op public repos

Blob

Date:: Thu May 19 07:14:21 2022 UTC
Message:: imsg_add() frees its msg argument on error; avoid double-free in error paths
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2019 Ori Bernstein <ori@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/queue.h>
19 #include <sys/uio.h>
20 #include <sys/time.h>
21 #include <sys/stat.h>
22 
23 #include <stdint.h>
24 #include <errno.h>
25 #include <imsg.h>
26 #include <limits.h>
27 #include <signal.h>
28 #include <stdio.h>
29 #include <stdlib.h>
30 #include <string.h>
31 #include <ctype.h>
32 #include <sha1.h>
33 #include <fcntl.h>
34 #include <unistd.h>
35 #include <zlib.h>
36 #include <err.h>
37 
38 #include "got_error.h"
39 #include "got_object.h"
40 #include "got_path.h"
41 #include "got_version.h"
42 #include "got_fetch.h"
43 #include "got_reference.h"
44 
45 #include "got_lib_sha1.h"
46 #include "got_lib_delta.h"
47 #include "got_lib_object.h"
48 #include "got_lib_object_parse.h"
49 #include "got_lib_privsep.h"
50 #include "got_lib_pack.h"
51 #include "got_lib_pkt.h"
52 #include "got_lib_gitproto.h"
53 #include "got_lib_ratelimit.h"
54 
55 #ifndef nitems
56 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
57 #endif
58 
59 struct got_object *indexed;
60 static int chattygot;
61 
62 static const struct got_capability got_capabilities[] = {
63 	{ GOT_CAPA_AGENT, "got/" GOT_VERSION_STR },
64 	{ GOT_CAPA_OFS_DELTA, NULL },
65 	{ GOT_CAPA_SIDE_BAND_64K, NULL },
66 };
67 
68 static void
69 match_remote_ref(struct got_pathlist_head *have_refs,
70     struct got_object_id *my_id, char *refname)
71 {
72 	struct got_pathlist_entry *pe;
73 
74 	/* XXX zero-hash signifies we don't have this ref;
75 	 * we should use a flag instead */
76 	memset(my_id, 0, sizeof(*my_id));
77 
78 	TAILQ_FOREACH(pe, have_refs, entry) {
79 		struct got_object_id *id = pe->data;
80 		if (strcmp(pe->path, refname) == 0) { 
81 			memcpy(my_id, id, sizeof(*my_id));
82 			break;
83 		}
84 	}
85 }
86 
87 static int
88 match_branch(const char *branch, const char *wanted_branch)
89 {
90 	if (strncmp(branch, "refs/heads/", 11) != 0)
91 		return 0;
92 
93 	if (strncmp(wanted_branch, "refs/heads/", 11) == 0)
94 		wanted_branch += 11;
95 
96 	return (strcmp(branch + 11, wanted_branch) == 0);
97 }
98 
99 static int
100 match_wanted_ref(const char *refname, const char *wanted_ref)
101 {
102 	if (strncmp(refname, "refs/", 5) != 0)
103 		return 0;
104 	refname += 5;
105 
106 	/*
107 	 * Prevent fetching of references that won't make any
108 	 * sense outside of the remote repository's context.
109 	 */
110 	if (strncmp(refname, "got/", 4) == 0)
111 		return 0;
112 	if (strncmp(refname, "remotes/", 8) == 0)
113 		return 0;
114 
115 	if (strncmp(wanted_ref, "refs/", 5) == 0)
116 		wanted_ref += 5;
117 
118 	/* Allow prefix match. */
119 	if (got_path_is_child(refname, wanted_ref, strlen(wanted_ref)))
120 		return 1;
121 
122 	/* Allow exact match. */
123 	return (strcmp(refname, wanted_ref) == 0);
124 }
125 
126 static const struct got_error *
127 send_fetch_server_progress(struct imsgbuf *ibuf, const char *msg, size_t msglen)
128 {
129 	if (msglen > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
130 		return got_error(GOT_ERR_NO_SPACE);
131 
132 	if (msglen == 0)
133 		return NULL;
134 
135 	if (imsg_compose(ibuf, GOT_IMSG_FETCH_SERVER_PROGRESS, 0, 0, -1,
136 	    msg, msglen) == -1)
137 		return got_error_from_errno(
138 		    "imsg_compose FETCH_SERVER_PROGRESS");
139 
140 	return got_privsep_flush_imsg(ibuf);
141 }
142 
143 static const struct got_error *
144 send_fetch_download_progress(struct imsgbuf *ibuf, off_t bytes,
145     struct got_ratelimit *rl)
146 {
147 	const struct got_error *err;
148 	int elapsed = 0;
149 
150 	if (rl) {
151 		err = got_ratelimit_check(&elapsed, rl);
152 		if (err || !elapsed)
153 			return err;
154 	}
155 
156 	if (imsg_compose(ibuf, GOT_IMSG_FETCH_DOWNLOAD_PROGRESS, 0, 0, -1,
157 	    &bytes, sizeof(bytes)) == -1)
158 		return got_error_from_errno(
159 		    "imsg_compose FETCH_DOWNLOAD_PROGRESS");
160 
161 	return got_privsep_flush_imsg(ibuf);
162 }
163 
164 static const struct got_error *
165 send_fetch_done(struct imsgbuf *ibuf, uint8_t *pack_sha1)
166 {
167 	if (imsg_compose(ibuf, GOT_IMSG_FETCH_DONE, 0, 0, -1,
168 	    pack_sha1, SHA1_DIGEST_LENGTH) == -1)
169 		return got_error_from_errno("imsg_compose FETCH");
170 	return got_privsep_flush_imsg(ibuf);
171 }
172 
173 static const struct got_error *
174 fetch_progress(struct imsgbuf *ibuf, const char *buf, size_t len)
175 {
176 	size_t i;
177 
178 	if (len == 0)
179 		return NULL;
180 
181 	/*
182 	 * Truncate messages which exceed the maximum imsg payload size.
