Andrew's git / gitweb.git / builtin/receive-pack.c
?
builtin / receive-pack.con commit am: fix commit buffer leak in get_commit_info() (f131db9)
   1#include "builtin.h"
   2#include "lockfile.h"
   3#include "pack.h"
   4#include "refs.h"
   5#include "pkt-line.h"
   6#include "sideband.h"
   7#include "run-command.h"
   8#include "exec_cmd.h"
   9#include "commit.h"
  10#include "object.h"
  11#include "remote.h"
  12#include "connect.h"
  13#include "transport.h"
  14#include "string-list.h"
  15#include "sha1-array.h"
  16#include "connected.h"
  17#include "argv-array.h"
  18#include "version.h"
  19#include "tag.h"
  20#include "gpg-interface.h"
  21#include "sigchain.h"
  22#include "fsck.h"
  23#include "tmp-objdir.h"
  24
  25static const char * const receive_pack_usage[] = {
  26        N_("git receive-pack <git-dir>"),
  27        NULL
  28};
  29
  30enum deny_action {
  31        DENY_UNCONFIGURED,
  32        DENY_IGNORE,
  33        DENY_WARN,
  34        DENY_REFUSE,
  35        DENY_UPDATE_INSTEAD
  36};
  37
  38static int deny_deletes;
  39static int deny_non_fast_forwards;
  40static enum deny_action deny_current_branch = DENY_UNCONFIGURED;
  41static enum deny_action deny_delete_current = DENY_UNCONFIGURED;
  42static int receive_fsck_objects = -1;
  43static int transfer_fsck_objects = -1;
  44static struct strbuf fsck_msg_types = STRBUF_INIT;
  45static int receive_unpack_limit = -1;
  46static int transfer_unpack_limit = -1;
  47static int advertise_atomic_push = 1;
  48static int advertise_push_options;
  49static int unpack_limit = 100;
  50static off_t max_input_size;
  51static int report_status;
  52static int use_sideband;
  53static int use_atomic;
  54static int use_push_options;
  55static int quiet;
  56static int prefer_ofs_delta = 1;
  57static int auto_update_server_info;
  58static int auto_gc = 1;
  59static int reject_thin;
  60static int stateless_rpc;
  61static const char *service_dir;
  62static const char *head_name;
  63static void *head_name_to_free;
  64static int sent_capabilities;
  65static int shallow_update;
  66static const char *alt_shallow_file;
  67static struct strbuf push_cert = STRBUF_INIT;
  68static unsigned char push_cert_sha1[20];
  69static struct signature_check sigcheck;
  70static const char *push_cert_nonce;
  71static const char *cert_nonce_seed;
  72
  73static const char *NONCE_UNSOLICITED = "UNSOLICITED";
  74static const char *NONCE_BAD = "BAD";
  75static const char *NONCE_MISSING = "MISSING";
  76static const char *NONCE_OK = "OK";
  77static const char *NONCE_SLOP = "SLOP";
  78static const char *nonce_status;
  79static long nonce_stamp_slop;
  80static unsigned long nonce_stamp_slop_limit;
  81static struct ref_transaction *transaction;
  82
  83static enum {
  84        KEEPALIVE_NEVER = 0,
  85        KEEPALIVE_AFTER_NUL,
  86        KEEPALIVE_ALWAYS
  87} use_keepalive;
  88static int keepalive_in_sec = 5;
  89
  90static struct tmp_objdir *tmp_objdir;
  91
  92static enum deny_action parse_deny_action(const char *var, const char *value)
  93{
  94        if (value) {
  95                if (!strcasecmp(value, "ignore"))
  96                        return DENY_IGNORE;
  97                if (!strcasecmp(value, "warn"))
  98                        return DENY_WARN;
  99                if (!strcasecmp(value, "refuse"))
 100                        return DENY_REFUSE;
 101                if (!strcasecmp(value, "updateinstead"))
 102                        return DENY_UPDATE_INSTEAD;
 103        }
 104        if (git_config_bool(var, value))
 105                return DENY_REFUSE;
 106        return DENY_IGNORE;
 107}
 108
 109static int receive_pack_config(const char *var, const char *value, void *cb)
 110{
 111        int status = parse_hide_refs_config(var, value, "receive");
 112
 113        if (status)
 114                return status;
 115
 116        if (strcmp(var, "receive.denydeletes") == 0) {
 117                deny_deletes = git_config_bool(var, value);
 118                return 0;
 119        }
 120
 121        if (strcmp(var, "receive.denynonfastforwards") == 0) {
 122                deny_non_fast_forwards = git_config_bool(var, value);
 123                return 0;
 124        }
 125
 126        if (strcmp(var, "receive.unpacklimit") == 0) {
 127                receive_unpack_limit = git_config_int(var, value);
 128                return 0;
 129        }
 130
 131        if (strcmp(var, "transfer.unpacklimit") == 0) {
 132                transfer_unpack_limit = git_config_int(var, value);
 133                return 0;
 134        }
 135
 136        if (strcmp(var, "receive.fsck.skiplist") == 0) {
 137                const char *path;
 138
 139                if (git_config_pathname(&path, var, value))
 140                        return 1;
 141                strbuf_addf(&fsck_msg_types, "%cskiplist=%s",
 142                        fsck_msg_types.len ? ',' : '=', path);
 143                free((char *)path);
 144                return 0;
 145        }
 146
 147        if (skip_prefix(var, "receive.fsck.", &var)) {
 148                if (is_valid_msg_type(var, value))
 149                        strbuf_addf(&fsck_msg_types, "%c%s=%s",
 150                                fsck_msg_types.len ? ',' : '=', var, value);
 151                else
 152                        warning("Skipping unknown msg id '%s'", var);
 153                return 0;
 154        }
 155
 156        if (strcmp(var, "receive.fsckobjects") == 0) {
 157                receive_fsck_objects = git_config_bool(var, value);
 158                return 0;
 159        }
 160
 161        if (strcmp(var, "transfer.fsckobjects") == 0) {
 162                transfer_fsck_objects = git_config_bool(var, value);
 163                return 0;
 164        }
 165
 166        if (!strcmp(var, "receive.denycurrentbranch")) {
 167                deny_current_branch = parse_deny_action(var, value);
 168                return 0;
 169        }
 170
 171        if (strcmp(var, "receive.denydeletecurrent") == 0) {
 172                deny_delete_current = parse_deny_action(var, value);
 173                return 0;
 174        }
 175
 176        if (strcmp(var, "repack.usedeltabaseoffset") == 0) {
 177                prefer_ofs_delta = git_config_bool(var, value);
 178                return 0;
 179        }
 180
 181        if (strcmp(var, "receive.updateserverinfo") == 0) {
 182                auto_update_server_info = git_config_bool(var, value);
 183                return 0;
 184        }
 185
 186        if (strcmp(var, "receive.autogc") == 0) {
 187                auto_gc = git_config_bool(var, value);
 188                return 0;
 189        }
 190
 191        if (strcmp(var, "receive.shallowupdate") == 0) {
 192                shallow_update = git_config_bool(var, value);
 193                return 0;
 194        }
 195
 196        if (strcmp(var, "receive.certnonceseed") == 0)
 197                return git_config_string(&cert_nonce_seed, var, value);
 198
 199        if (strcmp(var, "receive.certnonceslop") == 0) {
 200                nonce_stamp_slop_limit = git_config_ulong(var, value);
 201                return 0;
 202        }
 203
 204        if (strcmp(var, "receive.advertiseatomic") == 0) {
 205                advertise_atomic_push = git_config_bool(var, value);
 206                return 0;
 207        }
 208
 209        if (strcmp(var, "receive.advertisepushoptions") == 0) {
 210                advertise_push_options = git_config_bool(var, value);
 211                return 0;
 212        }
 213
 214        if (strcmp(var, "receive.keepalive") == 0) {
 215                keepalive_in_sec = git_config_int(var, value);
 216                return 0;
 217        }
 218
 219        if (strcmp(var, "receive.maxinputsize") == 0) {
 220                max_input_size = git_config_int64(var, value);
 221                return 0;
 222        }
 223
 224        return git_default_config(var, value, cb);
 225}
 226
 227static void show_ref(const char *path, const unsigned char *sha1)
 228{
 229        if (sent_capabilities) {
 230                packet_write_fmt(1, "%s %s\n", sha1_to_hex(sha1), path);
 231        } else {
 232                struct strbuf cap = STRBUF_INIT;
 233
 234                strbuf_addstr(&cap,
 235                              "report-status delete-refs side-band-64k quiet");
 236                if (advertise_atomic_push)
 237                        strbuf_addstr(&cap, " atomic");
 238                if (prefer_ofs_delta)
 239                        strbuf_addstr(&cap, " ofs-delta");
 240                if (push_cert_nonce)
 241                        strbuf_addf(&cap, " push-cert=%s", push_cert_nonce);
 242                if (advertise_push_options)
 243                        strbuf_addstr(&cap, " push-options");
 244                strbuf_addf(&cap, " agent=%s", git_user_agent_sanitized());
 245                packet_write_fmt(1, "%s %s%c%s\n",
 246                             sha1_to_hex(sha1), path, 0, cap.buf);
 247                strbuf_release(&cap);
 248                sent_capabilities = 1;
 249        }
 250}
 251
 252static int show_ref_cb(const char *path_full, const struct object_id *oid,
 253                       int flag, void *unused)
 254{
 255        const char *path = strip_namespace(path_full);
 256
 257        if (ref_is_hidden(path, path_full))
 258                return 0;
 259
 260        /*
 261         * Advertise refs outside our current namespace as ".have"
 262         * refs, so that the client can use them to minimize data
 263         * transfer but will otherwise ignore them. This happens to
 264         * cover ".have" that are thrown in by add_one_alternate_ref()
 265         * to mark histories that are complete in our alternates as
 266         * well.
