1 /*
2  * Copyright (c) 2016, 2019, 2020-2022 Tracey Emery <tracey@traceyemery.net>
3  * Copyright (c) 2015 Mike Larkin <mlarkin@openbsd.org>
4  * Copyright (c) 2014 Reyk Floeter <reyk@openbsd.org>
5  * Copyright (c) 2013 David Gwynne <dlg@openbsd.org>
6  * Copyright (c) 2013 Florian Obser <florian@openbsd.org>
7  *
8  * Permission to use, copy, modify, and distribute this software for any
9  * purpose with or without fee is hereby granted, provided that the above
10  * copyright notice and this permission notice appear in all copies.
11  *
12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19  */
20 
21 #include <net/if.h>
22 #include <netinet/in.h>
23 #include <sys/queue.h>
24 #include <sys/stat.h>
25 #include <sys/types.h>
26 
27 #include <ctype.h>
28 #include <dirent.h>
29 #include <errno.h>
30 #include <event.h>
31 #include <fcntl.h>
32 #include <imsg.h>
33 #include <sha1.h>
34 #include <sha2.h>
35 #include <stdio.h>
36 #include <stdlib.h>
37 #include <string.h>
38 #include <unistd.h>
39 
40 #include "got_error.h"
41 #include "got_object.h"
42 #include "got_reference.h"
43 #include "got_repository.h"
44 #include "got_path.h"
45 #include "got_cancel.h"
46 #include "got_worktree.h"
47 #include "got_diff.h"
48 #include "got_commit_graph.h"
49 #include "got_blame.h"
50 #include "got_privsep.h"
51 
52 #include "proc.h"
53 #include "gotwebd.h"
54 #include "tmpl.h"
55 
56 static const struct querystring_keys querystring_keys[] = {
57 	{ "action",		ACTION },
58 	{ "commit",		COMMIT },
59 	{ "file",		RFILE },
60 	{ "folder",		FOLDER },
61 	{ "headref",		HEADREF },
62 	{ "index_page",		INDEX_PAGE },
63 	{ "path",		PATH },
64 	{ "page",		PAGE },
65 };
66 
67 static const struct action_keys action_keys[] = {
68 	{ "blame",	BLAME },
69 	{ "blob",	BLOB },
70 	{ "blobraw",	BLOBRAW },
71 	{ "briefs",	BRIEFS },
72 	{ "commits",	COMMITS },
73 	{ "diff",	DIFF },
74 	{ "error",	ERR },
75 	{ "index",	INDEX },
76 	{ "summary",	SUMMARY },
77 	{ "tag",	TAG },
78 	{ "tags",	TAGS },
79 	{ "tree",	TREE },
80 	{ "rss",	RSS },
81 };
82 
83 static const struct got_error *gotweb_init_querystring(struct querystring **);
84 static const struct got_error *gotweb_parse_querystring(struct querystring **,
85     char *);
86 static const struct got_error *gotweb_assign_querystring(struct querystring **,
87     char *, char *);
88 static int gotweb_render_index(struct template *);
89 static const struct got_error *gotweb_init_repo_dir(struct repo_dir **,
90     const char *);
91 static const struct got_error *gotweb_load_got_path(struct request *c,
92     struct repo_dir *);
93 static const struct got_error *gotweb_get_repo_description(char **,
94     struct server *, const char *, int);
95 static const struct got_error *gotweb_get_clone_url(char **, struct server *,
96     const char *, int);
97 
98 static void gotweb_free_querystring(struct querystring *);
99 static void gotweb_free_repo_dir(struct repo_dir *);
100 
101 struct server *gotweb_get_server(uint8_t *, uint8_t *);
102 
103 static int
104 gotweb_reply(struct request *c, int status, const char *ctype,
105     struct gotweb_url *location)
106 {
107 	const char	*csp;
108 
109 	if (status != 200 && fcgi_printf(c, "Status: %d\r\n", status) == -1)
110 		return -1;
111 
112 	if (location) {
113 		if (fcgi_puts(c->tp, "Location: ") == -1 ||
114 		    gotweb_render_url(c, location) == -1 ||
115 		    fcgi_puts(c->tp, "\r\n") == -1)
116 			return -1;
117 	}
118 
119 	csp = "Content-Security-Policy: default-src 'self'; "
120 	    "script-src 'none'; object-src 'none';\r\n";
121 	if (fcgi_puts(c->tp, csp) == -1)
122 		return -1;
123 
124 	if (ctype && fcgi_printf(c, "Content-Type: %s\r\n", ctype) == -1)
125 		return -1;
126 
127 	return fcgi_puts(c->tp, "\r\n");
128 }
129 
130 static int
131 gotweb_reply_file(struct request *c, const char *ctype, const char *file,
132     const char *suffix)
133 {
134 	int r;
135 
136 	r = fcgi_printf(c, "Content-Disposition: attachment; "
137 	    "filename=%s%s\r\n", file, suffix ? suffix : "");
138 	if (r == -1)
139 		return -1;
140 	return gotweb_reply(c, 200, ctype, NULL);
141 }
142 
143 void
144 gotweb_process_request(struct request *c)
145 {
146 	const struct got_error *error = NULL;
147 	struct server *srv = NULL;
148 	struct querystring *qs = NULL;
149 	struct repo_dir *repo_dir = NULL;
150 
151 	/* init the transport */
152 	error = gotweb_init_transport(&c->t);
153 	if (error) {
154 		log_warnx("%s: %s", __func__, error->msg);
155 		return;
156 	}
157 	/* don't process any further if client disconnected */
158 	if (c->sock->client_status == CLIENT_DISCONNECT)
159 		return;
160 	/* get the gotwebd server */
161 	srv = gotweb_get_server(c->server_name, c->http_host);
162 	if (srv == NULL) {
163 		log_warnx("%s: error server is NULL", __func__);
164 		goto err;
165 	}
166 	c->srv = srv;
167 	/* parse our querystring */
168 	error = gotweb_init_querystring(&qs);
169 	if (error) {
170 		log_warnx("%s: %s", __func__, error->msg);
171 		goto err;
172 	}
173 	c->t->qs = qs;
174 	error = gotweb_parse_querystring(&qs, c->querystring);
175 	if (error) {
176 		log_warnx("%s: %s", __func__, error->msg);
177 		goto err;
178 	}
179 
180 	/*
181 	 * certain actions require a commit id in the querystring. this stops
182 	 * bad actors from exploiting this by manually manipulating the
183 	 * querystring.
