2012-01-07 12:42:45 +01:00
|
|
|
#!/bin/sh
|
|
|
|
|
|
|
|
test_description='test fetching over git protocol'
|
|
|
|
. ./test-lib.sh
|
|
|
|
|
|
|
|
. "$TEST_DIRECTORY"/lib-git-daemon.sh
|
|
|
|
start_git_daemon
|
|
|
|
|
2016-02-14 10:26:29 +01:00
|
|
|
check_verbose_connect () {
|
|
|
|
grep -F "Looking up 127.0.0.1 ..." stderr &&
|
|
|
|
grep -F "Connecting to 127.0.0.1 (port " stderr &&
|
|
|
|
grep -F "done." stderr
|
|
|
|
}
|
|
|
|
|
2012-01-07 12:42:45 +01:00
|
|
|
test_expect_success 'setup repository' '
|
2013-01-16 03:05:08 +01:00
|
|
|
git config push.default matching &&
|
2012-01-07 12:42:45 +01:00
|
|
|
echo content >file &&
|
|
|
|
git add file &&
|
|
|
|
git commit -m one
|
|
|
|
'
|
|
|
|
|
|
|
|
test_expect_success 'create git-accessible bare repository' '
|
|
|
|
mkdir "$GIT_DAEMON_DOCUMENT_ROOT_PATH/repo.git" &&
|
|
|
|
(cd "$GIT_DAEMON_DOCUMENT_ROOT_PATH/repo.git" &&
|
|
|
|
git --bare init &&
|
|
|
|
: >git-daemon-export-ok
|
|
|
|
) &&
|
|
|
|
git remote add public "$GIT_DAEMON_DOCUMENT_ROOT_PATH/repo.git" &&
|
|
|
|
git push public master:master
|
|
|
|
'
|
|
|
|
|
|
|
|
test_expect_success 'clone git repository' '
|
2016-02-14 10:26:29 +01:00
|
|
|
git clone -v "$GIT_DAEMON_URL/repo.git" clone 2>stderr &&
|
|
|
|
check_verbose_connect &&
|
2012-01-07 12:42:45 +01:00
|
|
|
test_cmp file clone/file
|
|
|
|
'
|
|
|
|
|
|
|
|
test_expect_success 'fetch changes via git protocol' '
|
|
|
|
echo content >>file &&
|
|
|
|
git commit -a -m two &&
|
|
|
|
git push public &&
|
2016-02-14 10:26:29 +01:00
|
|
|
(cd clone && git pull -v) 2>stderr &&
|
|
|
|
check_verbose_connect &&
|
2012-01-07 12:42:45 +01:00
|
|
|
test_cmp file clone/file
|
|
|
|
'
|
|
|
|
|
2016-02-14 10:26:29 +01:00
|
|
|
test_expect_success 'no-op fetch -v stderr is as expected' '
|
|
|
|
(cd clone && git fetch -v) 2>stderr &&
|
|
|
|
check_verbose_connect
|
|
|
|
'
|
|
|
|
|
|
|
|
test_expect_success 'no-op fetch without "-v" is quiet' '
|
|
|
|
(cd clone && git fetch) 2>stderr &&
|
|
|
|
! test -s stderr
|
|
|
|
'
|
|
|
|
|
2013-10-21 19:54:11 +02:00
|
|
|
test_expect_success 'remote detects correct HEAD' '
|
2012-01-07 12:42:45 +01:00
|
|
|
git push public master:other &&
|
|
|
|
(cd clone &&
|
|
|
|
git remote set-head -d origin &&
|
|
|
|
git remote set-head -a origin &&
|
|
|
|
git symbolic-ref refs/remotes/origin/HEAD > output &&
|
|
|
|
echo refs/remotes/origin/master > expect &&
|
|
|
|
test_cmp expect output
|
|
|
|
)
|
|
|
|
'
|
|
|
|
|
|
|
|
test_expect_success 'prepare pack objects' '
|
|
|
|
cp -R "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo.git "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo_pack.git &&
|
|
|
|
(cd "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo_pack.git &&
