upload.go

   1 /*
   2 GoCheese -- Python private package repository and caching proxy
   3 Copyright (C) 2019-2021 Sergey Matveev <stargrave@stargrave.org>
   4               2019-2021 Elena Balakhonova <balakhonova_e@riseup.net>
   5
   6 This program is free software: you can redistribute it and/or modify
   7 it under the terms of the GNU General Public License as published by
   8 the Free Software Foundation, version 3 of the License.
   9
  10 This program is distributed in the hope that it will be useful,
  11 but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 GNU General Public License for more details.
  14
  15 You should have received a copy of the GNU General Public License
  16 along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17 */
  18
  19 package main
  20
  21 import (
  22         "bufio"
  23         "bytes"
  24         "crypto/sha256"
  25         "encoding/hex"
  26         "io"
  27         "io/ioutil"
  28         "log"
  29         "net/http"
  30         "os"
  31         "path/filepath"
  32 )
  33
  34 func serveUpload(w http.ResponseWriter, r *http.Request) {
  35         // Authentication
  36         username, password, ok := r.BasicAuth()
  37         if !ok {
  38                 log.Println(r.RemoteAddr, "unauthenticated", username)
  39                 http.Error(w, "unauthenticated", http.StatusUnauthorized)
  40                 return
  41         }
  42         PasswordsM.RLock()
  43         auther, ok := Passwords[username]
  44         PasswordsM.RUnlock()
  45         if !ok || !auther.Auth(password) {
  46                 log.Println(r.RemoteAddr, "unauthenticated", username)
  47                 http.Error(w, "unauthenticated", http.StatusUnauthorized)
  48                 return
  49         }
  50
  51         // Form parsing
  52         var err error
  53         if err = r.ParseMultipartForm(1 << 20); err != nil {
  54                 http.Error(w, err.Error(), http.StatusBadRequest)
  55                 return
  56         }
  57         pkgNames, exists := r.MultipartForm.Value["name"]
  58         if !exists || len(pkgNames) != 1 {
  59                 http.Error(w, "single name is expected in request", http.StatusBadRequest)
  60                 return
  61         }
  62         pkgName := normalizationRe.ReplaceAllString(pkgNames[0], "-")
  63         dirPath := filepath.Join(*root, pkgName)
  64         var digestExpected []byte
  65         if digestExpectedHex, exists := r.MultipartForm.Value["sha256_digest"]; exists {
  66                 digestExpected, err = hex.DecodeString(digestExpectedHex[0])
  67                 if err != nil {
  68                         http.Error(w, "bad sha256_digest: "+err.Error(), http.StatusBadRequest)
  69                         return
  70                 }
  71         }
  72         gpgSigsExpected := make(map[string]struct{})
  73
  74         // Checking is it internal package
  75         if _, err = os.Stat(filepath.Join(dirPath, InternalFlag)); err != nil {
  76                 log.Println(r.RemoteAddr, "non-internal package", pkgName)
  77                 http.Error(w, "unknown internal package", http.StatusUnauthorized)
  78                 return
  79         }
  80
  81         for _, file := range r.MultipartForm.File["content"] {
  82                 filename := file.Filename
  83                 gpgSigsExpected[filename+GPGSigExt] = struct{}{}
  84                 log.Println(r.RemoteAddr, "put", filename, "by", username)
  85                 path := filepath.Join(dirPath, filename)
  86                 if _, err = os.Stat(path); err == nil {
  87                         log.Println(r.RemoteAddr, filename, "already exists")
  88                         http.Error(w, "already exists", http.StatusBadRequest)
  89                         return
  90                 }
  91                 if !mkdirForPkg(w, r, pkgName) {
  92                         return
  93                 }
  94                 src, err := file.Open()
  95                 defer src.Close()
  96                 if err != nil {
  97                         log.Println("error", r.RemoteAddr, filename, err)
  98                         http.Error(w, err.Error(), http.StatusInternalServerError)
  99                         return
 100                 }
 101                 dst, err := TempFile(dirPath)
 102                 if err != nil {
 103                         log.Println("error", r.RemoteAddr, filename, err)
 104                         http.Error(w, err.Error(), http.StatusInternalServerError)
 105                         return
 106                 }
 107                 dstBuf := bufio.NewWriter(dst)
 108                 hasher := sha256.New()
 109                 wr := io.MultiWriter(hasher, dst)
