Fork to maintain patches against the official gitea for https://code.ceondo.com https://github.com/go-gitea/gitea

http.go 16KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605
  1. // Copyright 2014 The Gogs Authors. All rights reserved.
  2. // Use of this source code is governed by a MIT-style
  3. // license that can be found in the LICENSE file.
  4. package repo
  5. import (
  6. "bytes"
  7. "compress/gzip"
  8. "fmt"
  9. "io"
  10. "io/ioutil"
  11. "net/http"
  12. "os"
  13. "os/exec"
  14. "path"
  15. "regexp"
  16. "runtime"
  17. "strconv"
  18. "strings"
  19. "time"
  20. "code.gitea.io/git"
  21. "code.gitea.io/gitea/models"
  22. "code.gitea.io/gitea/modules/base"
  23. "code.gitea.io/gitea/modules/context"
  24. "code.gitea.io/gitea/modules/log"
  25. "code.gitea.io/gitea/modules/setting"
  26. )
  27. // HTTP implmentation git smart HTTP protocol
  28. func HTTP(ctx *context.Context) {
  29. username := ctx.Params(":username")
  30. reponame := strings.TrimSuffix(ctx.Params(":reponame"), ".git")
  31. var isPull bool
  32. service := ctx.Query("service")
  33. if service == "git-receive-pack" ||
  34. strings.HasSuffix(ctx.Req.URL.Path, "git-receive-pack") {
  35. isPull = false
  36. } else if service == "git-upload-pack" ||
  37. strings.HasSuffix(ctx.Req.URL.Path, "git-upload-pack") {
  38. isPull = true
  39. } else if service == "git-upload-archive" ||
  40. strings.HasSuffix(ctx.Req.URL.Path, "git-upload-archive") {
  41. isPull = true
  42. } else {
  43. isPull = (ctx.Req.Method == "GET")
  44. }
  45. var accessMode models.AccessMode
  46. if isPull {
  47. accessMode = models.AccessModeRead
  48. } else {
  49. accessMode = models.AccessModeWrite
  50. }
  51. isWiki := false
  52. if strings.HasSuffix(reponame, ".wiki") {
  53. isWiki = true
  54. reponame = reponame[:len(reponame)-5]
  55. }
  56. repoUser, err := models.GetUserByName(username)
  57. if err != nil {
  58. if models.IsErrUserNotExist(err) {
  59. ctx.Handle(http.StatusNotFound, "GetUserByName", nil)
  60. } else {
  61. ctx.Handle(http.StatusInternalServerError, "GetUserByName", err)
  62. }
  63. return
  64. }
  65. repo, err := models.GetRepositoryByName(repoUser.ID, reponame)
  66. if err != nil {
  67. if models.IsErrRepoNotExist(err) {
  68. ctx.Handle(http.StatusNotFound, "GetRepositoryByName", nil)
  69. } else {
  70. ctx.Handle(http.StatusInternalServerError, "GetRepositoryByName", err)
  71. }
  72. return
  73. }
  74. // Only public pull don't need auth.
  75. isPublicPull := !repo.IsPrivate && isPull
  76. var (
  77. askAuth = !isPublicPull || setting.Service.RequireSignInView
  78. authUser *models.User
  79. authUsername string
  80. authPasswd string
  81. )
  82. // check access
  83. if askAuth {
  84. if setting.Service.EnableReverseProxyAuth {
  85. authUsername = ctx.Req.Header.Get(setting.ReverseProxyAuthUser)
  86. if len(authUsername) == 0 {
  87. ctx.HandleText(401, "reverse proxy login error. authUsername empty")
  88. return
  89. }
  90. authUser, err = models.GetUserByName(authUsername)
  91. if err != nil {
  92. ctx.HandleText(401, "reverse proxy login error, got error while running GetUserByName")
  93. return
  94. }
  95. } else {
  96. authHead := ctx.Req.Header.Get("Authorization")
  97. if len(authHead) == 0 {
  98. ctx.Resp.Header().Set("WWW-Authenticate", "Basic realm=\".\"")
  99. ctx.Error(http.StatusUnauthorized)
  100. return
  101. }
  102. auths := strings.Fields(authHead)
  103. // currently check basic auth
  104. // TODO: support digit auth
  105. // FIXME: middlewares/context.go did basic auth check already,
  106. // maybe could use that one.
