1 /*
2  * Copyright (c) 2016, 2019, 2020-2022 Tracey Emery <tracey@traceyemery.net>
3  * Copyright (c) 2015 Mike Larkin <mlarkin@openbsd.org>
4  * Copyright (c) 2014 Reyk Floeter <reyk@openbsd.org>
5  * Copyright (c) 2013 David Gwynne <dlg@openbsd.org>
6  * Copyright (c) 2013 Florian Obser <florian@openbsd.org>
7  *
8  * Permission to use, copy, modify, and distribute this software for any
9  * purpose with or without fee is hereby granted, provided that the above
10  * copyright notice and this permission notice appear in all copies.
11  *
12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19  */
20 
21 #include <net/if.h>
22 #include <netinet/in.h>
23 #include <sys/queue.h>
24 #include <sys/stat.h>
25 #include <sys/types.h>
26 
27 #include <ctype.h>
28 #include <dirent.h>
29 #include <errno.h>
30 #include <event.h>
31 #include <fcntl.h>
32 #include <imsg.h>
33 #include <sha1.h>
34 #include <sha2.h>
35 #include <stdio.h>
36 #include <stdlib.h>
37 #include <string.h>
38 #include <unistd.h>
39 
40 #include "got_error.h"
41 #include "got_object.h"
42 #include "got_reference.h"
43 #include "got_repository.h"
44 #include "got_path.h"
45 #include "got_cancel.h"
46 #include "got_worktree.h"
47 #include "got_diff.h"
48 #include "got_commit_graph.h"
49 #include "got_blame.h"
50 #include "got_privsep.h"
51 
52 #include "proc.h"
53 #include "gotwebd.h"
54 #include "tmpl.h"
55 
56 static const struct querystring_keys querystring_keys[] = {
57 	{ "action",		ACTION },
58 	{ "commit",		COMMIT },
59 	{ "file",		RFILE },
60 	{ "folder",		FOLDER },
61 	{ "headref",		HEADREF },
62 	{ "index_page",		INDEX_PAGE },
63 	{ "path",		PATH },
64 	{ "page",		PAGE },
65 };
66 
67 static const struct action_keys action_keys[] = {
68 	{ "blame",	BLAME },
69 	{ "blob",	BLOB },
70 	{ "blobraw",	BLOBRAW },
71 	{ "briefs",	BRIEFS },
72 	{ "commits",	COMMITS },
73 	{ "diff",	DIFF },
74 	{ "error",	ERR },
75 	{ "index",	INDEX },
76 	{ "summary",	SUMMARY },
77 	{ "tag",	TAG },
78 	{ "tags",	TAGS },
79 	{ "tree",	TREE },
80 	{ "rss",	RSS },
81 };
82 
83 static const struct got_error *gotweb_init_querystring(struct querystring **);
84 static const struct got_error *gotweb_parse_querystring(struct querystring **,
85     char *);
86 static const struct got_error *gotweb_assign_querystring(struct querystring **,
87     char *, char *);
88 static int gotweb_render_index(struct template *);
89 static const struct got_error *gotweb_init_repo_dir(struct repo_dir **,
90     const char *);
91 static const struct got_error *gotweb_load_got_path(struct request *c,
92     struct repo_dir *);
93 static const struct got_error *gotweb_get_repo_description(char **,
94     struct server *, const char *, int);
95 static const struct got_error *gotweb_get_clone_url(char **, struct server *,
96     const char *, int);
97 
98 static void gotweb_free_querystring(struct querystring *);
99 static void gotweb_free_repo_dir(struct repo_dir *);
100 
101 struct server *gotweb_get_server(uint8_t *, uint8_t *);
102 
103 static int
104 gotweb_reply(struct request *c, int status, const char *ctype,
105     struct gotweb_url *location)
106 {
107 	const char	*csp;
108 
109 	if (status != 200 && fcgi_printf(c, "Status: %d\r\n", status) == -1)
110 		return -1;
111 
112 	if (location) {
113 		if (fcgi_puts(c->tp, "Location: ") == -1 ||
114 		    gotweb_render_url(c, location) == -1 ||
115 		    fcgi_puts(c->tp, "\r\n") == -1)
116 			return -1;
117 	}
118 
119 	csp = "Content-Security-Policy: default-src 'self'; "
120 	    "script-src 'none'; object-src 'none';\r\n";
121 	if (fcgi_puts(c->tp, csp) == -1)
122 		return -1;
123 
124 	if (ctype && fcgi_printf(c, "Content-Type: %s\r\n", ctype) == -1)
125 		return -1;
126 
127 	return fcgi_puts(c->tp, "\r\n");
128 }
129 
130 static int
131 gotweb_reply_file(struct request *c, const char *ctype, const char *file,
132     const char *suffix)
133 {
134 	int r;
135 
136 	r = fcgi_printf(c, "Content-Disposition: attachment; "
137 	    "filename=%s%s\r\n", file, suffix ? suffix : "");
138 	if (r == -1)
139 		return -1;
140 	return gotweb_reply(c, 200, ctype, NULL);
141 }
142 
143 void
144 gotweb_process_request(struct request *c)
145 {
146 	const struct got_error *error = NULL;
147 	struct server *srv = NULL;
148 	struct querystring *qs = NULL;
149 	struct repo_dir *repo_dir = NULL;
150 	const char *rss_ctype = "application/rss+xml;charset=utf-8";
151 	const uint8_t *buf;
152 	size_t len;
153 	int r, binary = 0;
154 
155 	/* init the transport */
156 	error = gotweb_init_transport(&c->t);
157 	if (error) {
158 		log_warnx("%s: %s", __func__, error->msg);
159 		return;
160 	}
161 	/* don't process any further if client disconnected */
162 	if (c->sock->client_status == CLIENT_DISCONNECT)
163 		return;
164 	/* get the gotwebd server */
165 	srv = gotweb_get_server(c->server_name, c->http_host);
166 	if (srv == NULL) {
167 		log_warnx("%s: error server is NULL", __func__);
168 		goto err;
169 	}
170 	c->srv = srv;
171 	/* parse our querystring */
172 	error = gotweb_init_querystring(&qs);
173 	if (error) {
174 		log_warnx("%s: %s", __func__, error->msg);
175 		goto err;
176 	}
177 	c->t->qs = qs;
178 	error = gotweb_parse_querystring(&qs, c->querystring);
179 	if (error) {
180 		log_warnx("%s: %s", __func__, error->msg);
181 		goto err;
182 	}
183 
184 	/*
185 	 * certain actions require a commit id in the querystring. this stops
186 	 * bad actors from exploiting this by manually manipulating the
187 	 * querystring.
