upload.go

   1 /*
   2 GoCheese -- Python private package repository and caching proxy
   3 Copyright (C) 2019-2021 Sergey Matveev <stargrave@stargrave.org>
   4               2019-2021 Elena Balakhonova <balakhonova_e@riseup.net>
   5
   6 This program is free software: you can redistribute it and/or modify
   7 it under the terms of the GNU General Public License as published by
   8 the Free Software Foundation, version 3 of the License.
   9
  10 This program is distributed in the hope that it will be useful,
  11 but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 GNU General Public License for more details.
  14
  15 You should have received a copy of the GNU General Public License
  16 along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17 */
  18
  19 package main
  20
  21 import (
  22         "bufio"
  23         "bytes"
  24         "crypto/sha256"
  25         "encoding/hex"
  26         "io"
  27         "io/ioutil"
  28         "log"
  29         "net/http"
  30         "os"
  31         "path/filepath"
  32         "regexp"
  33         "strings"
  34         "time"
  35
  36         "go.cypherpunks.ru/recfile"
  37 )
  38
  39 var NormalizationRe = regexp.MustCompilePOSIX("[-_.]+")
  40
  41 func serveUpload(w http.ResponseWriter, r *http.Request) {
  42         // Authentication
  43         username, password, ok := r.BasicAuth()
  44         if !ok {
  45                 log.Println(r.RemoteAddr, "unauthenticated", username)
  46                 http.Error(w, "unauthenticated", http.StatusUnauthorized)
  47                 return
  48         }
  49         PasswordsM.RLock()
  50         auther, ok := Passwords[username]
  51         PasswordsM.RUnlock()
  52         if !ok || !auther.Auth(password) {
  53                 log.Println(r.RemoteAddr, "unauthenticated", username)
  54                 http.Error(w, "unauthenticated", http.StatusUnauthorized)
  55                 return
  56         }
  57
  58         // Form parsing
  59         var err error
  60         if err = r.ParseMultipartForm(1 << 20); err != nil {
  61                 http.Error(w, err.Error(), http.StatusBadRequest)
  62                 return
  63         }
  64         pkgNames, exists := r.MultipartForm.Value["name"]
  65         if !exists || len(pkgNames) != 1 {
  66                 http.Error(w, "single name is expected in request", http.StatusBadRequest)
  67                 return
  68         }
  69         pkgName := strings.ToLower(NormalizationRe.ReplaceAllString(pkgNames[0], "-"))
  70         dirPath := filepath.Join(Root, pkgName)
  71         gpgSigsExpected := make(map[string]struct{})
  72         now := time.Now().UTC()
  73
  74         var digestSHA256Expected []byte
  75         if digestSHA256ExpectedHex, exists := r.MultipartForm.Value["sha256_digest"]; exists {
  76                 digestSHA256Expected, err = hex.DecodeString(digestSHA256ExpectedHex[0])
  77                 if err != nil {
  78                         http.Error(w, "bad sha256_digest: "+err.Error(), http.StatusBadRequest)
  79                         return
  80                 }
  81         }
  82         var digestBLAKE2b256Expected []byte
  83         if digestBLAKE2b256ExpectedHex, exists := r.MultipartForm.Value["blake2_256_digest"]; exists {
  84                 digestBLAKE2b256Expected, err = hex.DecodeString(digestBLAKE2b256ExpectedHex[0])
  85                 if err != nil {
  86                         http.Error(w, "bad blake2_256_digest: "+err.Error(), http.StatusBadRequest)
  87                         return
  88                 }
  89         }
  90
  91         // Checking is it internal package
  92         if _, err = os.Stat(filepath.Join(dirPath, InternalFlag)); err != nil {
  93                 log.Println(r.RemoteAddr, "non-internal package", pkgName)
  94                 http.Error(w, "unknown internal package", http.StatusUnauthorized)
  95                 return
  96         }
  97
  98         for _, file := range r.MultipartForm.File["content"] {
  99                 filename := file.Filename
 100                 gpgSigsExpected[filename+GPGSigExt] = struct{}{}
 101                 log.Println(r.RemoteAddr, "put", filename, "by", username)
 102                 path := filepath.Join(dirPath, filename)
 103                 if _, err = os.Stat(path); err == nil {
 104                         log.Println(r.RemoteAddr, filename, "already exists")
 105                         http.Error(w, "already exists", http.StatusBadRequest)
 106                         return
 107                 }
 108                 if !mkdirForPkg(w, r, pkgName) {
 109                         return
 110                 }
 111                 src, err := file.Open()
 112                 defer src.Close()
 113                 if err != nil {