  107. if len(auths) != 2 || auths[0] != "Basic" {
  108. ctx.HandleText(http.StatusUnauthorized, "no basic auth and digit auth")
  109. return
  110. }
  111. authUsername, authPasswd, err = base.BasicAuthDecode(auths[1])
  112. if err != nil {
  113. ctx.HandleText(http.StatusUnauthorized, "no basic auth and digit auth")
  114. return
  115. }
  116. authUser, err = models.UserSignIn(authUsername, authPasswd)
  117. if err != nil {
  118. if !models.IsErrUserNotExist(err) {
  119. ctx.Handle(http.StatusInternalServerError, "UserSignIn error: %v", err)
  120. return
  121. }
  122. // Assume username now is a token.
  123. token, err := models.GetAccessTokenBySHA(authUsername)
  124. if err != nil {
  125. if models.IsErrAccessTokenNotExist(err) || models.IsErrAccessTokenEmpty(err) {
  126. ctx.HandleText(http.StatusUnauthorized, "invalid token")
  127. } else {
  128. ctx.Handle(http.StatusInternalServerError, "GetAccessTokenBySha", err)
  129. }
  130. return
  131. }
  132. token.Updated = time.Now()
  133. if err = models.UpdateAccessToken(token); err != nil {
  134. ctx.Handle(http.StatusInternalServerError, "UpdateAccessToken", err)
  135. }
  136. authUser, err = models.GetUserByID(token.UID)
  137. if err != nil {
  138. ctx.Handle(http.StatusInternalServerError, "GetUserByID", err)
  139. return
  140. }
  141. }
  142. if !isPublicPull {
  143. has, err := models.HasAccess(authUser, repo, accessMode)
  144. if err != nil {
  145. ctx.Handle(http.StatusInternalServerError, "HasAccess", err)
  146. return
  147. } else if !has {
  148. if accessMode == models.AccessModeRead {
  149. has, err = models.HasAccess(authUser, repo, models.AccessModeWrite)
  150. if err != nil {
  151. ctx.Handle(http.StatusInternalServerError, "HasAccess2", err)
  152. return
  153. } else if !has {
  154. ctx.HandleText(http.StatusForbidden, "User permission denied")
  155. return
  156. }
  157. } else {
  158. ctx.HandleText(http.StatusForbidden, "User permission denied")
  159. return
  160. }
  161. }
  162. if !isPull && repo.IsMirror {
  163. ctx.HandleText(http.StatusForbidden, "mirror repository is read-only")
  164. return
  165. }
  166. }
  167. }
  168. }
  169. callback := func(rpc string, input []byte) {
  170. if rpc != "receive-pack" || isWiki {
  171. return
  172. }
  173. var lastLine int64
  174. for {
  175. head := input[lastLine : lastLine+2]
  176. if head[0] == '0' && head[1] == '0' {
  177. size, err := strconv.ParseInt(string(input[lastLine+2:lastLine+4]), 16, 32)
  178. if err != nil {
  179. log.Error(4, "%v", err)
  180. return
  181. }
  182. if size == 0 {
  183. //fmt.Println(string(input[lastLine:]))
  184. break
  185. }
  186. line := input[lastLine : lastLine+size]
  187. idx := bytes.IndexRune(line, '\000')
  188. if idx > -1 {
  189. line = line[:idx]
  190. }
  191. fields := strings.Fields(string(line))
  192. if len(fields) >= 3 {
  193. oldCommitID := fields[0][4:]
  194. newCommitID := fields[1]
  195. refFullName := fields[2]
  196. // FIXME: handle error.
