upload.go

   1 /*
   2 GoCheese -- Python private package repository and caching proxy
   3 Copyright (C) 2019-2022 Sergey Matveev <stargrave@stargrave.org>
   4               2019-2022 Elena Balakhonova <balakhonova_e@riseup.net>
   5
   6 This program is free software: you can redistribute it and/or modify
   7 it under the terms of the GNU General Public License as published by
   8 the Free Software Foundation, version 3 of the License.
   9
  10 This program is distributed in the hope that it will be useful,
  11 but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 GNU General Public License for more details.
  14
  15 You should have received a copy of the GNU General Public License
  16 along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17 */
  18
  19 package main
  20
  21 import (
  22         "bufio"
  23         "bytes"
  24         "crypto/sha256"
  25         "encoding/hex"
  26         "io"
  27         "log"
  28         "net/http"
  29         "os"
  30         "path/filepath"
  31         "regexp"
  32         "strings"
  33         "time"
  34
  35         "go.cypherpunks.ru/recfile"
  36 )
  37
  38 var NormalizationRe = regexp.MustCompilePOSIX("[-_.]+")
  39
  40 func serveUpload(w http.ResponseWriter, r *http.Request) {
  41         // Authentication
  42         username, password, ok := r.BasicAuth()
  43         if !ok {
  44                 log.Println(r.RemoteAddr, "unauthenticated", username)
  45                 http.Error(w, "unauthenticated", http.StatusUnauthorized)
  46                 return
  47         }
  48         PasswordsM.RLock()
  49         auther, ok := Passwords[username]
  50         PasswordsM.RUnlock()
  51         if !ok || !auther.Auth(password) {
  52                 log.Println(r.RemoteAddr, "unauthenticated", username)
  53                 http.Error(w, "unauthenticated", http.StatusUnauthorized)
  54                 return
  55         }
  56
  57         // Form parsing
  58         var err error
  59         if err = r.ParseMultipartForm(1 << 20); err != nil {
  60                 http.Error(w, err.Error(), http.StatusBadRequest)
  61                 return
  62         }
  63         pkgNames, exists := r.MultipartForm.Value["name"]
  64         if !exists || len(pkgNames) != 1 {
  65                 http.Error(w, "single name is expected in request", http.StatusBadRequest)
  66                 return
  67         }
  68         pkgName := strings.ToLower(NormalizationRe.ReplaceAllString(pkgNames[0], "-"))
  69         dirPath := filepath.Join(Root, pkgName)
  70         gpgSigsExpected := make(map[string]struct{})
  71         now := time.Now().UTC()
  72
  73         var digestSHA256Expected []byte
  74         if digestSHA256ExpectedHex, exists := r.MultipartForm.Value["sha256_digest"]; exists {
  75                 digestSHA256Expected, err = hex.DecodeString(digestSHA256ExpectedHex[0])
  76                 if err != nil {
  77                         http.Error(w, "bad sha256_digest: "+err.Error(), http.StatusBadRequest)
  78                         return
  79                 }
  80         }
  81         var digestBLAKE2b256Expected []byte
  82         if digestBLAKE2b256ExpectedHex, exists := r.MultipartForm.Value["blake2_256_digest"]; exists {
  83                 digestBLAKE2b256Expected, err = hex.DecodeString(digestBLAKE2b256ExpectedHex[0])
  84                 if err != nil {
  85                         http.Error(w, "bad blake2_256_digest: "+err.Error(), http.StatusBadRequest)
  86                         return
  87                 }
  88         }
  89
  90         // Checking is it internal package
  91         if _, err = os.Stat(filepath.Join(dirPath, InternalFlag)); err != nil {
  92                 log.Println(r.RemoteAddr, "non-internal package", pkgName)
  93                 http.Error(w, "unknown internal package", http.StatusUnauthorized)
  94                 return
  95         }
  96
  97         for _, file := range r.MultipartForm.File["content"] {
  98                 filename := file.Filename
  99                 gpgSigsExpected[filename+GPGSigExt] = struct{}{}
 100                 log.Println(r.RemoteAddr, "put", filename, "by", username)
 101                 path := filepath.Join(dirPath, filename)
 102                 if _, err = os.Stat(path); err == nil {
 103                         log.Println(r.RemoteAddr, filename, "already exists")
 104                         http.Error(w, "already exists", http.StatusBadRequest)
 105                         return
 106                 }
 107                 if !mkdirForPkg(w, r, pkgName) {
 108                         return
 109                 }
 110                 src, err := file.Open()
 111                 defer src.Close()
 112                 if err != nil {
 113                         log.Println("error", r.RemoteAddr, filename, err)
 114                         http.Error(w, err.Error(), http.StatusInternalServerError)
 115                         return
 116                 }
 117                 dst, err := TempFile(dirPath)
 118                 if err != nil {
 119                         log.Println("error", r.RemoteAddr, filename, err)
 120                         http.Error(w, err.Error(), http.StatusInternalServerError)
 121                         return
 122                 }
 123                 dstBuf := bufio.NewWriter(dst)
 124                 hasherSHA256 := sha256.New()
 125                 hasherBLAKE2b256 := blake2b256New()
 126                 wr := io.MultiWriter(hasherSHA256, hasherBLAKE2b256, dst)
 127                 if _, err = io.Copy(wr, src); err != nil {
 128                         log.Println("error", r.RemoteAddr, filename, err)
 129                         os.Remove(dst.Name())
 130                         dst.Close()
 131                         http.Error(w, err.Error(), http.StatusInternalServerError)
 132                         return
 133                 }
 134                 if err = dstBuf.Flush(); err != nil {
 135                         log.Println("error", r.RemoteAddr, filename, err)
 136                         os.Remove(dst.Name())
 137                         dst.Close()
 138                         http.Error(w, err.Error(), http.StatusInternalServerError)
 139                         return
 140                 }
 141                 if !NoSync {
 142                         if err = dst.Sync(); err != nil {
 143                                 log.Println("error", r.RemoteAddr, filename, err)