 114                         log.Println("error", r.RemoteAddr, filename, err)
 115                         http.Error(w, err.Error(), http.StatusInternalServerError)
 116                         return
 117                 }
 118                 dst, err := TempFile(dirPath)
 119                 if err != nil {
 120                         log.Println("error", r.RemoteAddr, filename, err)
 121                         http.Error(w, err.Error(), http.StatusInternalServerError)
 122                         return
 123                 }
 124                 dstBuf := bufio.NewWriter(dst)
 125                 hasherSHA256 := sha256.New()
 126                 hasherBLAKE2b256 := blake2b256New()
 127                 wr := io.MultiWriter(hasherSHA256, hasherBLAKE2b256, dst)
 128                 if _, err = io.Copy(wr, src); err != nil {
 129                         log.Println("error", r.RemoteAddr, filename, err)
 130                         os.Remove(dst.Name())
 131                         dst.Close()
 132                         http.Error(w, err.Error(), http.StatusInternalServerError)
 133                         return
 134                 }
 135                 if err = dstBuf.Flush(); err != nil {
 136                         log.Println("error", r.RemoteAddr, filename, err)
 137                         os.Remove(dst.Name())
 138                         dst.Close()
 139                         http.Error(w, err.Error(), http.StatusInternalServerError)
 140                         return
 141                 }
 142                 if !NoSync {
 143                         if err = dst.Sync(); err != nil {
 144                                 log.Println("error", r.RemoteAddr, filename, err)
 145                                 os.Remove(dst.Name())
 146                                 dst.Close()
 147                                 http.Error(w, err.Error(), http.StatusInternalServerError)
 148                                 return
 149                         }
 150                 }
 151                 dst.Close()
 152
 153                 digestSHA256 := hasherSHA256.Sum(nil)
 154                 digestBLAKE2b256 := hasherBLAKE2b256.Sum(nil)
 155                 if digestSHA256Expected != nil {
 156                         if bytes.Compare(digestSHA256Expected, digestSHA256) == 0 {
 157                                 log.Println(r.RemoteAddr, filename, "good SHA256 checksum received")
 158                         } else {
 159                                 log.Println(r.RemoteAddr, filename, "bad SHA256 checksum received")
 160                                 http.Error(w, "bad sha256 checksum", http.StatusBadRequest)
 161                                 os.Remove(dst.Name())
 162                                 return
 163                         }
 164                 }
 165                 if digestBLAKE2b256Expected != nil {
 166                         if bytes.Compare(digestBLAKE2b256Expected, digestBLAKE2b256) == 0 {
 167                                 log.Println(r.RemoteAddr, filename, "good BLAKE2b-256 checksum received")
 168                         } else {
 169                                 log.Println(r.RemoteAddr, filename, "bad BLAKE2b-256 checksum received")
 170                                 http.Error(w, "bad blake2_256 checksum", http.StatusBadRequest)
 171                                 os.Remove(dst.Name())
 172                                 return
 173                         }
 174                 }
 175
 176                 if err = os.Rename(dst.Name(), path); err != nil {
 177                         log.Println("error", r.RemoteAddr, path, err)
 178                         http.Error(w, err.Error(), http.StatusInternalServerError)
 179                         return
 180                 }
 181                 if err = DirSync(dirPath); err != nil {
 182                         log.Println("error", r.RemoteAddr, dirPath, err)
 183                         http.Error(w, err.Error(), http.StatusInternalServerError)
 184                         return
 185                 }
 186                 if err = WriteFileSync(dirPath, path+"."+HashAlgoSHA256, digestSHA256, now); err != nil {
 187                         log.Println("error", r.RemoteAddr, path+"."+HashAlgoSHA256, err)
 188                         http.Error(w, err.Error(), http.StatusInternalServerError)
 189                         return
 190                 }
 191                 if err = WriteFileSync(dirPath, path+"."+HashAlgoBLAKE2b256, digestBLAKE2b256, now); err != nil {
 192                         log.Println("error", r.RemoteAddr, path+"."+HashAlgoBLAKE2b256, err)
 193                         http.Error(w, err.Error(), http.StatusInternalServerError)
 194                         return
 195                 }
 196         }
