1 /*
2  * Copyright (c) 2018, 2019 Ori Bernstein <ori@openbsd.org>
3  * Copyright (c) 2021 Stefan Sperling <stsp@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include "got_compat.h"
19 
20 #include <sys/queue.h>
21 #include <sys/types.h>
22 #include <sys/socket.h>
23 #include <sys/uio.h>
24 #include <netdb.h>
25 
26 #include <assert.h>
27 #include <err.h>
28 #include <limits.h>
29 #include <sha1.h>
30 #include <stdint.h>
31 #include <limits.h>
32 #include <stdio.h>
33 #include <stdlib.h>
34 #include <string.h>
35 #include <unistd.h>
36 #include <imsg.h>
37 
38 #include "got_error.h"
39 #include "got_path.h"
40 #include "got_object.h"
41 
42 #include "got_compat.h"
43 
44 #include "got_lib_dial.h"
45 #include "got_lib_delta.h"
46 #include "got_lib_object.h"
47 #include "got_lib_privsep.h"
48 #include "got_dial.h"
49 
50 #ifndef nitems
51 #define nitems(_a) (sizeof((_a)) / sizeof((_a)[0]))
52 #endif
53 
54 #ifndef ssizeof
55 #define ssizeof(_x) ((ssize_t)(sizeof(_x)))
56 #endif
57 
58 #ifndef MIN
59 #define	MIN(_a,_b) ((_a) < (_b) ? (_a) : (_b))
60 #endif
61 
62 #ifndef GOT_DIAL_PATH_SSH
63 #define GOT_DIAL_PATH_SSH	"/usr/bin/ssh"
64 #endif
65 
66 /* IANA assigned */
67 #define GOT_DEFAULT_GIT_PORT		9418
68 #define GOT_DEFAULT_GIT_PORT_STR	"9418"
69 
70 const struct got_error *
71 got_dial_apply_unveil(const char *proto)
72 {
73 	if (strcmp(proto, "git+ssh") == 0 || strcmp(proto, "ssh") == 0) {
74 		if (unveil(GOT_DIAL_PATH_SSH, "x") != 0) {
75 			return got_error_from_errno2("unveil",
76 			    GOT_DIAL_PATH_SSH);
77 		}
78 	}
79 
80 	if (strstr(proto, "http") != NULL) {
81 		if (unveil(GOT_PATH_PROG_FETCH_HTTP, "x") != 0) {
82 			return got_error_from_errno2("unveil",
83 			    GOT_PATH_PROG_FETCH_HTTP);
84 		}
85 	}
86 
87 	return NULL;
88 }
89 
90 static int
91 hassuffix(const char *base, const char *suf)
92 {
93 	int nb, ns;
94 
95 	nb = strlen(base);
96 	ns = strlen(suf);
97 	if (ns <= nb && strcmp(base + (nb - ns), suf) == 0)
98 		return 1;
99 	return 0;
100 }
101 
102 const struct got_error *
103 got_dial_parse_uri(char **proto, char **host, char **port,
104     char **server_path, char **repo_name, const char *uri)
105 {
106 	const struct got_error *err = NULL;
107 	char *s, *p, *q;
108 
109 	*proto = *host = *port = *server_path = *repo_name = NULL;
110 
111 	p = strstr(uri, "://");
112 	if (!p) {
113 		/* Try parsing Git's "scp" style URL syntax. */
114 		*proto = strdup("ssh");
115 		if (*proto == NULL) {
116 			err = got_error_from_errno("strdup");
117 			goto done;
118 		}
119 		s = (char *)uri;
120 		q = strchr(s, ':');
121 		if (q == NULL) {
122 			err = got_error(GOT_ERR_PARSE_URI);
123 			goto done;
124 		}
125 		/* No slashes allowed before first colon. */
126 		p = strchr(s, '/');
127 		if (p && q > p) {
128 			err = got_error(GOT_ERR_PARSE_URI);
129 			goto done;
130 		}
131 		*host = strndup(s, q - s);
132 		if (*host == NULL) {
133 			err = got_error_from_errno("strndup");
134 			goto done;
135 		}
136 		if ((*host)[0] == '\0') {
137 			err = got_error(GOT_ERR_PARSE_URI);
138 			goto done;
139 		}
140 		p = q + 1;
141 	} else {
142 		*proto = strndup(uri, p - uri);
143 		if (*proto == NULL) {
144 			err = got_error_from_errno("strndup");
145 			goto done;
146 		}
147 		s = p + 3;
148 
149 		p = strstr(s, "/");
150 		if (p == NULL || strlen(p) == 1) {
151 			err = got_error(GOT_ERR_PARSE_URI);
152 			goto done;
153 		}
154 
155 		q = memchr(s, ':', p - s);
156 		if (q) {