188 	 */
189 
190 	if (qs->action == BLAME || qs->action == BLOB ||
191 	    qs->action == BLOBRAW || qs->action == DIFF) {
192 		if (qs->commit == NULL) {
193 			error = got_error(GOT_ERR_QUERYSTRING);
194 			goto err;
195 		}
196 	}
197 
198 	if (qs->action != INDEX) {
199 		error = gotweb_init_repo_dir(&repo_dir, qs->path);
200 		if (error)
201 			goto err;
202 		error = gotweb_load_got_path(c, repo_dir);
203 		c->t->repo_dir = repo_dir;
204 		if (error && error->code != GOT_ERR_LONELY_PACKIDX)
205 			goto err;
206 	}
207 
208 	if (qs->action == BLOBRAW || qs->action == BLOB) {
209 		error = got_get_repo_commits(c, 1);
210 		if (error)
211 			goto err;
212 
213 		error = got_open_blob_for_output(&c->t->blob, &c->t->fd,
214 		    &binary, c);
215 		if (error)
216 			goto err;
217 	}
218 
219 	switch(qs->action) {
220 	case BLAME:
221 		error = got_get_repo_commits(c, 1);
222 		if (error) {
223 			log_warnx("%s: %s", __func__, error->msg);
224 			goto err;
225 		}
226 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
227 			return;
228 		gotweb_render_page(c->tp, gotweb_render_blame);
229 		return;
230 	case BLOB:
231 		if (binary) {
232 			struct gotweb_url url = {
233 				.index_page = -1,
234 				.page = -1,
235 				.action = BLOBRAW,
236 				.path = qs->path,
237 				.commit = qs->commit,
238 				.folder = qs->folder,
239 				.file = qs->file,
240 			};
241 
242 			gotweb_reply(c, 302, NULL, &url);
243 			return;
244 		}
245 
246 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
247 			return;
248 		gotweb_render_page(c->tp, gotweb_render_blob);
249 		return;
250 	case BLOBRAW:
251 		if (binary)
252 			r = gotweb_reply_file(c, "application/octet-stream",
253 			    qs->file, NULL);
254 		else
255 			r = gotweb_reply(c, 200, "text/plain", NULL);
256 		if (r == -1)
257 			return;
258 
259 		for (;;) {
260 			error = got_object_blob_read_block(&len, c->t->blob);
261 			if (error)
262 				break;
263 			if (len == 0)
264 				break;
265 			buf = got_object_blob_get_read_buf(c->t->blob);
266 			if (fcgi_gen_binary_response(c, buf, len) == -1)
267 				break;
268 		}
269 		return;
270 	case BRIEFS:
271 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
272 			return;
273 		gotweb_render_page(c->tp, gotweb_render_briefs);
274 		return;
275 	case COMMITS:
276 		error = got_get_repo_commits(c, srv->max_commits_display);
277 		if (error) {
278 			log_warnx("%s: %s", __func__, error->msg);
279 			goto err;
280 		}
281 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
282 			return;
283 		gotweb_render_page(c->tp, gotweb_render_commits);
284 		return;
285 	case DIFF:
286 		error = got_get_repo_commits(c, 1);
287 		if (error) {
288 			log_warnx("%s: %s", __func__, error->msg);
289 			goto err;
290 		}
291 		error = got_open_diff_for_output(&c->t->fp, &c->t->fd, c);
292 		if (error) {
293 			log_warnx("%s: %s", __func__, error->msg);
294 			goto err;
295 		}
296 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
297 			return;
298 		gotweb_render_page(c->tp, gotweb_render_diff);
299 		return;
300 	case INDEX:
301 		c->t->nrepos = scandir(srv->repos_path, &c->t->repos, NULL,
302 		    alphasort);
303 		if (c->t->nrepos == -1) {
304 			c->t->repos = NULL;
305 			error = got_error_from_errno2("scandir",
306 			    srv->repos_path);
307 			goto err;
308 		}
309 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
310 			return;
311 		gotweb_render_page(c->tp, gotweb_render_index);
312 		return;
313 	case RSS:
314 		error = got_get_repo_tags(c, D_MAXSLCOMMDISP);
315 		if (error)
316 			goto err;
317 		if (gotweb_reply_file(c, rss_ctype, repo_dir->name, ".rss")
318 		    == -1)
319 			return;
320 		gotweb_render_rss(c->tp);
321 		return;
322 	case SUMMARY:
323 		error = got_ref_list(&c->t->refs, c->t->repo, "refs/heads",
324 		    got_ref_cmp_by_name, NULL);
325 		if (error) {
326 			log_warnx("%s: got_ref_list: %s", __func__,
327 			    error->msg);
328 			goto err;
329 		}
330 		qs->action = TAGS;
331 		error = got_get_repo_tags(c, D_MAXSLCOMMDISP);
332 		if (error) {
333 			log_warnx("%s: got_get_repo_tags: %s", __func__,
334 			    error->msg);
335 			goto err;
336 		}
337 		qs->action = SUMMARY;
338 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
339 			return;
340 		gotweb_render_page(c->tp, gotweb_render_summary);
341 		return;
342 	case TAG:
343 		error = got_get_repo_tags(c, 1);
344 		if (error) {
345 			log_warnx("%s: %s", __func__, error->msg);
346 			goto err;
347 		}
348 		if (c->t->tag_count == 0) {
349 			error = got_error_msg(GOT_ERR_BAD_OBJ_ID,
350 			    "bad commit id");
351 			goto err;
352 		}
353 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
354 			return;
355 		gotweb_render_page(c->tp, gotweb_render_tag);
