git-daemon/chiark-urlmap: better security

Check the server IP address corresponds to the server hostname
when exporting VPN-only repositories.

Use symlinks under ~/.userv so that public-git directories
are not exported by default, as in the www-cgi configuration.

diff --git a/git-daemon/chiark-urlmap b/git-daemon/chiark-urlmap
index d3bb8761318dbdecc9a1cb78fbbcbf99a7c84f6f..499f21c81aa3e08e5b3662469e3c2e32b2e5f9c8 100644 (file)
--- a/git-daemon/chiark-urlmap
+++ b/git-daemon/chiark-urlmap
@@ -7,14 +7,16 @@
 if ($host eq 'git.chiark.greenend.org.uk') {
     if ($path =~ m{^~([^/]*)/(.*)}) {
         $user = $1;
 if ($host eq 'git.chiark.greenend.org.uk') {
     if ($path =~ m{^~([^/]*)/(.*)}) {
         $user = $1;

-        $dir = 'public-git';
+        $dir = '.userv/public-git';

         $repo = $2;
     } else {
         $user = 'webmaster';
         $dir = '/u2/git-repos';
         $repo = $path;
     }
         $repo = $2;
     } else {
         $user = 'webmaster';
         $dir = '/u2/git-repos';
         $repo = $path;
     }

-} elsif (m{^git://cabal[.]greenend[.]org[.]uk/~([^/]*)/(.*)$}) {
+} elsif ($server_addr eq '172.31.80.8' and
+         $host eq 'cabal.greenend.org.uk' and
+        $path =~ m|^~([^/]*)/(.*)$|) {

     $user = $1;
     $dir = 'cabal-git';
     $repo = $2;
     $user = $1;
     $dir = 'cabal-git';
     $repo = $2;