157 			*host = strndup(s, q - s);
158 			if (*host == NULL) {
159 				err = got_error_from_errno("strndup");
160 				goto done;
161 			}
162 			if ((*host)[0] == '\0') {
163 				err = got_error(GOT_ERR_PARSE_URI);
164 				goto done;
165 			}
166 			*port = strndup(q + 1, p - (q + 1));
167 			if (*port == NULL) {
168 				err = got_error_from_errno("strndup");
169 				goto done;
170 			}
171 			if ((*port)[0] == '\0') {
172 				err = got_error(GOT_ERR_PARSE_URI);
173 				goto done;
174 			}
175 		} else {
176 			*host = strndup(s, p - s);
177 			if (*host == NULL) {
178 				err = got_error_from_errno("strndup");
179 				goto done;
180 			}
181 			if ((*host)[0] == '\0') {
182 				err = got_error(GOT_ERR_PARSE_URI);
183 				goto done;
184 			}
185 		}
186 	}
187 
188 	while (p[0] == '/' && p[1] == '/')
189 		p++;
190 	*server_path = strdup(p);
191 	if (*server_path == NULL) {
192 		err = got_error_from_errno("strdup");
193 		goto done;
194 	}
195 	got_path_strip_trailing_slashes(*server_path);
196 	if ((*server_path)[0] == '\0') {
197 		err = got_error(GOT_ERR_PARSE_URI);
198 		goto done;
199 	}
200 
201 	err = got_path_basename(repo_name, *server_path);
202 	if (err)
203 		goto done;
204 	if (hassuffix(*repo_name, ".git"))
205 		(*repo_name)[strlen(*repo_name) - 4] = '\0';
206 	if ((*repo_name)[0] == '\0')
207 		err = got_error(GOT_ERR_PARSE_URI);
208 done:
209 	if (err) {
210 		free(*proto);
211 		*proto = NULL;
212 		free(*host);
213 		*host = NULL;
214 		free(*port);
215 		*port = NULL;
216 		free(*server_path);
217 		*server_path = NULL;
218 		free(*repo_name);
219 		*repo_name = NULL;
220 	}
221 	return err;
222 }
223 
224 /*
225  * Escape a given path for the shell which will be started by sshd.
226  * In particular, git-shell is known to require single-quote characters
227  * around its repository path argument and will refuse to run otherwise.
228  */
229 static const struct got_error *
230 escape_path(char *buf, size_t bufsize, const char *path)
231 {
232 	const char	*p;
233 	char		*q;
234 
235 	p = path;
236 	q = buf;
237 
238 	if (bufsize > 1)
239 		*q++ = '\'';
240 
241 	while (*p != '\0' && (q - buf < bufsize)) {
242 		/* git escapes ! too */
243 		if (*p != '\'' && *p != '!') {
244 			*q++ = *p++;
245 			continue;
246 		}
247 
248 		if (q - buf + 4 >= bufsize)
249 			break;
250 		*q++ = '\'';
251 		*q++ = '\\';
252 		*q++ = *p++;
253 		*q++ = '\'';
254 	}
255 
256 	if (*p == '\0' && (q - buf + 1 < bufsize)) {
257 		*q++ = '\'';
258 		*q = '\0';
259 		return NULL;
260 	}
261 
262 	return got_error_fmt(GOT_ERR_NO_SPACE, "overlong path: %s", path);
263 }
264 
265 const struct got_error *
266 got_dial_ssh(pid_t *newpid, int *newfd, const char *host,
267     const char *port, const char *path, const char *command, int verbosity)
268 {
269 	const struct got_error *error = NULL;
270 	int pid, pfd[2];
271 	char cmd[64];
272 	char escaped_path[PATH_MAX];
273 	const char *argv[11];
274 	int i = 0, j;
275 
276 	*newpid = -1;
277 	*newfd = -1;
278 
279 	error = escape_path(escaped_path, sizeof(escaped_path), path);
280 	if (error)
281 		return error;
282 
283 	argv[i++] = GOT_DIAL_PATH_SSH;
284 	if (port != NULL) {
285 		argv[i++] = "-p";
286 		argv[i++] = (char *)port;
287 	}
288 	if (verbosity == -1) {
289 		argv[i++] = "-q";
290 	} else {
291 		/* ssh(1) allows up to 3 "-v" options. */
292 		for (j = 0; j < MIN(3, verbosity); j++)
293 			argv[i++] = "-v";
294 	}
295 	argv[i++] = "--";
