1package daemon
2
3import (
4 "bytes"
5 "context"
6 "fmt"
7 "net"
8 "path/filepath"
9 "strings"
10 "sync"
11 "time"
12
13 "github.com/charmbracelet/log"
14 "github.com/charmbracelet/soft-serve/pkg/access"
15 "github.com/charmbracelet/soft-serve/pkg/backend"
16 "github.com/charmbracelet/soft-serve/pkg/config"
17 "github.com/charmbracelet/soft-serve/pkg/git"
18 "github.com/charmbracelet/soft-serve/pkg/utils"
19 "github.com/go-git/go-git/v5/plumbing/format/pktline"
20 "github.com/prometheus/client_golang/prometheus"
21 "github.com/prometheus/client_golang/prometheus/promauto"
22)
23
24var (
25 uploadPackGitCounter = promauto.NewCounterVec(prometheus.CounterOpts{
26 Namespace: "soft_serve",
27 Subsystem: "git",
28 Name: "git_upload_pack_total",
29 Help: "The total number of git-upload-pack requests",
30 }, []string{"repo"})
31
32 uploadArchiveGitCounter = promauto.NewCounterVec(prometheus.CounterOpts{
33 Namespace: "soft_serve",
34 Subsystem: "git",
35 Name: "git_upload_archive_total",
36 Help: "The total number of git-upload-archive requests",
37 }, []string{"repo"})
38)
39
40var (
41
42 // ErrServerClosed indicates that the server has been closed.
43 ErrServerClosed = fmt.Errorf("git: %w", net.ErrClosed)
44)
45
46// GitDaemon represents a Git daemon.
47type GitDaemon struct {
48 ctx context.Context
49 listener net.Listener
50 addr string
51 finished chan struct{}
52 conns connections
53 cfg *config.Config
54 be *backend.Backend
55 wg sync.WaitGroup
56 once sync.Once
57 logger *log.Logger
58}
59
60// NewDaemon returns a new Git daemon.
61func NewGitDaemon(ctx context.Context) (*GitDaemon, error) {
62 cfg := config.FromContext(ctx)
63 addr := cfg.Git.ListenAddr
64 d := &GitDaemon{
65 ctx: ctx,
66 addr: addr,
67 finished: make(chan struct{}, 1),
68 cfg: cfg,
69 be: backend.FromContext(ctx),
70 conns: connections{m: make(map[net.Conn]struct{})},
71 logger: log.FromContext(ctx).WithPrefix("gitdaemon"),
72 }
73 listener, err := net.Listen("tcp", d.addr)
74 if err != nil {
75 return nil, err
76 }
77 d.listener = listener
78 return d, nil
79}
80
81// Start starts the Git TCP daemon.
82func (d *GitDaemon) Start() error {
83 defer d.listener.Close() // nolint: errcheck
84
85 d.wg.Add(1)
86 defer d.wg.Done()
87
88 var tempDelay time.Duration
89 for {
90 conn, err := d.listener.Accept()
91 if err != nil {
92 select {
93 case <-d.finished:
94 return ErrServerClosed
95 default:
96 d.logger.Debugf("git: error accepting connection: %v", err)
97 }
98 if ne, ok := err.(net.Error); ok && ne.Temporary() { // nolint: staticcheck
99 if tempDelay == 0 {
100 tempDelay = 5 * time.Millisecond
101 } else {
102 tempDelay *= 2
103 }
104 if max := 1 * time.Second; tempDelay > max {
105 tempDelay = max
106 }
107 time.Sleep(tempDelay)
108 continue
109 }
110 return err
111 }
112
113 // Close connection if there are too many open connections.
114 if d.conns.Size()+1 >= d.cfg.Git.MaxConnections {
115 d.logger.Debugf("git: max connections reached, closing %s", conn.RemoteAddr())
116 d.fatal(conn, git.ErrMaxConnections)
117 continue
118 }
119
120 d.wg.Add(1)
121 go func() {
122 d.handleClient(conn)
123 d.wg.Done()
124 }()
125 }
126}
127
128func (d *GitDaemon) fatal(c net.Conn, err error) {
129 git.WritePktlineErr(c, err) // nolint: errcheck
130 if err := c.Close(); err != nil {
131 d.logger.Debugf("git: error closing connection: %v", err)
132 }
133}
134
135// handleClient handles a git protocol client.
