1package daemon
2
3import (
4 "bytes"
5 "context"
6 "fmt"
7 "net"
8 "path/filepath"
9 "strings"
10 "sync"
11 "time"
12
13 "github.com/charmbracelet/log"
14 "github.com/charmbracelet/soft-serve/server/access"
15 "github.com/charmbracelet/soft-serve/server/backend"
16 "github.com/charmbracelet/soft-serve/server/config"
17 "github.com/charmbracelet/soft-serve/server/git"
18 "github.com/charmbracelet/soft-serve/server/utils"
19 "github.com/go-git/go-git/v5/plumbing/format/pktline"
20 "github.com/prometheus/client_golang/prometheus"
21 "github.com/prometheus/client_golang/prometheus/promauto"
22)
23
24var (
25 uploadPackGitCounter = promauto.NewCounterVec(prometheus.CounterOpts{
26 Namespace: "soft_serve",
27 Subsystem: "git",
28 Name: "git_upload_pack_total",
29 Help: "The total number of git-upload-pack requests",
30 }, []string{"repo"})
31
32 uploadArchiveGitCounter = promauto.NewCounterVec(prometheus.CounterOpts{
33 Namespace: "soft_serve",
34 Subsystem: "git",
35 Name: "git_upload_archive_total",
36 Help: "The total number of git-upload-archive requests",
37 }, []string{"repo"})
38)
39
40var (
41
42 // ErrServerClosed indicates that the server has been closed.
43 ErrServerClosed = fmt.Errorf("git: %w", net.ErrClosed)
44)
45
46// GitDaemon represents a Git daemon.
47type GitDaemon struct {
48 ctx context.Context
49 listener net.Listener
50 addr string
51 finished chan struct{}
52 conns connections
53 cfg *config.Config
54 be *backend.Backend
55 wg sync.WaitGroup
56 once sync.Once
57 logger *log.Logger
58}
59
60// NewDaemon returns a new Git daemon.
61func NewGitDaemon(ctx context.Context) (*GitDaemon, error) {
62 cfg := config.FromContext(ctx)
63 addr := cfg.GitDaemon.ListenAddr
64 d := &GitDaemon{
65 ctx: ctx,
66 addr: addr,
67 finished: make(chan struct{}, 1),
68 cfg: cfg,
69 be: backend.FromContext(ctx),
70 conns: connections{m: make(map[net.Conn]struct{})},
71 logger: log.FromContext(ctx).WithPrefix("gitdaemon"),
72 }
73 listener, err := net.Listen("tcp", d.addr)
74 if err != nil {
75 return nil, err
76 }
77 d.listener = listener
78 return d, nil
79}
80
81// Start starts the Git TCP daemon.
82func (d *GitDaemon) Start() error {
83 defer d.listener.Close() // nolint: errcheck
84
85 d.wg.Add(1)
86 defer d.wg.Done()
87
88 var tempDelay time.Duration
89 for {
90 conn, err := d.listener.Accept()
91 if err != nil {
92 select {
93 case <-d.finished:
94 return ErrServerClosed
95 default:
96 d.logger.Debugf("git: error accepting connection: %v", err)
97 }
98 if ne, ok := err.(net.Error); ok && ne.Temporary() {
99 if tempDelay == 0 {
100 tempDelay = 5 * time.Millisecond
101 } else {
102 tempDelay *= 2
103 }
104 if max := 1 * time.Second; tempDelay > max {
105 tempDelay = max
106 }
107 time.Sleep(tempDelay)
108 continue
109 }
110 return err
111 }
112
113 // Close connection if there are too many open connections.
114 if d.conns.Size()+1 >= d.cfg.GitDaemon.MaxConnections {
115 d.logger.Debugf("git: max connections reached, closing %s", conn.RemoteAddr())
116 d.fatal(conn, git.ErrMaxConnections)
117 continue
118 }
119
120 d.wg.Add(1)
121 go func() {
122 d.handleClient(conn)
123 d.wg.Done()
124 }()
125 }
126}
127
128func (d *GitDaemon) fatal(c net.Conn, err error) {
129 git.WritePktline(c, err)
130 if err := c.Close(); err != nil {
131 d.logger.Debugf("git: error closing connection: %v", err)
132 }
133}
134
135// handleClient handles a git protocol client.