184 	 */
185 
186 	if (qs->action == BLAME || qs->action == BLOB ||
187 	    qs->action == BLOBRAW || qs->action == DIFF) {
188 		if (qs->commit == NULL) {
189 			error = got_error(GOT_ERR_QUERYSTRING);
190 			goto err;
191 		}
192 	}
193 
194 	if (qs->action != INDEX) {
195 		error = gotweb_init_repo_dir(&repo_dir, qs->path);
196 		if (error)
197 			goto err;
198 		error = gotweb_load_got_path(c, repo_dir);
199 		c->t->repo_dir = repo_dir;
200 		if (error && error->code != GOT_ERR_LONELY_PACKIDX)
201 			goto err;
202 	}
203 
204 	if (qs->action == BLOBRAW) {
205 		const uint8_t *buf;
206 		size_t len;
207 		int binary, r;
208 
209 		error = got_get_repo_commits(c, 1);
210 		if (error)
211 			goto err;
212 
213 		error = got_open_blob_for_output(&c->t->blob, &c->t->fd,
214 		    &binary, c);
215 		if (error)
216 			goto err;
217 
218 		if (binary)
219 			r = gotweb_reply_file(c, "application/octet-stream",
220 			    qs->file, NULL);
221 		else
222 			r = gotweb_reply(c, 200, "text/plain", NULL);
223 		if (r == -1)
224 			return;
225 
226 		for (;;) {
227 			error = got_object_blob_read_block(&len, c->t->blob);
228 			if (error)
229 				break;
230 			if (len == 0)
231 				break;
232 			buf = got_object_blob_get_read_buf(c->t->blob);
233 			if (fcgi_gen_binary_response(c, buf, len) == -1)
234 				break;
235 		}
236 
237 		return;
238 	}
239 
240 	if (qs->action == BLOB) {
241 		int binary;
242 		struct gotweb_url url = {
243 			.index_page = -1,
244 			.page = -1,
245 			.action = BLOBRAW,
246 			.path = qs->path,
247 			.commit = qs->commit,
248 			.folder = qs->folder,
249 			.file = qs->file,
250 		};
251 
252 		error = got_get_repo_commits(c, 1);
253 		if (error)
254 			goto err;
255 
256 		error = got_open_blob_for_output(&c->t->blob, &c->t->fd,
257 		    &binary, c);
258 		if (error)
259 			goto err;
260 		if (binary) {
261 			gotweb_reply(c, 302, NULL, &url);
262 			return;
263 		}
264 	}
265 
266 	if (qs->action == RSS) {
267 		const char *ctype = "application/rss+xml;charset=utf-8";
268 
269 		if (gotweb_reply_file(c, ctype, repo_dir->name, ".rss") == -1)
270 			return;
271 
272 		error = got_get_repo_tags(c, D_MAXSLCOMMDISP);
273 		if (error) {
274 			log_warnx("%s: %s", __func__, error->msg);
275 			return;
276 		}
277 		gotweb_render_rss(c->tp);
278 		return;
279 	}
280 
281 	switch(qs->action) {
282 	case BLAME:
283 		error = got_get_repo_commits(c, 1);
284 		if (error) {
285 			log_warnx("%s: %s", __func__, error->msg);
286 			goto err;
287 		}
288 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
289 			return;
290 		gotweb_render_page(c->tp, gotweb_render_blame);
291 		return;
292 	case BLOB:
293 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
294 			return;
295 		gotweb_render_page(c->tp, gotweb_render_blob);
296 		return;
297 	case BRIEFS:
298 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
299 			return;
300 		gotweb_render_page(c->tp, gotweb_render_briefs);
301 		return;
302 	case COMMITS:
303 		error = got_get_repo_commits(c, srv->max_commits_display);
304 		if (error) {
305 			log_warnx("%s: %s", __func__, error->msg);
306 			goto err;
307 		}
308 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
309 			return;
310 		gotweb_render_page(c->tp, gotweb_render_commits);
311 		return;
312 	case DIFF:
313 		error = got_get_repo_commits(c, 1);
314 		if (error) {
315 			log_warnx("%s: %s", __func__, error->msg);
316 			goto err;
317 		}
318 		error = got_open_diff_for_output(&c->t->fp, &c->t->fd, c);
319 		if (error) {
320 			log_warnx("%s: %s", __func__, error->msg);
321 			goto err;
322 		}
323 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
324 			return;
325 		gotweb_render_page(c->tp, gotweb_render_diff);
326 		return;
327 	case INDEX:
328 		c->t->nrepos = scandir(srv->repos_path, &c->t->repos, NULL,
329 		    alphasort);
330 		if (c->t->nrepos == -1) {
331 			c->t->repos = NULL;
332 			error = got_error_from_errno2("scandir",
333 			    srv->repos_path);
334 			goto err;
335 		}
336 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
337 			return;
338 		gotweb_render_page(c->tp, gotweb_render_index);
339 		return;
340 	case SUMMARY:
341 		error = got_ref_list(&c->t->refs, c->t->repo, "refs/heads",
342 		    got_ref_cmp_by_name, NULL);
343 		if (error) {
344 			log_warnx("%s: got_ref_list: %s", __func__,
345 			    error->msg);
346 			goto err;
347 		}
348 		qs->action = TAGS;
349 		error = got_get_repo_tags(c, D_MAXSLCOMMDISP);
350 		if (error) {
351 			log_warnx("%s: got_get_repo_tags: %s", __func__,
352 			    error->msg);
353 			goto err;
354 		}
355 		qs->action = SUMMARY;
356 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
357 			return;
358 		gotweb_render_page(c->tp, gotweb_render_summary);
359 		return;
360 	case TAG:
361 		error = got_get_repo_tags(c, 1);
362 		if (error) {
363 			log_warnx("%s: %s", __func__, error->msg);
364 			goto err;
365 		}
366 		if (c->t->tag_count == 0) {
