Commits
- Commit:
e70fd95218f6bb77ff45fc0c94b8daeb6709ffa7
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
split gotd/session.c into session_read.c and session_write.c
This makes it easier to tweak the read/write code paths separately.
- Commit:
1cb49b67c167a14c547143ce621e7573f59c82a3
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
get rid of gotd client_id field where it is not needed
This ID was necessary back when session and repo processes supported
connections from multiple clients. Nowadays, these processes run per
connection and exit once a single client session has been served.
The other processes already identify the client via the session/repo
file descriptor which has sent an imsg.
- Commit:
ba97b2d7ec97e54a025a39e04c0fd59fdd54a57b
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
add initial support for commit notifications to gotd(8)
At present only email notifications are implemented.
Code for HTTP notifications is not yet finished, hence HTTP-related
documentation remains hidden for now.
This adds a new 'notify' process which has an "exec" pledge. It runs
helper programs which implement the notification transport layer,
such as got-notify-email which speaks SMTP. This design avoids having
to link all of gotd with network libraries and related crypto libraries.
Notification content is generated by the 'repo_write' process. Commit log
messages and diffstats are written to a file which the 'notify' process
will pass on to its helpers on stdin. The default output looks similar
to 'got log -d'. If too many new commits are present the output looks
similar to 'got log -s' instead. Tags always look like 'got tag -l'.
The session process coordinates generation of notifications. It maintains
a notification queue which holds one notification per updated reference,
and passes notification requests from this queue to the 'repo_write'
process for notification content creation and then to the 'notify'
process for notification delivery.
Only one notification can be in flight at a time to avoid file descriptor
starvation if many references get updated in a single client session.
ok op@
- Commit:
4b3827cd43394b89d2af822dcd1d9a9179c1ee10
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
make gitwrapper ignore 'permission denied' for repository paths
We recommend that gotsh users should not have direct filesystem
access to repositories served by gotd. Which means admins will be
setting things up as follows if public read-access should be denied:
chown _gotd /git
chmod 700 /git
su -m _gotd -c 'gotadmin init /git/repo.git"
However, gitwrapper would error out when repositories listed in
gotd.conf were inaccessible to the user invoking gitwrapper:
git-upload-pack: /etc/gotd.conf:2: realpath /git/repo.git: Permission denied
Make gitwrapper ignore such errors as they are expected in this situation.
While here, add a PROC_GITWRAPPER process ID for use as a global variable
parse.y can check while special-casing any specific behaviour required by
gitwrapper. (The worse alternative would have been adding a new global
variable to parse.y just to control the behaviour on realpath errors.)
ok op@
- Commit:
c929736a36ab9616de454d901bd908e0c9512a26
- From:
- Omar Polo <op@omarpolo.com>
- Date:
move gotd_child_proc to gotd.c
make it opaque since it's unused outside of gotd.c. While here,
drop the unused `nhelpers' field.
ok/tweak stsp@
- Commit:
b061482840b244c4645851c4a02a9ce9723b9fc5
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
unveil repositories read-only in gotd session process while serving fetches
ok op@
- Commit:
1963be61deb20cacab2552113c66b38fbee7a080
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
remove dependency of gitwrapper on gotd/auth.c
Move gotd_auth_parseuid() from auth.c to parse.y as gotd_parseuid(), and
remove auth.c from the list of source files required by gitwrapper.
- Commit:
eeb616b754913da958b9781aee9ed88db64e7162
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
remove dependency of gitwrapper on gotd/listen.c
Move gotd_find_uid_connection_limit() from listen.c into parse.y and
remove listen.c from the list of source files required by gitwrapper.
- Commit:
9afa3de221045d529287cc3fa75fdc2915aed5c1
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
add support for protecting references against 'got send -f' to gotd
ok op@
- Commit:
e9e0377f452e9d3f600011e0714cc6c779f10bab
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
avoid gitwrapper printing a warning when /etc/gotd.conf does not exist
gotd still requires the config file, of course, but gitwrapper must
treat is as optional and remain silent if the file cannot be found.
