From 75bca8ea4a8bc1126cc47c97c9ce595fd650c831 Mon Sep 17 00:00:00 2001 From: James Moger Date: Wed, 3 Apr 2013 20:31:11 -0400 Subject: Added Git Daemon support --- src/main/java/com/gitblit/git/GitDaemon.java | 64 ++++ src/main/java/com/gitblit/git/GitServlet.java | 42 +++ .../com/gitblit/git/GitblitReceivePackFactory.java | 106 +++++++ .../com/gitblit/git/GitblitUploadPackFactory.java | 99 +++++++ src/main/java/com/gitblit/git/ReceiveHook.java | 321 +++++++++++++++++++++ .../java/com/gitblit/git/RepositoryResolver.java | 105 +++++++ 6 files changed, 737 insertions(+) create mode 100644 src/main/java/com/gitblit/git/GitDaemon.java create mode 100644 src/main/java/com/gitblit/git/GitServlet.java create mode 100644 src/main/java/com/gitblit/git/GitblitReceivePackFactory.java create mode 100644 src/main/java/com/gitblit/git/GitblitUploadPackFactory.java create mode 100644 src/main/java/com/gitblit/git/ReceiveHook.java create mode 100644 src/main/java/com/gitblit/git/RepositoryResolver.java (limited to 'src/main/java/com/gitblit/git') diff --git a/src/main/java/com/gitblit/git/GitDaemon.java b/src/main/java/com/gitblit/git/GitDaemon.java new file mode 100644 index 00000000..8ec05631 --- /dev/null +++ b/src/main/java/com/gitblit/git/GitDaemon.java @@ -0,0 +1,64 @@ +/* + * Copyright 2013 gitblit.com. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.gitblit.git; + +import java.io.File; +import java.net.InetSocketAddress; + +import org.eclipse.jgit.transport.Daemon; +import org.eclipse.jgit.transport.DaemonClient; + +import com.gitblit.utils.StringUtils; + +/** + * Gitblit's Git Daemon ignores any and all per-repository daemon settings + * and integrates into Gitblit's security model. + * + * @author James Moger + * + */ +public class GitDaemon extends Daemon { + + /** + * Construct the Gitblit Git daemon. + * + * @param bindInterface + * the ip address of the interface to bind + * @param port + * the port to serve on + * @param folder + * the folder to serve from + */ + public GitDaemon(String bindInterface, int port, File folder) { + super(StringUtils.isEmpty(bindInterface) ? new InetSocketAddress(port) : new InetSocketAddress(bindInterface, port)); + + // set the repository resolver and pack factories + setRepositoryResolver(new RepositoryResolver(folder)); + setUploadPackFactory(new GitblitUploadPackFactory()); + setReceivePackFactory(new GitblitReceivePackFactory()); + + // configure the git daemon to ignore the per-repository settings, + // daemon.uploadpack and daemon.receivepack + getService("git-upload-pack").setOverridable(false); + getService("git-receive-pack").setOverridable(false); + + // enable both the upload and receive services and let the resolver, + // pack factories, and receive hook handle security + getService("git-upload-pack").setEnabled(true); + getService("git-receive-pack").setEnabled(true); + } + +} diff --git a/src/main/java/com/gitblit/git/GitServlet.java b/src/main/java/com/gitblit/git/GitServlet.java new file mode 100644 index 00000000..5a401066 --- /dev/null +++ b/src/main/java/com/gitblit/git/GitServlet.java @@ -0,0 +1,42 @@ +/* + * Copyright 2011 gitblit.com. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.gitblit.git; + +import javax.servlet.ServletConfig; +import javax.servlet.ServletException; +import javax.servlet.http.HttpServletRequest; + +import com.gitblit.GitBlit; + +/** + * The GitServlet provides http/https access to Git repositories. + * Access to this servlet is protected by the GitFilter. + * + * @author James Moger + * + */ +public class GitServlet extends org.eclipse.jgit.http.server.GitServlet { + + private static final long serialVersionUID = 1L; + + @Override + public void init(ServletConfig config) throws ServletException { + setRepositoryResolver(new RepositoryResolver(GitBlit.getRepositoriesFolder())); + setUploadPackFactory(new GitblitUploadPackFactory()); + setReceivePackFactory(new GitblitReceivePackFactory()); + super.init(config); + } +} diff --git a/src/main/java/com/gitblit/git/GitblitReceivePackFactory.java b/src/main/java/com/gitblit/git/GitblitReceivePackFactory.java new file mode 100644 index 00000000..8b8ef0e4 --- /dev/null +++ b/src/main/java/com/gitblit/git/GitblitReceivePackFactory.java @@ -0,0 +1,106 @@ +/* + * Copyright 2011 gitblit.com. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.gitblit.git; + +import javax.servlet.http.HttpServletRequest; + +import org.eclipse.jgit.lib.PersonIdent; +import org.eclipse.jgit.lib.Repository; +import org.eclipse.jgit.transport.DaemonClient; +import org.eclipse.jgit.transport.ReceivePack; +import org.eclipse.jgit.transport.resolver.ReceivePackFactory; +import org.eclipse.jgit.transport.resolver.ServiceNotAuthorizedException; +import org.eclipse.jgit.transport.resolver.ServiceNotEnabledException; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.gitblit.GitBlit; +import com.gitblit.models.RepositoryModel; +import com.gitblit.models.UserModel; +import com.gitblit.utils.HttpUtils; + +/** + * The receive pack factory creates a receive pack which accepts pushes from + * clients. + * + * @author James Moger + * + * @param the connection type + */ +public class GitblitReceivePackFactory implements ReceivePackFactory { + + protected final Logger logger = LoggerFactory.getLogger(GitblitReceivePackFactory.class); + + @Override + public ReceivePack create(X req, Repository db) + throws ServiceNotEnabledException, ServiceNotAuthorizedException { + + final ReceivePack rp = new ReceivePack(db); + UserModel user = UserModel.ANONYMOUS; + String origin = ""; + String gitblitUrl = ""; + int timeout = 0; + + // XXX extract the repository name from the config + // the name is injected by GitRepositoryResolver + String repositoryName = db.getConfig().getString("gitblit", null, "repositoryName"); + + + if (req instanceof HttpServletRequest) { + // http/https request may or may not be authenticated + HttpServletRequest request = (HttpServletRequest) req; + origin = request.getRemoteHost(); + gitblitUrl = HttpUtils.getGitblitURL(request); + + // determine pushing user + String username = request.getRemoteUser(); + if (username != null && !"".equals(username)) { + user = GitBlit.self().getUserModel(username); + if (user == null) { + // anonymous push, create a temporary usermodel + user = new UserModel(username); + } + } + } else if (req instanceof DaemonClient) { + // git daemon request is alway anonymous + DaemonClient client = (DaemonClient) req; + origin = client.getRemoteAddress().getHostAddress(); + // set timeout from Git daemon + timeout = client.getDaemon().getTimeout(); + } + + // set pushing user identity for reflog + rp.setRefLogIdent(new PersonIdent(user.username, user.username + "@" + origin)); + rp.setTimeout(timeout); + + // set advanced ref permissions + RepositoryModel repository = GitBlit.self().getRepositoryModel(repositoryName); + rp.setAllowCreates(user.canCreateRef(repository)); + rp.setAllowDeletes(user.canDeleteRef(repository)); + rp.setAllowNonFastForwards(user.canRewindRef(repository)); + + // setup the receive hook + ReceiveHook hook = new ReceiveHook(); + hook.user = user; + hook.repository = repository; + hook.gitblitUrl = gitblitUrl; + + rp.setPreReceiveHook(hook); + rp.setPostReceiveHook(hook); + + return rp; + } +} diff --git a/src/main/java/com/gitblit/git/GitblitUploadPackFactory.java b/src/main/java/com/gitblit/git/GitblitUploadPackFactory.java new file mode 100644 index 00000000..85750f84 --- /dev/null +++ b/src/main/java/com/gitblit/git/GitblitUploadPackFactory.java @@ -0,0 +1,99 @@ +/* + * Copyright 2011 gitblit.com. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.gitblit.git; + +import java.util.Map; + +import javax.servlet.http.HttpServletRequest; + +import org.eclipse.jgit.lib.Ref; +import org.eclipse.jgit.lib.Repository; +import org.eclipse.jgit.transport.DaemonClient; +import org.eclipse.jgit.transport.RefFilter; +import org.eclipse.jgit.transport.UploadPack; +import org.eclipse.jgit.transport.resolver.ServiceNotAuthorizedException; +import org.eclipse.jgit.transport.resolver.ServiceNotEnabledException; +import org.eclipse.jgit.transport.resolver.UploadPackFactory; + +import com.gitblit.GitBlit; +import com.gitblit.models.UserModel; +import com.gitblit.utils.IssueUtils; +import com.gitblit.utils.PushLogUtils; + +/** + * The upload pack factory creates an upload pack which controls what refs are + * advertised to cloning/pulling clients. + * + * @author James Moger + * + * @param the connection type + */ +public class GitblitUploadPackFactory implements UploadPackFactory { + + @Override + public UploadPack create(X req, Repository db) + throws ServiceNotEnabledException, ServiceNotAuthorizedException { + + UserModel user = UserModel.ANONYMOUS; + int timeout = 0; + + if (req instanceof HttpServletRequest) { + // http/https request may or may not be authenticated + user = GitBlit.self().authenticate((HttpServletRequest) req); + if (user == null) { + user = UserModel.ANONYMOUS; + } + } else if (req instanceof DaemonClient) { + // git daemon request is always anonymous + DaemonClient client = (DaemonClient) req; + // set timeout from Git daemon + timeout = client.getDaemon().getTimeout(); + } + + RefFilter refFilter = new UserRefFilter(user); + UploadPack up = new UploadPack(db); + up.setRefFilter(refFilter); + up.setTimeout(timeout); + + return up; + } + + /** + * Restricts advertisement of certain refs based on the permission of the + * requesting user. + */ + public static class UserRefFilter implements RefFilter { + + final UserModel user; + + public UserRefFilter(UserModel user) { + this.user = user; + } + + @Override + public Map filter(Map refs) { + if (user.canAdmin()) { + // admins can see all refs + return refs; + } + + // normal users can not clone gitblit refs + refs.remove(IssueUtils.GB_ISSUES); + refs.remove(PushLogUtils.GB_PUSHES); + return refs; + } + } +} diff --git a/src/main/java/com/gitblit/git/ReceiveHook.java b/src/main/java/com/gitblit/git/ReceiveHook.java new file mode 100644 index 00000000..a961f5a6 --- /dev/null +++ b/src/main/java/com/gitblit/git/ReceiveHook.java @@ -0,0 +1,321 @@ +/* + * Copyright 2011 gitblit.com. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.gitblit.git; + +import groovy.lang.Binding; +import groovy.util.GroovyScriptEngine; + +import java.io.File; +import java.io.IOException; +import java.text.MessageFormat; +import java.util.Collection; +import java.util.LinkedHashSet; +import java.util.List; +import java.util.Set; + +import org.eclipse.jgit.lib.PersonIdent; +import org.eclipse.jgit.revwalk.RevCommit; +import org.eclipse.jgit.transport.PostReceiveHook; +import org.eclipse.jgit.transport.PreReceiveHook; +import org.eclipse.jgit.transport.ReceiveCommand; +import org.eclipse.jgit.transport.ReceiveCommand.Result; +import org.eclipse.jgit.transport.ReceivePack; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.gitblit.Constants.AccessRestrictionType; +import com.gitblit.GitBlit; +import com.gitblit.Keys; +import com.gitblit.client.Translation; +import com.gitblit.models.RepositoryModel; +import com.gitblit.models.UserModel; +import com.gitblit.utils.ClientLogger; +import com.gitblit.utils.JGitUtils; +import com.gitblit.utils.PushLogUtils; +import com.gitblit.utils.StringUtils; + +/** + * The Gitblit receive hook allows for special processing on push events. + * That might include rejecting writes to specific branches or executing a + * script. + * + * @author James Moger + * + */ +public class ReceiveHook implements PreReceiveHook, PostReceiveHook { + + protected final Logger logger = LoggerFactory.getLogger(ReceiveHook.class); + + protected UserModel user; + + protected RepositoryModel repository; + + protected String gitblitUrl; + + private GroovyScriptEngine gse; + + private File groovyDir; + + public ReceiveHook() { + groovyDir = GitBlit.getGroovyScriptsFolder(); + try { + // set Grape root + File grapeRoot = GitBlit.getFileOrFolder(Keys.groovy.grapeFolder, "${baseFolder}/groovy/grape").getAbsoluteFile(); + grapeRoot.mkdirs(); + System.setProperty("grape.root", grapeRoot.getAbsolutePath()); + + gse = new GroovyScriptEngine(groovyDir.getAbsolutePath()); + } catch (IOException e) { + //throw new ServletException("Failed to instantiate Groovy Script Engine!", e); + } + } + + /** + * Instrumentation point where the incoming push event has been parsed, + * validated, objects created BUT refs have not been updated. You might + * use this to enforce a branch-write permissions model. + */ + @Override + public void onPreReceive(ReceivePack rp, Collection commands) { + if (repository.isFrozen) { + // repository is frozen/readonly + String reason = MessageFormat.format("Gitblit does not allow pushes to \"{0}\" because it is frozen!", repository.name); + logger.warn(reason); + for (ReceiveCommand cmd : commands) { + cmd.setResult(Result.REJECTED_OTHER_REASON, reason); + } + return; + } + + if (!repository.isBare) { + // repository has a working copy + String reason = MessageFormat.format("Gitblit does not allow pushes to \"{0}\" because it has a working copy!", repository.name); + logger.warn(reason); + for (ReceiveCommand cmd : commands) { + cmd.setResult(Result.REJECTED_OTHER_REASON, reason); + } + return; + } + + if (!user.canPush(repository)) { + // user does not have push permissions + String reason = MessageFormat.format("User \"{0}\" does not have push permissions for \"{1}\"!", user.username, repository.name); + logger.warn(reason); + for (ReceiveCommand cmd : commands) { + cmd.setResult(Result.REJECTED_OTHER_REASON, reason); + } + return; + } + + if (repository.accessRestriction.atLeast(AccessRestrictionType.PUSH) && repository.verifyCommitter) { + // enforce committer verification + if (StringUtils.isEmpty(user.emailAddress)) { + // emit warning if user does not have an email address + logger.warn(MessageFormat.format("Consider setting an email address for {0} ({1}) to improve committer verification.", user.getDisplayName(), user.username)); + } + + // Optionally enforce that the committer of the left parent chain + // match the account being used to push the commits. + // + // This requires all merge commits are executed with the "--no-ff" + // option to force a merge commit even if fast-forward is possible. + // This ensures that the chain of left parents has the commit + // identity of the merging user. + boolean allRejected = false; + for (ReceiveCommand cmd : commands) { + try { + List commits = JGitUtils.getRevLog(rp.getRepository(), cmd.getOldId().name(), cmd.getNewId().name()); + for (RevCommit commit : commits) { + PersonIdent committer = commit.getCommitterIdent(); + if (!user.is(committer.getName(), committer.getEmailAddress())) { + String reason; + if (StringUtils.isEmpty(user.emailAddress)) { + // account does not have en email address + reason = MessageFormat.format("{0} by {1} <{2}> was not committed by {3} ({4})", commit.getId().name(), committer.getName(), StringUtils.isEmpty(committer.getEmailAddress()) ? "?":committer.getEmailAddress(), user.getDisplayName(), user.username); + } else { + // account has an email address + reason = MessageFormat.format("{0} by {1} <{2}> was not committed by {3} ({4}) <{5}>", commit.getId().name(), committer.getName(), StringUtils.isEmpty(committer.getEmailAddress()) ? "?":committer.getEmailAddress(), user.getDisplayName(), user.username, user.emailAddress); + } + logger.warn(reason); + cmd.setResult(Result.REJECTED_OTHER_REASON, reason); + allRejected &= true; + break; + } else { + allRejected = false; + } + } + } catch (Exception e) { + logger.error("Failed to verify commits were made by pushing user", e); + } + } + + if (allRejected) { + // all ref updates rejected, abort + return; + } + } + + Set scripts = new LinkedHashSet(); + scripts.addAll(GitBlit.self().getPreReceiveScriptsInherited(repository)); + scripts.addAll(repository.preReceiveScripts); + runGroovy(repository, user, commands, rp, scripts); + for (ReceiveCommand cmd : commands) { + if (!Result.NOT_ATTEMPTED.equals(cmd.getResult())) { + logger.warn(MessageFormat.format("{0} {1} because \"{2}\"", cmd.getNewId() + .getName(), cmd.getResult(), cmd.getMessage())); + } + } + } + + /** + * Instrumentation point where the incoming push has been applied to the + * repository. This is the point where we would trigger a Jenkins build + * or send an email. + */ + @Override + public void onPostReceive(ReceivePack rp, Collection commands) { + if (commands.size() == 0) { + logger.debug("skipping post-receive hooks, no refs created, updated, or removed"); + return; + } + + // log ref changes + for (ReceiveCommand cmd : commands) { + if (Result.OK.equals(cmd.getResult())) { + // add some logging for important ref changes + switch (cmd.getType()) { + case DELETE: + logger.info(MessageFormat.format("{0} DELETED {1} in {2} ({3})", user.username, cmd.getRefName(), repository.name, cmd.getOldId().name())); + break; + case CREATE: + logger.info(MessageFormat.format("{0} CREATED {1} in {2}", user.username, cmd.getRefName(), repository.name)); + break; + case UPDATE: + logger.info(MessageFormat.format("{0} UPDATED {1} in {2} (from {3} to {4})", user.username, cmd.getRefName(), repository.name, cmd.getOldId().name(), cmd.getNewId().name())); + break; + case UPDATE_NONFASTFORWARD: + logger.info(MessageFormat.format("{0} UPDATED NON-FAST-FORWARD {1} in {2} (from {3} to {4})", user.username, cmd.getRefName(), repository.name, cmd.getOldId().name(), cmd.getNewId().name())); + break; + default: + break; + } + } + } + + if (repository.useIncrementalPushTags) { + // tag each pushed branch tip + String emailAddress = user.emailAddress == null ? rp.getRefLogIdent().getEmailAddress() : user.emailAddress; + PersonIdent userIdent = new PersonIdent(user.getDisplayName(), emailAddress); + + for (ReceiveCommand cmd : commands) { + if (!cmd.getRefName().startsWith("refs/heads/")) { + // only tag branch ref changes + continue; + } + + if (!ReceiveCommand.Type.DELETE.equals(cmd.getType()) + && ReceiveCommand.Result.OK.equals(cmd.getResult())) { + String objectId = cmd.getNewId().getName(); + String branch = cmd.getRefName().substring("refs/heads/".length()); + // get translation based on the server's locale setting + String template = Translation.get("gb.incrementalPushTagMessage"); + String msg = MessageFormat.format(template, branch); + String prefix; + if (StringUtils.isEmpty(repository.incrementalPushTagPrefix)) { + prefix = GitBlit.getString(Keys.git.defaultIncrementalPushTagPrefix, "r"); + } else { + prefix = repository.incrementalPushTagPrefix; + } + + JGitUtils.createIncrementalRevisionTag( + rp.getRepository(), + objectId, + userIdent, + prefix, + "0", + msg); + } + } + } + + // update push log + try { + PushLogUtils.updatePushLog(user, rp.getRepository(), commands); + logger.debug(MessageFormat.format("{0} push log updated", repository.name)); + } catch (Exception e) { + logger.error(MessageFormat.format("Failed to update {0} pushlog", repository.name), e); + } + + // run Groovy hook scripts + Set scripts = new LinkedHashSet(); + scripts.addAll(GitBlit.self().getPostReceiveScriptsInherited(repository)); + scripts.addAll(repository.postReceiveScripts); + runGroovy(repository, user, commands, rp, scripts); + } + + /** + * Runs the specified Groovy hook scripts. + * + * @param repository + * @param user + * @param commands + * @param scripts + */ + protected void runGroovy(RepositoryModel repository, UserModel user, + Collection commands, ReceivePack rp, Set scripts) { + if (scripts == null || scripts.size() == 0) { + // no Groovy scripts to execute + return; + } + + Binding binding = new Binding(); + binding.setVariable("gitblit", GitBlit.self()); + binding.setVariable("repository", repository); + binding.setVariable("receivePack", rp); + binding.setVariable("user", user); + binding.setVariable("commands", commands); + binding.setVariable("url", gitblitUrl); + binding.setVariable("logger", logger); + binding.setVariable("clientLogger", new ClientLogger(rp)); + for (String script : scripts) { + if (StringUtils.isEmpty(script)) { + continue; + } + // allow script to be specified without .groovy extension + // this is easier to read in the settings + File file = new File(groovyDir, script); + if (!file.exists() && !script.toLowerCase().endsWith(".groovy")) { + file = new File(groovyDir, script + ".groovy"); + if (file.exists()) { + script = file.getName(); + } + } + try { + Object result = gse.run(script, binding); + if (result instanceof Boolean) { + if (!