367 			error = got_error_msg(GOT_ERR_BAD_OBJ_ID,
368 			    "bad commit id");
369 			goto err;
370 		}
371 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
372 			return;
373 		gotweb_render_page(c->tp, gotweb_render_tag);
374 		return;
375 	case TAGS:
376 		error = got_get_repo_tags(c, srv->max_commits_display);
377 		if (error) {
378 			log_warnx("%s: %s", __func__, error->msg);
379 			goto err;
380 		}
381 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
382 			return;
383 		gotweb_render_page(c->tp, gotweb_render_tags);
384 		return;
385 	case TREE:
386 		error = got_get_repo_commits(c, 1);
387 		if (error) {
388 			log_warnx("%s: %s", __func__, error->msg);
389 			goto err;
390 		}
391 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
392 			return;
393 		gotweb_render_page(c->tp, gotweb_render_tree);
394 		return;
395 	case ERR:
396 	default:
397 		error = got_error(GOT_ERR_BAD_QUERYSTRING);
398 	}
399 
400 err:
401 	c->t->error = error;
402 	if (gotweb_reply(c, 400, "text/html", NULL) == -1)
403 		return;
404 	gotweb_render_page(c->tp, gotweb_render_error);
405 }
406 
407 struct server *
408 gotweb_get_server(uint8_t *server_name, uint8_t *subdomain)
409 {
410 	struct server *srv = NULL;
411 
412 	/* check against the server name first */
413 	if (strlen(server_name) > 0)
414 		TAILQ_FOREACH(srv, &gotwebd_env->servers, entry)
415 			if (strcmp(srv->name, server_name) == 0)
416 				goto done;
417 
418 	/* check against subdomain second */
419 	if (strlen(subdomain) > 0)
420 		TAILQ_FOREACH(srv, &gotwebd_env->servers, entry)
421 			if (strcmp(srv->name, subdomain) == 0)
422 				goto done;
423 
424 	/* if those fail, send first server */
425 	TAILQ_FOREACH(srv, &gotwebd_env->servers, entry)
426 		if (srv != NULL)
427 			break;
428 done:
429 	return srv;
430 };
431 
432 const struct got_error *
433 gotweb_init_transport(struct transport **t)
434 {
435 	const struct got_error *error = NULL;
436 
437 	*t = calloc(1, sizeof(**t));
438 	if (*t == NULL)
439 		return got_error_from_errno2("%s: calloc", __func__);
440 
441 	TAILQ_INIT(&(*t)->repo_commits);
442 	TAILQ_INIT(&(*t)->repo_tags);
443 	TAILQ_INIT(&(*t)->refs);
444 
445 	(*t)->repo = NULL;
446 	(*t)->repo_dir = NULL;
447 	(*t)->qs = NULL;
448 	(*t)->next_id = NULL;
449 	(*t)->prev_id = NULL;
450 	(*t)->next_disp = 0;
451 	(*t)->prev_disp = 0;
452 
453 	(*t)->fd = -1;
454 
455 	return error;
456 }
457 
458 static const struct got_error *
459 gotweb_init_querystring(struct querystring **qs)
460 {
461 	const struct got_error *error = NULL;
462 
463 	*qs = calloc(1, sizeof(**qs));
464 	if (*qs == NULL)
465 		return got_error_from_errno2("%s: calloc", __func__);
466 
467 	(*qs)->headref = strdup("HEAD");
468 	if ((*qs)->headref == NULL) {
469 		free(*qs);
470 		*qs = NULL;
471 		return got_error_from_errno2("%s: strdup", __func__);
472 	}
473 
474 	(*qs)->action = INDEX;
475 	(*qs)->commit = NULL;
476 	(*qs)->file = NULL;
477 	(*qs)->folder = NULL;
478 	(*qs)->index_page = 0;
479 	(*qs)->path = NULL;
480 
481 	return error;
482 }
483 
484 static const struct got_error *
485 gotweb_parse_querystring(struct querystring **qs, char *qst)
486 {
487 	const struct got_error *error = NULL;
488 	char *tok1 = NULL, *tok1_pair = NULL, *tok1_end = NULL;
489 	char *tok2 = NULL, *tok2_pair = NULL, *tok2_end = NULL;
490 
491 	if (qst == NULL)
492 		return error;
493 
494 	tok1 = strdup(qst);
495 	if (tok1 == NULL)
496 		return got_error_from_errno2("%s: strdup", __func__);
497 
498 	tok1_pair = tok1;
499 	tok1_end = tok1;
500 
501 	while (tok1_pair != NULL) {
502 		strsep(&tok1_end, "&");
503 
504 		tok2 = strdup(tok1_pair);
505 		if (tok2 == NULL) {
506 			free(tok1);
507 			return got_error_from_errno2("%s: strdup", __func__);
508 		}
509 
510 		tok2_pair = tok2;
511 		tok2_end = tok2;
512 
513 		while (tok2_pair != NULL) {
514 			strsep(&tok2_end, "=");
515 			if (tok2_end) {
516 				error = gotweb_assign_querystring(qs, tok2_pair,
517 				    tok2_end);
518 				if (error)
519 					goto err;
520 			}
521 			tok2_pair = tok2_end;
522 		}
523 		free(tok2);
524 		tok1_pair = tok1_end;
525 	}
526 	free(tok1);
527 	return error;
528 err:
529 	free(tok2);
530 	free(tok1);
531 	return error;
532 }
533 
534 /*
535  * Adapted from usr.sbin/httpd/httpd.c url_decode.
536  */
537 static const struct got_error *
538 gotweb_urldecode(char *url)
539 {
540 	char		*p, *q;
541 	char		 hex[3];
542 	unsigned long	 x;
543 
544 	hex[2] = '\0';
545 	p = q = url;
546 
547 	while (*p != '\0') {
548 		switch (*p) {
549 		case '%':
550 			/* Encoding character is followed by two hex chars */
551 			if (!isxdigit((unsigned char)p[1]) ||
552 			    !isxdigit((unsigned char)p[2]) ||
553 			    (p[1] == '0' && p[2] == '0'))
554 				return got_error(GOT_ERR_BAD_QUERYSTRING);
555 
556 			hex[0] = p[1];
557 			hex[1] = p[2];
558 
559 			/*
560 			 * We don't have to validate "hex" because it is
561 			 * guaranteed to include two hex chars followed by nul.