356 		return;
357 	case TAGS:
358 		error = got_get_repo_tags(c, srv->max_commits_display);
359 		if (error) {
360 			log_warnx("%s: %s", __func__, error->msg);
361 			goto err;
362 		}
363 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
364 			return;
365 		gotweb_render_page(c->tp, gotweb_render_tags);
366 		return;
367 	case TREE:
368 		error = got_get_repo_commits(c, 1);
369 		if (error) {
370 			log_warnx("%s: %s", __func__, error->msg);
371 			goto err;
372 		}
373 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
374 			return;
375 		gotweb_render_page(c->tp, gotweb_render_tree);
376 		return;
377 	case ERR:
378 	default:
379 		error = got_error(GOT_ERR_BAD_QUERYSTRING);
380 	}
381 
382 err:
383 	c->t->error = error;
384 	if (gotweb_reply(c, 400, "text/html", NULL) == -1)
385 		return;
386 	gotweb_render_page(c->tp, gotweb_render_error);
387 }
388 
389 struct server *
390 gotweb_get_server(uint8_t *server_name, uint8_t *subdomain)
391 {
392 	struct server *srv = NULL;
393 
394 	/* check against the server name first */
395 	if (strlen(server_name) > 0)
396 		TAILQ_FOREACH(srv, &gotwebd_env->servers, entry)
397 			if (strcmp(srv->name, server_name) == 0)
398 				goto done;
399 
400 	/* check against subdomain second */
401 	if (strlen(subdomain) > 0)
402 		TAILQ_FOREACH(srv, &gotwebd_env->servers, entry)
403 			if (strcmp(srv->name, subdomain) == 0)
404 				goto done;
405 
406 	/* if those fail, send first server */
407 	TAILQ_FOREACH(srv, &gotwebd_env->servers, entry)
408 		if (srv != NULL)
409 			break;
410 done:
411 	return srv;
412 };
413 
414 const struct got_error *
415 gotweb_init_transport(struct transport **t)
416 {
417 	const struct got_error *error = NULL;
418 
419 	*t = calloc(1, sizeof(**t));
420 	if (*t == NULL)
421 		return got_error_from_errno2("%s: calloc", __func__);
422 
423 	TAILQ_INIT(&(*t)->repo_commits);
424 	TAILQ_INIT(&(*t)->repo_tags);
425 	TAILQ_INIT(&(*t)->refs);
426 
427 	(*t)->repo = NULL;
428 	(*t)->repo_dir = NULL;
429 	(*t)->qs = NULL;
430 	(*t)->next_id = NULL;
431 	(*t)->prev_id = NULL;
432 	(*t)->next_disp = 0;
433 	(*t)->prev_disp = 0;
434 
435 	(*t)->fd = -1;
436 
437 	return error;
438 }
439 
440 static const struct got_error *
441 gotweb_init_querystring(struct querystring **qs)
442 {
443 	const struct got_error *error = NULL;
444 
445 	*qs = calloc(1, sizeof(**qs));
446 	if (*qs == NULL)
447 		return got_error_from_errno2("%s: calloc", __func__);
448 
449 	(*qs)->headref = strdup("HEAD");
450 	if ((*qs)->headref == NULL) {
451 		free(*qs);
452 		*qs = NULL;
453 		return got_error_from_errno2("%s: strdup", __func__);
454 	}
455 
456 	(*qs)->action = INDEX;
457 	(*qs)->commit = NULL;
458 	(*qs)->file = NULL;
459 	(*qs)->folder = NULL;
460 	(*qs)->index_page = 0;
461 	(*qs)->path = NULL;
462 
463 	return error;
464 }
465 
466 static const struct got_error *
467 gotweb_parse_querystring(struct querystring **qs, char *qst)
468 {
469 	const struct got_error *error = NULL;
470 	char *tok1 = NULL, *tok1_pair = NULL, *tok1_end = NULL;
471 	char *tok2 = NULL, *tok2_pair = NULL, *tok2_end = NULL;
472 
473 	if (qst == NULL)
474 		return error;
475 
476 	tok1 = strdup(qst);
477 	if (tok1 == NULL)
478 		return got_error_from_errno2("%s: strdup", __func__);
479 
480 	tok1_pair = tok1;
481 	tok1_end = tok1;
482 
483 	while (tok1_pair != NULL) {
484 		strsep(&tok1_end, "&");
485 
486 		tok2 = strdup(tok1_pair);
487 		if (tok2 == NULL) {
488 			free(tok1);
489 			return got_error_from_errno2("%s: strdup", __func__);
490 		}
491 
492 		tok2_pair = tok2;
493 		tok2_end = tok2;
494 
495 		while (tok2_pair != NULL) {
496 			strsep(&tok2_end, "=");
497 			if (tok2_end) {
498 				error = gotweb_assign_querystring(qs, tok2_pair,
499 				    tok2_end);
500 				if (error)
501 					goto err;
502 			}
503 			tok2_pair = tok2_end;
504 		}
505 		free(tok2);
506 		tok1_pair = tok1_end;
507 	}
508 	free(tok1);
509 	return error;
510 err:
511 	free(tok2);
512 	free(tok1);
513 	return error;
514 }
515 
516 /*
517  * Adapted from usr.sbin/httpd/httpd.c url_decode.
518  */
519 static const struct got_error *
520 gotweb_urldecode(char *url)
521 {
522 	char		*p, *q;
523 	char		 hex[3];
524 	unsigned long	 x;
525 
526 	hex[2] = '\0';
527 	p = q = url;
528 
529 	while (*p != '\0') {
530 		switch (*p) {
531 		case '%':
532 			/* Encoding character is followed by two hex chars */
533 			if (!isxdigit((unsigned char)p[1]) ||
534 			    !isxdigit((unsigned char)p[2]) ||
535 			    (p[1] == '0' && p[2] == '0'))
536 				return got_error(GOT_ERR_BAD_QUERYSTRING);
537 
538 			hex[0] = p[1];
539 			hex[1] = p[2];
540 
541 			/*
542 			 * We don't have to validate "hex" because it is
543 			 * guaranteed to include two hex chars followed by nul.