136func (d *GitDaemon) handleClient(conn net.Conn) {
137 ctx, cancel := context.WithCancel(context.Background())
138 idleTimeout := time.Duration(d.cfg.Git.IdleTimeout) * time.Second
139 c := &serverConn{
140 Conn: conn,
141 idleTimeout: idleTimeout,
142 closeCanceler: cancel,
143 }
144 if d.cfg.Git.MaxTimeout > 0 {
145 dur := time.Duration(d.cfg.Git.MaxTimeout) * time.Second
146 c.maxDeadline = time.Now().Add(dur)
147 }
148 d.conns.Add(c)
149 defer func() {
150 d.conns.Close(c) // nolint: errcheck
151 }()
152
153 readc := make(chan struct{}, 1)
154 s := pktline.NewScanner(c)
155 go func() {
156 if !s.Scan() {
157 if err := s.Err(); err != nil {
158 if nerr, ok := err.(net.Error); ok && nerr.Timeout() {
159 d.fatal(c, git.ErrTimeout)
160 } else {
161 d.logger.Debugf("git: error scanning pktline: %v", err)
162 d.fatal(c, git.ErrSystemMalfunction)
163 }
164 }
165 return
166 }
167 readc <- struct{}{}
168 }()
169
170 select {
171 case <-ctx.Done():
172 if err := ctx.Err(); err != nil {
173 d.logger.Debugf("git: connection context error: %v", err)
174 }
175 return
176 case <-readc:
177 line := s.Bytes()
178 split := bytes.SplitN(line, []byte{' '}, 2)
179 if len(split) != 2 {
180 d.fatal(c, git.ErrInvalidRequest)
181 return
182 }
183
184 var counter *prometheus.CounterVec
185 service := git.Service(split[0])
186 switch service {
187 case git.UploadPackService:
188 counter = uploadPackGitCounter
189 case git.UploadArchiveService:
190 counter = uploadArchiveGitCounter
191 default:
192 d.fatal(c, git.ErrInvalidRequest)
193 return
194 }
195
196 opts := bytes.SplitN(split[1], []byte{0}, 3)
197 if len(opts) < 2 {
198 d.fatal(c, git.ErrInvalidRequest) // nolint: errcheck
199 return
200 }
201
202 host := strings.TrimPrefix(string(opts[1]), "host=")
203 extraParams := map[string]string{}
204
205 if len(opts) > 2 {
206 buf := bytes.TrimPrefix(opts[2], []byte{0})
207 for _, o := range bytes.Split(buf, []byte{0}) {
208 opt := string(o)
209 if opt == "" {
210 continue
211 }
212
213 kv := strings.SplitN(opt, "=", 2)
214 if len(kv) != 2 {
215 d.logger.Errorf("git: invalid option %q", opt)
216 continue
217 }
218
219 extraParams[kv[0]] = kv[1]
220 }
221
222 version := extraParams["version"]
223 if version != "" {
224 d.logger.Debugf("git: protocol version %s", version)
225 }
226 }
227
228 be := d.be
229 if !be.AllowKeyless(ctx) {
230 d.fatal(c, git.ErrNotAuthed)
231 return
232 }
233
234 name := utils.SanitizeRepo(string(opts[0]))
235 d.logger.Debugf("git: connect %s %s %s", c.RemoteAddr(), service, name)
236 defer d.logger.Debugf("git: disconnect %s %s %s", c.RemoteAddr(), service, name)
237
238 // git bare repositories should end in ".git"
239 // https://git-scm.com/docs/gitrepository-layout
240 repo := name + ".git"
241 reposDir := filepath.Join(d.cfg.DataPath, "repos")
242 if err := git.EnsureWithin(reposDir, repo); err != nil {
243 d.logger.Debugf("git: error ensuring repo path: %v", err)
244 d.fatal(c, git.ErrInvalidRepo)
245 return
246 }
247
248 if _, err := d.be.Repository(ctx, repo); err != nil {
249 d.fatal(c, git.ErrInvalidRepo)
250 return
251 }
252
253 auth := be.AccessLevel(ctx, name, "")
254 if auth < access.ReadOnlyAccess {
255 d.fatal(c, git.ErrNotAuthed)
256 return
257 }
258
259 // Environment variables to pass down to git hooks.
260 envs := []string{
261 "SOFT_SERVE_REPO_NAME=" + name,
262 "SOFT_SERVE_REPO_PATH=" + filepath.Join(reposDir, repo),
263 "SOFT_SERVE_HOST=" + host,
264 "SOFT_SERVE_LOG_PATH=" + filepath.Join(d.cfg.DataPath, "log", "hooks.log"),
265 }
266
267 // Add git protocol environment variable.
268 if len(extraParams) > 0 {
269 var gitProto string
270 for k, v := range extraParams {
271 if len(gitProto) > 0 {
272 gitProto += ":"
273 }
274 gitProto += k + "=" + v
275 }
276 envs = append(envs, "GIT_PROTOCOL="+gitProto)
277 }
278
279 envs = append(envs, d.cfg.Environ()...)
280
281 cmd := git.ServiceCommand{
282 Stdin: c,
283 Stdout: c,
284 Stderr: c,
285 Env: envs,
286 Dir: filepath.Join(reposDir, repo),
287 }
288
289 if err := service.Handler(ctx, cmd); err != nil {
290 d.logger.Debugf("git: error handling request: %v", err)
291 d.fatal(c, err)
292 return
293 }
294
295 counter.WithLabelValues(name)
296 }
297}
298
299// Close closes the underlying listener.
300func (d *GitDaemon) Close() error {
301 d.once.Do(func() { close(d.finished) })
302 err := d.listener.Close()
303 d.conns.CloseAll() // nolint: errcheck
304 return err
305}
306
307// Shutdown gracefully shuts down the daemon.
308func (d *GitDaemon) Shutdown(ctx context.Context) error {
309 d.once.Do(func() { close(d.finished) })
310 err := d.listener.Close()
311 finished := make(chan struct{}, 1)
312 go func() {
313 d.wg.Wait()
314 finished <- struct{}{}
315 }()
316 select {
317 case <-ctx.Done():
318 return ctx.Err()
319 case <-finished:
320 return err
321 }
322}