|
|
|
|
git --bare repack -a -d
|
|
|
|
)
|
|
|
|
'
|
|
|
|
|
|
|
|
test_expect_success 'fetch notices corrupt pack' '
|
|
|
|
cp -R "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo_pack.git "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo_bad1.git &&
|
|
|
|
(cd "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo_bad1.git &&
|
2016-01-04 10:10:48 +01:00
|
|
|
p=$(ls objects/pack/pack-*.pack) &&
|
2012-01-07 12:42:45 +01:00
|
|
|
chmod u+w $p &&
|
|
|
|
printf %0256d 0 | dd of=$p bs=256 count=1 seek=1 conv=notrunc
|
|
|
|
) &&
|
|
|
|
mkdir repo_bad1.git &&
|
|
|
|
(cd repo_bad1.git &&
|
|
|
|
git --bare init &&
|
|
|
|
test_must_fail git --bare fetch "$GIT_DAEMON_URL/repo_bad1.git" &&
|
2016-01-04 10:10:48 +01:00
|
|
|
test 0 = $(ls objects/pack/pack-*.pack | wc -l)
|
2012-01-07 12:42:45 +01:00
|
|
|
)
|
|
|
|
'
|
|
|
|
|
|
|
|
test_expect_success 'fetch notices corrupt idx' '
|
|
|
|
cp -R "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo_pack.git "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo_bad2.git &&
|
|
|
|
(cd "$GIT_DAEMON_DOCUMENT_ROOT_PATH"/repo_bad2.git &&
|
2016-01-04 10:10:48 +01:00
|
|
|
p=$(ls objects/pack/pack-*.idx) &&
|
2012-01-07 12:42:45 +01:00
|
|
|
chmod u+w $p &&
|
|
|
|
printf %0256d 0 | dd of=$p bs=256 count=1 seek=1 conv=notrunc
|
|
|
|
) &&
|
|
|
|
mkdir repo_bad2.git &&
|
|
|
|
(cd repo_bad2.git &&
|
|
|
|
git --bare init &&
|
|
|
|
test_must_fail git --bare fetch "$GIT_DAEMON_URL/repo_bad2.git" &&
|
2016-01-04 10:10:48 +01:00
|
|
|
test 0 = $(ls objects/pack | wc -l)
|
2012-01-07 12:42:45 +01:00
|
|
|
)
|
|
|
|
'
|
|
|
|
|
|
|
|
test_remote_error()
|
|
|
|
{
|
|
|
|
do_export=YesPlease
|
|
|
|
while test $# -gt 0
|
|
|
|
do
|
|
|
|
case $1 in
|
|
|
|
-x)
|
|
|
|
shift
|
|
|
|
chmod -x "$GIT_DAEMON_DOCUMENT_ROOT_PATH/repo.git"
|
|
|
|
;;
|
|
|
|
-n)
|
|
|
|
shift
|
|
|
|
do_export=
|
|
|
|
;;
|
|
|
|
*)
|
|
|
|
break
|
|
|
|
esac
|
|
|
|
done
|
|
|
|
|
2012-04-24 09:50:04 +02:00
|
|
|
msg=$1
|
|
|
|
shift
|
2012-01-07 12:42:45 +01:00
|
|
|
cmd=$1
|
2012-04-24 09:50:04 +02:00
|
|
|
shift
|
|
|
|
repo=$1
|
|
|
|
shift || error "invalid number of arguments"
|
2012-01-07 12:42:45 +01:00
|
|
|
|
|
|
|
if test -x "$GIT_DAEMON_DOCUMENT_ROOT_PATH/$repo"
|
|
|
|
then
|
|
|
|
if test -n "$do_export"
|
|
|
|
then
|
|
|
|
: >"$GIT_DAEMON_DOCUMENT_ROOT_PATH/$repo/git-daemon-export-ok"
|
|
|
|
else
|
|
|
|
rm -f "$GIT_DAEMON_DOCUMENT_ROOT_PATH/$repo/git-daemon-export-ok"
|
|
|
|
fi
|
|
|
|
fi
|
|
|
|
|
2012-04-24 09:50:04 +02:00
|
|
|
test_must_fail git "$cmd" "$GIT_DAEMON_URL/$repo" "$@" 2>output &&
|
2013-10-21 19:54:12 +02:00
|
|
|
test_i18ngrep "fatal: remote error: $msg: /$repo" output &&
|
2012-01-07 12:42:45 +01:00
|
|
|
ret=$?