 110                 if _, err = io.Copy(wr, src); err != nil {
 111                         log.Println("error", r.RemoteAddr, filename, err)
 112                         os.Remove(dst.Name())
 113                         dst.Close()
 114                         http.Error(w, err.Error(), http.StatusInternalServerError)
 115                         return
 116                 }
 117                 if err = dstBuf.Flush(); err != nil {
 118                         log.Println("error", r.RemoteAddr, filename, err)
 119                         os.Remove(dst.Name())
 120                         dst.Close()
 121                         http.Error(w, err.Error(), http.StatusInternalServerError)
 122                         return
 123                 }
 124                 if !NoSync {
 125                         if err = dst.Sync(); err != nil {
 126                                 log.Println("error", r.RemoteAddr, filename, err)
 127                                 os.Remove(dst.Name())
 128                                 dst.Close()
 129                                 http.Error(w, err.Error(), http.StatusInternalServerError)
 130                                 return
 131                         }
 132                 }
 133                 dst.Close()
 134                 digest := hasher.Sum(nil)
 135                 if digestExpected != nil {
 136                         if bytes.Compare(digestExpected, digest) == 0 {
 137                                 log.Println(r.RemoteAddr, filename, "good checksum received")
 138                         } else {
 139                                 log.Println(r.RemoteAddr, filename, "bad checksum received")
 140                                 http.Error(w, "bad checksum", http.StatusBadRequest)
 141                                 os.Remove(dst.Name())
 142                                 return
 143                         }
 144                 }
 145                 if err = os.Rename(dst.Name(), path); err != nil {
 146                         log.Println("error", r.RemoteAddr, path, err)
 147                         http.Error(w, err.Error(), http.StatusInternalServerError)
 148                         return
 149                 }
 150                 if err = DirSync(dirPath); err != nil {
 151                         log.Println("error", r.RemoteAddr, dirPath, err)
 152                         http.Error(w, err.Error(), http.StatusInternalServerError)
 153                         return
 154                 }
 155                 if err = WriteFileSync(dirPath, path+"."+HashAlgoSHA256, digest); err != nil {
 156                         log.Println("error", r.RemoteAddr, path+"."+HashAlgoSHA256, err)
 157                         http.Error(w, err.Error(), http.StatusInternalServerError)
 158                         return
 159                 }
 160         }
 161         for _, file := range r.MultipartForm.File["gpg_signature"] {
 162                 filename := file.Filename
 163                 if _, exists := gpgSigsExpected[filename]; !exists {
 164                         log.Println(r.RemoteAddr, filename, "unexpected GPG signature filename")
 165                         http.Error(w, "unexpected GPG signature filename", http.StatusBadRequest)
 166                         return
 167                 }
 168                 delete(gpgSigsExpected, filename)
 169                 log.Println(r.RemoteAddr, "put", filename, "by", username)
 170                 path := filepath.Join(dirPath, filename)
 171                 if _, err = os.Stat(path); err == nil {
 172                         log.Println(r.RemoteAddr, filename, "already exists")
 173                         http.Error(w, "already exists", http.StatusBadRequest)
 174                         return
 175                 }
 176                 src, err := file.Open()
 177                 if err != nil {
 178                         log.Println("error", r.RemoteAddr, filename, err)
 179                         http.Error(w, err.Error(), http.StatusInternalServerError)
 180                         return
 181                 }
 182                 sig, err := ioutil.ReadAll(src)
 183                 src.Close()
 184                 if err != nil {
 185                         log.Println("error", r.RemoteAddr, filename, err)
 186                         http.Error(w, err.Error(), http.StatusInternalServerError)
 187                         return
 188                 }
 189                 if err = WriteFileSync(dirPath, path, sig); err != nil {
 190                         log.Println("error", r.RemoteAddr, path, err)
 191                         http.Error(w, err.Error(), http.StatusInternalServerError)
 192                         return
 193                 }
 194         }
 195 }