((Boolean) result)) { + logger.error(MessageFormat.format( + "Groovy script {0} has failed! Hook scripts aborted.", script)); + break; + } + } + } catch (Exception e) { + logger.error( + MessageFormat.format("Failed to execute Groovy script {0}", script), e); + } + } + } +} \ No newline at end of file diff --git a/src/main/java/com/gitblit/git/RepositoryResolver.java b/src/main/java/com/gitblit/git/RepositoryResolver.java new file mode 100644 index 00000000..fb5db712 --- /dev/null +++ b/src/main/java/com/gitblit/git/RepositoryResolver.java @@ -0,0 +1,105 @@ +/* + * Copyright 2013 gitblit.com. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.gitblit.git; + +import java.io.File; +import java.io.IOException; +import java.text.MessageFormat; + +import javax.servlet.http.HttpServletRequest; + +import org.eclipse.jgit.errors.RepositoryNotFoundException; +import org.eclipse.jgit.lib.Repository; +import org.eclipse.jgit.transport.DaemonClient; +import org.eclipse.jgit.transport.resolver.FileResolver; +import org.eclipse.jgit.transport.resolver.ServiceNotEnabledException; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.gitblit.GitBlit; +import com.gitblit.models.RepositoryModel; +import com.gitblit.models.UserModel; + +/** + * Resolves repositories and grants export access. + * + * @author James Moger + * + */ +public class RepositoryResolver extends FileResolver { + + private final Logger logger = LoggerFactory.getLogger(RepositoryResolver.class); + + public RepositoryResolver(File repositoriesFolder) { + super(repositoriesFolder, true); + } + + /** + * Open the repository and inject the repository name into the settings. + */ + @Override + public Repository open(final X req, final String name) + throws RepositoryNotFoundException, ServiceNotEnabledException { + Repository repo = super.open(req, name); + // XXX Set repository name for the pack factories + // We do this because the JGit API does not have a consistent way to + // retrieve the repository name from the pack factories or the hooks. + repo.getConfig().setString("gitblit", null, "repositoryName", name); + return repo; + } + + /** + * Check if this repository can be served by the requested client connection. + */ + @Override + protected boolean isExportOk(X req, String repositoryName, Repository db) throws IOException { + RepositoryModel model = GitBlit.self().getRepositoryModel(repositoryName); + + String scheme = null; + UserModel user = null; + String origin = null; + + if (req instanceof DaemonClient) { + // git daemon request + // this is an anonymous/unauthenticated protocol + DaemonClient client = (DaemonClient) req; + scheme = "git"; + origin = client.getRemoteAddress().toString(); + user = UserModel.ANONYMOUS; + } else if (req instanceof HttpServletRequest) { + // http/https request + HttpServletRequest httpRequest = (HttpServletRequest) req; + scheme = httpRequest.getScheme(); + origin = httpRequest.getRemoteAddr(); + user = GitBlit.self().authenticate(httpRequest); + if (user == null) { + user = UserModel.ANONYMOUS; + } + } + + if (user.canClone(model)) { + // user can access this git repo + logger.debug(MessageFormat.format("{0}:// access of {1} by {2} from {3} PERMITTED", + scheme, repositoryName, user.username, origin)); + return true; + } + + // user can not access this git repo + logger.warn(MessageFormat.format("{0}:// access of {1} by {2} from {3} DENIED", + scheme, repositoryName, user.username, origin)); + return false; + } +} -- cgit v1.2.3