@matheusbsbs / matheus-bagliano / commits / 5b01a4e8ff

Fork 0

upload-pack.c: introduce 'uploadpackfilter.tree.maxDepth'

In b79cf959b2 (upload-pack.c: allow banning certain object filter(s), 2020-02-26), we introduced functionality to disallow certain object filters from being chosen from within 'git upload-pack'. Traditionally, administrators use this functionality to disallow filters that are known to perform slowly, for e.g., those that do not have bitmap-level filtering. In the past, the '--filter=tree:<n>' was one such filter that does not have bitmap-level filtering support, and so was likely to be banned by administrators. However, in the previous couple of commits, we introduced bitmap-level filtering for the case when 'n' is equal to '0', i.e., as if we had a '--filter=tree:none' choice. While it would be sufficient to simply write $ git config uploadpackfilter.tree.allow true (since it would allow all values of 'n'), we would like to be able to allow this filter for certain values of 'n', i.e., those no greater than some pre-specified maximum. In order to do this, introduce a new configuration key, as follows: $ git config uploadpackfilter.tree.maxDepth <m> where '<m>' specifies the maximum allowed value of 'n' in the filter 'tree:n'. Administrators who wish to allow for only the value '0' can write: $ git config uploadpackfilter.tree.allow true $ git config uploadpackfilter.tree.maxDepth 0 which allows '--filter=tree:0', but no other values. Signed-off-by: Taylor Blau <me@ttaylorr.com> Acked-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Taylor Blau committed Aug 3, 2020 at 14:00 UTC 5b01a4e8ff19fa9797a67b53df2db0a1a574fe81

3 files changed +33

Documentation/config/uploadpack.txt

@@ -69,6 +69,12 @@ uploadpackfilter.<filter>.allow::

69 combined filters, both `combine` and all of the nested filter

70 kinds must be allowed. Defaults to `uploadpackfilter.allow`.

72 +uploadpackfilter.tree.maxDepth::

73 + Only allow `--filter=tree=<n>` when `n` is no more than the value of

74 + `uploadpackfilter.tree.maxDepth`. If set, this also implies

75 + `uploadpackfilter.tree.allow=true`, unless this configuration

76 + variable had already been set. Has no effect if unset.

77 +

78 uploadpack.allowRefInWant::

79 If this option is set, `upload-pack` will support the `ref-in-want`

80 feature of the protocol version 2 `fetch` command. This feature

t/t5616-partial-clone.sh

@@ -259,6 +259,15 @@ test_expect_success 'upload-pack fails banned object filters with fallback' '

259 grep "filter '\''blob:none'\'' not supported" err

260 '

261

262 +test_expect_success 'upload-pack limits tree depth filters' '

263 + test_config -C srv.bare uploadpackfilter.allow false &&

264 + test_config -C srv.bare uploadpackfilter.tree.allow true &&

265 + test_config -C srv.bare uploadpackfilter.tree.maxDepth 0 &&

266 + test_must_fail ok=sigpipe git clone --no-checkout --filter=tree:1 \

267 + "file://$(pwd)/srv.bare" pc3 2>err &&

268 + grep "tree filter allows max depth 0, but got 1" err

269 +'

270 +

271 test_expect_success 'partial clone fetches blobs pointed to by refs even if normally filtered out' '

272 rm -rf src dst &&

273 git init src &&

upload-pack.c

+18

@@ -105,6 +105,7 @@ struct upload_pack_data {

105 unsigned use_include_tag : 1;

106 unsigned allow_filter : 1;

107 unsigned allow_filter_fallback : 1;

108 + unsigned long tree_filter_max_depth;

109

110 unsigned done : 1; /* v2 only */

111 unsigned allow_ref_in_want : 1; /* v2 only */

@@ -136,6 +137,7 @@ static void upload_pack_data_init(struct upload_pack_data *data)

137 data->extra_edge_obj = extra_edge_obj;

138 data->allowed_filters = allowed_filters;

139 data->allow_filter_fallback = 1;

140 + data->tree_filter_max_depth = ULONG_MAX;

141 packet_writer_init(&data->writer, 1);

142

143 data->keepalive = 5;

@@ -1019,6 +1021,13 @@ static void check_one_filter(struct upload_pack_data *data,

1021

1022 if (!allowed)

1023 send_err_and_die(data, "filter '%s' not supported", key);

1024 +

1025 + if (opts->choice == LOFC_TREE_DEPTH &&

1026 + opts->tree_exclude_depth > data->tree_filter_max_depth)

1027 + send_err_and_die(data,

1028 + "tree filter allows max depth %lu, but got %lu",

1029 + data->tree_filter_max_depth,

1030 + opts->tree_exclude_depth);

1031 }

1032

1033 static void check_filter_recurse(struct upload_pack_data *data,

@@ -1247,6 +1256,15 @@ static int parse_object_filter_config(const char *var, const char *value,

1256 if (!strcmp(key, "allow"))

1257 string_list_insert(&data->allowed_filters, buf.buf)->util =

1258 (void *)(intptr_t)git_config_bool(var, value);

1259 + else if (!strcmp(buf.buf, "tree") && !strcmp(key, "maxdepth")) {

1260 + if (!value) {

1261 + strbuf_release(&buf);

1262 + return config_error_nonbool(var);

1263 + }

1264 + string_list_insert(&data->allowed_filters, buf.buf)->util =

1265 + (void *)(intptr_t)1;

1266 + data->tree_filter_max_depth = git_config_ulong(var, value);

1267 + }

1268

1269 strbuf_release(&buf);

1270 return 0;