  197. if err = models.PushUpdate(models.PushUpdateOptions{
  198. RefFullName: refFullName,
  199. OldCommitID: oldCommitID,
  200. NewCommitID: newCommitID,
  201. PusherID: authUser.ID,
  202. PusherName: authUser.Name,
  203. RepoUserName: username,
  204. RepoName: reponame,
  205. }); err == nil {
  206. go models.AddTestPullRequestTask(authUser, repo.ID, strings.TrimPrefix(refFullName, git.BranchPrefix), true)
  207. }
  208. }
  209. lastLine = lastLine + size
  210. } else {
  211. break
  212. }
  213. }
  214. }
  215. params := make(map[string]string)
  216. if askAuth {
  217. params[models.ProtectedBranchUserID] = fmt.Sprintf("%d", authUser.ID)
  218. if err == nil {
  219. params[models.ProtectedBranchAccessMode] = accessMode.String()
  220. }
  221. params[models.ProtectedBranchRepoID] = fmt.Sprintf("%d", repo.ID)
  222. }
  223. HTTPBackend(ctx, &serviceConfig{
  224. UploadPack: true,
  225. ReceivePack: true,
  226. Params: params,
  227. OnSucceed: callback,
  228. })(ctx.Resp, ctx.Req.Request)
  229. runtime.GC()
  230. }
  231. type serviceConfig struct {
  232. UploadPack bool
  233. ReceivePack bool
  234. Params map[string]string
  235. OnSucceed func(rpc string, input []byte)
  236. }
  237. type serviceHandler struct {
  238. cfg *serviceConfig
  239. w http.ResponseWriter
  240. r *http.Request
  241. dir string
  242. file string
  243. }
  244. func (h *serviceHandler) setHeaderNoCache() {
  245. h.w.Header().Set("Expires", "Fri, 01 Jan 1980 00:00:00 GMT")
  246. h.w.Header().Set("Pragma", "no-cache")
  247. h.w.Header().Set("Cache-Control", "no-cache, max-age=0, must-revalidate")
  248. }
  249. func (h *serviceHandler) getBranch(input []byte) string {
  250. var lastLine int64
  251. var branchName string
  252. for {
  253. head := input[lastLine : lastLine+2]
  254. if head[0] == '0' && head[1] == '0' {
  255. size, err := strconv.ParseInt(string(input[lastLine+2:lastLine+4]), 16, 32)
  256. if err != nil {
  257. log.Error(4, "%v", err)
  258. return branchName
  259. }
  260. if size == 0 {
  261. //fmt.Println(string(input[lastLine:]))
  262. break
  263. }
  264. line := input[lastLine : lastLine+size]
  265. idx := bytes.IndexRune(line, '\000')
  266. if idx > -1 {
  267. line = line[:idx]
  268. }
  269. fields := strings.Fields(string(line))
  270. if len(fields) >= 3 {
  271. refFullName := fields[2]
  272. branchName = strings.TrimPrefix(refFullName, git.BranchPrefix)
  273. }
  274. lastLine = lastLine + size
  275. } else {
  276. break
  277. }
  278. }
  279. return branchName
  280. }
  281. func (h *serviceHandler) setHeaderCacheForever() {
  282. now := time.Now().Unix()
  283. expires := now + 31536000
  284. h.w.Header().Set("Date", fmt.Sprintf("%d", now))
  285. h.w.Header().Set("Expires", fmt.Sprintf("%d", expires))
  286. h.w.Header().Set("Cache-Control", "public, max-age=31536000")
  287. }
  288. func (h *serviceHandler) sendFile(contentType string) {
  289. reqFile := path.Join(h.dir, h.file)
  290. fi, err := os.Stat(reqFile)
  291. if os.IsNotExist(err) {
  292. h.w.WriteHeader(http.StatusNotFound)
  293. return
  294. }
  295. h.w.Header().Set("Content-Type", contentType)
  296. h.w.Header().Set("Content-Length", fmt.Sprintf("%d", fi.Size()))
  297. h.w.Header().Set("Last-Modified", fi.ModTime().Format(http.TimeFormat))
  298. http.ServeFile(h.w, h.r, reqFile)
  299. }
  300. type route struct {
  301. reg *regexp.Regexp
  302. method string
  303. handler func(serviceHandler)
  304. }
  305. var routes = []route{
  306. {regexp.MustCompile("(.*?)/git-upload-pack$"), "POST", serviceUploadPack},
  307. {regexp.MustCompile("(.*?)/git-receive-pack$"), "POST", serviceReceivePack},
  308. {regexp.MustCompile("(.*?)/info/refs$"), "GET", getInfoRefs},
  309. {regexp.MustCompile("(.*?)/HEAD$"), "GET", getTextFile},
  310. {regexp.MustCompile("(.*?)/objects/info/alternates$"), "GET", getTextFile},
  311. {regexp.MustCompile("(.*?)/objects/info/http-alternates$"), "GET", getTextFile},
  312. {regexp.MustCompile("(.*?)/objects/info/packs$"), "GET", getInfoPacks},
  313. {regexp.MustCompile("(.*?)/objects/info/[^/]*$"), "GET", getTextFile},
  314. {regexp.MustCompile("(.*?)/objects/[0-9a-f]{2}/[0-9a-f]{38}$"), "GET", getLooseObject},
  315. {regexp.MustCompile("(.*?)/objects/pack/pack-[0-9a-f]{40}\\.pack$"), "GET", getPackFile},
  316. {regexp.MustCompile("(.*?)/objects/pack/pack-[0-9a-f]{40}\\.idx$"), "GET", getIdxFile},
  317. }
  318. // FIXME: use process module
  319. func gitCommand(dir string, args ...string) []byte {
  320. cmd := exec.Command("git", args...)