183 	 * Server may send up to 64k.
184 	 */
185 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
186 		len = MAX_IMSGSIZE - IMSG_HEADER_SIZE;
187 
188 	/* Only allow printable ASCII. */
189 	for (i = 0; i < len; i++) {
190 		if (isprint((unsigned char)buf[i]) ||
191 		    isspace((unsigned char)buf[i]))
192 			continue;
193 		return got_error_msg(GOT_ERR_BAD_PACKET,
194 		    "non-printable progress message received from server");
195 	}
196 
197 	return send_fetch_server_progress(ibuf, buf, len);
198 }
199 
200 static const struct got_error *
201 fetch_error(const char *buf, size_t len)
202 {
203 	static char msg[1024];
204 	size_t i;
205 
206 	for (i = 0; i < len && i < sizeof(msg) - 1; i++) {
207 		if (!isprint(buf[i]))
208 			return got_error_msg(GOT_ERR_BAD_PACKET,
209 			    "non-printable error message received from server");
210 		msg[i] = buf[i];
211 	}
212 	msg[i] = '\0';
213 	return got_error_msg(GOT_ERR_FETCH_FAILED, msg);
214 }
215 
216 static const struct got_error *
217 send_fetch_symrefs(struct imsgbuf *ibuf, struct got_pathlist_head *symrefs)
218 {
219 	struct ibuf *wbuf;
220 	size_t len, nsymrefs = 0;
221 	struct got_pathlist_entry *pe;
222 
223 	len = sizeof(struct got_imsg_fetch_symrefs);
224 	TAILQ_FOREACH(pe, symrefs, entry) {
225 		const char *target = pe->data;
226 		len += sizeof(struct got_imsg_fetch_symref) +
227 		    pe->path_len + strlen(target);
228 		nsymrefs++;
229 	}
230 
231 	if (len >= MAX_IMSGSIZE - IMSG_HEADER_SIZE)
232 		return got_error(GOT_ERR_NO_SPACE);
233 
234 	wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_SYMREFS, 0, 0, len);
235 	if (wbuf == NULL)
236 		return got_error_from_errno("imsg_create FETCH_SYMREFS");
237 
238 	/* Keep in sync with struct got_imsg_fetch_symrefs definition! */
239 	if (imsg_add(wbuf, &nsymrefs, sizeof(nsymrefs)) == -1)
240 		return got_error_from_errno("imsg_add FETCH_SYMREFS");
241 
242 	TAILQ_FOREACH(pe, symrefs, entry) {
243 		const char *name = pe->path;
244 		size_t name_len = pe->path_len;
245 		const char *target = pe->data;
246 		size_t target_len = strlen(target);
247 
248 		/* Keep in sync with struct got_imsg_fetch_symref definition! */
249 		if (imsg_add(wbuf, &name_len, sizeof(name_len)) == -1)
250 			return got_error_from_errno("imsg_add FETCH_SYMREFS");
251 		if (imsg_add(wbuf, &target_len, sizeof(target_len)) == -1)
252 			return got_error_from_errno("imsg_add FETCH_SYMREFS");
253 		if (imsg_add(wbuf, name, name_len) == -1)
254 			return got_error_from_errno("imsg_add FETCH_SYMREFS");
255 		if (imsg_add(wbuf, target, target_len) == -1)
256 			return got_error_from_errno("imsg_add FETCH_SYMREFS");
257 	}
258 
259 	wbuf->fd = -1;
260 	imsg_close(ibuf, wbuf);
261 	return got_privsep_flush_imsg(ibuf);
262 }
263 
264 static const struct got_error *
265 send_fetch_ref(struct imsgbuf *ibuf, struct got_object_id *refid,
266     const char *refname)
267 {
268 	struct ibuf *wbuf;
269 	size_t len, reflen = strlen(refname);
270 
271 	len = sizeof(struct got_imsg_fetch_ref) + reflen;