562 			 */
563 			x = strtoul(hex, NULL, 16);
564 			*q = (char)x;
565 			p += 2;
566 			break;
567 		default:
568 			*q = *p;
569 			break;
570 		}
571 		p++;
572 		q++;
573 	}
574 	*q = '\0';
575 
576 	return NULL;
577 }
578 
579 static const struct got_error *
580 gotweb_assign_querystring(struct querystring **qs, char *key, char *value)
581 {
582 	const struct got_error *error = NULL;
583 	const char *errstr;
584 	int a_cnt, el_cnt;
585 
586 	error = gotweb_urldecode(value);
587 	if (error)
588 		return error;
589 
590 	for (el_cnt = 0; el_cnt < QSELEM__MAX; el_cnt++) {
591 		if (strcmp(key, querystring_keys[el_cnt].name) != 0)
592 			continue;
593 
594 		switch (querystring_keys[el_cnt].element) {
595 		case ACTION:
596 			for (a_cnt = 0; a_cnt < ACTIONS__MAX; a_cnt++) {
597 				if (strcmp(value, action_keys[a_cnt].name) != 0)
598 					continue;
599 				else if (strcmp(value,
600 				    action_keys[a_cnt].name) == 0){
601 					(*qs)->action =
602 					    action_keys[a_cnt].action;
603 					goto qa_found;
604 				}
605 			}
606 			(*qs)->action = ERR;
607 qa_found:
608 			break;
609 		case COMMIT:
610 			(*qs)->commit = strdup(value);
611 			if ((*qs)->commit == NULL) {
612 				error = got_error_from_errno2("%s: strdup",
613 				    __func__);
614 				goto done;
615 			}
616 			break;
617 		case RFILE:
618 			(*qs)->file = strdup(value);
619 			if ((*qs)->file == NULL) {
620 				error = got_error_from_errno2("%s: strdup",
621 				    __func__);
622 				goto done;
623 			}
624 			break;
625 		case FOLDER:
626 			(*qs)->folder = strdup(value);
627 			if ((*qs)->folder == NULL) {
628 				error = got_error_from_errno2("%s: strdup",
629 				    __func__);
630 				goto done;
631 			}
632 			break;
633 		case HEADREF:
634 			free((*qs)->headref);
635 			(*qs)->headref = strdup(value);
636 			if ((*qs)->headref == NULL) {
637 				error = got_error_from_errno2("%s: strdup",
638 				    __func__);
639 				goto done;
640 			}
641 			break;
642 		case INDEX_PAGE:
643 			if (strlen(value) == 0)
644 				break;
645 			(*qs)->index_page = strtonum(value, INT64_MIN,
646 			    INT64_MAX, &errstr);
647 			if (errstr) {
648 				error = got_error_from_errno3("%s: strtonum %s",
649 				    __func__, errstr);
650 				goto done;
651 			}
652 			if ((*qs)->index_page < 0)
653 				(*qs)->index_page = 0;
654 			break;
655 		case PATH:
656 			(*qs)->path = strdup(value);
657 			if ((*qs)->path == NULL) {
658 				error = got_error_from_errno2("%s: strdup",
659 				    __func__);
660 				goto done;
661 			}
662 			break;
663 		case PAGE:
664 			if (strlen(value) == 0)
665 				break;
666 			(*qs)->page = strtonum(value, INT64_MIN,
667 			    INT64_MAX, &errstr);
668 			if (errstr) {
669 				error = got_error_from_errno3("%s: strtonum %s",
670 				    __func__, errstr);
671 				goto done;
672 			}
673 			if ((*qs)->page < 0)
674 				(*qs)->page = 0;
675 			break;
676 		default:
677 			break;
678 		}
679 	}
680 done:
681 	return error;
682 }
683 
684 void
685 gotweb_free_repo_tag(struct repo_tag *rt)
686 {
687 	if (rt != NULL) {
688 		free(rt->commit_id);
689 		free(rt->tag_name);
690 		free(rt->tag_commit);
691 		free(rt->commit_msg);
692 		free(rt->tagger);
693 	}
694 	free(rt);
695 }
696 
697 void
698 gotweb_free_repo_commit(struct repo_commit *rc)
699 {
700 	if (rc != NULL) {
701 		free(rc->path);
702 		free(rc->refs_str);
703 		free(rc->commit_id);
704 		free(rc->parent_id);
705 		free(rc->tree_id);
706 		free(rc->author);
707 		free(rc->committer);
708 		free(rc->commit_msg);
709 	}
710 	free(rc);
711 }
712 
713 static void
714 gotweb_free_querystring(struct querystring *qs)
715 {
716 	if (qs != NULL) {
717 		free(qs->commit);
718 		free(qs->file);
719 		free(qs->folder);
720 		free(qs->headref);
721 		free(qs->path);
722 	}
723 	free(qs);
724 }
725 
726 static void
727 gotweb_free_repo_dir(struct repo_dir *repo_dir)
728 {
729 	if (repo_dir != NULL) {
730 		free(repo_dir->name);
731 		free(repo_dir->owner);
732 		free(repo_dir->description);
733 		free(repo_dir->url);
734 		free(repo_dir->path);
735 	}
736 	free(repo_dir);
737 }
738 
739 void
740 gotweb_free_transport(struct transport *t)
741 {
742 	const struct got_error *err;
743 	struct repo_commit *rc = NULL, *trc = NULL;
744 	struct repo_tag *rt = NULL, *trt = NULL;
745 	int i;
746 
747 	got_ref_list_free(&t->refs);
748 	TAILQ_FOREACH_SAFE(rc, &t->repo_commits, entry, trc) {
749 		TAILQ_REMOVE(&t->repo_commits, rc, entry);
750 		gotweb_free_repo_commit(rc);
751 	}
752 	TAILQ_FOREACH_SAFE(rt, &t->repo_tags, entry, trt) {
753 		TAILQ_REMOVE(&t->repo_tags, rt, entry);