|
|
|
|
chmod +x "$GIT_DAEMON_DOCUMENT_ROOT_PATH/repo.git"
|
|
|
|
(exit $ret)
|
|
|
|
}
|
|
|
|
|
|
|
|
msg="access denied or repository not exported"
|
2012-04-24 09:50:04 +02:00
|
|
|
test_expect_success 'clone non-existent' "test_remote_error '$msg' clone nowhere.git "
|
|
|
|
test_expect_success 'push disabled' "test_remote_error '$msg' push repo.git master"
|
|
|
|
test_expect_success 'read access denied' "test_remote_error -x '$msg' fetch repo.git "
|
|
|
|
test_expect_success 'not exported' "test_remote_error -n '$msg' fetch repo.git "
|
2012-01-07 12:42:45 +01:00
|
|
|
|
|
|
|
stop_git_daemon
|
|
|
|
start_git_daemon --informative-errors
|
|
|
|
|
2012-04-24 09:50:04 +02:00
|
|
|
test_expect_success 'clone non-existent' "test_remote_error 'no such repository' clone nowhere.git "
|
|
|
|
test_expect_success 'push disabled' "test_remote_error 'service not enabled' push repo.git master"
|
|
|
|
test_expect_success 'read access denied' "test_remote_error -x 'no such repository' fetch repo.git "
|
|
|
|
test_expect_success 'not exported' "test_remote_error -n 'repository not exported' fetch repo.git "
|
2012-01-07 12:42:45 +01:00
|
|
|
|
2015-02-17 09:40:57 +01:00
|
|
|
stop_git_daemon
|
|
|
|
start_git_daemon --interpolated-path="$GIT_DAEMON_DOCUMENT_ROOT_PATH/%H%D"
|
|
|
|
|
|
|
|
test_expect_success 'access repo via interpolated hostname' '
|
|
|
|
repo="$GIT_DAEMON_DOCUMENT_ROOT_PATH/localhost/interp.git" &&
|
|
|
|
git init --bare "$repo" &&
|
|
|
|
git push "$repo" HEAD &&
|
|
|
|
>"$repo"/git-daemon-export-ok &&
|
|
|
|
GIT_OVERRIDE_VIRTUAL_HOST=localhost \
|
2018-01-25 01:55:05 +01:00
|
|
|
git ls-remote "$GIT_DAEMON_URL/interp.git" &&
|
2015-02-17 09:40:57 +01:00
|
|
|
GIT_OVERRIDE_VIRTUAL_HOST=LOCALHOST \
|
2018-01-25 01:55:05 +01:00
|
|
|
git ls-remote "$GIT_DAEMON_URL/interp.git"
|
2015-02-17 09:40:57 +01:00
|
|
|
'
|
|
|
|
|
daemon: sanitize incoming virtual hostname
We use the daemon_avoid_alias function to make sure that the
pathname the user gives us is sane. However, after applying
that check, we might then interpolate the path using a
string given by the server admin, but which may contain more
untrusted data from the client. We should be sure to
sanitize this data, as well.
We cannot use daemon_avoid_alias here, as it is more strict
than we need in requiring a leading '/'. At the same time,
we can be much more strict here. We are interpreting a
hostname, which should not contain slashes or excessive runs
of dots, as those things are not allowed in DNS names.