 144                                 os.Remove(dst.Name())
 145                                 dst.Close()
 146                                 http.Error(w, err.Error(), http.StatusInternalServerError)
 147                                 return
 148                         }
 149                 }
 150                 dst.Close()
 151
 152                 digestSHA256 := hasherSHA256.Sum(nil)
 153                 digestBLAKE2b256 := hasherBLAKE2b256.Sum(nil)
 154                 if digestSHA256Expected != nil {
 155                         if bytes.Compare(digestSHA256Expected, digestSHA256) == 0 {
 156                                 log.Println(r.RemoteAddr, filename, "good SHA256 checksum received")
 157                         } else {
 158                                 log.Println(r.RemoteAddr, filename, "bad SHA256 checksum received")
 159                                 http.Error(w, "bad sha256 checksum", http.StatusBadRequest)
 160                                 os.Remove(dst.Name())
 161                                 return
 162                         }
 163                 }
 164                 if digestBLAKE2b256Expected != nil {
 165                         if bytes.Compare(digestBLAKE2b256Expected, digestBLAKE2b256) == 0 {
 166                                 log.Println(r.RemoteAddr, filename, "good BLAKE2b-256 checksum received")
 167                         } else {
 168                                 log.Println(r.RemoteAddr, filename, "bad BLAKE2b-256 checksum received")
 169                                 http.Error(w, "bad blake2_256 checksum", http.StatusBadRequest)
 170                                 os.Remove(dst.Name())
 171                                 return
 172                         }
 173                 }
 174
 175                 if err = os.Rename(dst.Name(), path); err != nil {
 176                         log.Println("error", r.RemoteAddr, path, err)
 177                         http.Error(w, err.Error(), http.StatusInternalServerError)
 178                         return
 179                 }
 180                 if err = DirSync(dirPath); err != nil {
 181                         log.Println("error", r.RemoteAddr, dirPath, err)
 182                         http.Error(w, err.Error(), http.StatusInternalServerError)
 183                         return
 184                 }
 185                 if err = WriteFileSync(dirPath, path+"."+HashAlgoSHA256, digestSHA256, now); err != nil {
 186                         log.Println("error", r.RemoteAddr, path+"."+HashAlgoSHA256, err)
 187                         http.Error(w, err.Error(), http.StatusInternalServerError)
 188                         return
 189                 }
 190                 if err = WriteFileSync(dirPath, path+"."+HashAlgoBLAKE2b256, digestBLAKE2b256, now); err != nil {
 191                         log.Println("error", r.RemoteAddr, path+"."+HashAlgoBLAKE2b256, err)
 192                         http.Error(w, err.Error(), http.StatusInternalServerError)
 193                         return
 194                 }
 195         }
 196         for _, file := range r.MultipartForm.File["gpg_signature"] {
 197                 filename := file.Filename
 198                 if _, exists := gpgSigsExpected[filename]; !exists {
 199                         log.Println(r.RemoteAddr, filename, "unexpected GPG signature filename")
 200                         http.Error(w, "unexpected GPG signature filename", http.StatusBadRequest)
 201                         return
 202                 }
 203                 delete(gpgSigsExpected, filename)
 204                 log.Println(r.RemoteAddr, "put", filename, "by", username)
 205                 path := filepath.Join(dirPath, filename)
 206                 if _, err = os.Stat(path); err == nil {
 207                         log.Println(r.RemoteAddr, filename, "already exists")
 208                         http.Error(w, "already exists", http.StatusBadRequest)
 209                         return
 210                 }
 211                 src, err := file.Open()
 212                 if err != nil {
 213                         log.Println("error", r.RemoteAddr, filename, err)
 214                         http.Error(w, err.Error(), http.StatusInternalServerError)
 215                         return
 216                 }
 217                 sig, err := io.ReadAll(src)
 218                 src.Close()
 219                 if err != nil {
 220                         log.Println("error", r.RemoteAddr, filename, err)
 221                         http.Error(w, err.Error(), http.StatusInternalServerError)
 222                         return
 223                 }
 224                 if err = WriteFileSync(dirPath, path, sig, now); err != nil {
 225                         log.Println("error", r.RemoteAddr, path, err)
 226                         http.Error(w, err.Error(), http.StatusInternalServerError)
 227                         return
 228                 }
 229         }
 230
 231         var buf bytes.Buffer
 232         wr := recfile.NewWriter(&buf)
 233         for _, m := range MDFormToRecField {
 234                 formField, recField := m[0], m[1]
 235                 if vs, exists := r.MultipartForm.Value[formField]; exists {
 236                         for _, v := range vs {
 237                                 lines := strings.Split(v, "\n")
 238                                 if len(lines) > 1 {
 239                                         _, err = wr.WriteFieldMultiline(recField, lines)
 240                                 } else {
 241                                         _, err = wr.WriteFields(recfile.Field{
 242                                                 Name:  recField,
 243                                                 Value: lines[0],
 244                                         })
 245                                 }
 246                                 if err != nil {
 247                                         log.Fatalln(err)
 248                                 }
 249                         }
 250                 }
 251         }
 252         path := filepath.Join(dirPath, MDFile)
 253         if err = WriteFileSync(dirPath, path, buf.Bytes(), now); err != nil {
 254                 log.Println("error", r.RemoteAddr, path, err)
 255                 http.Error(w, err.Error(), http.StatusInternalServerError)
 256                 return
 257         }
 258 }