754 		gotweb_free_repo_tag(rt);
755 	}
756 	gotweb_free_repo_dir(t->repo_dir);
757 	gotweb_free_querystring(t->qs);
758 	free(t->more_id);
759 	free(t->next_id);
760 	free(t->prev_id);
761 	if (t->blob)
762 		got_object_blob_close(t->blob);
763 	if (t->fp) {
764 		err = got_gotweb_flushfile(t->fp, t->fd);
765 		if (err)
766 			log_warnx("%s: got_gotweb_flushfile failure: %s",
767 			    __func__, err->msg);
768 		t->fd = -1;
769 	}
770 	if (t->fd != -1)
771 		close(t->fd);
772 	if (t->repos) {
773 		for (i = 0; i < t->nrepos; ++i)
774 			free(t->repos[i]);
775 		free(t->repos);
776 	}
777 	free(t);
778 }
779 
780 void
781 gotweb_get_navs(struct request *c, struct gotweb_url *prev, int *have_prev,
782     struct gotweb_url *next, int *have_next)
783 {
784 	struct transport *t = c->t;
785 	struct querystring *qs = t->qs;
786 	struct server *srv = c->srv;
787 
788 	*have_prev = *have_next = 0;
789 
790 	switch(qs->action) {
791 	case INDEX:
792 		if (qs->index_page > 0) {
793 			*have_prev = 1;
794 			*prev = (struct gotweb_url){
795 				.action = -1,
796 				.index_page = qs->index_page - 1,
797 				.page = -1,
798 			};
799 		}
800 		if (t->next_disp == srv->max_repos_display &&
801 		    t->repos_total != (qs->index_page + 1) *
802 		    srv->max_repos_display) {
803 			*have_next = 1;
804 			*next = (struct gotweb_url){
805 				.action = -1,
806 				.index_page = qs->index_page + 1,
807 				.page = -1,
808 			};
809 		}
810 		break;
811 	case TAGS:
812 		if (t->prev_id && qs->commit != NULL &&
813 		    strcmp(qs->commit, t->prev_id) != 0) {
814 			*have_prev = 1;
815 			*prev = (struct gotweb_url){
816 				.action = TAGS,
817 				.index_page = -1,
818 				.page = qs->page - 1,
819 				.path = qs->path,
820 				.commit = t->prev_id,
821 				.headref = qs->headref,
822 			};
823 		}
824 		if (t->next_id) {
825 			*have_next = 1;
826 			*next = (struct gotweb_url){
827 				.action = TAGS,
828 				.index_page = -1,
829 				.page = qs->page + 1,
830 				.path = qs->path,
831 				.commit = t->next_id,
832 				.headref = qs->headref,
833 			};
834 		}
835 		break;
836 	}
837 }
838 
839 static int
840 gotweb_render_index(struct template *tp)
841 {
842 	const struct got_error *error = NULL;
843 	struct request *c = tp->tp_arg;
844 	struct server *srv = c->srv;
845 	struct transport *t = c->t;
846 	struct querystring *qs = t->qs;
847 	struct repo_dir *repo_dir = NULL;
848 	struct dirent **sd_dent = t->repos;
849 	unsigned int d_i, d_disp = 0;
850 	unsigned int d_skipped = 0;
851 	int type, r;
852 
853 	if (gotweb_render_repo_table_hdr(c->tp) == -1)
854 		return -1;
855 
856 	for (d_i = 0; d_i < t->nrepos; d_i++) {
857 		if (srv->max_repos > 0 && t->prev_disp == srv->max_repos)
858 			break;
859 
860 		if (strcmp(sd_dent[d_i]->d_name, ".") == 0 ||
861 		    strcmp(sd_dent[d_i]->d_name, "..") == 0) {
862 			d_skipped++;
863 			continue;
864 		}
865 
866 		error = got_path_dirent_type(&type, srv->repos_path,
867 		    sd_dent[d_i]);
868 		if (error)
869 			continue;
870 		if (type != DT_DIR) {
871 			d_skipped++;
872 			continue;
873 		}
874 
875 		if (qs->index_page > 0 && (qs->index_page *
876 		    srv->max_repos_display) > t->prev_disp) {
877 			t->prev_disp++;
878 			continue;
879 		}
880 
881 		error = gotweb_init_repo_dir(&repo_dir, sd_dent[d_i]->d_name);
882 		if (error)
883 			continue;
884 
885 		error = gotweb_load_got_path(c, repo_dir);
886 		if (error && error->code == GOT_ERR_LONELY_PACKIDX) {
887 			if (error->code != GOT_ERR_NOT_GIT_REPO)
888 				log_warnx("%s: %s: %s", __func__,
889 				    sd_dent[d_i]->d_name, error->msg);
890 			gotweb_free_repo_dir(repo_dir);
891 			repo_dir = NULL;
892 			d_skipped++;
893 			continue;
894 		}
895 
896 		d_disp++;
897 		t->prev_disp++;
898 
899 		r = gotweb_render_repo_fragment(c->tp, repo_dir);
900 		gotweb_free_repo_dir(repo_dir);
901 		if (r == -1)
902 			return -1;
903 
904 		t->next_disp++;
905 		if (d_disp == srv->max_repos_display)
906 			break;
907 	}
908 	t->repos_total = t->nrepos - d_skipped;
909 
910 	if (srv->max_repos_display == 0)
911 		return 0;
912 	if (srv->max_repos > 0 && srv->max_repos < srv->max_repos_display)
913 		return 0;
914 	if (t->repos_total <= srv->max_repos ||
915 	    t->repos_total <= srv->max_repos_display)
916 		return 0;
917 
918 	if (gotweb_render_navs(c->tp) == -1)
919 		return -1;
920 
921 	return 0;
922 }
923 
924 static inline int
925 should_urlencode(int c)
926 {
927 	if (c <= ' ' || c >= 127)
928 		return 1;
929 
930 	switch (c) {
931 		/* gen-delim */
932 	case ':':
933 	case '/':
934 	case '?':
935 	case '#':
936 	case '[':
937 	case ']':