 267         */
 268        if (!path)
 269                path = ".have";
 270        show_ref(path, oid->hash);
 271        return 0;
 272}
 273
 274static int show_one_alternate_sha1(const unsigned char sha1[20], void *unused)
 275{
 276        show_ref(".have", sha1);
 277        return 0;
 278}
 279
 280static void collect_one_alternate_ref(const struct ref *ref, void *data)
 281{
 282        struct sha1_array *sa = data;
 283        sha1_array_append(sa, ref->old_oid.hash);
 284}
 285
 286static void write_head_info(void)
 287{
 288        struct sha1_array sa = SHA1_ARRAY_INIT;
 289
 290        for_each_alternate_ref(collect_one_alternate_ref, &sa);
 291        sha1_array_for_each_unique(&sa, show_one_alternate_sha1, NULL);
 292        sha1_array_clear(&sa);
 293        for_each_ref(show_ref_cb, NULL);
 294        if (!sent_capabilities)
 295                show_ref("capabilities^{}", null_sha1);
 296
 297        advertise_shallow_grafts(1);
 298
 299        /* EOF */
 300        packet_flush(1);
 301}
 302
 303struct command {
 304        struct command *next;
 305        const char *error_string;
 306        unsigned int skip_update:1,
 307                     did_not_exist:1;
 308        int index;
 309        unsigned char old_sha1[20];
 310        unsigned char new_sha1[20];
 311        char ref_name[FLEX_ARRAY]; /* more */
 312};
 313
 314static void rp_error(const char *err, ...) __attribute__((format (printf, 1, 2)));
 315static void rp_warning(const char *err, ...) __attribute__((format (printf, 1, 2)));
 316
 317static void report_message(const char *prefix, const char *err, va_list params)
 318{
 319        int sz;
 320        char msg[4096];
 321
 322        sz = xsnprintf(msg, sizeof(msg), "%s", prefix);
 323        sz += vsnprintf(msg + sz, sizeof(msg) - sz, err, params);
 324        if (sz > (sizeof(msg) - 1))
 325                sz = sizeof(msg) - 1;
 326        msg[sz++] = '\n';
 327
 328        if (use_sideband)
 329                send_sideband(1, 2, msg, sz, use_sideband);
 330        else
 331                xwrite(2, msg, sz);
 332}
 333
 334static void rp_warning(const char *err, ...)
 335{
 336        va_list params;
 337        va_start(params, err);
 338        report_message("warning: ", err, params);
 339        va_end(params);
 340}
 341
 342static void rp_error(const char *err, ...)
 343{
 344        va_list params;
 345        va_start(params, err);
 346        report_message("error: ", err, params);
 347        va_end(params);
 348}
 349
 350static int copy_to_sideband(int in, int out, void *arg)
 351{
 352        char data[128];
 353        int keepalive_active = 0;
 354
 355        if (keepalive_in_sec <= 0)
 356                use_keepalive = KEEPALIVE_NEVER;
 357        if (use_keepalive == KEEPALIVE_ALWAYS)
 358                keepalive_active = 1;
 359
 360        while (1) {
 361                ssize_t sz;
 362
 363                if (keepalive_active) {
 364                        struct pollfd pfd;
 365                        int ret;
 366
 367                        pfd.fd = in;
 368                        pfd.events = POLLIN;
 369                        ret = poll(&pfd, 1, 1000 * keepalive_in_sec);
 370
 371                        if (ret < 0) {
 372                                if (errno == EINTR)
 373                                        continue;
 374                                else
 375                                        break;
 376                        } else if (ret == 0) {
 377                                /* no data; send a keepalive packet */
 378                                static const char buf[] = "0005\1";
 379                                write_or_die(1, buf, sizeof(buf) - 1);
 380                                continue;
 381                        } /* else there is actual data to read */
 382                }
 383
 384                sz = xread(in, data, sizeof(data));
 385                if (sz <= 0)
 386                        break;
 387
 388                if (use_keepalive == KEEPALIVE_AFTER_NUL && !keepalive_active) {
 389                        const char *p = memchr(data, '\0', sz);
 390                        if (p) {
 391                                /*
 392                                 * The NUL tells us to start sending keepalives. Make
 393                                 * sure we send any other data we read along
 394                                 * with it.
 395                                 */
 396                                keepalive_active = 1;
 397                                send_sideband(1, 2, data, p - data, use_sideband);
 398                                send_sideband(1, 2, p + 1, sz - (p - data + 1), use_sideband);
 399                                continue;
 400                        }
 401                }
 402
 403                /*
 404                 * Either we're not looking for a NUL signal, or we didn't see
 405                 * it yet; just pass along the data.
 406                 */
 407                send_sideband(1, 2, data, sz, use_sideband);
 408        }
 409        close(in);
 410        return 0;
 411}
 412
 413#define HMAC_BLOCK_SIZE 64
 414
 415static void hmac_sha1(unsigned char *out,
 416                      const char *key_in, size_t key_len,
 417                      const char *text, size_t text_len)
 418{
 419        unsigned char key[HMAC_BLOCK_SIZE];
 420        unsigned char k_ipad[HMAC_BLOCK_SIZE];
 421        unsigned char k_opad[HMAC_BLOCK_SIZE];
 422        int i;
 423        git_SHA_CTX ctx;
 424
 425        /* RFC 2104 2. (1) */
 426        memset(key, '\0', HMAC_BLOCK_SIZE);
 427        if (HMAC_BLOCK_SIZE < key_len) {
 428                git_SHA1_Init(&ctx);
 429                git_SHA1_Update(&ctx, key_in, key_len);
 430                git_SHA1_Final(key, &ctx);
 431        } else {
 432                memcpy(key, key_in, key_len);
 433        }
 434
 435        /* RFC 2104 2. (2) & (5) */
 436        for (i = 0; i < sizeof(key); i++) {
 437                k_ipad[i] = key[i] ^ 0x36;
 438                k_opad[i] = key[i] ^ 0x5c;
 439        }
 440
 441        /* RFC 2104 2. (3) & (4) */
 442        git_SHA1_Init(&ctx);
 443        git_SHA1_Update(&ctx, k_ipad, sizeof(k_ipad));
 444        git_SHA1_Update(&ctx, text, text_len);
 445        git_SHA1_Final(out, &ctx);
 446
 447        /* RFC 2104 2. (6) & (7) */
 448        git_SHA1_Init(&ctx);
 449        git_SHA1_Update(&ctx, k_opad, sizeof(k_opad));
 450        git_SHA1_Update(&ctx, out, 20);
 451        git_SHA1_Final(out, &ctx);
 452}
 453
 454static char *prepare_push_cert_nonce(const char *path, unsigned long stamp)
 455{
 456        struct strbuf buf = STRBUF_INIT;
 457        unsigned char sha1[20];
 458
 459        strbuf_addf(&buf, "%s:%lu", path, stamp);
 460        hmac_sha1(sha1, buf.buf, buf.len, cert_nonce_seed, strlen(cert_nonce_seed));;
 461        strbuf_release(&buf);
 462
 463        /* RFC 2104 5. HMAC-SHA1-80 */
 464        strbuf_addf(&buf, "%lu-%.*s", stamp, 20, sha1_to_hex(sha1));
 465        return strbuf_detach(&buf, NULL);
 466}
 467
 468/*
 469 * NEEDSWORK: reuse find_commit_header() from jk/commit-author-parsing
 470 * after dropping "_commit" from its name and possibly moving it out
 471 * of commit.c
 472 */
 473static char *find_header(const char *msg, size_t len, const char *key)
 474{
 475        int key_len = strlen(key);
 476        const char *line = msg;
 477
 478        while (line && line < msg + len) {
 479                const char *eol = strchrnul(line, '\n');
 480
 481                if ((msg + len <= eol) || line == eol)
 482                        return NULL;
 483                if (line + key_len < eol &&
 484                    !memcmp(line, key, key_len) && line[key_len] == ' ') {
 485                        int offset = key_len + 1;
 486                        return xmemdupz(line + offset, (eol - line) - offset);
 487                }
 488                line = *eol ? eol + 1 : NULL;
 489        }
 490        return NULL;
 491}
 492
 493static const char *check_nonce(const char *buf, size_t len)
 494{
 495        char *nonce = find_header(buf, len, "nonce");
 496        unsigned long stamp, ostamp;
 497        char *bohmac, *expect = NULL;
 498        const char *retval = NONCE_BAD;
 499
 500        if (!nonce) {
 501                retval = NONCE_MISSING;
 502                goto leave;
 503        } else if (!push_cert_nonce) {
 504                retval = NONCE_UNSOLICITED;
 505                goto leave;
 506        } else if (!strcmp(push_cert_nonce, nonce)) {
 507                retval = NONCE_OK;
 508                goto leave;
 509        }
 510
 511        if (!stateless_rpc) {
 512                /* returned nonce MUST match what we gave out earlier */
 513                retval = NONCE_BAD;
 514                goto leave;
 515        }
 516
 517        /*
 518         * In stateless mode, we may be receiving a nonce issued by
 519         * another instance of the server that serving the same
 520         * repository, and the timestamps may not match, but the
 521         * nonce-seed and dir should match, so we can recompute and
 522         * report the time slop.