136func (d *GitDaemon) handleClient(conn net.Conn) {
137 ctx, cancel := context.WithCancel(context.Background())
138 idleTimeout := time.Duration(d.cfg.GitDaemon.IdleTimeout) * time.Second
139 c := &serverConn{
140 Conn: conn,
141 idleTimeout: idleTimeout,
142 closeCanceler: cancel,
143 }
144 if d.cfg.GitDaemon.MaxTimeout > 0 {
145 dur := time.Duration(d.cfg.GitDaemon.MaxTimeout) * time.Second
146 c.maxDeadline = time.Now().Add(dur)
147 }
148 d.conns.Add(c)
149 defer func() {
150 d.conns.Close(c)
151 }()
152
153 readc := make(chan struct{}, 1)
154 s := pktline.NewScanner(c)
155 go func() {
156 if !s.Scan() {
157 if err := s.Err(); err != nil {
158 if nerr, ok := err.(net.Error); ok && nerr.Timeout() {
159 d.fatal(c, git.ErrTimeout)
160 } else {
161 d.logger.Debugf("git: error scanning pktline: %v", err)
162 d.fatal(c, git.ErrSystemMalfunction)
163 }
164 }
165 return
166 }
167 readc <- struct{}{}
168 }()
169
170 select {
171 case <-ctx.Done():
172 if err := ctx.Err(); err != nil {
173 d.logger.Debugf("git: connection context error: %v", err)
174 }
175 return
176 case <-readc:
177 line := s.Bytes()
178 split := bytes.SplitN(line, []byte{' '}, 2)
179 if len(split) != 2 {
180 d.fatal(c, git.ErrInvalidRequest)
181 return
182 }
183
184 var handler git.ServiceHandler
185 var counter *prometheus.CounterVec
186 service := git.Service(split[0])
187 switch service {
188 case git.UploadPackService:
189 handler = git.UploadPack
190 counter = uploadPackGitCounter
191 case git.UploadArchiveService:
192 handler = git.UploadArchive
193 counter = uploadArchiveGitCounter
194 default:
195 d.fatal(c, git.ErrInvalidRequest)
196 return
197 }
198
199 opts := bytes.SplitN(split[1], []byte{0}, 3)
200 if len(opts) < 2 {
201 d.fatal(c, git.ErrInvalidRequest) // nolint: errcheck
202 return
203 }
204
205 host := strings.TrimPrefix(string(opts[1]), "host=")
206 extraParams := map[string]string{}
207
208 if len(opts) > 2 {
209 buf := bytes.TrimPrefix(opts[2], []byte{0})
210 for _, o := range bytes.Split(buf, []byte{0}) {
211 opt := string(o)
212 if opt == "" {
213 continue
214 }
215
216 kv := strings.SplitN(opt, "=", 2)
217 if len(kv) != 2 {
218 d.logger.Errorf("git: invalid option %q", opt)
219 continue
220 }
221
222 extraParams[kv[0]] = kv[1]
223 }
224
225 version := extraParams["version"]
226 if version != "" {
227 d.logger.Debugf("git: protocol version %s", version)
228 }
229 }
230
231 be := d.be
232 if !be.AllowKeyless(ctx) {
233 d.fatal(c, git.ErrUnauthorized)
234 return
235 }
236
237 name := utils.SanitizeRepo(string(opts[0]))
238 d.logger.Debugf("git: connect %s %s %s", c.RemoteAddr(), service, name)
239 defer d.logger.Debugf("git: disconnect %s %s %s", c.RemoteAddr(), service, name)
240
241 // git bare repositories should end in ".git"
242 // https://git-scm.com/docs/gitrepository-layout
243 repo := name + ".git"
244 reposDir := filepath.Join(d.cfg.DataPath, "repos")
245 if err := git.EnsureWithin(reposDir, repo); err != nil {
246 d.logger.Debugf("git: error ensuring repo path: %v", err)
247 d.fatal(c, git.ErrNotExist)
248 return
249 }
250
251 if _, err := d.be.Repository(ctx, repo); err != nil {
252 d.fatal(c, git.ErrNotExist)
253 return
254 }
255
256 auth, err := be.AccessLevel(ctx, name, nil)
257 if err != nil || auth < access.ReadOnlyAccess {
258 d.fatal(c, git.ErrUnauthorized)
259 return
260 }
261
262 // Environment variables to pass down to git hooks.
263 envs := []string{
264 "SOFT_SERVE_REPO_NAME=" + name,
265 "SOFT_SERVE_REPO_PATH=" + filepath.Join(reposDir, repo),
266 "SOFT_SERVE_HOST=" + host,
267 }
268
269 // Add git protocol environment variable.
270 if len(extraParams) > 0 {
271 var gitProto string
272 for k, v := range extraParams {
273 if len(gitProto) > 0 {
274 gitProto += ":"
275 }
276 gitProto += k + "=" + v
277 }
278 envs = append(envs, "GIT_PROTOCOL="+gitProto)
279 }
280
281 envs = append(envs, d.cfg.Environ()...)
282
283 cmd := git.ServiceCommand{
284 Stdin: c,
285 Stdout: c,
286 Stderr: c,
287 Env: envs,
288 Dir: filepath.Join(reposDir, repo),
289 }
290
291 if err := handler(ctx, cmd); err != nil {
292 d.logger.Debugf("git: error handling request: %v", err)
293 d.fatal(c, err)
294 return
295 }
296
297 counter.WithLabelValues(name)
298 }
299}
300
301// Close closes the underlying listener.
302func (d *GitDaemon) Close() error {
303 d.once.Do(func() { close(d.finished) })
304 err := d.listener.Close()
305 d.conns.CloseAll()
306 return err
307}
308
309// Shutdown gracefully shuts down the daemon.
310func (d *GitDaemon) Shutdown(ctx context.Context) error {
311 d.once.Do(func() { close(d.finished) })
312 err := d.listener.Close()
313 finished := make(chan struct{}, 1)
314 go func() {
315 d.wg.Wait()
316 finished <- struct{}{}
317 }()
318 select {
319 case <-ctx.Done():
320 return ctx.Err()
321 case <-finished:
322 return err
323 }
324}