544 			 */
545 			x = strtoul(hex, NULL, 16);
546 			*q = (char)x;
547 			p += 2;
548 			break;
549 		default:
550 			*q = *p;
551 			break;
552 		}
553 		p++;
554 		q++;
555 	}
556 	*q = '\0';
557 
558 	return NULL;
559 }
560 
561 static const struct got_error *
562 gotweb_assign_querystring(struct querystring **qs, char *key, char *value)
563 {
564 	const struct got_error *error = NULL;
565 	const char *errstr;
566 	int a_cnt, el_cnt;
567 
568 	error = gotweb_urldecode(value);
569 	if (error)
570 		return error;
571 
572 	for (el_cnt = 0; el_cnt < QSELEM__MAX; el_cnt++) {
573 		if (strcmp(key, querystring_keys[el_cnt].name) != 0)
574 			continue;
575 
576 		switch (querystring_keys[el_cnt].element) {
577 		case ACTION:
578 			for (a_cnt = 0; a_cnt < ACTIONS__MAX; a_cnt++) {
579 				if (strcmp(value, action_keys[a_cnt].name) != 0)
580 					continue;
581 				else if (strcmp(value,
582 				    action_keys[a_cnt].name) == 0){
583 					(*qs)->action =
584 					    action_keys[a_cnt].action;
585 					goto qa_found;
586 				}
587 			}
588 			(*qs)->action = ERR;
589 qa_found:
590 			break;
591 		case COMMIT:
592 			(*qs)->commit = strdup(value);
593 			if ((*qs)->commit == NULL) {
594 				error = got_error_from_errno2("%s: strdup",
595 				    __func__);
596 				goto done;
597 			}
598 			break;
599 		case RFILE:
600 			(*qs)->file = strdup(value);
601 			if ((*qs)->file == NULL) {
602 				error = got_error_from_errno2("%s: strdup",
603 				    __func__);
604 				goto done;
605 			}
606 			break;
607 		case FOLDER:
608 			(*qs)->folder = strdup(value);
609 			if ((*qs)->folder == NULL) {
610 				error = got_error_from_errno2("%s: strdup",
611 				    __func__);
612 				goto done;
613 			}
614 			break;
615 		case HEADREF:
616 			free((*qs)->headref);
617 			(*qs)->headref = strdup(value);
618 			if ((*qs)->headref == NULL) {
619 				error = got_error_from_errno2("%s: strdup",
620 				    __func__);
621 				goto done;
622 			}
623 			break;
624 		case INDEX_PAGE:
625 			if (strlen(value) == 0)
626 				break;
627 			(*qs)->index_page = strtonum(value, INT64_MIN,
628 			    INT64_MAX, &errstr);
629 			if (errstr) {
630 				error = got_error_from_errno3("%s: strtonum %s",
631 				    __func__, errstr);
632 				goto done;
633 			}
634 			if ((*qs)->index_page < 0)
635 				(*qs)->index_page = 0;
636 			break;
637 		case PATH:
638 			(*qs)->path = strdup(value);
639 			if ((*qs)->path == NULL) {
640 				error = got_error_from_errno2("%s: strdup",
641 				    __func__);
642 				goto done;
643 			}
644 			break;
645 		case PAGE:
646 			if (strlen(value) == 0)
647 				break;
648 			(*qs)->page = strtonum(value, INT64_MIN,
649 			    INT64_MAX, &errstr);
650 			if (errstr) {
651 				error = got_error_from_errno3("%s: strtonum %s",
652 				    __func__, errstr);
653 				goto done;
654 			}
655 			if ((*qs)->page < 0)
656 				(*qs)->page = 0;
657 			break;
658 		default:
659 			break;
660 		}
661 	}
662 done:
663 	return error;
664 }
665 
666 void
667 gotweb_free_repo_tag(struct repo_tag *rt)
668 {
669 	if (rt != NULL) {
670 		free(rt->commit_id);
671 		free(rt->tag_name);
672 		free(rt->tag_commit);
673 		free(rt->commit_msg);
674 		free(rt->tagger);
675 	}
676 	free(rt);
677 }
678 
679 void
680 gotweb_free_repo_commit(struct repo_commit *rc)
681 {
682 	if (rc != NULL) {
683 		free(rc->path);
684 		free(rc->refs_str);
685 		free(rc->commit_id);
686 		free(rc->parent_id);
687 		free(rc->tree_id);
688 		free(rc->author);
689 		free(rc->committer);
690 		free(rc->commit_msg);
691 	}
692 	free(rc);
693 }
694 
695 static void
696 gotweb_free_querystring(struct querystring *qs)
697 {
698 	if (qs != NULL) {
699 		free(qs->commit);
700 		free(qs->file);
701 		free(qs->folder);
702 		free(qs->headref);
703 		free(qs->path);
704 	}
705 	free(qs);
706 }
707 
708 static void
709 gotweb_free_repo_dir(struct repo_dir *repo_dir)
710 {
711 	if (repo_dir != NULL) {
712 		free(repo_dir->name);
713 		free(repo_dir->owner);
714 		free(repo_dir->description);
715 		free(repo_dir->url);
716 		free(repo_dir->path);
717 	}
718 	free(repo_dir);
719 }
720 
721 void
722 gotweb_free_transport(struct transport *t)
723 {
724 	const struct got_error *err;
725 	struct repo_commit *rc = NULL, *trc = NULL;
726 	struct repo_tag *rt = NULL, *trt = NULL;
727 	int i;
728 
729 	got_ref_list_free(&t->refs);
730 	TAILQ_FOREACH_SAFE(rc, &t->repo_commits, entry, trc) {
731 		TAILQ_REMOVE(&t->repo_commits, rc, entry);
732 		gotweb_free_repo_commit(rc);
733 	}
734 	TAILQ_FOREACH_SAFE(rt, &t->repo_tags, entry, trt) {
735 		TAILQ_REMOVE(&t->repo_tags, rt, entry);