296 	argv[i++] = (char *)host;
297 	argv[i++] = (char *)cmd;
298 	argv[i++] = (char *)escaped_path;
299 	argv[i++] = NULL;
300 	assert(i <= nitems(argv));
301 
302 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pfd) == -1)
303 		return got_error_from_errno("socketpair");
304 
305 	pid = fork();
306 	if (pid == -1) {
307 		error = got_error_from_errno("fork");
308 		close(pfd[0]);
309 		close(pfd[1]);
310 		return error;
311 	} else if (pid == 0) {
312 		if (close(pfd[1]) == -1)
313 			err(1, "close");
314 		if (dup2(pfd[0], 0) == -1)
315 			err(1, "dup2");
316 		if (dup2(pfd[0], 1) == -1)
317 			err(1, "dup2");
318 		if (strlcpy(cmd, command, sizeof(cmd)) >= sizeof(cmd))
319 			err(1, "snprintf");
320 		if (execv(GOT_DIAL_PATH_SSH, (char *const *)argv) == -1)
321 			err(1, "execv %s", GOT_DIAL_PATH_SSH);
322 		abort(); /* not reached */
323 	} else {
324 		if (close(pfd[0]) == -1)
325 			return got_error_from_errno("close");
326 		*newpid = pid;
327 		*newfd = pfd[1];
328 		return NULL;
329 	}
330 }
331 
332 const struct got_error *
333 got_dial_git(int *newfd, const char *host, const char *port,
334     const char *path, const char *command)
335 {
336 	const struct got_error *err = NULL;
337 	struct addrinfo hints, *servinfo, *p;
338 	char *cmd = NULL;
339 	int fd = -1, len, r, eaicode;
340 
341 	*newfd = -1;
342 
343 	if (port == NULL)
344 		port = GOT_DEFAULT_GIT_PORT_STR;
345 
346 	memset(&hints, 0, sizeof hints);
347 	hints.ai_family = AF_UNSPEC;
348 	hints.ai_socktype = SOCK_STREAM;
349 	eaicode = getaddrinfo(host, port, &hints, &servinfo);
350 	if (eaicode) {
351 		char msg[512];
352 		snprintf(msg, sizeof(msg), "%s: %s", host,
353 		    gai_strerror(eaicode));
354 		return got_error_msg(GOT_ERR_ADDRINFO, msg);
355 	}
356 
357 	for (p = servinfo; p != NULL; p = p->ai_next) {
358 		if ((fd = socket(p->ai_family, p->ai_socktype,
359 		    p->ai_protocol)) == -1)
360 			continue;
361 		if (connect(fd, p->ai_addr, p->ai_addrlen) == 0) {
362 			err = NULL;
363 			break;
364 		}
365 		err = got_error_from_errno("connect");
366 		close(fd);
367 	}
368 	freeaddrinfo(servinfo);
369 	if (p == NULL)
370 		goto done;
371 
372 	if (asprintf(&cmd, "%s %s", command, path) == -1) {
373 		err = got_error_from_errno("asprintf");
374 		goto done;
375 	}
376 	len = 4 + strlen(cmd) + 1 + strlen("host=") + strlen(host) + 1;
377 	r = dprintf(fd, "%04x%s%chost=%s%c", len, cmd, '\0', host, '\0');
378 	if (r < 0)
379 		err = got_error_from_errno("dprintf");
380 done:
381 	free(cmd);
382 	if (err) {
383 		if (fd != -1)
384 			close(fd);
385 	} else
386 		*newfd = fd;
387 	return err;
388 }
389 
390 const struct got_error *
391 got_dial_http(pid_t *newpid, int *newfd, const char *host,
392     const char *port, const char *path, int verbosity, int tls)
393 {
394 	const struct got_error *error = NULL;
395 	int pid, pfd[2];
396 	const char *argv[8];
397 	int i = 0;
398 
399 	*newpid = -1;
400 	*newfd = -1;
401 
402 	if (!port)
403 		port = tls ? "443" : "80";
404 
405 	argv[i++] = GOT_PATH_PROG_FETCH_HTTP;
406 	if (verbosity == -1)
407 		argv[i++] = "-q";
408 	else if (verbosity > 0)
409 		argv[i++] = "-v";
410 	argv[i++] = "--";
411 	argv[i++] = tls ? "https" : "http";
412 	argv[i++] = host;
413 	argv[i++] = port;
414 	argv[i++] = path;
415 	argv[i++] = NULL;
416 	assert(i <= nitems(argv));
417 
418 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pfd) == -1)
419 		return got_error_from_errno("socketpair");
