user/sven/git.git/daemon.c, branch v1.0rc6

[PATCH] daemon.c and path.enter_repo(): revamp path validation.

2005-12-04T07:17:42Z

The whitelist of git-daemon is checked against return value from enter_repo(), and enter_repo() used to return the value obtained from getcwd() to avoid directory aliasing issues as discussed earier (mid October 2005). Unfortunately, it did not go well as we hoped. For example, /pub on a kernel.org public machine is a symlink to its real mountpoint, and it is understandable that the administrator does not want to adjust the whitelist every time /pub needs to point at a different partition for storage allcation or whatever reasons. Being able to keep using /pub/scm as the whitelist is a desirable property. So this version of enter_repo() reports what it used to chdir() and validate, but does not use getcwd() to canonicalize the directory name. When it sees a user relative path ~user/path, it internally resolves it to try chdir() there, but it still reports ~user/path (possibly after appending .git if allowed to do so, in which case it would report ~user/path.git). What this means is that if a whitelist wants to allow a user relative path, it needs to say "~" (for all users) or list user home directories like "~alice" "~bob". And no, you cannot say /home if the advertised way to access user home directories are ~alice,~bob, etc. The whole point of this is to avoid unnecessary aliasing issues. Anyway, because of this, daemon needs to do a bit more work to guard itself. Namely, it needs to make sure that the accessor does not try to exploit its leading path match rule by inserting /../ in the middle or hanging /.. at the end. I resurrected the belts and suspender paranoia code HPA did for this purpose. This check cannot be done in the enter_repo() unconditionally, because there are valid callers of enter_repo() that want to honor /../; authorized users coming over ssh to run send-pack and fetch-pack should be allowed to do so. Signed-off-by: Junio C Hamano

git-daemon not listening when compiled with -DNO_IPV6

2005-11-21T22:36:43Z

git-daemon was not listening when compiled with -DNO_IPV6. socksetup() was not returning socket count when compiled with -DNO_IPV6. Signed-off-by: Paul Serice Signed-off-by: Junio C Hamano

daemon: further tweaks.

2005-11-21T21:47:00Z

- Do validation only on canonicalized paths - Run upload-pack with "." as repository argument Signed-off-by: Junio C Hamano

git-daemon support for user-relative paths.

2005-11-21T21:47:00Z

Dropped a fair amount of reundant code in favour of the library code in path.c Added option --strict-paths with documentation, with backwards compatibility for whitelist entries with symlinks. Everything that worked earlier still works insofar as I have remembered testing it. Signed-off-by: Andreas Ericsson Signed-off-by: Junio C Hamano

daemon.c: fix arg parsing bugs

2005-11-17T04:34:26Z

Allow --init-timeout and --timeout to be specified without falling through to usage(). Make sure openlog() is called even if implied by --inetd, or messages will be sent to wherever LOG_USER ends up. Signed-off-by: Andreas Ericsson Signed-off-by: Junio C Hamano

git-daemon: --inetd implies --syslog

2005-11-15T08:19:32Z

Otherwise nothing is logged anywhere, which is a Bad Thing. Signed-off-by: Andreas Ericsson Signed-off-by: Junio C Hamano

fix daemon.c to compile on OpenBSD

2005-10-26T00:37:59Z

I can confirm that the following patch lets the current origin compile on OpenBSD. If you could apply this until you sort out the rest of the namespace issue, I would be happy. Thanks. Signed-off-by: Junio C Hamano

Merge branch 'fixes'

2005-10-21T06:21:50Z

daemon.c: remove trailing whitespace.

2005-10-21T06:19:36Z

Signed-off-by: Junio C Hamano

Fix git-daemon argument-parsing bug

2005-10-21T05:46:03Z

Fix stupid bug in parsing the --init-timeout option. Signed-off-by: H. Peter Anvin Signed-off-by: Junio C Hamano