Note that in addition to cleansing the hostname field, we
must check the "canonical hostname" (%CH) as well as the
port (%P), which we take as a raw string. For the canonical
hostname, this comes from an actual DNS lookup on the
accessed IP, which makes it a much less likely vector for
problems. But it does not hurt to sanitize it in the same
way. Unfortunately we cannot test this case easily, as it
would involve a custom hostname lookup.
We do not need to check %IP, as it comes straight from
inet_ntop, so must have a sane form.
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2015-02-17 20:09:24 +01:00
|
|
|
test_expect_success 'hostname cannot break out of directory' '
|
|
|
|
repo="$GIT_DAEMON_DOCUMENT_ROOT_PATH/../escape.git" &&
|
|
|
|
git init --bare "$repo" &&
|
|
|
|
git push "$repo" HEAD &&
|
|
|
|
>"$repo"/git-daemon-export-ok &&
|
|
|
|
test_must_fail \
|
|
|
|
env GIT_OVERRIDE_VIRTUAL_HOST=.. \
|
2018-01-25 01:55:05 +01:00
|
|
|
git ls-remote "$GIT_DAEMON_URL/escape.git"
|
daemon: sanitize incoming virtual hostname
We use the daemon_avoid_alias function to make sure that the
pathname the user gives us is sane. However, after applying
that check, we might then interpolate the path using a
string given by the server admin, but which may contain more
untrusted data from the client. We should be sure to
sanitize this data, as well.
We cannot use daemon_avoid_alias here, as it is more strict
than we need in requiring a leading '/'. At the same time,
we can be much more strict here. We are interpreting a
hostname, which should not contain slashes or excessive runs
of dots, as those things are not allowed in DNS names.
Note that in addition to cleansing the hostname field, we
must check the "canonical hostname" (%CH) as well as the
port (%P), which we take as a raw string. For the canonical
hostname, this comes from an actual DNS lookup on the
accessed IP, which makes it a much less likely vector for
problems. But it does not hurt to sanitize it in the same
way. Unfortunately we cannot test this case easily, as it
would involve a custom hostname lookup.
We do not need to check %IP, as it comes straight from
inet_ntop, so must have a sane form.
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2015-02-17 20:09:24 +01:00
|
|
|
'
|
|
|
|
|
daemon: fix off-by-one in logging extended attributes
If receive a request like:
git-upload-pack /foo.git\0host=localhost
we mark the offset of the NUL byte as "len", and then log
the bytes after the NUL with a "%.*s" placeholder, using
"pktlen - len" as the length, and "line + len + 1" as the
start of the string.
This is off-by-one, since the start of the string skips past
the separating NUL byte, but the adjusted length includes
it. Fortunately this doesn't actually read past the end of
the buffer, since "%.*s" will stop when it hits a NUL. And
regardless of what is in the buffer, packet_read() will
always add an extra NUL terminator for safety.
As an aside, the git.git client sends an extra NUL after a
"host" field, too, so we'd generally hit that one first, not
the one added by packet_read(). You can see this in the test
output which reports 15 bytes, even though the string has
only 14 bytes of visible data. But the point is that even a
client sending unusual data could not get us to read past
the end of the buffer, so this is purely a cosmetic fix.
Reported-by: Michael Haggerty <mhagger@alum.mit.edu>
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2018-01-25 01:56:07 +01:00
|
|
|
test_expect_success 'daemon log records hostnames' '
|
|
|
|
cat >expect <<-\EOF &&
|
|
|
|
Extended attributes (15 bytes) exist <host=localhost>
|
|
|
|
EOF
|
|
|
|
>daemon.log &&
|
|
|
|
GIT_OVERRIDE_VIRTUAL_HOST=localhost \
|
|
|
|
git ls-remote "$GIT_DAEMON_URL/interp.git" &&
|
|
|
|
grep -i extended.attribute daemon.log | cut -d" " -f2- >actual &&
|
|
|
|
test_cmp expect actual
|
|
|
|
'
|
|
|
|
|
2012-01-07 12:42:45 +01:00
|
|
|
stop_git_daemon
|
|
|
|
test_done
|