  321. cmd.Dir = dir
  322. out, err := cmd.Output()
  323. if err != nil {
  324. log.GitLogger.Error(4, fmt.Sprintf("%v - %s", err, out))
  325. }
  326. return out
  327. }
  328. func getGitConfig(option, dir string) string {
  329. out := string(gitCommand(dir, "config", option))
  330. return out[0 : len(out)-1]
  331. }
  332. func getConfigSetting(service, dir string) bool {
  333. service = strings.Replace(service, "-", "", -1)
  334. setting := getGitConfig("http."+service, dir)
  335. if service == "uploadpack" {
  336. return setting != "false"
  337. }
  338. return setting == "true"
  339. }
  340. func hasAccess(service string, h serviceHandler, checkContentType bool) bool {
  341. if checkContentType {
  342. if h.r.Header.Get("Content-Type") != fmt.Sprintf("application/x-git-%s-request", service) {
  343. return false
  344. }
  345. }
  346. if !(service == "upload-pack" || service == "receive-pack") {
  347. return false
  348. }
  349. if service == "receive-pack" {
  350. return h.cfg.ReceivePack
  351. }
  352. if service == "upload-pack" {
  353. return h.cfg.UploadPack
  354. }
  355. return getConfigSetting(service, h.dir)
  356. }
  357. func serviceRPC(h serviceHandler, service string) {
  358. defer h.r.Body.Close()
  359. if !hasAccess(service, h, true) {
  360. h.w.WriteHeader(http.StatusUnauthorized)
  361. return
  362. }
  363. h.w.Header().Set("Content-Type", fmt.Sprintf("application/x-git-%s-result", service))
  364. var (
  365. reqBody = h.r.Body
  366. input []byte
  367. br io.Reader
  368. err error
  369. branchName string
  370. )
  371. // Handle GZIP.
  372. if h.r.Header.Get("Content-Encoding") == "gzip" {
  373. reqBody, err = gzip.NewReader(reqBody)
  374. if err != nil {
  375. log.GitLogger.Error(2, "fail to create gzip reader: %v", err)
  376. h.w.WriteHeader(http.StatusInternalServerError)
  377. return
  378. }
  379. }
  380. if h.cfg.OnSucceed != nil {
  381. input, err = ioutil.ReadAll(reqBody)
  382. if err != nil {
  383. log.GitLogger.Error(2, "fail to read request body: %v", err)
  384. h.w.WriteHeader(http.StatusInternalServerError)
  385. return
  386. }
  387. branchName = h.getBranch(input)
  388. br = bytes.NewReader(input)
  389. } else {
  390. br = reqBody
  391. }
  392. // check protected branch
  393. repoID, _ := strconv.ParseInt(h.cfg.Params[models.ProtectedBranchRepoID], 10, 64)
  394. accessMode := models.ParseAccessMode(h.cfg.Params[models.ProtectedBranchAccessMode])
  395. // skip admin or owner AccessMode
  396. if accessMode == models.AccessModeWrite {
  397. protectBranch, err := models.GetProtectedBranchBy(repoID, branchName)
  398. if err != nil {
  399. log.GitLogger.Error(2, "fail to get protected branch information: %v", err)
  400. h.w.WriteHeader(http.StatusInternalServerError)
  401. return
  402. }
  403. if protectBranch != nil {
  404. log.GitLogger.Error(2, "protected branches can not be pushed to")
  405. h.w.WriteHeader(http.StatusForbidden)
  406. return
  407. }
  408. }
  409. cmd := exec.Command("git", service, "--stateless-rpc", h.dir)
  410. cmd.Dir = h.dir
  411. cmd.Stdout = h.w
  412. cmd.Stdin = br
  413. if err := cmd.Run(); err != nil {
  414. log.GitLogger.Error(2, "fail to serve RPC(%s): %v", service, err)
  415. h.w.WriteHeader(http.StatusInternalServerError)
  416. return
  417. }
  418. if h.cfg.OnSucceed != nil {
  419. h.cfg.OnSucceed(service, input)
  420. }
  421. }
  422. func serviceUploadPack(h serviceHandler) {
  423. serviceRPC(h, "upload-pack")
  424. }
  425. func serviceReceivePack(h serviceHandler) {
  426. serviceRPC(h, "receive-pack")
  427. }
  428. func getServiceType(r *http.Request) string {
  429. serviceType := r.FormValue("service")
  430. if !strings.HasPrefix(serviceType, "git-") {
  431. return ""
  432. }
  433. return strings.Replace(serviceType, "git-", "", 1)
  434. }
  435. func updateServerInfo(dir string) []byte {
  436. return gitCommand(dir, "update-server-info")
  437. }
  438. func packetWrite(str string) []byte {
  439. s := strconv.FormatInt(int64(len(str)+4), 16)
  440. if len(s)%4 != 0 {
  441. s = strings.Repeat("0", 4-len(s)%4) + s
  442. }
  443. return []byte(s + str)
  444. }
  445. func getInfoRefs(h serviceHandler) {
  446. h.setHeaderNoCache()
  447. if hasAccess(getServiceType(h.r), h, false) {
  448. service := getServiceType(h.r)
  449. refs := gitCommand(h.dir, service, "--stateless-rpc", "--advertise-refs", ".")