938 	case '@':
939 		/* sub-delims */
940 	case '!':
941 	case '$':
942 	case '&':
943 	case '\'':
944 	case '(':
945 	case ')':
946 	case '*':
947 	case '+':
948 	case ',':
949 	case ';':
950 	case '=':
951 		/* needed because the URLs are embedded into the HTML */
952 	case '\"':
953 		return 1;
954 	default:
955 		return 0;
956 	}
957 }
958 
959 static char *
960 gotweb_urlencode(const char *str)
961 {
962 	const char *s;
963 	char *escaped;
964 	size_t i, len;
965 	int a, b;
966 
967 	len = 0;
968 	for (s = str; *s; ++s) {
969 		len++;
970 		if (should_urlencode(*s))
971 			len += 2;
972 	}
973 
974 	escaped = calloc(1, len + 1);
975 	if (escaped == NULL)
976 		return NULL;
977 
978 	i = 0;
979 	for (s = str; *s; ++s) {
980 		if (should_urlencode(*s)) {
981 			a = (*s & 0xF0) >> 4;
982 			b = (*s & 0x0F);
983 
984 			escaped[i++] = '%';
985 			escaped[i++] = a <= 9 ? ('0' + a) : ('7' + a);
986 			escaped[i++] = b <= 9 ? ('0' + b) : ('7' + b);
987 		} else
988 			escaped[i++] = *s;
989 	}
990 
991 	return escaped;
992 }
993 
994 const char *
995 gotweb_action_name(int action)
996 {
997 	switch (action) {
998 	case BLAME:
999 		return "blame";
1000 	case BLOB:
1001 		return "blob";
1002 	case BLOBRAW:
1003 		return "blobraw";
1004 	case BRIEFS:
1005 		return "briefs";
1006 	case COMMITS:
1007 		return "commits";
1008 	case DIFF:
1009 		return "diff";
1010 	case ERR:
1011 		return "err";
1012 	case INDEX:
1013 		return "index";
1014 	case SUMMARY:
1015 		return "summary";
1016 	case TAG:
1017 		return "tag";
1018 	case TAGS:
1019 		return "tags";
1020 	case TREE:
1021 		return "tree";
1022 	case RSS:
1023 		return "rss";
1024 	default:
1025 		return NULL;
1026 	}
1027 }
1028 
1029 int
1030 gotweb_render_url(struct request *c, struct gotweb_url *url)
1031 {
1032 	const char *sep = "?", *action;
1033 	char *tmp;
1034 	int r;
1035 
1036 	action = gotweb_action_name(url->action);
1037 	if (action != NULL) {
1038 		if (fcgi_printf(c, "?action=%s", action) == -1)
1039 			return -1;
1040 		sep = "&";
1041 	}
1042 
1043 	if (url->commit) {
1044 		if (fcgi_printf(c, "%scommit=%s", sep, url->commit) == -1)
1045 			return -1;
1046 		sep = "&";
1047 	}
1048 
1049 	if (url->previd) {
1050 		if (fcgi_printf(c, "%sprevid=%s", sep, url->previd) == -1)
1051 			return -1;
1052 		sep = "&";
1053 	}
1054 
1055 	if (url->prevset) {
1056 		if (fcgi_printf(c, "%sprevset=%s", sep, url->prevset) == -1)
1057 			return -1;
1058 		sep = "&";
1059 	}
1060 
1061 	if (url->file) {
1062 		tmp = gotweb_urlencode(url->file);
1063 		if (tmp == NULL)
1064 			return -1;
1065 		r = fcgi_printf(c, "%sfile=%s", sep, tmp);
1066 		free(tmp);
1067 		if (r == -1)
1068 			return -1;
1069 		sep = "&";
1070 	}
1071 
1072 	if (url->folder) {
1073 		tmp = gotweb_urlencode(url->folder);
1074 		if (tmp == NULL)
1075 			return -1;
1076 		r = fcgi_printf(c, "%sfolder=%s", sep, tmp);
1077 		free(tmp);
1078 		if (r == -1)
1079 			return -1;
1080 		sep = "&";
1081 	}
1082 
1083 	if (url->headref) {
1084 		tmp = gotweb_urlencode(url->headref);
1085 		if (tmp == NULL)
1086 			return -1;
1087 		r = fcgi_printf(c, "%sheadref=%s", sep, url->headref);
1088 		free(tmp);
1089 		if (r == -1)
1090 			return -1;
1091 		sep = "&";
1092 	}
1093 
1094 	if (url->index_page != -1) {
1095 		if (fcgi_printf(c, "%sindex_page=%d", sep,
1096 		    url->index_page) == -1)
1097 			return -1;
1098 		sep = "&";
1099 	}
1100 
1101 	if (url->path) {
1102 		tmp = gotweb_urlencode(url->path);
1103 		if (tmp == NULL)
1104 			return -1;
1105 		r = fcgi_printf(c, "%spath=%s", sep, tmp);
1106 		free(tmp);
1107 		if (r == -1)
1108 			return -1;
1109 		sep = "&";
1110 	}
1111 
1112 	if (url->page != -1) {
1113 		if (fcgi_printf(c, "%spage=%d", sep, url->page) == -1)
1114 			return -1;
1115 		sep = "&";
1116 	}
1117 
1118 	return 0;
1119 }
1120 
1121 int
1122 gotweb_render_absolute_url(struct request *c, struct gotweb_url *url)
1123 {
1124 	struct template	*tp = c->tp;
1125 	const char	*proto = c->https ? "https" : "http";
1126 
1127 	if (fcgi_puts(tp, proto) == -1 ||
1128 	    fcgi_puts(tp, "://") == -1 ||
1129 	    tp_htmlescape(tp, c->server_name) == -1 ||
1130 	    tp_htmlescape(tp, c->document_uri) == -1)
1131 		return -1;
1132 
1133 	return gotweb_render_url(c, url);
1134 }
1135 
1136 static struct got_repository *
1137 find_cached_repo(struct server *srv, const char *path)
1138 {
1139 	int i;
1140 
1141 	for (i = 0; i < srv->ncached_repos; i++) {
1142 		if (strcmp(srv->cached_repos[i].path, path) == 0)
1143 			return srv->cached_repos[i].repo;
1144 	}
1145 
1146 	return NULL;
1147 }
1148 