- Commit:
b09c127974759a56a6b5273da53d215f8500f5a7
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
add gitwrapper(1)
ok op@, tracey@ earlier version
- Commit:
9a8e357c727600cb61ac6ec4c83259fa6d9a3081
- From:
- Omar Polo <op@omarpolo.com>
- Date:
gotd: implement the delete-refs capability
Allow clients to run "got send -d" against gotd. Clients will send a
zero-id as new id for a reference and, in the special but more common
case of just deleting and not updating, no pack file will be sent.
ok and tweaks by stsp@
- Commit:
eac23c306591c21ddaa23930159d302f668ae34c
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
update client state tracking in the gotd parent process
The session process takes over the old state definitions under
a new name ("session state"). The parent only needs to keep
track of whether a client has been granted access, so it only
uses two states: NEW, and ACCCESS_GRANTED which is set as soon
as the auth process has granted repository access and before
the session and repo_read/repo_write children are started.
Because 'gotctl info' can no longer observe the session state
remove support code for printing it.
ok op@
- Commit:
ee0b2e502f3be1d01835e96bdcd38afed67429f7
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
remove support for showing client capabilities in 'gotctl info'
The gotd parent process has lost access to client capabilities.
Take the easy way out and remove related code. If needed, client
capabilities can still be found in the debug log with 'gotd -v'.
ok op, jamsek
- Commit:
ae7c1b785440d9b4e2289d935ca85725f45680f1
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
add a gotd session process, split off from the parent process
The new session process is able to manipulate files in the repository
and keeps track of the read/write client session state.
The parent process now restricts its view of the filesystem to the
absolute path stored in argv[0], and combines this with unveil "x"
on this path. As a result the parent process can only re-exec itself.
small tweaks + ok op@
- Commit:
6f854dde056f82d0c757c720beed863fc557a1ca
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
remove the gotsh group requirement from gotd; any user can now connect
Repository access is now controlled by access rules in gotd.conf,
and concurrent connections to the gotd socket by local users are
limited by the listen process. We should keep refining our anti-DoS
measures in the future, but at least we have something in place now.
ok jamsek, op
- Commit:
40b85cca5d86ebef3a353efd464af989c3ebf18b
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
introduce connection options to gotd.conf
Allow administrators to tweak the default authentication and request
timeouts if needed, and to tweak the limit of concurrent connections
for specific user accounts.
with several tweaks from and ok op@
- Commit:
7a0564e3ba8d55d4f066d3ba0f35ff64fd6a8d60
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
enforce a per-uid connection limit in the gotd listen process
For now the limit is set at compile-time. It will become configurable
via gotd.conf soon.
ok op@
- Commit:
365cf0f34d08316d433e730a8663283029f729b3
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
move "unix" pledge promise from gotd parent to auth process
The listen process now communicates the client UID/GID to the parent,
and the auth process verifies this on behalf of the parent.
This allows us to remove the "unix" pledge promise from the parent,
removing parent access to syscalls such as listen() and accept() in
the AF_UNIX domain.
ok tracey@ op@
- Commit:
5e25db14db9eb20ee11b68048b45b3e0f54d50eb
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
run gotd authentication in a separate child process
ok op@
- Commit:
b50a2b4639132c68255480f1c5c8785fd7cd8094
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
fork gotd repo_read/repo_write children on demand
ok op, jamsek
- Commit:
eec68231a79adb345b1a6a3194e5ddb353570356
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
switch gotd from chroot(2) to unveil(2)
In the future, gotd will fork+exec new processes for each client connection.
Using unveil instead of chroot avoids having to start such processes as root.
The -portable version could use chroot(2) where no equivalent to unveil(2)
exists. A future component which starts new processes will be isolated as
a separate process, which could run as root in the -portable version.
ok op@
- Commit:
d93ecf7dc6dd75bc506128cc5666c1b76761e0a0
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
add a gotd "listen" process which watches the unix socket
ok op@
- Commit:
8c6fc1468a57de4851e137b55bda5cd838e2f759
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
rename GOTD_SOCK_FILENO to GOTD_FILENO_MSG_PIPE for clarity (it's not a socket)
- Commit:
ddbe612c691511246aacb15046c1a202d0efcf75
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
fix group membership check in gotd auth
ok op@