272 	if (len >= MAX_IMSGSIZE - IMSG_HEADER_SIZE)
273 		return got_error(GOT_ERR_NO_SPACE);
274 
275 	wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_REF, 0, 0, len);
276 	if (wbuf == NULL)
277 		return got_error_from_errno("imsg_create FETCH_REF");
278 
279 	/* Keep in sync with struct got_imsg_fetch_ref definition! */
280 	if (imsg_add(wbuf, refid->sha1, SHA1_DIGEST_LENGTH) == -1)
281 		return got_error_from_errno("imsg_add FETCH_REF");
282 	if (imsg_add(wbuf, refname, reflen) == -1)
283 		return got_error_from_errno("imsg_add FETCH_REF");
284 
285 	wbuf->fd = -1;
286 	imsg_close(ibuf, wbuf);
287 	return got_privsep_flush_imsg(ibuf);
288 }
289 
290 static const struct got_error *
291 fetch_pack(int fd, int packfd, uint8_t *pack_sha1,
292     struct got_pathlist_head *have_refs, int fetch_all_branches,
293     struct got_pathlist_head *wanted_branches,
294     struct got_pathlist_head *wanted_refs, int list_refs_only,
295     struct imsgbuf *ibuf)
296 {
297 	const struct got_error *err = NULL;
298 	char buf[GOT_PKT_MAX];
299 	char hashstr[SHA1_DIGEST_STRING_LENGTH];
300 	struct got_object_id *have, *want;
301 	int is_firstpkt = 1, nref = 0, refsz = 16;
302 	int i, n, nwant = 0, nhave = 0, acked = 0;
303 	off_t packsz = 0, last_reported_packsz = 0;
304 	char *id_str = NULL, *refname = NULL;
305 	char *server_capabilities = NULL, *my_capabilities = NULL;
306 	const char *default_branch = NULL;
307 	struct got_pathlist_head symrefs;
308 	struct got_pathlist_entry *pe;
309 	int sent_my_capabilites = 0, have_sidebands = 0;
310 	int found_branch = 0;
311 	SHA1_CTX sha1_ctx;
312 	uint8_t sha1_buf[SHA1_DIGEST_LENGTH];
313 	size_t sha1_buf_len = 0;
314 	ssize_t w;
315 	struct got_ratelimit rl;
316 
317 	TAILQ_INIT(&symrefs);
318 	SHA1Init(&sha1_ctx);
319 	got_ratelimit_init(&rl, 0, 500);
320 
321 	have = malloc(refsz * sizeof(have[0]));
322 	if (have == NULL)
323 		return got_error_from_errno("malloc");
324 	want = malloc(refsz * sizeof(want[0]));
325 	if (want == NULL) {
326 		err = got_error_from_errno("malloc");
327 		goto done;
328 	}
329 	while (1) {
330 		err = got_pkt_readpkt(&n, fd, buf, sizeof(buf), chattygot);
331 		if (err)
332 			goto done;
333 		if (n == 0)
334 			break;
335 		if (n >= 4 && strncmp(buf, "ERR ", 4) == 0) {
336 			err = fetch_error(&buf[4], n - 4);
337 			goto done;
338 		}
339 		free(id_str);
340 		free(refname);
341 		err = got_gitproto_parse_refline(&id_str, &refname,
342 		    &server_capabilities, buf, n);
343 		if (err)
344 			goto done;
345 		if (is_firstpkt) {
346 			if (chattygot && server_capabilities[0] != '\0')
347 				fprintf(stderr, "%s: server capabilities: %s\n",
348 				    getprogname(), server_capabilities);
349 			err = got_gitproto_match_capabilities(&my_capabilities,
350 			    &symrefs, server_capabilities,
351 			    got_capabilities, nitems(got_capabilities));
352 			if (err)
353 				goto done;
354 			if (chattygot)
355 				fprintf(stderr, "%s: my capabilities:%s\n",
356 				    getprogname(), my_capabilities != NULL ?