 523         *
 524         * In addition, when a nonce issued by another instance has
 525         * timestamp within receive.certnonceslop seconds, we pretend
 526         * as if we issued that nonce when reporting to the hook.
 527         */
 528
 529        /* nonce is concat(<seconds-since-epoch>, "-", <hmac>) */
 530        if (*nonce <= '0' || '9' < *nonce) {
 531                retval = NONCE_BAD;
 532                goto leave;
 533        }
 534        stamp = strtoul(nonce, &bohmac, 10);
 535        if (bohmac == nonce || bohmac[0] != '-') {
 536                retval = NONCE_BAD;
 537                goto leave;
 538        }
 539
 540        expect = prepare_push_cert_nonce(service_dir, stamp);
 541        if (strcmp(expect, nonce)) {
 542                /* Not what we would have signed earlier */
 543                retval = NONCE_BAD;
 544                goto leave;
 545        }
 546
 547        /*
 548         * By how many seconds is this nonce stale?  Negative value
 549         * would mean it was issued by another server with its clock
 550         * skewed in the future.
 551         */
 552        ostamp = strtoul(push_cert_nonce, NULL, 10);
 553        nonce_stamp_slop = (long)ostamp - (long)stamp;
 554
 555        if (nonce_stamp_slop_limit &&
 556            labs(nonce_stamp_slop) <= nonce_stamp_slop_limit) {
 557                /*
 558                 * Pretend as if the received nonce (which passes the
 559                 * HMAC check, so it is not a forged by third-party)
 560                 * is what we issued.
 561                 */
 562                free((void *)push_cert_nonce);
 563                push_cert_nonce = xstrdup(nonce);
 564                retval = NONCE_OK;
 565        } else {
 566                retval = NONCE_SLOP;
 567        }
 568
 569leave:
 570        free(nonce);
 571        free(expect);
 572        return retval;
 573}
 574
 575static void prepare_push_cert_sha1(struct child_process *proc)
 576{
 577        static int already_done;
 578
 579        if (!push_cert.len)
 580                return;
 581
 582        if (!already_done) {
 583                struct strbuf gpg_output = STRBUF_INIT;
 584                struct strbuf gpg_status = STRBUF_INIT;
 585                int bogs /* beginning_of_gpg_sig */;
 586
 587                already_done = 1;
 588                if (write_sha1_file(push_cert.buf, push_cert.len, "blob", push_cert_sha1))
 589                        hashclr(push_cert_sha1);
 590
 591                memset(&sigcheck, '\0', sizeof(sigcheck));
 592                sigcheck.result = 'N';
 593
 594                bogs = parse_signature(push_cert.buf, push_cert.len);
 595                if (verify_signed_buffer(push_cert.buf, bogs,
 596                                         push_cert.buf + bogs, push_cert.len - bogs,
 597                                         &gpg_output, &gpg_status) < 0) {
 598                        ; /* error running gpg */
 599                } else {
 600                        sigcheck.payload = push_cert.buf;
 601                        sigcheck.gpg_output = gpg_output.buf;
 602                        sigcheck.gpg_status = gpg_status.buf;
 603                        parse_gpg_output(&sigcheck);
 604                }
 605
 606                strbuf_release(&gpg_output);
 607                strbuf_release(&gpg_status);
 608                nonce_status = check_nonce(push_cert.buf, bogs);
 609        }
 610        if (!is_null_sha1(push_cert_sha1)) {
 611                argv_array_pushf(&proc->env_array, "GIT_PUSH_CERT=%s",
 612                                 sha1_to_hex(push_cert_sha1));
 613                argv_array_pushf(&proc->env_array, "GIT_PUSH_CERT_SIGNER=%s",
 614                                 sigcheck.signer ? sigcheck.signer : "");
 615                argv_array_pushf(&proc->env_array, "GIT_PUSH_CERT_KEY=%s",
 616                                 sigcheck.key ? sigcheck.key : "");
 617                argv_array_pushf(&proc->env_array, "GIT_PUSH_CERT_STATUS=%c",
 618                                 sigcheck.result);
 619                if (push_cert_nonce) {
 620                        argv_array_pushf(&proc->env_array,
 621                                         "GIT_PUSH_CERT_NONCE=%s",
 622                                         push_cert_nonce);
 623                        argv_array_pushf(&proc->env_array,
 624                                         "GIT_PUSH_CERT_NONCE_STATUS=%s",
 625                                         nonce_status);
 626                        if (nonce_status == NONCE_SLOP)
 627                                argv_array_pushf(&proc->env_array,
 628                                                 "GIT_PUSH_CERT_NONCE_SLOP=%ld",
 629                                                 nonce_stamp_slop);
 630                }
 631        }
 632}
 633
 634struct receive_hook_feed_state {
 635        struct command *cmd;
 636        int skip_broken;
 637        struct strbuf buf;
 638        const struct string_list *push_options;
 639};
 640
 641typedef int (*feed_fn)(void *, const char **, size_t *);
 642static int run_and_feed_hook(const char *hook_name, feed_fn feed,
 643                             struct receive_hook_feed_state *feed_state)
 644{
 645        struct child_process proc = CHILD_PROCESS_INIT;
 646        struct async muxer;
 647        const char *argv[2];
 648        int code;
 649
 650        argv[0] = find_hook(hook_name);
 651        if (!argv[0])
 652                return 0;
 653
 654        argv[1] = NULL;
 655
 656        proc.argv = argv;
 657        proc.in = -1;
 658        proc.stdout_to_stderr = 1;
 659        if (feed_state->push_options) {
 660                int i;
 661                for (i = 0; i < feed_state->push_options->nr; i++)
 662                        argv_array_pushf(&proc.env_array,
 663                                "GIT_PUSH_OPTION_%d=%s", i,
 664                                feed_state->push_options->items[i].string);
 665                argv_array_pushf(&proc.env_array, "GIT_PUSH_OPTION_COUNT=%d",
 666                                 feed_state->push_options->nr);
 667        } else
 668                argv_array_pushf(&proc.env_array, "GIT_PUSH_OPTION_COUNT");
 669
 670        if (tmp_objdir)
 671                argv_array_pushv(&proc.env_array, tmp_objdir_env(tmp_objdir));
 672
 673        if (use_sideband) {
 674                memset(&muxer, 0, sizeof(muxer));
 675                muxer.proc = copy_to_sideband;
 676                muxer.in = -1;
 677                code = start_async(&muxer);
 678                if (code)
 679                        return code;
 680                proc.err = muxer.in;
 681        }
 682
 683        prepare_push_cert_sha1(&proc);
 684
 685        code = start_command(&proc);
 686        if (code) {
 687                if (use_sideband)
 688                        finish_async(&muxer);
 689                return code;
 690        }
 691
 692        sigchain_push(SIGPIPE, SIG_IGN);
 693
 694        while (1) {
 695                const char *buf;
 696                size_t n;
 697                if (feed(feed_state, &buf, &n))
 698                        break;
 699                if (write_in_full(proc.in, buf, n) != n)
 700                        break;
 701        }
 702        close(proc.in);
 703        if (use_sideband)
 704                finish_async(&muxer);
 705
 706        sigchain_pop(SIGPIPE);
 707
 708        return finish_command(&proc);
 709}
 710
 711static int feed_receive_hook(void *state_, const char **bufp, size_t *sizep)
 712{
 713        struct receive_hook_feed_state *state = state_;
 714        struct command *cmd = state->cmd;
 715
 716        while (cmd &&
 717               state->skip_broken && (cmd->error_string || cmd->did_not_exist))
 718                cmd = cmd->next;
 719        if (!cmd)
 720                return -1; /* EOF */
 721        strbuf_reset(&state->buf);
 722        strbuf_addf(&state->buf, "%s %s %s\n",
 723                    sha1_to_hex(cmd->old_sha1), sha1_to_hex(cmd->new_sha1),
 724                    cmd->ref_name);
 725        state->cmd = cmd->next;
 726        if (bufp) {
 727                *bufp = state->buf.buf;
 728                *sizep = state->buf.len;
 729        }
 730        return 0;
 731}
 732
 733static int run_receive_hook(struct command *commands,
 734                            const char *hook_name,
 735                            int skip_broken,
 736                            const struct string_list *push_options)
 737{
 738        struct receive_hook_feed_state state;
 739        int status;
 740
 741        strbuf_init(&state.buf, 0);
 742        state.cmd = commands;
 743        state.skip_broken = skip_broken;
 744        if (feed_receive_hook(&state, NULL, NULL))
 745                return 0;
 746        state.cmd = commands;
 747        state.push_options = push_options;
 748        status = run_and_feed_hook(hook_name, feed_receive_hook, &state);
 749        strbuf_release(&state.buf);
 750        return status;
 751}
 752
 753static int run_update_hook(struct command *cmd)
 754{
 755        const char *argv[5];
 756        struct child_process proc = CHILD_PROCESS_INIT;
 757        int code;
 758
 759        argv[0] = find_hook("update");