1149 static const struct got_error *
1150 cache_repo(struct got_repository **new, struct server *srv,
1151     struct repo_dir *repo_dir, struct socket *sock)
1152 {
1153 	const struct got_error *error = NULL;
1154 	struct got_repository *repo;
1155 	struct cached_repo *cr;
1156 	int evicted = 0;
1157 
1158 	if (srv->ncached_repos >= GOTWEBD_REPO_CACHESIZE) {
1159 		cr = &srv->cached_repos[srv->ncached_repos - 1];
1160 		error = got_repo_close(cr->repo);
1161 		memset(cr, 0, sizeof(*cr));
1162 		srv->ncached_repos--;
1163 		if (error)
1164 			return error;
1165 		memmove(&srv->cached_repos[1], &srv->cached_repos[0],
1166 		    srv->ncached_repos * sizeof(srv->cached_repos[0]));
1167 		cr = &srv->cached_repos[0];
1168 		evicted = 1;
1169 	} else {
1170 		cr = &srv->cached_repos[srv->ncached_repos];
1171 	}
1172 
1173 	error = got_repo_open(&repo, repo_dir->path, NULL, sock->pack_fds);
1174 	if (error) {
1175 		if (evicted) {
1176 			memmove(&srv->cached_repos[0], &srv->cached_repos[1],
1177 			    srv->ncached_repos * sizeof(srv->cached_repos[0]));
1178 		}
1179 		return error;
1180 	}
1181 
1182 	if (strlcpy(cr->path, repo_dir->path, sizeof(cr->path))
1183 	    >= sizeof(cr->path)) {
1184 		if (evicted) {
1185 			memmove(&srv->cached_repos[0], &srv->cached_repos[1],
1186 			    srv->ncached_repos * sizeof(srv->cached_repos[0]));
1187 		}
1188 		return got_error(GOT_ERR_NO_SPACE);
1189 	}
1190 
1191 	cr->repo = repo;
1192 	srv->ncached_repos++;
1193 	*new = repo;
1194 	return NULL;
1195 }
1196 
1197 static const struct got_error *
1198 gotweb_load_got_path(struct request *c, struct repo_dir *repo_dir)
1199 {
1200 	const struct got_error *error = NULL;
1201 	struct socket *sock = c->sock;
1202 	struct server *srv = c->srv;
1203 	struct transport *t = c->t;
1204 	struct got_repository *repo = NULL;
1205 	DIR *dt;
1206 	char *dir_test;
1207 
1208 	if (asprintf(&dir_test, "%s/%s/%s", srv->repos_path, repo_dir->name,
1209 	    GOTWEB_GIT_DIR) == -1)
1210 		return got_error_from_errno("asprintf");
1211 
1212 	dt = opendir(dir_test);
1213 	if (dt == NULL) {
1214 		free(dir_test);
1215 	} else {
1216 		repo_dir->path = dir_test;
1217 		dir_test = NULL;
1218 		goto done;
1219 	}
1220 
1221 	if (asprintf(&dir_test, "%s/%s", srv->repos_path,
1222 	    repo_dir->name) == -1)
1223 		return got_error_from_errno("asprintf");
1224 
1225 	dt = opendir(dir_test);
1226 	if (dt == NULL) {
1227 		error = got_error_path(repo_dir->name, GOT_ERR_NOT_GIT_REPO);
1228 		goto err;
1229 	} else {
1230 		repo_dir->path = dir_test;
1231 		dir_test = NULL;
1232 	}
1233 
1234 done:
1235 	if (srv->respect_exportok &&
1236 	    faccessat(dirfd(dt), "git-daemon-export-ok", F_OK, 0) == -1) {
1237 		error = got_error_path(repo_dir->name, GOT_ERR_NOT_GIT_REPO);
1238 		goto err;
1239 	}
1240 
1241 	repo = find_cached_repo(srv, repo_dir->path);
1242 	if (repo == NULL) {
1243 		error = cache_repo(&repo, srv, repo_dir, sock);
1244 		if (error)
1245 			goto err;
1246 	}
1247 	t->repo = repo;
1248 	error = gotweb_get_repo_description(&repo_dir->description, srv,
1249 	    repo_dir->path, dirfd(dt));
1250 	if (error)
1251 		goto err;
1252 	error = got_get_repo_owner(&repo_dir->owner, c);
1253 	if (error)
1254 		goto err;
1255 	error = got_get_repo_age(&repo_dir->age, c, NULL);
1256 	if (error)
1257 		goto err;
1258 	error = gotweb_get_clone_url(&repo_dir->url, srv, repo_dir->path,
1259 	    dirfd(dt));
1260 err:
1261 	free(dir_test);
1262 	if (dt != NULL && closedir(dt) == EOF && error == NULL)
1263 		error = got_error_from_errno("closedir");
1264 	return error;
1265 }
1266 
1267 static const struct got_error *
1268 gotweb_init_repo_dir(struct repo_dir **repo_dir, const char *dir)
1269 {
1270 	const struct got_error *error;
1271 
1272 	*repo_dir = calloc(1, sizeof(**repo_dir));
1273 	if (*repo_dir == NULL)
1274 		return got_error_from_errno("calloc");
1275 
1276 	if (asprintf(&(*repo_dir)->name, "%s", dir) == -1) {
1277 		error = got_error_from_errno("asprintf");
1278 		free(*repo_dir);
1279 		*repo_dir = NULL;
1280 		return error;
1281 	}
1282 	(*repo_dir)->owner = NULL;
1283 	(*repo_dir)->description = NULL;
1284 	(*repo_dir)->url = NULL;
1285 	(*repo_dir)->path = NULL;
1286 
1287 	return NULL;
1288 }
1289 
1290 static const struct got_error *
1291 gotweb_get_repo_description(char **description, struct server *srv,
1292     const char *dirpath, int dir)
1293 {
1294 	const struct got_error *error = NULL;
1295 	struct stat sb;
1296 	int fd = -1;
1297 	off_t len;
1298 
1299 	*description = NULL;
1300 	if (srv->show_repo_description == 0)
1301 		return NULL;
1302 