357 				    my_capabilities : "");
358 			err = send_fetch_symrefs(ibuf, &symrefs);
359 			if (err)
360 				goto done;
361 			is_firstpkt = 0;
362 			if (!fetch_all_branches) {
363 				TAILQ_FOREACH(pe, &symrefs, entry) {
364 					const char *name = pe->path;
365 					const char *symref_target = pe->data;
366 					if (strcmp(name, GOT_REF_HEAD) != 0)
367 						continue;
368 					default_branch = symref_target;
369 					break;
370 				}
371 			}
372 			continue;
373 		}
374 		if (strstr(refname, "^{}")) {
375 			if (chattygot) {
376 				fprintf(stderr, "%s: ignoring %s\n",
377 				    getprogname(), refname);
378 			}
379 			continue;
380 		}
381 
382 		if (strncmp(refname, "refs/heads/", 11) == 0) {
383 			if (fetch_all_branches || list_refs_only) {
384 				found_branch = 1;
385 			} else if (!TAILQ_EMPTY(wanted_branches)) {
386 				TAILQ_FOREACH(pe, wanted_branches, entry) {
387 					if (match_branch(refname, pe->path))
388 						break;
389 				}
390 				if (pe == NULL) {
391 					if (chattygot) {
392 						fprintf(stderr,
393 						    "%s: ignoring %s\n",
394 						    getprogname(), refname);
395 					}
396 					continue;
397 				}
398 				found_branch = 1;
399 			} else if (default_branch != NULL) {
400 				if (!match_branch(refname, default_branch)) {
401 					if (chattygot) {
402 						fprintf(stderr,
403 						    "%s: ignoring %s\n",
404 						    getprogname(), refname);
405 					}
406 					continue;
407 				}
408 				found_branch = 1;
409 			}
410 		} else if (strncmp(refname, "refs/tags/", 10) != 0) {
411 			if (!TAILQ_EMPTY(wanted_refs)) {
412 				TAILQ_FOREACH(pe, wanted_refs, entry) {
413 					if (match_wanted_ref(refname, pe->path))
414 						break;
415 				}
416 				if (pe == NULL) {
417 					if (chattygot) {
418 						fprintf(stderr,
419 						    "%s: ignoring %s\n",
420 						    getprogname(), refname);
421 					}
422 					continue;
423 				}
424 				found_branch = 1;
425 			} else if (!list_refs_only) {
426 				if (chattygot) {
427 					fprintf(stderr, "%s: ignoring %s\n",
428 					    getprogname(), refname);
429 				}
430 				continue;
431 			}
432 		}
433 
434 		if (refsz == nref + 1) {
435 			refsz *= 2;
436 			have = reallocarray(have, refsz, sizeof(have[0]));
437 			if (have == NULL) {
438 				err = got_error_from_errno("reallocarray");
439 				goto done;
440 			}
441 			want = reallocarray(want, refsz, sizeof(want[0]));
442 			if (want == NULL) {
443 				err = got_error_from_errno("reallocarray");
444 				goto done;
445 			}
446 		}
447 		if (!got_parse_sha1_digest(want[nref].sha1, id_str)) {
448 			err = got_error(GOT_ERR_BAD_OBJ_ID_STR);
449 			goto done;
450 		}
451 		match_remote_ref(have_refs, &have[nref], refname);
452 		err = send_fetch_ref(ibuf, &want[nref], refname);
453 		if (err)
454 			goto done;
455 
456 		if (chattygot)
457 			fprintf(stderr, "%s: %s will be fetched\n",
458 			    getprogname(), refname);
459 		if (chattygot > 1) {
460 			char *theirs, *mine;
461 			err = got_object_id_str(&theirs, &want[nref]);
462 			if (err)
463 				goto done;
464 			err = got_object_id_str(&mine, &have[nref]);
465 			if (err) {
466 				free(theirs);
467 				goto done;
468 			}
469 			fprintf(stderr, "%s: remote: %s\n%s: local:  %s\n",
470 			    getprogname(), theirs, getprogname(), mine);
471 			free(theirs);
472 			free(mine);
473 		}
474 		nref++;
475 	}
476 
477 	if (list_refs_only)
478 		goto done;
479 
480 	/* Abort if we haven't found any branch to fetch. */
481 	if (!found_branch) {
482 		err = got_error(GOT_ERR_FETCH_NO_BRANCH);
483 		goto done;
484 	}
485 
486 	for (i = 0; i < nref; i++) {
487 		if (got_object_id_cmp(&have[i], &want[i]) == 0)
488 			continue;
489 		got_sha1_digest_to_str(want[i].sha1, hashstr, sizeof(hashstr));
490 		n = snprintf(buf, sizeof(buf), "want %s%s\n", hashstr,
491 		    sent_my_capabilites || my_capabilities == NULL ?