736 		gotweb_free_repo_tag(rt);
737 	}
738 	gotweb_free_repo_dir(t->repo_dir);
739 	gotweb_free_querystring(t->qs);
740 	free(t->more_id);
741 	free(t->next_id);
742 	free(t->prev_id);
743 	if (t->blob)
744 		got_object_blob_close(t->blob);
745 	if (t->fp) {
746 		err = got_gotweb_flushfile(t->fp, t->fd);
747 		if (err)
748 			log_warnx("%s: got_gotweb_flushfile failure: %s",
749 			    __func__, err->msg);
750 		t->fd = -1;
751 	}
752 	if (t->fd != -1)
753 		close(t->fd);
754 	if (t->repos) {
755 		for (i = 0; i < t->nrepos; ++i)
756 			free(t->repos[i]);
757 		free(t->repos);
758 	}
759 	free(t);
760 }
761 
762 void
763 gotweb_get_navs(struct request *c, struct gotweb_url *prev, int *have_prev,
764     struct gotweb_url *next, int *have_next)
765 {
766 	struct transport *t = c->t;
767 	struct querystring *qs = t->qs;
768 	struct server *srv = c->srv;
769 
770 	*have_prev = *have_next = 0;
771 
772 	switch(qs->action) {
773 	case INDEX:
774 		if (qs->index_page > 0) {
775 			*have_prev = 1;
776 			*prev = (struct gotweb_url){
777 				.action = -1,
778 				.index_page = qs->index_page - 1,
779 				.page = -1,
780 			};
781 		}
782 		if (t->next_disp == srv->max_repos_display &&
783 		    t->repos_total != (qs->index_page + 1) *
784 		    srv->max_repos_display) {
785 			*have_next = 1;
786 			*next = (struct gotweb_url){
787 				.action = -1,
788 				.index_page = qs->index_page + 1,
789 				.page = -1,
790 			};
791 		}
792 		break;
793 	case TAGS:
794 		if (t->prev_id && qs->commit != NULL &&
795 		    strcmp(qs->commit, t->prev_id) != 0) {
796 			*have_prev = 1;
797 			*prev = (struct gotweb_url){
798 				.action = TAGS,
799 				.index_page = -1,
800 				.page = qs->page - 1,
801 				.path = qs->path,
802 				.commit = t->prev_id,
803 				.headref = qs->headref,
804 			};
805 		}
806 		if (t->next_id) {
807 			*have_next = 1;
808 			*next = (struct gotweb_url){
809 				.action = TAGS,
810 				.index_page = -1,
811 				.page = qs->page + 1,
812 				.path = qs->path,
813 				.commit = t->next_id,
814 				.headref = qs->headref,
815 			};
816 		}
817 		break;
818 	}
819 }
820 
821 static int
822 gotweb_render_index(struct template *tp)
823 {
824 	const struct got_error *error = NULL;
825 	struct request *c = tp->tp_arg;
826 	struct server *srv = c->srv;
827 	struct transport *t = c->t;
828 	struct querystring *qs = t->qs;
829 	struct repo_dir *repo_dir = NULL;
830 	struct dirent **sd_dent = t->repos;
831 	unsigned int d_i, d_disp = 0;
832 	unsigned int d_skipped = 0;
833 	int type, r;
834 
835 	if (gotweb_render_repo_table_hdr(c->tp) == -1)
836 		return -1;
837 
838 	for (d_i = 0; d_i < t->nrepos; d_i++) {
839 		if (srv->max_repos > 0 && t->prev_disp == srv->max_repos)
840 			break;
841 
842 		if (strcmp(sd_dent[d_i]->d_name, ".") == 0 ||
843 		    strcmp(sd_dent[d_i]->d_name, "..") == 0) {
844 			d_skipped++;
845 			continue;
846 		}
847 
848 		error = got_path_dirent_type(&type, srv->repos_path,
849 		    sd_dent[d_i]);
850 		if (error)
851 			continue;
852 		if (type != DT_DIR) {
853 			d_skipped++;
854 			continue;
855 		}
856 
857 		if (qs->index_page > 0 && (qs->index_page *
858 		    srv->max_repos_display) > t->prev_disp) {
859 			t->prev_disp++;
860 			continue;
861 		}
862 
863 		error = gotweb_init_repo_dir(&repo_dir, sd_dent[d_i]->d_name);
864 		if (error)
865 			continue;
866 
867 		error = gotweb_load_got_path(c, repo_dir);
868 		if (error && error->code == GOT_ERR_LONELY_PACKIDX) {
869 			if (error->code != GOT_ERR_NOT_GIT_REPO)
870 				log_warnx("%s: %s: %s", __func__,
871 				    sd_dent[d_i]->d_name, error->msg);
872 			gotweb_free_repo_dir(repo_dir);
873 			repo_dir = NULL;
874 			d_skipped++;
875 			continue;
876 		}
877 
878 		d_disp++;
879 		t->prev_disp++;
880 
881 		r = gotweb_render_repo_fragment(c->tp, repo_dir);
882 		gotweb_free_repo_dir(repo_dir);
883 		if (r == -1)
884 			return -1;
885 
886 		t->next_disp++;
887 		if (d_disp == srv->max_repos_display)
888 			break;
889 	}
890 	t->repos_total = t->nrepos - d_skipped;
891 
892 	if (srv->max_repos_display == 0)
893 		return 0;
894 	if (srv->max_repos > 0 && srv->max_repos < srv->max_repos_display)
895 		return 0;
896 	if (t->repos_total <= srv->max_repos ||
897 	    t->repos_total <= srv->max_repos_display)
898 		return 0;
899 
900 	if (gotweb_render_navs(c->tp) == -1)
901 		return -1;
902 
903 	return 0;
904 }
905 
906 static inline int
907 should_urlencode(int c)
908 {
909 	if (c <= ' ' || c >= 127)
910 		return 1;
911 
912 	switch (c) {
913 		/* gen-delim */
914 	case ':':
915 	case '/':
916 	case '?':
917 	case '#':
918 	case '[':
