregexp.New("(.*?)/objects/[0-9a-f]{2}/[0-9a-f]{38}$"), "GET", getLooseObject},
  323. {lazyregexp.New("(.*?)/objects/pack/pack-[0-9a-f]{40}\\.pack$"), "GET", getPackFile},
  324. {lazyregexp.New("(.*?)/objects/pack/pack-[0-9a-f]{40}\\.idx$"), "GET", getIdxFile},
  325. }
  326. func getGitRepoPath(dir string) (string, error) {
  327. if !strings.HasSuffix(dir, ".git") {
  328. dir += ".git"
  329. }
  330. filename := filepath.Join(conf.Repository.Root, dir)
  331. if _, err := os.Stat(filename); os.IsNotExist(err) {
  332. return "", err
  333. }
  334. return filename, nil
  335. }
  336. func HTTP(c *HTTPContext) {
  337. for _, route := range routes {
  338. reqPath := strings.ToLower(c.Req.URL.Path)
  339. m := route.re.FindStringSubmatch(reqPath)
  340. if m == nil {
  341. continue
  342. }
  343. // We perform check here because route matched in cmd/web.go is wider than needed,
  344. // but we only want to output this message only if user is really trying to access
  345. // Git HTTP endpoints.
  346. if conf.Repository.DisableHTTPGit {
  347. c.Error(http.StatusForbidden, "Interacting with repositories by HTTP protocol is disabled")
  348. return
  349. }
  350. if route.method != c.Req.Method {
  351. c.NotFound()
  352. return
  353. }
  354. file := strings.TrimPrefix(reqPath, m[1]+"/")
  355. dir, err := getGitRepoPath(m[1])
  356. if err != nil {
  357. log.Warn("HTTP.getGitRepoPath: %v", err)
  358. c.NotFound()
  359. return
  360. }
  361. route.handler(serviceHandler{
  362. w: c.Resp,
  363. r: c.Req.Request,
  364. dir: dir,
  365. file: file,
  366. authUser: c.AuthUser,
  367. ownerName: c.OwnerName,
  368. ownerSalt: c.OwnerSalt,
  369. repoID: c.RepoID,
  370. repoName: c.RepoName,
  371. })
  372. return
  373. }
  374. c.NotFound()
  375. }