 760        if (!argv[0])
 761                return 0;
 762
 763        argv[1] = cmd->ref_name;
 764        argv[2] = sha1_to_hex(cmd->old_sha1);
 765        argv[3] = sha1_to_hex(cmd->new_sha1);
 766        argv[4] = NULL;
 767
 768        proc.no_stdin = 1;
 769        proc.stdout_to_stderr = 1;
 770        proc.err = use_sideband ? -1 : 0;
 771        proc.argv = argv;
 772        proc.env = tmp_objdir_env(tmp_objdir);
 773
 774        code = start_command(&proc);
 775        if (code)
 776                return code;
 777        if (use_sideband)
 778                copy_to_sideband(proc.err, -1, NULL);
 779        return finish_command(&proc);
 780}
 781
 782static int is_ref_checked_out(const char *ref)
 783{
 784        if (is_bare_repository())
 785                return 0;
 786
 787        if (!head_name)
 788                return 0;
 789        return !strcmp(head_name, ref);
 790}
 791
 792static char *refuse_unconfigured_deny_msg =
 793        N_("By default, updating the current branch in a non-bare repository\n"
 794           "is denied, because it will make the index and work tree inconsistent\n"
 795           "with what you pushed, and will require 'git reset --hard' to match\n"
 796           "the work tree to HEAD.\n"
 797           "\n"
 798           "You can set 'receive.denyCurrentBranch' configuration variable to\n"
 799           "'ignore' or 'warn' in the remote repository to allow pushing into\n"
 800           "its current branch; however, this is not recommended unless you\n"
 801           "arranged to update its work tree to match what you pushed in some\n"
 802           "other way.\n"
 803           "\n"
 804           "To squelch this message and still keep the default behaviour, set\n"
 805           "'receive.denyCurrentBranch' configuration variable to 'refuse'.");
 806
 807static void refuse_unconfigured_deny(void)
 808{
 809        rp_error("%s", _(refuse_unconfigured_deny_msg));
 810}
 811
 812static char *refuse_unconfigured_deny_delete_current_msg =
 813        N_("By default, deleting the current branch is denied, because the next\n"
 814           "'git clone' won't result in any file checked out, causing confusion.\n"
 815           "\n"
 816           "You can set 'receive.denyDeleteCurrent' configuration variable to\n"
 817           "'warn' or 'ignore' in the remote repository to allow deleting the\n"
 818           "current branch, with or without a warning message.\n"
 819           "\n"
 820           "To squelch this message, you can set it to 'refuse'.");
 821
 822static void refuse_unconfigured_deny_delete_current(void)
 823{
 824        rp_error("%s", _(refuse_unconfigured_deny_delete_current_msg));
 825}
 826
 827static int command_singleton_iterator(void *cb_data, unsigned char sha1[20]);
 828static int update_shallow_ref(struct command *cmd, struct shallow_info *si)
 829{
 830        static struct lock_file shallow_lock;
 831        struct sha1_array extra = SHA1_ARRAY_INIT;
 832        struct check_connected_options opt = CHECK_CONNECTED_INIT;
 833        uint32_t mask = 1 << (cmd->index % 32);
 834        int i;
 835
 836        trace_printf_key(&trace_shallow,
 837                         "shallow: update_shallow_ref %s\n", cmd->ref_name);
 838        for (i = 0; i < si->shallow->nr; i++)
 839                if (si->used_shallow[i] &&
 840                    (si->used_shallow[i][cmd->index / 32] & mask) &&
 841                    !delayed_reachability_test(si, i))
 842                        sha1_array_append(&extra, si->shallow->sha1[i]);
 843
 844        opt.env = tmp_objdir_env(tmp_objdir);
 845        setup_alternate_shallow(&shallow_lock, &opt.shallow_file, &extra);
 846        if (check_connected(command_singleton_iterator, cmd, &opt)) {
 847                rollback_lock_file(&shallow_lock);
 848                sha1_array_clear(&extra);
 849                return -1;
 850        }
 851
 852        commit_lock_file(&shallow_lock);
 853
 854        /*
 855         * Make sure setup_alternate_shallow() for the next ref does
 856         * not lose these new roots..
 857         */
 858        for (i = 0; i < extra.nr; i++)
 859                register_shallow(extra.sha1[i]);
 860
 861        si->shallow_ref[cmd->index] = 0;
 862        sha1_array_clear(&extra);
 863        return 0;
 864}
 865
 866/*
 867 * NEEDSWORK: we should consolidate various implementions of "are we
 868 * on an unborn branch?" test into one, and make the unified one more
 869 * robust. !get_sha1() based check used here and elsewhere would not
 870 * allow us to tell an unborn branch from corrupt ref, for example.
 871 * For the purpose of fixing "deploy-to-update does not work when
 872 * pushing into an empty repository" issue, this should suffice for
 873 * now.
 874 */
 875static int head_has_history(void)
 876{
 877        unsigned char sha1[20];
 878
 879        return !get_sha1("HEAD", sha1);
 880}
 881
 882static const char *push_to_deploy(unsigned char *sha1,
 883                                  struct argv_array *env,
 884                                  const char *work_tree)
 885{
 886        const char *update_refresh[] = {
 887                "update-index", "-q", "--ignore-submodules", "--refresh", NULL
 888        };
 889        const char *diff_files[] = {
 890                "diff-files", "--quiet", "--ignore-submodules", "--", NULL
 891        };
 892        const char *diff_index[] = {
 893                "diff-index", "--quiet", "--cached", "--ignore-submodules",
 894                NULL, "--", NULL
 895        };
 896        const char *read_tree[] = {
 897                "read-tree", "-u", "-m", NULL, NULL
 898        };
 899        struct child_process child = CHILD_PROCESS_INIT;
 900
 901        child.argv = update_refresh;
 902        child.env = env->argv;
 903        child.dir = work_tree;
 904        child.no_stdin = 1;
 905        child.stdout_to_stderr = 1;
 906        child.git_cmd = 1;
 907        if (run_command(&child))
 908                return "Up-to-date check failed";
 909
 910        /* run_command() does not clean up completely; reinitialize */
 911        child_process_init(&child);
 912        child.argv = diff_files;
 913        child.env = env->argv;
 914        child.dir = work_tree;
 915        child.no_stdin = 1;
 916        child.stdout_to_stderr = 1;
 917        child.git_cmd = 1;
 918        if (run_command(&child))
 919                return "Working directory has unstaged changes";
 920
 921        /* diff-index with either HEAD or an empty tree */
 922        diff_index[4] = head_has_history() ? "HEAD" : EMPTY_TREE_SHA1_HEX;
 923
 924        child_process_init(&child);
 925        child.argv = diff_index;
 926        child.env = env->argv;
 927        child.no_stdin = 1;
 928        child.no_stdout = 1;
 929        child.stdout_to_stderr = 0;
 930        child.git_cmd = 1;
 931        if (run_command(&child))
 932                return "Working directory has staged changes";
 933
 934        read_tree[3] = sha1_to_hex(sha1);
 935        child_process_init(&child);
 936        child.argv = read_tree;
 937        child.env = env->argv;
 938        child.dir = work_tree;
 939        child.no_stdin = 1;
 940        child.no_stdout = 1;
 941        child.stdout_to_stderr = 0;
 942        child.git_cmd = 1;
 943        if (run_command(&child))
 944                return "Could not update working tree to new HEAD";
 945
 946        return NULL;
 947}
 948
 949static const char *push_to_checkout_hook = "push-to-checkout";
 950
 951static const char *push_to_checkout(unsigned char *sha1,
 952                                    struct argv_array *env,
 953                                    const char *work_tree)
 954{
 955        argv_array_pushf(env, "GIT_WORK_TREE=%s", absolute_path(work_tree));
 956        if (run_hook_le(env->argv, push_to_checkout_hook,
 957                        sha1_to_hex(sha1), NULL))
 958                return "push-to-checkout hook declined";
 959        else
 960                return NULL;
 961}
 962
 963static const char *update_worktree(unsigned char *sha1)
 964{
 965        const char *retval;
 966        const char *work_tree = git_work_tree_cfg ? git_work_tree_cfg : "..";
 967        struct argv_array env = ARGV_ARRAY_INIT;
 968
 969        if (is_bare_repository())
 970                return "denyCurrentBranch = updateInstead needs a worktree";
 971
 972        argv_array_pushf(&env, "GIT_DIR=%s", absolute_path(get_git_dir()));
 973
 974        if (!find_hook(push_to_checkout_hook))
 975                retval = push_to_deploy(sha1, &env, work_tree);
 976        else
 977                retval = push_to_checkout(sha1, &env, work_tree);
 978
 979        argv_array_clear(&env);
 980        return retval;
 981}
 982
 983static const char *update(struct command *cmd, struct shallow_info *si)
 984{
 985        const char *name = cmd->ref_name;
 986        struct strbuf namespaced_name_buf = STRBUF_INIT;
 987        const char *namespaced_name, *ret;
 988        unsigned char *old_sha1 = cmd->old_sha1;
 989        unsigned char *new_sha1 = cmd->new_sha1;
 990
 991        /* only refs/... are allowed */
 992        if (!starts_with(name, "refs/") || check_refname_format(name + 5, 0)) {
 993                rp_error("refusing to create funny ref '%s' remotely", name);