919 	case ']':
920 	case '@':
921 		/* sub-delims */
922 	case '!':
923 	case '$':
924 	case '&':
925 	case '\'':
926 	case '(':
927 	case ')':
928 	case '*':
929 	case '+':
930 	case ',':
931 	case ';':
932 	case '=':
933 		/* needed because the URLs are embedded into the HTML */
934 	case '\"':
935 		return 1;
936 	default:
937 		return 0;
938 	}
939 }
940 
941 static char *
942 gotweb_urlencode(const char *str)
943 {
944 	const char *s;
945 	char *escaped;
946 	size_t i, len;
947 	int a, b;
948 
949 	len = 0;
950 	for (s = str; *s; ++s) {
951 		len++;
952 		if (should_urlencode(*s))
953 			len += 2;
954 	}
955 
956 	escaped = calloc(1, len + 1);
957 	if (escaped == NULL)
958 		return NULL;
959 
960 	i = 0;
961 	for (s = str; *s; ++s) {
962 		if (should_urlencode(*s)) {
963 			a = (*s & 0xF0) >> 4;
964 			b = (*s & 0x0F);
965 
966 			escaped[i++] = '%';
967 			escaped[i++] = a <= 9 ? ('0' + a) : ('7' + a);
968 			escaped[i++] = b <= 9 ? ('0' + b) : ('7' + b);
969 		} else
970 			escaped[i++] = *s;
971 	}
972 
973 	return escaped;
974 }
975 
976 const char *
977 gotweb_action_name(int action)
978 {
979 	switch (action) {
980 	case BLAME:
981 		return "blame";
982 	case BLOB:
983 		return "blob";
984 	case BLOBRAW:
985 		return "blobraw";
986 	case BRIEFS:
987 		return "briefs";
988 	case COMMITS:
989 		return "commits";
990 	case DIFF:
991 		return "diff";
992 	case ERR:
993 		return "err";
994 	case INDEX:
995 		return "index";
996 	case SUMMARY:
997 		return "summary";
998 	case TAG:
999 		return "tag";
1000 	case TAGS:
1001 		return "tags";
1002 	case TREE:
1003 		return "tree";
1004 	case RSS:
1005 		return "rss";
1006 	default:
1007 		return NULL;
1008 	}
1009 }
1010 
1011 int
1012 gotweb_render_url(struct request *c, struct gotweb_url *url)
1013 {
1014 	const char *sep = "?", *action;
1015 	char *tmp;
1016 	int r;
1017 
1018 	action = gotweb_action_name(url->action);
1019 	if (action != NULL) {
1020 		if (fcgi_printf(c, "?action=%s", action) == -1)
1021 			return -1;
1022 		sep = "&";
1023 	}
1024 
1025 	if (url->commit) {
1026 		if (fcgi_printf(c, "%scommit=%s", sep, url->commit) == -1)
1027 			return -1;
1028 		sep = "&";
1029 	}
1030 
1031 	if (url->previd) {
1032 		if (fcgi_printf(c, "%sprevid=%s", sep, url->previd) == -1)
1033 			return -1;
1034 		sep = "&";
1035 	}
1036 
1037 	if (url->prevset) {
1038 		if (fcgi_printf(c, "%sprevset=%s", sep, url->prevset) == -1)
1039 			return -1;
1040 		sep = "&";
1041 	}
1042 
1043 	if (url->file) {
1044 		tmp = gotweb_urlencode(url->file);
1045 		if (tmp == NULL)
1046 			return -1;
1047 		r = fcgi_printf(c, "%sfile=%s", sep, tmp);
1048 		free(tmp);
1049 		if (r == -1)
1050 			return -1;
1051 		sep = "&";
1052 	}
1053 
1054 	if (url->folder) {
1055 		tmp = gotweb_urlencode(url->folder);
1056 		if (tmp == NULL)
1057 			return -1;
1058 		r = fcgi_printf(c, "%sfolder=%s", sep, tmp);
1059 		free(tmp);
1060 		if (r == -1)
1061 			return -1;
1062 		sep = "&";
1063 	}
1064 
1065 	if (url->headref) {
1066 		tmp = gotweb_urlencode(url->headref);
1067 		if (tmp == NULL)
1068 			return -1;
1069 		r = fcgi_printf(c, "%sheadref=%s", sep, url->headref);
1070 		free(tmp);
1071 		if (r == -1)
1072 			return -1;
1073 		sep = "&";
1074 	}
1075 
1076 	if (url->index_page != -1) {
1077 		if (fcgi_printf(c, "%sindex_page=%d", sep,
1078 		    url->index_page) == -1)
1079 			return -1;
1080 		sep = "&";
1081 	}
1082 
1083 	if (url->path) {
1084 		tmp = gotweb_urlencode(url->path);
1085 		if (tmp == NULL)
1086 			return -1;
1087 		r = fcgi_printf(c, "%spath=%s", sep, tmp);
1088 		free(tmp);
1089 		if (r == -1)
1090 			return -1;
1091 		sep = "&";
1092 	}
1093 
1094 	if (url->page != -1) {
1095 		if (fcgi_printf(c, "%spage=%d", sep, url->page) == -1)
1096 			return -1;
1097 		sep = "&";
1098 	}
1099 
1100 	return 0;
1101 }
1102 
1103 int
1104 gotweb_render_absolute_url(struct request *c, struct gotweb_url *url)
1105 {
1106 	struct template	*tp = c->tp;
1107 	const char	*proto = c->https ? "https" : "http";
1108 
1109 	if (fcgi_puts(tp, proto) == -1 ||
1110 	    fcgi_puts(tp, "://") == -1 ||
1111 	    tp_htmlescape(tp, c->server_name) == -1 ||
1112 	    tp_htmlescape(tp, c->document_uri) == -1)
1113 		return -1;
1114 
1115 	return gotweb_render_url(c, url);
1116 }
1117 
1118 static struct got_repository *
1119 find_cached_repo(struct server *srv, const char *path)
1120 {
1121 	int i;
1122 
1123 	for (i = 0; i < srv->ncached_repos; i++) {
1124 		if (strcmp(srv->cached_repos[i].path, path) == 0)
1125 			return srv->cached_repos[i].repo;
1126 	}
1127 
1128 	return NULL;
1129 }
1130 