  450. h.w.Header().Set("Content-Type", fmt.Sprintf("application/x-git-%s-advertisement", service))
  451. h.w.WriteHeader(http.StatusOK)
  452. h.w.Write(packetWrite("# service=git-" + service + "\n"))
  453. h.w.Write([]byte("0000"))
  454. h.w.Write(refs)
  455. } else {
  456. updateServerInfo(h.dir)
  457. h.sendFile("text/plain; charset=utf-8")
  458. }
  459. }
  460. func getTextFile(h serviceHandler) {
  461. h.setHeaderNoCache()
  462. h.sendFile("text/plain")
  463. }
  464. func getInfoPacks(h serviceHandler) {
  465. h.setHeaderCacheForever()
  466. h.sendFile("text/plain; charset=utf-8")
  467. }
  468. func getLooseObject(h serviceHandler) {
  469. h.setHeaderCacheForever()
  470. h.sendFile("application/x-git-loose-object")
  471. }
  472. func getPackFile(h serviceHandler) {
  473. h.setHeaderCacheForever()
  474. h.sendFile("application/x-git-packed-objects")
  475. }
  476. func getIdxFile(h serviceHandler) {
  477. h.setHeaderCacheForever()
  478. h.sendFile("application/x-git-packed-objects-toc")
  479. }
  480. func getGitRepoPath(subdir string) (string, error) {
  481. if !strings.HasSuffix(subdir, ".git") {
  482. subdir += ".git"
  483. }
  484. fpath := path.Join(setting.RepoRootPath, subdir)
  485. if _, err := os.Stat(fpath); os.IsNotExist(err) {
  486. return "", err
  487. }
  488. return fpath, nil
  489. }
  490. // HTTPBackend middleware for git smart HTTP protocol
  491. func HTTPBackend(ctx *context.Context, cfg *serviceConfig) http.HandlerFunc {
  492. return func(w http.ResponseWriter, r *http.Request) {
  493. for _, route := range routes {
  494. r.URL.Path = strings.ToLower(r.URL.Path) // blue: In case some repo name has upper case name
  495. if m := route.reg.FindStringSubmatch(r.URL.Path); m != nil {
  496. if setting.Repository.DisableHTTPGit {
  497. w.WriteHeader(http.StatusForbidden)
  498. w.Write([]byte("Interacting with repositories by HTTP protocol is not allowed"))
  499. return
  500. }
  501. if route.method != r.Method {
  502. if r.Proto == "HTTP/1.1" {
  503. w.WriteHeader(http.StatusMethodNotAllowed)
  504. w.Write([]byte("Method Not Allowed"))
  505. } else {
  506. w.WriteHeader(http.StatusBadRequest)
  507. w.Write([]byte("Bad Request"))
  508. }
  509. return
  510. }
  511. file := strings.Replace(r.URL.Path, m[1]+"/", "", 1)
  512. dir, err := getGitRepoPath(m[1])
  513. if err != nil {
  514. log.GitLogger.Error(4, err.Error())
  515. ctx.Handle(http.StatusNotFound, "HTTPBackend", err)
  516. return
  517. }
  518. route.handler(serviceHandler{cfg, w, r, dir, file})
  519. return
  520. }
  521. }
  522. ctx.Handle(http.StatusNotFound, "HTTPBackend", nil)
  523. return
  524. }
  525. }