 994                return "funny refname";
 995        }
 996
 997        strbuf_addf(&namespaced_name_buf, "%s%s", get_git_namespace(), name);
 998        namespaced_name = strbuf_detach(&namespaced_name_buf, NULL);
 999
1000        if (is_ref_checked_out(namespaced_name)) {
1001                switch (deny_current_branch) {
1002                case DENY_IGNORE:
1003                        break;
1004                case DENY_WARN:
1005                        rp_warning("updating the current branch");
1006                        break;
1007                case DENY_REFUSE:
1008                case DENY_UNCONFIGURED:
1009                        rp_error("refusing to update checked out branch: %s", name);
1010                        if (deny_current_branch == DENY_UNCONFIGURED)
1011                                refuse_unconfigured_deny();
1012                        return "branch is currently checked out";
1013                case DENY_UPDATE_INSTEAD:
1014                        ret = update_worktree(new_sha1);
1015                        if (ret)
1016                                return ret;
1017                        break;
1018                }
1019        }
1020
1021        if (!is_null_sha1(new_sha1) && !has_sha1_file(new_sha1)) {
1022                error("unpack should have generated %s, "
1023                      "but I can't find it!", sha1_to_hex(new_sha1));
1024                return "bad pack";
1025        }
1026
1027        if (!is_null_sha1(old_sha1) && is_null_sha1(new_sha1)) {
1028                if (deny_deletes && starts_with(name, "refs/heads/")) {
1029                        rp_error("denying ref deletion for %s", name);
1030                        return "deletion prohibited";
1031                }
1032
1033                if (head_name && !strcmp(namespaced_name, head_name)) {
1034                        switch (deny_delete_current) {
1035                        case DENY_IGNORE:
1036                                break;
1037                        case DENY_WARN:
1038                                rp_warning("deleting the current branch");
1039                                break;
1040                        case DENY_REFUSE:
1041                        case DENY_UNCONFIGURED:
1042                        case DENY_UPDATE_INSTEAD:
1043                                if (deny_delete_current == DENY_UNCONFIGURED)
1044                                        refuse_unconfigured_deny_delete_current();
1045                                rp_error("refusing to delete the current branch: %s", name);
1046                                return "deletion of the current branch prohibited";
1047                        default:
1048                                return "Invalid denyDeleteCurrent setting";
1049                        }
1050                }
1051        }
1052
1053        if (deny_non_fast_forwards && !is_null_sha1(new_sha1) &&
1054            !is_null_sha1(old_sha1) &&
1055            starts_with(name, "refs/heads/")) {
1056                struct object *old_object, *new_object;
1057                struct commit *old_commit, *new_commit;
1058
1059                old_object = parse_object(old_sha1);
1060                new_object = parse_object(new_sha1);
1061
1062                if (!old_object || !new_object ||
1063                    old_object->type != OBJ_COMMIT ||
1064                    new_object->type != OBJ_COMMIT) {
1065                        error("bad sha1 objects for %s", name);
1066                        return "bad ref";
1067                }
1068                old_commit = (struct commit *)old_object;
1069                new_commit = (struct commit *)new_object;
1070                if (!in_merge_bases(old_commit, new_commit)) {
1071                        rp_error("denying non-fast-forward %s"
1072                                 " (you should pull first)", name);
1073                        return "non-fast-forward";
1074                }
1075        }
1076        if (run_update_hook(cmd)) {
1077                rp_error("hook declined to update %s", name);
1078                return "hook declined";
1079        }
1080
1081        if (is_null_sha1(new_sha1)) {
1082                struct strbuf err = STRBUF_INIT;
1083                if (!parse_object(old_sha1)) {
1084                        old_sha1 = NULL;
1085                        if (ref_exists(name)) {
1086                                rp_warning("Allowing deletion of corrupt ref.");
1087                        } else {
1088                                rp_warning("Deleting a non-existent ref.");
1089                                cmd->did_not_exist = 1;
1090                        }
1091                }
1092                if (ref_transaction_delete(transaction,
1093                                           namespaced_name,
1094                                           old_sha1,
1095                                           0, "push", &err)) {
1096                        rp_error("%s", err.buf);
1097                        strbuf_release(&err);
1098                        return "failed to delete";
1099                }
1100                strbuf_release(&err);
1101                return NULL; /* good */
1102        }
1103        else {
1104                struct strbuf err = STRBUF_INIT;
1105                if (shallow_update && si->shallow_ref[cmd->index] &&
1106                    update_shallow_ref(cmd, si))
1107                        return "shallow error";
1108
1109                if (ref_transaction_update(transaction,
1110                                           namespaced_name,
1111                                           new_sha1, old_sha1,
1112                                           0, "push",
1113                                           &err)) {
1114                        rp_error("%s", err.buf);
1115                        strbuf_release(&err);
1116
1117                        return "failed to update ref";
1118                }
1119                strbuf_release(&err);
1120
1121                return NULL; /* good */
1122        }
1123}
1124
1125static void run_update_post_hook(struct command *commands)
1126{
1127        struct command *cmd;
1128        int argc;
1129        struct child_process proc = CHILD_PROCESS_INIT;
1130        const char *hook;
1131
1132        hook = find_hook("post-update");
1133        for (argc = 0, cmd = commands; cmd; cmd = cmd->next) {
1134                if (cmd->error_string || cmd->did_not_exist)
1135                        continue;
1136                argc++;
1137        }
1138        if (!argc || !hook)
1139                return;
1140
1141        argv_array_push(&proc.args, hook);
1142        for (cmd = commands; cmd; cmd = cmd->next) {
1143                if (cmd->error_string || cmd->did_not_exist)
1144                        continue;
1145                argv_array_push(&proc.args, cmd->ref_name);
1146        }
1147
1148        proc.no_stdin = 1;
1149        proc.stdout_to_stderr = 1;
1150        proc.err = use_sideband ? -1 : 0;
1151
1152        if (!start_command(&proc)) {
1153                if (use_sideband)
1154                        copy_to_sideband(proc.err, -1, NULL);
1155                finish_command(&proc);
1156        }
1157}
1158
1159static void check_aliased_update(struct command *cmd, struct string_list *list)
1160{
1161        struct strbuf buf = STRBUF_INIT;
1162        const char *dst_name;
1163        struct string_list_item *item;
1164        struct command *dst_cmd;
1165        unsigned char sha1[GIT_SHA1_RAWSZ];
1166        int flag;
1167
1168        strbuf_addf(&buf, "%s%s", get_git_namespace(), cmd->ref_name);
1169        dst_name = resolve_ref_unsafe(buf.buf, 0, sha1, &flag);
1170        strbuf_release(&buf);
1171
1172        if (!(flag & REF_ISSYMREF))
1173                return;
1174
1175        if (!dst_name) {
1176                rp_error("refusing update to broken symref '%s'", cmd->ref_name);
1177                cmd->skip_update = 1;
1178                cmd->error_string = "broken symref";
1179                return;
1180        }
1181        dst_name = strip_namespace(dst_name);
1182
1183        if ((item = string_list_lookup(list, dst_name)) == NULL)
1184                return;
1185
1186        cmd->skip_update = 1;
1187
1188        dst_cmd = (struct command *) item->util;
1189
1190        if (!hashcmp(cmd->old_sha1, dst_cmd->old_sha1) &&
1191            !hashcmp(cmd->new_sha1, dst_cmd->new_sha1))
1192                return;
1193
1194        dst_cmd->skip_update = 1;
1195
1196        rp_error("refusing inconsistent update between symref '%s' (%s..%s) and"
1197                 " its target '%s' (%s..%s)",
1198                 cmd->ref_name,
1199                 find_unique_abbrev(cmd->old_sha1, DEFAULT_ABBREV),
1200                 find_unique_abbrev(cmd->new_sha1, DEFAULT_ABBREV),
1201                 dst_cmd->ref_name,
1202                 find_unique_abbrev(dst_cmd->old_sha1, DEFAULT_ABBREV),
1203                 find_unique_abbrev(dst_cmd->new_sha1, DEFAULT_ABBREV));
1204
1205        cmd->error_string = dst_cmd->error_string =
1206                "inconsistent aliased update";
1207}
1208
1209static void check_aliased_updates(struct command *commands)
1210{
1211        struct command *cmd;
1212        struct string_list ref_list = STRING_LIST_INIT_NODUP;