1303 	fd = openat(dir, "description", O_RDONLY);
1304 	if (fd == -1) {
1305 		if (errno != ENOENT && errno != EACCES) {
1306 			error = got_error_from_errno_fmt("openat %s/%s",
1307 			    dirpath, "description");
1308 		}
1309 		goto done;
1310 	}
1311 
1312 	if (fstat(fd, &sb) == -1) {
1313 		error = got_error_from_errno_fmt("fstat %s/%s",
1314 		    dirpath, "description");
1315 		goto done;
1316 	}
1317 
1318 	len = sb.st_size;
1319 	if (len > GOTWEBD_MAXDESCRSZ - 1)
1320 		len = GOTWEBD_MAXDESCRSZ - 1;
1321 
1322 	*description = calloc(len + 1, sizeof(**description));
1323 	if (*description == NULL) {
1324 		error = got_error_from_errno("calloc");
1325 		goto done;
1326 	}
1327 
1328 	if (read(fd, *description, len) == -1)
1329 		error = got_error_from_errno("read");
1330 done:
1331 	if (fd != -1 && close(fd) == -1 && error == NULL)
1332 		error = got_error_from_errno("close");
1333 	return error;
1334 }
1335 
1336 static const struct got_error *
1337 gotweb_get_clone_url(char **url, struct server *srv, const char *dirpath,
1338     int dir)
1339 {
1340 	const struct got_error *error = NULL;
1341 	struct stat sb;
1342 	int fd = -1;
1343 	off_t len;
1344 
1345 	*url = NULL;
1346 	if (srv->show_repo_cloneurl == 0)
1347 		return NULL;
1348 
1349 	fd = openat(dir, "cloneurl", O_RDONLY);
1350 	if (fd == -1) {
1351 		if (errno != ENOENT && errno != EACCES) {
1352 			error = got_error_from_errno_fmt("openat %s/%s",
1353 			    dirpath, "cloneurl");
1354 		}
1355 		goto done;
1356 	}
1357 
1358 	if (fstat(fd, &sb) == -1) {
1359 		error = got_error_from_errno_fmt("fstat %s/%s",
1360 		    dirpath, "cloneurl");
1361 		goto done;
1362 	}
1363 
1364 	len = sb.st_size;
1365 	if (len > GOTWEBD_MAXCLONEURLSZ - 1)
1366 		len = GOTWEBD_MAXCLONEURLSZ - 1;
1367 
1368 	*url = calloc(len + 1, sizeof(**url));
1369 	if (*url == NULL) {
1370 		error = got_error_from_errno("calloc");
1371 		goto done;
1372 	}
1373 
1374 	if (read(fd, *url, len) == -1)
1375 		error = got_error_from_errno("read");
1376 done:
1377 	if (fd != -1 && close(fd) == -1 && error == NULL)
1378 		error = got_error_from_errno("close");
1379 	return error;
1380 }
1381 
1382 int
1383 gotweb_render_age(struct template *tp, time_t committer_time, int ref_tm)
1384 {
1385 	struct request *c = tp->tp_arg;
1386 	struct tm tm;
1387 	long long diff_time;
1388 	const char *years = "years ago", *months = "months ago";
1389 	const char *weeks = "weeks ago", *days = "days ago";
1390 	const char *hours = "hours ago",  *minutes = "minutes ago";
1391 	const char *seconds = "seconds ago", *now = "right now";
1392 	char *s;
1393 	char datebuf[64];
1394 	size_t r;
1395 
1396 	switch (ref_tm) {
1397 	case TM_DIFF:
1398 		diff_time = time(NULL) - committer_time;
1399 		if (diff_time > 60 * 60 * 24 * 365 * 2) {
1400 			if (fcgi_printf(c, "%lld %s",
1401 			    (diff_time / 60 / 60 / 24 / 365), years) == -1)
1402 				return -1;
1403 		} else if (diff_time > 60 * 60 * 24 * (365 / 12) * 2) {
1404 			if (fcgi_printf(c, "%lld %s",
1405 			    (diff_time / 60 / 60 / 24 / (365 / 12)),
1406 			    months) == -1)
1407 				return -1;
1408 		} else if (diff_time > 60 * 60 * 24 * 7 * 2) {
1409 			if (fcgi_printf(c, "%lld %s",
1410 			    (diff_time / 60 / 60 / 24 / 7), weeks) == -1)
1411 				return -1;
1412 		} else if (diff_time > 60 * 60 * 24 * 2) {
1413 			if (fcgi_printf(c, "%lld %s",
1414 			    (diff_time / 60 / 60 / 24), days) == -1)
1415 				return -1;
1416 		} else if (diff_time > 60 * 60 * 2) {
1417 			if (fcgi_printf(c, "%lld %s",
1418 			    (diff_time / 60 / 60), hours) == -1)
1419 				return -1;
1420 		} else if (diff_time > 60 * 2) {
1421 			if (fcgi_printf(c, "%lld %s", (diff_time / 60),
1422 			    minutes) == -1)
1423 				return -1;
1424 		} else if (diff_time > 2) {
1425 			if (fcgi_printf(c, "%lld %s", diff_time,
1426 			    seconds) == -1)
1427 				return -1;
1428 		} else {
1429 			if (fcgi_puts(tp, now) == -1)
1430 				return -1;
1431 		}
1432 		break;
1433 	case TM_LONG:
1434 		if (gmtime_r(&committer_time, &tm) == NULL)
1435 			return -1;
1436 
1437 		s = asctime_r(&tm, datebuf);
1438 		if (s == NULL)
1439 			return -1;
1440 
1441 		if (fcgi_puts(tp, datebuf) == -1 ||
1442 		    fcgi_puts(tp, " UTC") == -1)
1443 			return -1;
1444 		break;
1445 	case TM_RFC822:
1446 		if (gmtime_r(&committer_time, &tm) == NULL)
1447 			return -1;
1448 
1449 		r = strftime(datebuf, sizeof(datebuf),
1450 		    "%a, %d %b %Y %H:%M:%S GMT", &tm);
1451 		if (r == 0)
1452 			return -1;
1453 
1454 		if (fcgi_puts(tp, datebuf) == -1)
1455 			return -1;
1456 		break;
1457 	}
1458 	return 0;
1459 }