492 		    "" : my_capabilities);
493 		if (n >= sizeof(buf)) {
494 			err = got_error(GOT_ERR_NO_SPACE);
495 			goto done;
496 		}
497 		err = got_pkt_writepkt(fd, buf, n, chattygot);
498 		if (err)
499 			goto done;
500 		sent_my_capabilites = 1;
501 		nwant++;
502 	}
503 	err = got_pkt_flushpkt(fd, chattygot);
504 	if (err)
505 		goto done;
506 
507 	if (nwant == 0)
508 		goto done;
509 
510 	TAILQ_FOREACH(pe, have_refs, entry) {
511 		struct got_object_id *id = pe->data;
512 		got_sha1_digest_to_str(id->sha1, hashstr, sizeof(hashstr));
513 		n = snprintf(buf, sizeof(buf), "have %s\n", hashstr);
514 		if (n >= sizeof(buf)) {
515 			err = got_error(GOT_ERR_NO_SPACE);
516 			goto done;
517 		}
518 		err = got_pkt_writepkt(fd, buf, n, chattygot);
519 		if (err)
520 			goto done;
521 		nhave++;
522 	}
523 
524 	while (nhave > 0 && !acked) {
525 		struct got_object_id common_id;
526 
527 		/* The server should ACK the object IDs we need. */
528 		err = got_pkt_readpkt(&n, fd, buf, sizeof(buf), chattygot);
529 		if (err)
530 			goto done;
531 		if (n >= 4 && strncmp(buf, "ERR ", 4) == 0) {
532 			err = fetch_error(&buf[4], n - 4);
533 			goto done;
534 		}
535 		if (n >= 4 && strncmp(buf, "NAK\n", 4) == 0) {
536 			/* Server has not located our objects yet. */
537 			continue;
538 		}
539 		if (n < 4 + SHA1_DIGEST_STRING_LENGTH ||
540 		    strncmp(buf, "ACK ", 4) != 0) {
541 			err = got_error_msg(GOT_ERR_BAD_PACKET,
542 			    "unexpected message from server");
543 			goto done;
544 		}
545 		if (!got_parse_sha1_digest(common_id.sha1, buf + 4)) {
546 			err = got_error_msg(GOT_ERR_BAD_PACKET,
547 			    "bad object ID in ACK packet from server");
548 			goto done;
549 		}
550 		acked++;
551 	}
552 
553 	n = snprintf(buf, sizeof(buf), "done\n");
554 	err = got_pkt_writepkt(fd, buf, n, chattygot);
555 	if (err)
556 		goto done;
557 
558 	if (nhave == 0) {
559 		err = got_pkt_readpkt(&n, fd, buf, sizeof(buf), chattygot);
560 		if (err)
561 			goto done;
562 		if (n != 4 || strncmp(buf, "NAK\n", n) != 0) {
563 			err = got_error_msg(GOT_ERR_BAD_PACKET,
564 			    "unexpected message from server");
565 			goto done;
566 		}
567 	}
568 
569 	if (chattygot)
570 		fprintf(stderr, "%s: fetching...\n", getprogname());
571 
572 	if (my_capabilities != NULL &&
573 	    strstr(my_capabilities, GOT_CAPA_SIDE_BAND_64K) != NULL)
574 		have_sidebands = 1;
575 
576 	while (1) {
577 		ssize_t r = 0;
578 		int datalen = -1;
579 
580 		if (have_sidebands) {
581 			err = got_pkt_readhdr(&datalen, fd, chattygot);
582 			if (err)
583 				goto done;
584 			if (datalen <= 0)
585 				break;
586 
587 			/* Read sideband channel ID (one byte). */
588 			r = read(fd, buf, 1);
589 			if (r == -1) {
590 				err = got_error_from_errno("read");
591 				goto done;
592 			}
593 			if (r != 1) {
594 				err = got_error_msg(GOT_ERR_BAD_PACKET,
595 				    "short packet");
596 				goto done;
597 			}
598 			if (datalen > sizeof(buf) - 5) {
599 				err = got_error_msg(GOT_ERR_BAD_PACKET,
600 				    "bad packet length");
601 				goto done;
602 			}
603 			datalen--; /* sideband ID has been read */
604 			if (buf[0] == GOT_SIDEBAND_PACKFILE_DATA) {
605 				/* Read packfile data. */
606 				err = got_pkt_readn(&r, fd, buf, datalen);
607 				if (err)
608 					goto done;
609 				if (r != datalen) {
610 					err = got_error_msg(GOT_ERR_BAD_PACKET,
611 					    "packet too short");
612 					goto done;
613 				}
614 			} else if (buf[0] == GOT_SIDEBAND_PROGRESS_INFO) {
615 				err = got_pkt_readn(&r, fd, buf, datalen);
616 				if (err)
617 					goto done;
618 				if (r != datalen) {
619 					err = got_error_msg(GOT_ERR_BAD_PACKET,
620 					    "packet too short");
621 					goto done;
622 				}
623 				err = fetch_progress(ibuf, buf, r);
624 				if (err)
625 					goto done;
626 				continue;
627 			} else if (buf[0] == GOT_SIDEBAND_ERROR_INFO) {
628 				err = got_pkt_readn(&r, fd, buf, datalen);
629 				if (err)
630 					goto done;
631 				if (r != datalen) {
632 					err = got_error_msg(GOT_ERR_BAD_PACKET,
633 					    "packet too short");
634 					goto done;
635 				}
636 				err = fetch_error(buf, r);
637 				goto done;
638 			} else if (buf[0] == 'A') {
639 				err = got_pkt_readn(&r, fd, buf, datalen);
640 				if (err)
641 					goto done;
642 				if (r != datalen) {
643 					err = got_error_msg(GOT_ERR_BAD_PACKET,
644 					    "packet too short");
645 					goto done;
646 				}
647 				/*
648 				 * Git server responds with ACK after 'done'
649 				 * even though multi_ack is disabled?!?