1213
1214        for (cmd = commands; cmd; cmd = cmd->next) {
1215                struct string_list_item *item =
1216                        string_list_append(&ref_list, cmd->ref_name);
1217                item->util = (void *)cmd;
1218        }
1219        string_list_sort(&ref_list);
1220
1221        for (cmd = commands; cmd; cmd = cmd->next) {
1222                if (!cmd->error_string)
1223                        check_aliased_update(cmd, &ref_list);
1224        }
1225
1226        string_list_clear(&ref_list, 0);
1227}
1228
1229static int command_singleton_iterator(void *cb_data, unsigned char sha1[20])
1230{
1231        struct command **cmd_list = cb_data;
1232        struct command *cmd = *cmd_list;
1233
1234        if (!cmd || is_null_sha1(cmd->new_sha1))
1235                return -1; /* end of list */
1236        *cmd_list = NULL; /* this returns only one */
1237        hashcpy(sha1, cmd->new_sha1);
1238        return 0;
1239}
1240
1241static void set_connectivity_errors(struct command *commands,
1242                                    struct shallow_info *si)
1243{
1244        struct command *cmd;
1245
1246        for (cmd = commands; cmd; cmd = cmd->next) {
1247                struct command *singleton = cmd;
1248                struct check_connected_options opt = CHECK_CONNECTED_INIT;
1249
1250                if (shallow_update && si->shallow_ref[cmd->index])
1251                        /* to be checked in update_shallow_ref() */
1252                        continue;
1253
1254                opt.env = tmp_objdir_env(tmp_objdir);
1255                if (!check_connected(command_singleton_iterator, &singleton,
1256                                     &opt))
1257                        continue;
1258
1259                cmd->error_string = "missing necessary objects";
1260        }
1261}
1262
1263struct iterate_data {
1264        struct command *cmds;
1265        struct shallow_info *si;
1266};
1267
1268static int iterate_receive_command_list(void *cb_data, unsigned char sha1[20])
1269{
1270        struct iterate_data *data = cb_data;
1271        struct command **cmd_list = &data->cmds;
1272        struct command *cmd = *cmd_list;
1273
1274        for (; cmd; cmd = cmd->next) {
1275                if (shallow_update && data->si->shallow_ref[cmd->index])
1276                        /* to be checked in update_shallow_ref() */
1277                        continue;
1278                if (!is_null_sha1(cmd->new_sha1) && !cmd->skip_update) {
1279                        hashcpy(sha1, cmd->new_sha1);
1280                        *cmd_list = cmd->next;
1281                        return 0;
1282                }
1283        }
1284        *cmd_list = NULL;
1285        return -1; /* end of list */
1286}
1287
1288static void reject_updates_to_hidden(struct command *commands)
1289{
1290        struct strbuf refname_full = STRBUF_INIT;
1291        size_t prefix_len;
1292        struct command *cmd;
1293
1294        strbuf_addstr(&refname_full, get_git_namespace());
1295        prefix_len = refname_full.len;
1296
1297        for (cmd = commands; cmd; cmd = cmd->next) {
1298                if (cmd->error_string)
1299                        continue;
1300
1301                strbuf_setlen(&refname_full, prefix_len);
1302                strbuf_addstr(&refname_full, cmd->ref_name);
1303
1304                if (!ref_is_hidden(cmd->ref_name, refname_full.buf))
1305                        continue;
1306                if (is_null_sha1(cmd->new_sha1))
1307                        cmd->error_string = "deny deleting a hidden ref";
1308                else
1309                        cmd->error_string = "deny updating a hidden ref";
1310        }
1311
1312        strbuf_release(&refname_full);
1313}
1314
1315static int should_process_cmd(struct command *cmd)
1316{
1317        return !cmd->error_string && !cmd->skip_update;
1318}
1319
1320static void warn_if_skipped_connectivity_check(struct command *commands,
1321                                               struct shallow_info *si)
1322{
1323        struct command *cmd;
1324        int checked_connectivity = 1;
1325
1326        for (cmd = commands; cmd; cmd = cmd->next) {
1327                if (should_process_cmd(cmd) && si->shallow_ref[cmd->index]) {
1328                        error("BUG: connectivity check has not been run on ref %s",
1329                              cmd->ref_name);
1330                        checked_connectivity = 0;
1331                }
1332        }
1333        if (!checked_connectivity)
1334                die("BUG: connectivity check skipped???");
1335}
1336
1337static void execute_commands_non_atomic(struct command *commands,
1338                                        struct shallow_info *si)
1339{
1340        struct command *cmd;
1341        struct strbuf err = STRBUF_INIT;
1342
1343        for (cmd = commands; cmd; cmd = cmd->next) {
1344                if (!should_process_cmd(cmd))
1345                        continue;
1346
1347                transaction = ref_transaction_begin(&err);
1348                if (!transaction) {
1349                        rp_error("%s", err.buf);
1350                        strbuf_reset(&err);
1351                        cmd->error_string = "transaction failed to start";
1352                        continue;
1353                }
1354
1355                cmd->error_string = update(cmd, si);
1356
1357                if (!cmd->error_string
1358                    && ref_transaction_commit(transaction, &err)) {
1359                        rp_error("%s", err.buf);
1360                        strbuf_reset(&err);
1361                        cmd->error_string = "failed to update ref";
1362                }
1363                ref_transaction_free(transaction);
1364        }
1365        strbuf_release(&err);
1366}
1367
1368static void execute_commands_atomic(struct command *commands,
1369                                        struct shallow_info *si)
1370{
1371        struct command *cmd;
1372        struct strbuf err = STRBUF_INIT;
1373        const char *reported_error = "atomic push failure";
1374
1375        transaction = ref_transaction_begin(&err);
1376        if (!transaction) {
1377                rp_error("%s", err.buf);
1378                strbuf_reset(&err);
1379                reported_error = "transaction failed to start";
1380                goto failure;
1381        }
1382
1383        for (cmd = commands; cmd; cmd = cmd->next) {
1384                if (!should_process_cmd(cmd))
1385                        continue;
1386
1387                cmd->error_string = update(cmd, si);
1388
1389                if (cmd->error_string)
1390                        goto failure;
1391        }
1392
1393        if (ref_transaction_commit(transaction, &err)) {
1394                rp_error("%s", err.buf);
1395                reported_error = "atomic transaction failed";
1396                goto failure;
1397        }
1398        goto cleanup;
1399
1400failure:
1401        for (cmd = commands; cmd; cmd = cmd->next)
1402                if (!cmd->error_string)
1403                        cmd->error_string = reported_error;
1404
1405cleanup:
1406        ref_transaction_free(transaction);
1407        strbuf_release(&err);
1408}
1409
1410static void execute_commands(struct command *commands,
1411                             const char *unpacker_error,
1412                             struct shallow_info *si,
1413                             const struct string_list *push_options)
1414{
1415        struct check_connected_options opt = CHECK_CONNECTED_INIT;
1416        struct command *cmd;
1417        unsigned char sha1[20];
1418        struct iterate_data data;
1419        struct async muxer;
1420        int err_fd = 0;
1421
1422        if (unpacker_error) {
1423                for (cmd = commands; cmd; cmd = cmd->next)
1424                        cmd->error_string = "unpacker error";
1425                return;
1426        }
1427
1428        if (use_sideband) {
1429                memset(&muxer, 0, sizeof(muxer));
1430                muxer.proc = copy_to_sideband;
1431                muxer.in = -1;
1432                if (!start_async(&muxer))
1433                        err_fd = muxer.in;
1434                /* ...else, continue without relaying sideband */
1435        }
1436
1437        data.cmds = commands;
1438        data.si = si;
1439        opt.err_fd = err_fd;
1440        opt.progress = err_fd && !quiet;
1441        opt.env = tmp_objdir_env(tmp_objdir);
1442        if (check_connected(iterate_receive_command_list, &data, &opt))
1443                set_connectivity_errors(commands, si);
1444
1445        if (use_sideband)
1446                finish_async(&muxer);
1447
1448        reject_updates_to_hidden(commands);
1449
1450        if (run_receive_hook(commands, "pre-receive", 0, push_options)) {
1451                for (cmd = commands; cmd; cmd = cmd->next) {
1452                        if (!cmd->error_string)
1453                                cmd->error_string = "pre-receive hook declined";
1454                }
1455                return;
1456        }
1457
1458        /*
1459         * Now we'll start writing out refs, which means the objects need
1460         * to be in their final positions so that other processes can see them.