1131 static const struct got_error *
1132 cache_repo(struct got_repository **new, struct server *srv,
1133     struct repo_dir *repo_dir, struct socket *sock)
1134 {
1135 	const struct got_error *error = NULL;
1136 	struct got_repository *repo;
1137 	struct cached_repo *cr;
1138 	int evicted = 0;
1139 
1140 	if (srv->ncached_repos >= GOTWEBD_REPO_CACHESIZE) {
1141 		cr = &srv->cached_repos[srv->ncached_repos - 1];
1142 		error = got_repo_close(cr->repo);
1143 		memset(cr, 0, sizeof(*cr));
1144 		srv->ncached_repos--;
1145 		if (error)
1146 			return error;
1147 		memmove(&srv->cached_repos[1], &srv->cached_repos[0],
1148 		    srv->ncached_repos * sizeof(srv->cached_repos[0]));
1149 		cr = &srv->cached_repos[0];
1150 		evicted = 1;
1151 	} else {
1152 		cr = &srv->cached_repos[srv->ncached_repos];
1153 	}
1154 
1155 	error = got_repo_open(&repo, repo_dir->path, NULL, sock->pack_fds);
1156 	if (error) {
1157 		if (evicted) {
1158 			memmove(&srv->cached_repos[0], &srv->cached_repos[1],
1159 			    srv->ncached_repos * sizeof(srv->cached_repos[0]));
1160 		}
1161 		return error;
1162 	}
1163 
1164 	if (strlcpy(cr->path, repo_dir->path, sizeof(cr->path))
1165 	    >= sizeof(cr->path)) {
1166 		if (evicted) {
1167 			memmove(&srv->cached_repos[0], &srv->cached_repos[1],
1168 			    srv->ncached_repos * sizeof(srv->cached_repos[0]));
1169 		}
1170 		return got_error(GOT_ERR_NO_SPACE);
1171 	}
1172 
1173 	cr->repo = repo;
1174 	srv->ncached_repos++;
1175 	*new = repo;
1176 	return NULL;
1177 }
1178 
1179 static const struct got_error *
1180 gotweb_load_got_path(struct request *c, struct repo_dir *repo_dir)
1181 {
1182 	const struct got_error *error = NULL;
1183 	struct socket *sock = c->sock;
1184 	struct server *srv = c->srv;
1185 	struct transport *t = c->t;
1186 	struct got_repository *repo = NULL;
1187 	DIR *dt;
1188 	char *dir_test;
1189 
1190 	if (asprintf(&dir_test, "%s/%s/%s", srv->repos_path, repo_dir->name,
1191 	    GOTWEB_GIT_DIR) == -1)
1192 		return got_error_from_errno("asprintf");
1193 
1194 	dt = opendir(dir_test);
1195 	if (dt == NULL) {
1196 		free(dir_test);
1197 	} else {
1198 		repo_dir->path = dir_test;
1199 		dir_test = NULL;
1200 		goto done;
1201 	}
1202 
1203 	if (asprintf(&dir_test, "%s/%s", srv->repos_path,
1204 	    repo_dir->name) == -1)
1205 		return got_error_from_errno("asprintf");
1206 
1207 	dt = opendir(dir_test);
1208 	if (dt == NULL) {
1209 		error = got_error_path(repo_dir->name, GOT_ERR_NOT_GIT_REPO);
1210 		goto err;
1211 	} else {
1212 		repo_dir->path = dir_test;
1213 		dir_test = NULL;
1214 	}
1215 
1216 done:
1217 	if (srv->respect_exportok &&
1218 	    faccessat(dirfd(dt), "git-daemon-export-ok", F_OK, 0) == -1) {
1219 		error = got_error_path(repo_dir->name, GOT_ERR_NOT_GIT_REPO);
1220 		goto err;
1221 	}
1222 
1223 	repo = find_cached_repo(srv, repo_dir->path);
1224 	if (repo == NULL) {
1225 		error = cache_repo(&repo, srv, repo_dir, sock);
1226 		if (error)
1227 			goto err;
1228 	}
1229 	t->repo = repo;
1230 	error = gotweb_get_repo_description(&repo_dir->description, srv,
1231 	    repo_dir->path, dirfd(dt));
1232 	if (error)
1233 		goto err;
1234 	error = got_get_repo_owner(&repo_dir->owner, c);
1235 	if (error)
1236 		goto err;
1237 	error = got_get_repo_age(&repo_dir->age, c, NULL);
1238 	if (error)
1239 		goto err;
1240 	error = gotweb_get_clone_url(&repo_dir->url, srv, repo_dir->path,
1241 	    dirfd(dt));
1242 err:
1243 	free(dir_test);
1244 	if (dt != NULL && closedir(dt) == EOF && error == NULL)
1245 		error = got_error_from_errno("closedir");
1246 	return error;
1247 }
1248 
1249 static const struct got_error *
1250 gotweb_init_repo_dir(struct repo_dir **repo_dir, const char *dir)
1251 {
1252 	const struct got_error *error;
1253 
1254 	*repo_dir = calloc(1, sizeof(**repo_dir));
1255 	if (*repo_dir == NULL)
1256 		return got_error_from_errno("calloc");
1257 
1258 	if (asprintf(&(*repo_dir)->name, "%s", dir) == -1) {
1259 		error = got_error_from_errno("asprintf");
1260 		free(*repo_dir);
1261 		*repo_dir = NULL;
1262 		return error;
1263 	}
1264 	(*repo_dir)->owner = NULL;
1265 	(*repo_dir)->description = NULL;
1266 	(*repo_dir)->url = NULL;
1267 	(*repo_dir)->path = NULL;
1268 
1269 	return NULL;
1270 }
1271 
1272 static const struct got_error *
1273 gotweb_get_repo_description(char **description, struct server *srv,
1274     const char *dirpath, int dir)
1275 {
1276 	const struct got_error *error = NULL;
1277 	struct stat sb;
1278 	int fd = -1;
1279 	off_t len;
1280 
1281 	*description = NULL;
1282 	if (srv->show_repo_description == 0)
1283 		return NULL;
1284 