650 				 */
651 				buf[r] = '\0';
652 				if (strncmp(buf, "CK ", 3) == 0)
653 					continue; /* ignore */
654 				err = got_error_msg(GOT_ERR_BAD_PACKET,
655 				    "unexpected message from server");
656 				goto done;
657 			} else {
658 				err = got_error_msg(GOT_ERR_BAD_PACKET,
659 				    "unknown side-band received from server");
660 				goto done;
661 			}
662 		} else {
663 			/* No sideband channel. Every byte is packfile data. */
664 			err = got_pkt_readn(&r, fd, buf, sizeof buf);
665 			if (err)
666 				goto done;
667 			if (r <= 0)
668 				break;
669 		}
670 
671 		/*
672 		 * An expected SHA1 checksum sits at the end of the pack file.
673 		 * Since we don't know the file size ahead of time we have to
674 		 * keep SHA1_DIGEST_LENGTH bytes buffered and avoid mixing
675 		 * those bytes into our SHA1 checksum computation until we
676 		 * know for sure that additional pack file data bytes follow.
677 		 *
678 		 * We can assume r > 0 since otherwise the loop would exit.
679 		 */
680 		if (r < SHA1_DIGEST_LENGTH) {
681 			if (sha1_buf_len < SHA1_DIGEST_LENGTH) {
682 				/*
683 				 * If there's enough buffered + read data to
684 				 * fill up the buffer then shift a sufficient
685 				 * amount of bytes out at the front to make
686 				 * room, mixing those bytes into the checksum.
687 				 */
688 				while (sha1_buf_len > 0 &&
689 				    sha1_buf_len + r > SHA1_DIGEST_LENGTH) {
690 					SHA1Update(&sha1_ctx, sha1_buf, 1);
691 					memmove(sha1_buf, sha1_buf + 1, 1);
692 					sha1_buf_len--;
693 				}
694 
695 				/* Buffer potential checksum bytes. */
696 				memcpy(sha1_buf + sha1_buf_len, buf, r);
697 				sha1_buf_len += r;
698 			} else {
699 				/*
700 				 * Mix in previously buffered bytes which
701 				 * are not part of the checksum after all.
702 				 */
703 				SHA1Update(&sha1_ctx, sha1_buf, r);
704 
705 				/* Update potential checksum buffer. */
706 				memmove(sha1_buf, sha1_buf + r,
707 				    sha1_buf_len - r);
708 				memcpy(sha1_buf + sha1_buf_len - r, buf, r);
709 			}
710 		} else {
711 			/* Mix in any previously buffered bytes. */
712 			SHA1Update(&sha1_ctx, sha1_buf, sha1_buf_len);
713 
714 			/* Mix in bytes read minus potential checksum bytes. */
715 			SHA1Update(&sha1_ctx, buf, r - SHA1_DIGEST_LENGTH);
716 
717 			/* Buffer potential checksum bytes. */
718 			memcpy(sha1_buf, buf + r - SHA1_DIGEST_LENGTH,
719 			    SHA1_DIGEST_LENGTH);
720 			sha1_buf_len = SHA1_DIGEST_LENGTH;
721 		}
722 
723 		/* Write packfile data to temporary pack file. */
724 		w = write(packfd, buf, r);
725 		if (w == -1) {
726 			err = got_error_from_errno("write");
727 			goto done;
728 		}
729 		if (w != r) {
730 			err = got_error(GOT_ERR_IO);
731 			goto done;
732 		}
733 		packsz += w;
734 
735 		/* Don't send too many progress privsep messages. */
736 		if (packsz > last_reported_packsz + 1024) {
737 			err = send_fetch_download_progress(ibuf, packsz, &rl);
738 			if (err)
739 				goto done;
740 			last_reported_packsz = packsz;
741 		}
742 	}
743 	err = send_fetch_download_progress(ibuf, packsz, NULL);
744 	if (err)
745 		goto done;
746 
747 	SHA1Final(pack_sha1, &sha1_ctx);
748 	if (sha1_buf_len != SHA1_DIGEST_LENGTH ||
749 	    memcmp(pack_sha1, sha1_buf, sha1_buf_len) != 0) {
750 		err = got_error_msg(GOT_ERR_BAD_PACKFILE,
751 		    "pack file checksum mismatch");
752 	}
753 done:
754 	TAILQ_FOREACH(pe, &symrefs, entry) {
755 		free((void *)pe->path);
756 		free(pe->data);
757 	}
758 	got_pathlist_free(&symrefs);
759 	free(have);
760 	free(want);