1461         */
1462        if (tmp_objdir_migrate(tmp_objdir) < 0) {
1463                for (cmd = commands; cmd; cmd = cmd->next) {
1464                        if (!cmd->error_string)
1465                                cmd->error_string = "unable to migrate objects to permanent storage";
1466                }
1467                return;
1468        }
1469        tmp_objdir = NULL;
1470
1471        check_aliased_updates(commands);
1472
1473        free(head_name_to_free);
1474        head_name = head_name_to_free = resolve_refdup("HEAD", 0, sha1, NULL);
1475
1476        if (use_atomic)
1477                execute_commands_atomic(commands, si);
1478        else
1479                execute_commands_non_atomic(commands, si);
1480
1481        if (shallow_update)
1482                warn_if_skipped_connectivity_check(commands, si);
1483}
1484
1485static struct command **queue_command(struct command **tail,
1486                                      const char *line,
1487                                      int linelen)
1488{
1489        unsigned char old_sha1[20], new_sha1[20];
1490        struct command *cmd;
1491        const char *refname;
1492        int reflen;
1493
1494        if (linelen < 83 ||
1495            line[40] != ' ' ||
1496            line[81] != ' ' ||
1497            get_sha1_hex(line, old_sha1) ||
1498            get_sha1_hex(line + 41, new_sha1))
1499                die("protocol error: expected old/new/ref, got '%s'", line);
1500
1501        refname = line + 82;
1502        reflen = linelen - 82;
1503        FLEX_ALLOC_MEM(cmd, ref_name, refname, reflen);
1504        hashcpy(cmd->old_sha1, old_sha1);
1505        hashcpy(cmd->new_sha1, new_sha1);
1506        *tail = cmd;
1507        return &cmd->next;
1508}
1509
1510static void queue_commands_from_cert(struct command **tail,
1511                                     struct strbuf *push_cert)
1512{
1513        const char *boc, *eoc;
1514
1515        if (*tail)
1516                die("protocol error: got both push certificate and unsigned commands");
1517
1518        boc = strstr(push_cert->buf, "\n\n");
1519        if (!boc)
1520                die("malformed push certificate %.*s", 100, push_cert->buf);
1521        else
1522                boc += 2;
1523        eoc = push_cert->buf + parse_signature(push_cert->buf, push_cert->len);
1524
1525        while (boc < eoc) {
1526                const char *eol = memchr(boc, '\n', eoc - boc);
1527                tail = queue_command(tail, boc, eol ? eol - boc : eoc - eol);
1528                boc = eol ? eol + 1 : eoc;
1529        }
1530}
1531
1532static struct command *read_head_info(struct sha1_array *shallow)
1533{
1534        struct command *commands = NULL;
1535        struct command **p = &commands;
1536        for (;;) {
1537                char *line;
1538                int len, linelen;
1539
1540                line = packet_read_line(0, &len);
1541                if (!line)
1542                        break;
1543
1544                if (len == 48 && starts_with(line, "shallow ")) {
1545                        unsigned char sha1[20];
1546                        if (get_sha1_hex(line + 8, sha1))
1547                                die("protocol error: expected shallow sha, got '%s'",
1548                                    line + 8);
1549                        sha1_array_append(shallow, sha1);
1550                        continue;
1551                }
1552
1553                linelen = strlen(line);
1554                if (linelen < len) {
1555                        const char *feature_list = line + linelen + 1;
1556                        if (parse_feature_request(feature_list, "report-status"))
1557                                report_status = 1;
1558                        if (parse_feature_request(feature_list, "side-band-64k"))
1559                                use_sideband = LARGE_PACKET_MAX;
1560                        if (parse_feature_request(feature_list, "quiet"))
1561                                quiet = 1;
1562                        if (advertise_atomic_push
1563                            && parse_feature_request(feature_list, "atomic"))
1564                                use_atomic = 1;
1565                        if (advertise_push_options
1566                            && parse_feature_request(feature_list, "push-options"))
1567                                use_push_options = 1;
1568                }
1569
1570                if (!strcmp(line, "push-cert")) {
1571                        int true_flush = 0;
1572                        char certbuf[1024];
1573
1574                        for (;;) {
1575                                len = packet_read(0, NULL, NULL,
1576                                                  certbuf, sizeof(certbuf), 0);
1577                                if (!len) {
1578                                        true_flush = 1;
1579                                        break;
1580                                }
1581                                if (!strcmp(certbuf, "push-cert-end\n"))
1582                                        break; /* end of cert */
1583                                strbuf_addstr(&push_cert, certbuf);
1584                        }
1585
1586                        if (true_flush)
1587                                break;
1588                        continue;
1589                }
1590
1591                p = queue_command(p, line, linelen);
1592        }
1593
1594        if (push_cert.len)
1595                queue_commands_from_cert(p, &push_cert);
1596
1597        return commands;
1598}
1599
1600static void read_push_options(struct string_list *options)
1601{
1602        while (1) {
1603                char *line;
1604                int len;
1605
1606                line = packet_read_line(0, &len);
1607
1608                if (!line)
1609                        break;
1610
1611                string_list_append(options, line);
1612        }
1613}
1614
1615static const char *parse_pack_header(struct pack_header *hdr)
1616{
1617        switch (read_pack_header(0, hdr)) {
1618        case PH_ERROR_EOF:
1619                return "eof before pack header was fully read";
1620
1621        case PH_ERROR_PACK_SIGNATURE:
1622                return "protocol error (pack signature mismatch detected)";
1623
1624        case PH_ERROR_PROTOCOL:
1625                return "protocol error (pack version unsupported)";
1626
1627        default:
1628                return "unknown error in parse_pack_header";
1629
1630        case 0:
1631                return NULL;
1632        }
1633}
1634
1635static const char *pack_lockfile;
1636
1637static const char *unpack(int err_fd, struct shallow_info *si)
1638{
1639        struct pack_header hdr;
1640        const char *hdr_err;
1641        int status;
1642        char hdr_arg[38];
1643        struct child_process child = CHILD_PROCESS_INIT;
1644        int fsck_objects = (receive_fsck_objects >= 0
1645                            ? receive_fsck_objects
1646                            : transfer_fsck_objects >= 0
1647                            ? transfer_fsck_objects
1648                            : 0);
1649
1650        hdr_err = parse_pack_header(&hdr);
1651        if (hdr_err) {
1652                if (err_fd > 0)
1653                        close(err_fd);
1654                return hdr_err;
1655        }
1656        snprintf(hdr_arg, sizeof(hdr_arg),
1657                        "--pack_header=%"PRIu32",%"PRIu32,
1658                        ntohl(hdr.hdr_version), ntohl(hdr.hdr_entries));
1659
1660        if (si->nr_ours || si->nr_theirs) {
1661                alt_shallow_file = setup_temporary_shallow(si->shallow);
1662                argv_array_push(&child.args, "--shallow-file");
1663                argv_array_push(&child.args, alt_shallow_file);
1664        }
1665
1666        tmp_objdir = tmp_objdir_create();
1667        if (!tmp_objdir)
1668                return "unable to create temporary object directory";
1669        child.env = tmp_objdir_env(tmp_objdir);
1670
1671        /*
1672         * Normally we just pass the tmp_objdir environment to the child
1673         * processes that do the heavy lifting, but we may need to see these
1674         * objects ourselves to set up shallow information.
1675         */
1676        tmp_objdir_add_as_alternate(tmp_objdir);
1677
1678        if (ntohl(hdr.hdr_entries) < unpack_limit) {
1679                argv_array_pushl(&child.args, "unpack-objects", hdr_arg, NULL);
1680                if (quiet)
1681                        argv_array_push(&child.args, "-q");
1682                if (fsck_objects)
1683                        argv_array_pushf(&child.args, "--strict%s",
1684                                fsck_msg_types.buf);
1685                if (max_input_size)
1686                        argv_array_pushf(&child.args, "--max-input-size=%"PRIuMAX,
1687                                (uintmax_t)max_input_size);
1688                child.no_stdout = 1;
1689                child.err = err_fd;
1690                child.git_cmd = 1;
1691                status = run_command(&child);
1692                if (status)
1693                        return "unpack-objects abnormal exit";
1694        } else {
1695                char hostname[256];
1696
1697                argv_array_pushl(&child.args, "index-pack",
1698                                 "--stdin", hdr_arg, NULL);
1699
1700                if (gethostname(hostname, sizeof(hostname)))
1701                        xsnprintf(hostname, sizeof(hostname), "localhost");
1702                argv_array_pushf(&child.args,
1703                                 "--keep=receive-pack %"PRIuMAX" on %s",
1704                                 (uintmax_t)getpid(),
1705                                 hostname);
1706
1707                if (!quiet && err_fd)
1708                        argv_array_push(&child.args, "--show-resolving-progress");
1709                if (use_sideband)
1710                        argv_array_push(&child.args, "--report-end-of-input");
1711                if (fsck_objects)
1712                        argv_array_pushf(&child.args, "--strict%s",
1713                                fsck_msg_types.buf);
1714                if (!reject_thin)
1715                        argv_array_push(&child.args, "--fix-thin");
1716                if (max_input_size)
1717                        argv_array_pushf(&child.args, "--max-input-size=%"PRIuMAX,
1718                                (uintmax_t)max_input_size);
1719                child.out = -1;
1720                child.err = err_fd;
1721                child.git_cmd = 1;
1722                status = start_command(&child);
1723                if (status)
1724                        return "index-pack fork failed";
1725                pack_lockfile = index_pack_lockfile(child.out);
1726                close(child.out);
1727                status = finish_command(&child);
1728                if (status)
1729                        return "index-pack abnormal exit";
1730                reprepare_packed_git();
1731        }
1732        return NULL;
1733}
1734
1735static const char *unpack_with_sideband(struct shallow_info *si)
1736{
1737        struct async muxer;
1738        const char *ret;
1739
1740        if (!use_sideband)
1741                return unpack(0, si);
1742
1743        use_keepalive = KEEPALIVE_AFTER_NUL;
1744        memset(&muxer, 0, sizeof(muxer));
1745        muxer.proc = copy_to_sideband;
1746        muxer.in = -1;
1747        if (start_async(&muxer))
1748                return NULL;
1749
1750        ret = unpack(muxer.in, si);
1751
1752        finish_async(&muxer);
1753        return ret;
1754}
1755
1756static void prepare_shallow_update(struct command *commands,
1757                                   struct shallow_info *si)
1758{
1759        int i, j, k, bitmap_size = (si->ref->nr + 31) / 32;
1760
1761        ALLOC_ARRAY(si->used_shallow, si->shallow->nr);
1762        assign_shallow_commits_to_refs(si, si->used_shallow, NULL);
1763
1764        si->need_reachability_test =
1765                xcalloc(si->shallow->nr, sizeof(*si->need_reachability_test));
1766        si->reachable =
1767                xcalloc(si->shallow->nr, sizeof(*si->reachable));
1768        si->shallow_ref = xcalloc(si->ref->nr, sizeof(*si->shallow_ref));
1769
1770        for (i = 0; i < si->nr_ours; i++)
1771                si->need_reachability_test[si->ours[i]] = 1;
1772
1773        for (i = 0; i < si->shallow->nr; i++) {
1774                if (!si->used_shallow[i])
1775                        continue;
1776                for (j = 0; j < bitmap_size; j++) {
1777                        if (!si->used_shallow[i][j])
1778                                continue;
1779                        si->need_reachability_test[i]++;
1780                        for (k = 0; k < 32; k++)
1781                                if (si->used_shallow[i][j] & (1U << k))
1782                                        si->shallow_ref[j * 32 + k]++;
1783                }
1784
1785                /*
1786                 * true for those associated with some refs and belong
1787                 * in "ours" list aka "step 7 not done yet"
1788                 */
1789                si->need_reachability_test[i] =
1790                        si->need_reachability_test[i] > 1;
1791        }
1792
1793        /*
1794         * keep hooks happy by forcing a temporary shallow file via
1795         * env variable because we can't add --shallow-file to every
1796         * command. check_everything_connected() will be done with
1797         * true .git/shallow though.
