1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121

package main

import (
	"compress/gzip"
	"context"
	"fmt"
	"io"
	"net/http"
	"os/exec"
	"strings"
	"time"
)

func isSmart(r *http.Request, rest string) bool {
	switch rest {
	case "info/refs":
		return r.URL.Query().Get("service") != ""
	case "git-upload-pack", "git-receive-pack":
		return r.Method == "POST"
	}
	return false
}

func (s *Server) basicUser(r *http.Request) (User, bool) {
	name, secret, ok := r.BasicAuth()
	if !ok {
		return User{}, false
	}
	if u, ok := s.store.UserByToken(name, secret); ok {
		return u, true
	}
	return s.store.CheckPassword(name, secret)
}

func (s *Server) smart(w http.ResponseWriter, r *http.Request, owner User, name, rest string) {
	repo, err := s.store.RepoByPath(owner.Name, name)
	if err != nil {
		http.Error(w, "repository not found", 404)
		return
	}
	service := r.URL.Query().Get("service")
	if rest != "info/refs" {
		service = rest
	}
	if service != "git-upload-pack" && service != "git-receive-pack" {
		http.Error(w, "unsupported service", 403)
		return
	}
	needAuth := service == "git-receive-pack" || repo.Private
	if needAuth {
		ip := clientIP(r)
		if s.limiter.blocked(ip) {
			http.Error(w, "too many failed attempts", 429)
			return
		}
		u, ok := s.basicUser(r)
		if !ok || u.ID != repo.Owner.ID {
			if _, _, given := r.BasicAuth(); given {
				s.limiter.fail(ip)
			}
			w.Header().Set("WWW-Authenticate", `Basic realm="`+s.host+`"`)
			http.Error(w, "authentication required", 401)
			return
		}
	}
	dir := s.repoDir(repo)
	w.Header().Set("Cache-Control", "no-cache")
	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Minute)
	defer cancel()
	if rest == "info/refs" {
		cmd := exec.CommandContext(ctx, "git", strings.TrimPrefix(service, "git-"), "--stateless-rpc", "--advertise-refs", dir)
		out, err := cmd.Output()
		if err != nil {
			http.Error(w, "git failed", 500)
			return
		}
		w.Header().Set("Content-Type", "application/x-"+service+"-advertisement")
		fmt.Fprintf(w, "%04x# service=%s\n0000", len(service)+15, service)
		w.Write(out)
		return
	}
	var body io.Reader = r.Body
	if r.Header.Get("Content-Encoding") == "gzip" {
		gz, err := gzip.NewReader(r.Body)
		if err != nil {
			http.Error(w, "bad gzip", 400)
			return
		}
		defer gz.Close()
		body = gz
	}
	cmd := exec.CommandContext(ctx, "git", strings.TrimPrefix(service, "git-"), "--stateless-rpc", dir)
	cmd.Stdin = body
	cmd.Env = []string{"GIT_PROTOCOL=" + r.Header.Get("Git-Protocol"), "HOME=/nonexistent"}
	stdout, err := cmd.StdoutPipe()
	if err != nil {
		http.Error(w, "git failed", 500)
		return
	}
	if err := cmd.Start(); err != nil {
		http.Error(w, "git failed", 500)
		return
	}
	w.Header().Set("Content-Type", "application/x-"+service+"-result")
	w.WriteHeader(200)
	flusher, _ := w.(http.Flusher)
	buf := make([]byte, 32*1024)
	for {
		n, err := stdout.Read(buf)
		if n > 0 {
			w.Write(buf[:n])
			if flusher != nil {
				flusher.Flush()
			}
		}
		if err != nil {
			break
		}
	}
	cmd.Wait()
}