761 	free(id_str);
762 	free(refname);
763 	free(server_capabilities);
764 	return err;
765 }
766 
767 
768 int
769 main(int argc, char **argv)
770 {
771 	const struct got_error *err = NULL;
772 	int fetchfd, packfd = -1;
773 	uint8_t pack_sha1[SHA1_DIGEST_LENGTH];
774 	struct imsgbuf ibuf;
775 	struct imsg imsg;
776 	struct got_pathlist_head have_refs;
777 	struct got_pathlist_head wanted_branches;
778 	struct got_pathlist_head wanted_refs;
779 	struct got_pathlist_entry *pe;
780 	struct got_imsg_fetch_request fetch_req;
781 	struct got_imsg_fetch_have_ref href;
782 	struct got_imsg_fetch_wanted_branch wbranch;
783 	struct got_imsg_fetch_wanted_ref wref;
784 	size_t datalen, i;
785 #if 0
786 	static int attached;
787 	while (!attached)
788 		sleep (1);
789 #endif
790 
791 	TAILQ_INIT(&have_refs);
792 	TAILQ_INIT(&wanted_branches);
793 	TAILQ_INIT(&wanted_refs);
794 
795 	imsg_init(&ibuf, GOT_IMSG_FD_CHILD);
796 #ifndef PROFILE
797 	/* revoke access to most system calls */
798 	if (pledge("stdio recvfd", NULL) == -1) {
799 		err = got_error_from_errno("pledge");
800 		got_privsep_send_error(&ibuf, err);
801 		return 1;
802 	}
803 #endif
804 	err = got_privsep_recv_imsg(&imsg, &ibuf, 0);
805 	if (err) {
806 		if (err->code == GOT_ERR_PRIVSEP_PIPE)
807 			err = NULL;
808 		goto done;
809 	}
810 	if (imsg.hdr.type == GOT_IMSG_STOP)
811 		goto done;
812 	if (imsg.hdr.type != GOT_IMSG_FETCH_REQUEST) {
813 		err = got_error(GOT_ERR_PRIVSEP_MSG);
814 		goto done;
815 	}
816 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
817 	if (datalen < sizeof(fetch_req)) {
818 		err = got_error(GOT_ERR_PRIVSEP_LEN);
819 		goto done;
820 	}
821 	memcpy(&fetch_req, imsg.data, sizeof(fetch_req));
822 	fetchfd = imsg.fd;
823 	imsg_free(&imsg);
824 
825 	if (fetch_req.verbosity > 0)
826 		chattygot += fetch_req.verbosity;
827 
828 	for (i = 0; i < fetch_req.n_have_refs; i++) {
829 		struct got_object_id *id;
830 		char *refname;
831 
832 		err = got_privsep_recv_imsg(&imsg, &ibuf, 0);
833 		if (err) {
834 			if (err->code == GOT_ERR_PRIVSEP_PIPE)
835 				err = NULL;
836 			goto done;
837 		}
838 		if (imsg.hdr.type == GOT_IMSG_STOP)
839 			goto done;
840 		if (imsg.hdr.type != GOT_IMSG_FETCH_HAVE_REF) {
841 			err = got_error(GOT_ERR_PRIVSEP_MSG);
842 			goto done;
843 		}
844 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
845 		if (datalen < sizeof(href)) {
846 			err = got_error(GOT_ERR_PRIVSEP_LEN);
847 			goto done;
848 		}
849 		memcpy(&href, imsg.data, sizeof(href));
850 		if (datalen - sizeof(href) < href.name_len) {
851 			err = got_error(GOT_ERR_PRIVSEP_LEN);
852 			goto done;
853 		}
854 		refname = malloc(href.name_len + 1);
855 		if (refname == NULL) {
856 			err = got_error_from_errno("malloc");
857 			goto done;
858 		}
859 		memcpy(refname, imsg.data + sizeof(href), href.name_len);
860 		refname[href.name_len] = '\0';
861 
862 		id = malloc(sizeof(*id));
863 		if (id == NULL) {
864 			free(refname);
865 			err = got_error_from_errno("malloc");
866 			goto done;
867 		}
868 		memcpy(id->sha1, href.id, SHA1_DIGEST_LENGTH);
869 		err = got_pathlist_append(&have_refs, refname, id);
870 		if (err) {
871 			free(refname);
872 			free(id);
873 			goto done;
874 		}
875 
876 		imsg_free(&imsg);
877 	}
878 
879 	for (i = 0; i < fetch_req.n_wanted_branches; i++) {
880 		char *refname;
881 
882 		err = got_privsep_recv_imsg(&imsg, &ibuf, 0);
883 		if (err) {
884 			if (err->code == GOT_ERR_PRIVSEP_PIPE)
885 				err = NULL;
886 			goto done;
887 		}
888 		if (imsg.hdr.type == GOT_IMSG_STOP)