420 
421 	pid = fork();
422 	if (pid == -1) {
423 		error = got_error_from_errno("fork");
424 		close(pfd[0]);
425 		close(pfd[1]);
426 		return error;
427 	} else if (pid == 0) {
428 		if (close(pfd[1]) == -1)
429 			err(1, "close");
430 		if (dup2(pfd[0], 0) == -1)
431 			err(1, "dup2");
432 		if (dup2(pfd[0], 1) == -1)
433 			err(1, "dup2");
434 		if (execv(GOT_PATH_PROG_FETCH_HTTP, (char *const *)argv) == -1)
435 			err(1, "execv %s", GOT_PATH_PROG_FETCH_HTTP);
436 		abort(); /* not reached */
437 	} else {
438 		if (close(pfd[0]) == -1)
439 			return got_error_from_errno("close");
440 		*newpid = pid;
441 		*newfd = pfd[1];
442 		return NULL;
443 	}
444 }
445 
446 const struct got_error *
447 got_dial_parse_command(char **command, char **repo_path, const char *gitcmd)
448 {
449 	const struct got_error *err = NULL;
450 	size_t len, cmdlen, pathlen;
451 	char *path0 = NULL, *path, *abspath = NULL, *canonpath = NULL;
452 	const char *relpath;
453 
454 	*command = NULL;
455 	*repo_path = NULL;
456 
457 	len = strlen(gitcmd);
458 
459 	if (len >= strlen(GOT_DIAL_CMD_SEND) &&
460 	    strncmp(gitcmd, GOT_DIAL_CMD_SEND,
461 	    strlen(GOT_DIAL_CMD_SEND)) == 0)
462 		cmdlen = strlen(GOT_DIAL_CMD_SEND);
463 	else if (len >= strlen(GOT_DIAL_CMD_FETCH) &&
464 	    strncmp(gitcmd, GOT_DIAL_CMD_FETCH,
465 	    strlen(GOT_DIAL_CMD_FETCH)) == 0)
466 		cmdlen = strlen(GOT_DIAL_CMD_FETCH);
467 	else
468 		return got_error(GOT_ERR_BAD_PACKET);
469 
470 	if (len <= cmdlen + 1 || gitcmd[cmdlen] != ' ')
471 		return got_error(GOT_ERR_BAD_PACKET);
472 
473 	if (memchr(&gitcmd[cmdlen + 1], '\0', len - cmdlen) == NULL)
474 		return got_error(GOT_ERR_BAD_PATH);
475 
476 	/* Forbid linefeeds in paths, like Git does. */
477 	if (memchr(&gitcmd[cmdlen + 1], '\n', len - cmdlen) != NULL)
478 		return got_error(GOT_ERR_BAD_PATH);
479 
480 	path0 = strdup(&gitcmd[cmdlen + 1]);
481 	if (path0 == NULL)
482 		return got_error_from_errno("strdup");
483 	path = path0;
484 	pathlen = strlen(path);
485 
486 	/*
487 	 * Git clients send a shell command.
488 	 * Trim spaces and quotes around the path.
489 	 */
490 	while (path[0] == '\'' || path[0] == '\"' || path[0] == ' ') {
491 		path++;
492 		pathlen--;
493 	}
494 	while (pathlen > 0 &&
495 	    (path[pathlen - 1] == '\'' || path[pathlen - 1] == '\"' ||
496 	    path[pathlen - 1] == ' ')) {
497 		path[pathlen - 1] = '\0';
498 		pathlen--;
499 	}
500 
501 	/* Deny an empty repository path. */
502 	if (path[0] == '\0' || got_path_is_root_dir(path)) {
503 		err = got_error(GOT_ERR_NOT_GIT_REPO);
504 		goto done;
505 	}
506 
507 	if (asprintf(&abspath, "/%s", path) == -1) {
508 		err = got_error_from_errno("asprintf");
509 		goto done;
510 	}
511 	pathlen = strlen(abspath);
512 	canonpath = malloc(pathlen + 1);
513 	if (canonpath == NULL) {
514 		err = got_error_from_errno("malloc");
515 		goto done;
516 	}
517 	err = got_canonpath(abspath, canonpath, pathlen + 1);
518 	if (err)
519 		goto done;
520 
521 	relpath = canonpath;
522 	while (relpath[0] == '/')
523 		relpath++;
524 	*repo_path = strdup(relpath);
525 	if (*repo_path == NULL) {
526 		err = got_error_from_errno("strdup");
527 		goto done;
528 	}
529 	*command = strndup(gitcmd, cmdlen);
530 	if (*command == NULL)
531 		err = got_error_from_errno("strndup");
532 done:
533 	free(path0);
534 	free(abspath);
535 	free(canonpath);
536 	if (err) {
537 		free(*repo_path);
538 		*repo_path = NULL;
539 	}
540 	return err;
541 }