1798         */
1799        setenv(GIT_SHALLOW_FILE_ENVIRONMENT, alt_shallow_file, 1);
1800}
1801
1802static void update_shallow_info(struct command *commands,
1803                                struct shallow_info *si,
1804                                struct sha1_array *ref)
1805{
1806        struct command *cmd;
1807        int *ref_status;
1808        remove_nonexistent_theirs_shallow(si);
1809        if (!si->nr_ours && !si->nr_theirs) {
1810                shallow_update = 0;
1811                return;
1812        }
1813
1814        for (cmd = commands; cmd; cmd = cmd->next) {
1815                if (is_null_sha1(cmd->new_sha1))
1816                        continue;
1817                sha1_array_append(ref, cmd->new_sha1);
1818                cmd->index = ref->nr - 1;
1819        }
1820        si->ref = ref;
1821
1822        if (shallow_update) {
1823                prepare_shallow_update(commands, si);
1824                return;
1825        }
1826
1827        ALLOC_ARRAY(ref_status, ref->nr);
1828        assign_shallow_commits_to_refs(si, NULL, ref_status);
1829        for (cmd = commands; cmd; cmd = cmd->next) {
1830                if (is_null_sha1(cmd->new_sha1))
1831                        continue;
1832                if (ref_status[cmd->index]) {
1833                        cmd->error_string = "shallow update not allowed";
1834                        cmd->skip_update = 1;
1835                }
1836        }
1837        free(ref_status);
1838}
1839
1840static void report(struct command *commands, const char *unpack_status)
1841{
1842        struct command *cmd;
1843        struct strbuf buf = STRBUF_INIT;
1844
1845        packet_buf_write(&buf, "unpack %s\n",
1846                         unpack_status ? unpack_status : "ok");
1847        for (cmd = commands; cmd; cmd = cmd->next) {
1848                if (!cmd->error_string)
1849                        packet_buf_write(&buf, "ok %s\n",
1850                                         cmd->ref_name);
1851                else
1852                        packet_buf_write(&buf, "ng %s %s\n",
1853                                         cmd->ref_name, cmd->error_string);
1854        }
1855        packet_buf_flush(&buf);
1856
1857        if (use_sideband)
1858                send_sideband(1, 1, buf.buf, buf.len, use_sideband);
1859        else
1860                write_or_die(1, buf.buf, buf.len);
1861        strbuf_release(&buf);
1862}
1863
1864static int delete_only(struct command *commands)
1865{
1866        struct command *cmd;
1867        for (cmd = commands; cmd; cmd = cmd->next) {
1868                if (!is_null_sha1(cmd->new_sha1))
1869                        return 0;
1870        }
1871        return 1;
1872}
1873
1874int cmd_receive_pack(int argc, const char **argv, const char *prefix)
1875{
1876        int advertise_refs = 0;
1877        struct command *commands;
1878        struct sha1_array shallow = SHA1_ARRAY_INIT;
1879        struct sha1_array ref = SHA1_ARRAY_INIT;
1880        struct shallow_info si;
1881
1882        struct option options[] = {
1883                OPT__QUIET(&quiet, N_("quiet")),
1884                OPT_HIDDEN_BOOL(0, "stateless-rpc", &stateless_rpc, NULL),
1885                OPT_HIDDEN_BOOL(0, "advertise-refs", &advertise_refs, NULL),
1886                OPT_HIDDEN_BOOL(0, "reject-thin-pack-for-testing", &reject_thin, NULL),
1887                OPT_END()
1888        };
1889
1890        packet_trace_identity("receive-pack");
1891
1892        argc = parse_options(argc, argv, prefix, options, receive_pack_usage, 0);
1893
1894        if (argc > 1)
1895                usage_msg_opt(_("Too many arguments."), receive_pack_usage, options);
1896        if (argc == 0)
1897                usage_msg_opt(_("You must specify a directory."), receive_pack_usage, options);
1898
1899        service_dir = argv[0];
1900
1901        setup_path();
1902
1903        if (!enter_repo(service_dir, 0))
1904                die("'%s' does not appear to be a git repository", service_dir);
1905
1906        git_config(receive_pack_config, NULL);
1907        if (cert_nonce_seed)
1908                push_cert_nonce = prepare_push_cert_nonce(service_dir, time(NULL));
1909
1910        if (0 <= transfer_unpack_limit)
1911                unpack_limit = transfer_unpack_limit;
1912        else if (0 <= receive_unpack_limit)
1913                unpack_limit = receive_unpack_limit;
1914
1915        if (advertise_refs || !stateless_rpc) {
1916                write_head_info();
1917        }
1918        if (advertise_refs)
1919                return 0;
1920
1921        if ((commands = read_head_info(&shallow)) != NULL) {
1922                const char *unpack_status = NULL;
1923                struct string_list push_options = STRING_LIST_INIT_DUP;
1924
1925                if (use_push_options)
1926                        read_push_options(&push_options);
1927
1928                prepare_shallow_info(&si, &shallow);
1929                if (!si.nr_ours && !si.nr_theirs)
1930                        shallow_update = 0;
1931                if (!delete_only(commands)) {
1932                        unpack_status = unpack_with_sideband(&si);
1933                        update_shallow_info(commands, &si, &ref);
1934                }
1935                use_keepalive = KEEPALIVE_ALWAYS;
1936                execute_commands(commands, unpack_status, &si,
1937                                 &push_options);
1938                if (pack_lockfile)
1939                        unlink_or_warn(pack_lockfile);
1940                if (report_status)
1941                        report(commands, unpack_status);
1942                run_receive_hook(commands, "post-receive", 1,
1943                                 &push_options);
1944                run_update_post_hook(commands);
1945                if (push_options.nr)
1946                        string_list_clear(&push_options, 0);
1947                if (auto_gc) {
1948                        const char *argv_gc_auto[] = {
1949                                "gc", "--auto", "--quiet", NULL,
1950                        };
1951                        struct child_process proc = CHILD_PROCESS_INIT;
1952
1953                        proc.no_stdin = 1;
1954                        proc.stdout_to_stderr = 1;
1955                        proc.err = use_sideband ? -1 : 0;
1956                        proc.git_cmd = 1;
1957                        proc.argv = argv_gc_auto;
1958
1959                        close_all_packs();
1960                        if (!start_command(&proc)) {
1961                                if (use_sideband)
1962                                        copy_to_sideband(proc.err, -1, NULL);
1963                                finish_command(&proc);
1964                        }
1965                }
1966                if (auto_update_server_info)
1967                        update_server_info(0);
1968                clear_shallow_info(&si);
1969        }
1970        if (use_sideband)
1971                packet_flush(1);
1972        sha1_array_clear(&shallow);
1973        sha1_array_clear(&ref);
1974        free((void *)push_cert_nonce);
1975        return 0;
1976}