889 			goto done;
890 		if (imsg.hdr.type != GOT_IMSG_FETCH_WANTED_BRANCH) {
891 			err = got_error(GOT_ERR_PRIVSEP_MSG);
892 			goto done;
893 		}
894 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
895 		if (datalen < sizeof(wbranch)) {
896 			err = got_error(GOT_ERR_PRIVSEP_LEN);
897 			goto done;
898 		}
899 		memcpy(&wbranch, imsg.data, sizeof(wbranch));
900 		if (datalen - sizeof(wbranch) < wbranch.name_len) {
901 			err = got_error(GOT_ERR_PRIVSEP_LEN);
902 			goto done;
903 		}
904 		refname = malloc(wbranch.name_len + 1);
905 		if (refname == NULL) {
906 			err = got_error_from_errno("malloc");
907 			goto done;
908 		}
909 		memcpy(refname, imsg.data + sizeof(wbranch), wbranch.name_len);
910 		refname[wbranch.name_len] = '\0';
911 
912 		err = got_pathlist_append(&wanted_branches, refname, NULL);
913 		if (err) {
914 			free(refname);
915 			goto done;
916 		}
917 
918 		imsg_free(&imsg);
919 	}
920 
921 	for (i = 0; i < fetch_req.n_wanted_refs; i++) {
922 		char *refname;
923 
924 		err = got_privsep_recv_imsg(&imsg, &ibuf, 0);
925 		if (err) {
926 			if (err->code == GOT_ERR_PRIVSEP_PIPE)
927 				err = NULL;
928 			goto done;
929 		}
930 		if (imsg.hdr.type == GOT_IMSG_STOP)
931 			goto done;
932 		if (imsg.hdr.type != GOT_IMSG_FETCH_WANTED_REF) {
933 			err = got_error(GOT_ERR_PRIVSEP_MSG);
934 			goto done;
935 		}
936 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
937 		if (datalen < sizeof(wref)) {
938 			err = got_error(GOT_ERR_PRIVSEP_LEN);
939 			goto done;
940 		}
941 		memcpy(&wref, imsg.data, sizeof(wref));
942 		if (datalen - sizeof(wref) < wref.name_len) {
943 			err = got_error(GOT_ERR_PRIVSEP_LEN);
944 			goto done;
945 		}
946 		refname = malloc(wref.name_len + 1);
947 		if (refname == NULL) {
948 			err = got_error_from_errno("malloc");
949 			goto done;
950 		}
951 		memcpy(refname, imsg.data + sizeof(wref), wref.name_len);
952 		refname[wref.name_len] = '\0';
953 
954 		err = got_pathlist_append(&wanted_refs, refname, NULL);
955 		if (err) {
956 			free(refname);
957 			goto done;
958 		}
959 
960 		imsg_free(&imsg);
961 	}
962 
963 	err = got_privsep_recv_imsg(&imsg, &ibuf, 0);
964 	if (err) {
965 		if (err->code == GOT_ERR_PRIVSEP_PIPE)
966 			err = NULL;
967 		goto done;
968 	}
969 	if (imsg.hdr.type == GOT_IMSG_STOP)
970 		goto done;
971 	if (imsg.hdr.type != GOT_IMSG_FETCH_OUTFD) {
972 		err = got_error(GOT_ERR_PRIVSEP_MSG);
973 		goto done;
974 	}
975 	if (imsg.hdr.len - IMSG_HEADER_SIZE != 0) {
976 		err = got_error(GOT_ERR_PRIVSEP_LEN);
977 		goto done;
978 	}
979 	packfd = imsg.fd;
980 
981 	err = fetch_pack(fetchfd, packfd, pack_sha1, &have_refs,
982 	    fetch_req.fetch_all_branches, &wanted_branches,
983 	    &wanted_refs, fetch_req.list_refs_only, &ibuf);
984 done:
985 	TAILQ_FOREACH(pe, &have_refs, entry) {
986 		free((char *)pe->path);
987 		free(pe->data);
988 	}
989 	got_pathlist_free(&have_refs);
990 	TAILQ_FOREACH(pe, &wanted_branches, entry)
991 		free((char *)pe->path);
992 	got_pathlist_free(&wanted_branches);
993 	if (fetchfd != -1 && close(fetchfd) == -1 && err == NULL)
994 		err = got_error_from_errno("close");
995 	if (packfd != -1 && close(packfd) == -1 && err == NULL)
996 		err = got_error_from_errno("close");
997 	if (err != NULL)
998 		got_privsep_send_error(&ibuf, err);
999 	else
1000 		err = send_fetch_done(&ibuf, pack_sha1);
1001 	if (err != NULL) {
1002 		fprintf(stderr, "%s: %s\n", getprogname(), err->msg);
1003 		got_privsep_send_error(&ibuf, err);
1004 	}
1005 
1006 	exit(0);
1007 }