1285 	fd = openat(dir, "description", O_RDONLY);
1286 	if (fd == -1) {
1287 		if (errno != ENOENT && errno != EACCES) {
1288 			error = got_error_from_errno_fmt("openat %s/%s",
1289 			    dirpath, "description");
1290 		}
1291 		goto done;
1292 	}
1293 
1294 	if (fstat(fd, &sb) == -1) {
1295 		error = got_error_from_errno_fmt("fstat %s/%s",
1296 		    dirpath, "description");
1297 		goto done;
1298 	}
1299 
1300 	len = sb.st_size;
1301 	if (len > GOTWEBD_MAXDESCRSZ - 1)
1302 		len = GOTWEBD_MAXDESCRSZ - 1;
1303 
1304 	*description = calloc(len + 1, sizeof(**description));
1305 	if (*description == NULL) {
1306 		error = got_error_from_errno("calloc");
1307 		goto done;
1308 	}
1309 
1310 	if (read(fd, *description, len) == -1)
1311 		error = got_error_from_errno("read");
1312 done:
1313 	if (fd != -1 && close(fd) == -1 && error == NULL)
1314 		error = got_error_from_errno("close");
1315 	return error;
1316 }
1317 
1318 static const struct got_error *
1319 gotweb_get_clone_url(char **url, struct server *srv, const char *dirpath,
1320     int dir)
1321 {
1322 	const struct got_error *error = NULL;
1323 	struct stat sb;
1324 	int fd = -1;
1325 	off_t len;
1326 
1327 	*url = NULL;
1328 	if (srv->show_repo_cloneurl == 0)
1329 		return NULL;
1330 
1331 	fd = openat(dir, "cloneurl", O_RDONLY);
1332 	if (fd == -1) {
1333 		if (errno != ENOENT && errno != EACCES) {
1334 			error = got_error_from_errno_fmt("openat %s/%s",
1335 			    dirpath, "cloneurl");
1336 		}
1337 		goto done;
1338 	}
1339 
1340 	if (fstat(fd, &sb) == -1) {
1341 		error = got_error_from_errno_fmt("fstat %s/%s",
1342 		    dirpath, "cloneurl");
1343 		goto done;
1344 	}
1345 
1346 	len = sb.st_size;
1347 	if (len > GOTWEBD_MAXCLONEURLSZ - 1)
1348 		len = GOTWEBD_MAXCLONEURLSZ - 1;
1349 
1350 	*url = calloc(len + 1, sizeof(**url));
1351 	if (*url == NULL) {
1352 		error = got_error_from_errno("calloc");
1353 		goto done;
1354 	}
1355 
1356 	if (read(fd, *url, len) == -1)
1357 		error = got_error_from_errno("read");
1358 done:
1359 	if (fd != -1 && close(fd) == -1 && error == NULL)
1360 		error = got_error_from_errno("close");
1361 	return error;
1362 }
1363 
1364 int
1365 gotweb_render_age(struct template *tp, time_t committer_time, int ref_tm)
1366 {
1367 	struct request *c = tp->tp_arg;
1368 	struct tm tm;
1369 	long long diff_time;
1370 	const char *years = "years ago", *months = "months ago";
1371 	const char *weeks = "weeks ago", *days = "days ago";
1372 	const char *hours = "hours ago",  *minutes = "minutes ago";
1373 	const char *seconds = "seconds ago", *now = "right now";
1374 	char *s;
1375 	char datebuf[64];
1376 	size_t r;
1377 
1378 	switch (ref_tm) {
1379 	case TM_DIFF:
1380 		diff_time = time(NULL) - committer_time;
1381 		if (diff_time > 60 * 60 * 24 * 365 * 2) {
1382 			if (fcgi_printf(c, "%lld %s",
1383 			    (diff_time / 60 / 60 / 24 / 365), years) == -1)
1384 				return -1;
1385 		} else if (diff_time > 60 * 60 * 24 * (365 / 12) * 2) {
1386 			if (fcgi_printf(c, "%lld %s",
1387 			    (diff_time / 60 / 60 / 24 / (365 / 12)),
1388 			    months) == -1)
1389 				return -1;
1390 		} else if (diff_time > 60 * 60 * 24 * 7 * 2) {
1391 			if (fcgi_printf(c, "%lld %s",
1392 			    (diff_time / 60 / 60 / 24 / 7), weeks) == -1)
1393 				return -1;
1394 		} else if (diff_time > 60 * 60 * 24 * 2) {
1395 			if (fcgi_printf(c, "%lld %s",
1396 			    (diff_time / 60 / 60 / 24), days) == -1)
1397 				return -1;
1398 		} else if (diff_time > 60 * 60 * 2) {
1399 			if (fcgi_printf(c, "%lld %s",
1400 			    (diff_time / 60 / 60), hours) == -1)
1401 				return -1;
1402 		} else if (diff_time > 60 * 2) {
1403 			if (fcgi_printf(c, "%lld %s", (diff_time / 60),
1404 			    minutes) == -1)
1405 				return -1;
1406 		} else if (diff_time > 2) {
1407 			if (fcgi_printf(c, "%lld %s", diff_time,
1408 			    seconds) == -1)
1409 				return -1;
1410 		} else {
1411 			if (fcgi_puts(tp, now) == -1)
1412 				return -1;
1413 		}
1414 		break;
1415 	case TM_LONG:
1416 		if (gmtime_r(&committer_time, &tm) == NULL)
1417 			return -1;
1418 
1419 		s = asctime_r(&tm, datebuf);
1420 		if (s == NULL)
1421 			return -1;
1422 
1423 		if (fcgi_puts(tp, datebuf) == -1 ||
1424 		    fcgi_puts(tp, " UTC") == -1)
1425 			return -1;
1426 		break;
1427 	case TM_RFC822:
1428 		if (gmtime_r(&committer_time, &tm) == NULL)
1429 			return -1;
1430 
1431 		r = strftime(datebuf, sizeof(datebuf),
1432 		    "%a, %d %b %Y %H:%M:%S GMT", &tm);
1433 		if (r == 0)
1434 			return -1;
1435 
1436 		if (fcgi_puts(tp, datebuf) == -1)
1437 			return -1;
1438 		break;
1439 	}
1440 	return 0;
1441 }