AgeCommit message (Collapse)AuthorLines
Lock a cache slot with flockBryce Kwon-0/+38
The slot lock was a POSIX record lock, which a process loses the moment any descriptor on the file closes, and the fill puts the lock file on stdout, which every exec filter and snapshot compressor closes with its dup2. A second request on the slot could then rebuild it under the first and splice the two pages. An flock holds until the last descriptor goes.
Abandon a fill whose last flush fails to writeBryce Kwon-0/+16
The slot being filled was forgotten before the page's final flush, so a write that failed there, on a full disk for one, could not abandon the fill: cgit died into the lock file instead and the visitor got nothing. The mid-page path already delivered the page from the lock file.
Compare the cached page with the uncached one wholeBryce Kwon-5/+1
The footer lost the time it was generated at in 2018, and both runs come from the same binary, so the two pages have nothing to differ in.
Cache every branch page under cache-dynamic-ttlBryce Kwon-0/+19
The dynamic ttl only applied when the url named a branch with h=, so the log, tree and refs of the default branch, which never carry one, fell back to cache-summary-ttl. The manual already gives each ttl the scope the code now uses.
Keep clone files and oversized responses out of the cacheBryce Kwon-0/+43
The dumb transport reads files that already sit on the disk, so a pack copied into a slot cost that disk twice and the request a second write of every byte. A snapshot took a slot whatever its size, so a visitor naming distinct refs and ids could fill the cache root with archives. `cache-max-slot-size`, 64 MB unless set, now serves a larger response from the lock file and drops it, along with any expired copy it would have replaced.
Test the hardening passBryce Kwon-5/+4
Clean up the whole treeBryce Kwon-4/+2
Trim the comments and dead code across the treeBryce Kwon-6/+4
Deduplicate the cache test request listsBryce Kwon-48/+25
Renumber the test scripts into themed rangesBryce Kwon-0/+0
t000x the ground the suite stands on: git version, html validity, the cache t01xx page content, one script per page t02xx features that cut across pages: filters, submodule links, dates, limits t03xx defence, the security regressions and the $HOME promise t04xx the helper tools under tools/
Serve nothing further once a fill is abandonedBryce Kwon-0/+29
Keep error pages out of the cacheBryce Kwon-0/+14
Tidy the test comments and shell portabilityBryce Kwon-17/+26
Bound the search and cache key a request can askBryce Kwon-0/+21
Gather page output into one bufferBryce Kwon-0/+49
cache.c: cache ls_cache output properlyJohn Keeping-1/+7
By using the standard library's printf, cache_ls does not redirect its output to the cache when we change the process' stdout file descriptor to point to the cache file. Fix this by using "htmlf" in the same way that we do for writing HTTP headers. Signed-off-by: John Keeping <john@keeping.me.uk>
tests/: Do not use `sed -i`Lukas Fleischer-3/+6
"-i" isn't part of the POSIX standard and doesn't work on several platforms such as OpenBSD. Use a temporary file instead. Signed-off-by: Lukas Fleischer <cgit@cryptocrack.de>
tests: use Git's test frameworkJohn Keeping-15/+17
This allows tests to run in parallel as well as letting us use "prove" or another TAP harness to run the tests. Git's test framework requires Git to be fully built before letting any tests run, so add a new target to the top-level Makefile which builds all of Git instead of just libgit.a and make the "test" target depend on that. Signed-off-by: John Keeping <john@keeping.me.uk>
Redesign the caching layerLars Hjemli-0/+67
The original caching layer in cgit has no upper bound on the number of concurrent cache entries, so when cgit is traversed by a spider (like the googlebot), the cache might end up filling your disk. Also, if any error occurs in the cache layer, no content is returned to the client. This patch redesigns the caching layer to avoid these flaws by * giving the cache a bound number of slots * disabling the cache for the current request when errors occur The cache size limit is implemented by hashing the querystring (the cache lookup key) and generating a cache filename based on this hash modulo the cache size. In order to detect hash collisions, the full lookup key (i.e. the querystring) is stored in the cache file (separated from its associated content by ascii 0). The cache filename is the reversed 8-digit hexadecimal representation of hash(key) % cache_size which should make the filesystem lookup pretty fast (if directory content is indexed/sorted); reversing the representation avoids the problem where all keys have equal prefix. There is a new config option, cache-size, which sets the upper bound for the cache. Default value for this option is 0, which has the same effect as setting nocache=1 (hence nocache is now deprecated). Included in this patch is also a new testfile which verifies that the new option works as intended. Signed-off-by: Lars Hjemli <hjemli@gmail.com>