 197         for _, file := range r.MultipartForm.File["gpg_signature"] {
 198                 filename := file.Filename
 199                 if _, exists := gpgSigsExpected[filename]; !exists {
 200                         log.Println(r.RemoteAddr, filename, "unexpected GPG signature filename")
 201                         http.Error(w, "unexpected GPG signature filename", http.StatusBadRequest)
 202                         return
 203                 }
 204                 delete(gpgSigsExpected, filename)
 205                 log.Println(r.RemoteAddr, "put", filename, "by", username)
 206                 path := filepath.Join(dirPath, filename)
 207                 if _, err = os.Stat(path); err == nil {
 208                         log.Println(r.RemoteAddr, filename, "already exists")
 209                         http.Error(w, "already exists", http.StatusBadRequest)
 210                         return
 211                 }
 212                 src, err := file.Open()
 213                 if err != nil {
 214                         log.Println("error", r.RemoteAddr, filename, err)
 215                         http.Error(w, err.Error(), http.StatusInternalServerError)
 216                         return
 217                 }
 218                 sig, err := ioutil.ReadAll(src)
 219                 src.Close()
 220                 if err != nil {
 221                         log.Println("error", r.RemoteAddr, filename, err)
 222                         http.Error(w, err.Error(), http.StatusInternalServerError)
 223                         return
 224                 }
 225                 if err = WriteFileSync(dirPath, path, sig, now); err != nil {
 226                         log.Println("error", r.RemoteAddr, path, err)
 227                         http.Error(w, err.Error(), http.StatusInternalServerError)
 228                         return
 229                 }
 230         }
 231
 232         var buf bytes.Buffer
 233         wr := recfile.NewWriter(&buf)
 234         for _, m := range [][2]string{
 235                 {"name", MetadataFieldName},
 236                 {"version", MetadataFieldVersion},
 237                 {"platform", MetadataFieldPlatform},
 238                 {"supported_platform", MetadataFieldSupportedPlatform},
 239                 {"summary", MetadataFieldSummary},
 240                 {"description", MetadataFieldDescription},
 241                 {"description_content_type", MetadataFieldDescriptionContentType},
 242                 {"keywords", MetadataFieldKeywords},
 243                 {"home_page", MetadataFieldHomePage},
 244                 {"author", MetadataFieldAuthor},
 245                 {"author_email", MetadataFieldAuthorEmail},
 246                 {"maintainer", MetadataFieldMaintainer},
 247                 {"maintainer_email", MetadataFieldMaintainerEmail},
 248                 {"license", MetadataFieldLicense},
 249                 {"classifiers", MetadataFieldClassifier},
 250                 {"requires_dist", MetadataFieldRequiresDist},
 251                 {"requires_python", MetadataFieldRequiresPython},
 252                 {"requires_external", MetadataFieldRequiresExternal},
 253                 {"project_url", MetadataFieldProjectURL},
 254                 {"provides_extra", MetadataFieldProvidesExtra},
 255         } {
 256                 formField, recField := m[0], m[1]
 257                 if vs, exists := r.MultipartForm.Value[formField]; exists {
 258                         for _, v := range vs {
 259                                 lines := strings.Split(v, "\n")
 260                                 if len(lines) > 1 {
 261                                         _, err = wr.WriteFieldMultiline(
 262                                                 metadataFieldToRecField(recField),
 263                                                 lines,
 264                                         )
 265                                 } else {
 266                                         _, err = wr.WriteFields(recfile.Field{
 267                                                 Name:  metadataFieldToRecField(recField),
 268                                                 Value: lines[0],
 269                                         })
 270                                 }
 271                                 if err != nil {
 272                                         log.Fatalln(err)
 273                                 }
 274                         }
 275                 }
 276         }
 277         path := filepath.Join(dirPath, MetadataFile)
 278         if err = WriteFileSync(dirPath, path, buf.Bytes(), now); err != nil {
 279                 log.Println("error", r.RemoteAddr, path, err)
 280                 http.Error(w, err.Error(), http.StatusInternalServerError)
 281                 return
 282         }
 283 }