push --signed: tighten what the receiving end can ask to sign
[alt-git.git] / send-pack.c
blob22498080271a5702a7e79a72af1f1f8491d15121
1 #include "builtin.h"
2 #include "commit.h"
3 #include "refs.h"
4 #include "pkt-line.h"
5 #include "sideband.h"
6 #include "run-command.h"
7 #include "remote.h"
8 #include "connect.h"
9 #include "send-pack.h"
10 #include "quote.h"
11 #include "transport.h"
12 #include "version.h"
13 #include "sha1-array.h"
14 #include "gpg-interface.h"
16 static int feed_object(const unsigned char *sha1, int fd, int negative)
18 char buf[42];
20 if (negative && !has_sha1_file(sha1))
21 return 1;
23 memcpy(buf + negative, sha1_to_hex(sha1), 40);
24 if (negative)
25 buf[0] = '^';
26 buf[40 + negative] = '\n';
27 return write_or_whine(fd, buf, 41 + negative, "send-pack: send refs");
31 * Make a pack stream and spit it out into file descriptor fd
33 static int pack_objects(int fd, struct ref *refs, struct sha1_array *extra, struct send_pack_args *args)
36 * The child becomes pack-objects --revs; we feed
37 * the revision parameters to it via its stdin and
38 * let its stdout go back to the other end.
40 const char *argv[] = {
41 "pack-objects",
42 "--all-progress-implied",
43 "--revs",
44 "--stdout",
45 NULL,
46 NULL,
47 NULL,
48 NULL,
49 NULL,
51 struct child_process po;
52 int i;
54 i = 4;
55 if (args->use_thin_pack)
56 argv[i++] = "--thin";
57 if (args->use_ofs_delta)
58 argv[i++] = "--delta-base-offset";
59 if (args->quiet || !args->progress)
60 argv[i++] = "-q";
61 if (args->progress)
62 argv[i++] = "--progress";
63 memset(&po, 0, sizeof(po));
64 po.argv = argv;
65 po.in = -1;
66 po.out = args->stateless_rpc ? -1 : fd;
67 po.git_cmd = 1;
68 if (start_command(&po))
69 die_errno("git pack-objects failed");
72 * We feed the pack-objects we just spawned with revision
73 * parameters by writing to the pipe.
75 for (i = 0; i < extra->nr; i++)
76 if (!feed_object(extra->sha1[i], po.in, 1))
77 break;
79 while (refs) {
80 if (!is_null_sha1(refs->old_sha1) &&
81 !feed_object(refs->old_sha1, po.in, 1))
82 break;
83 if (!is_null_sha1(refs->new_sha1) &&
84 !feed_object(refs->new_sha1, po.in, 0))
85 break;
86 refs = refs->next;
89 close(po.in);
91 if (args->stateless_rpc) {
92 char *buf = xmalloc(LARGE_PACKET_MAX);
93 while (1) {
94 ssize_t n = xread(po.out, buf, LARGE_PACKET_MAX);
95 if (n <= 0)
96 break;
97 send_sideband(fd, -1, buf, n, LARGE_PACKET_MAX);
99 free(buf);
100 close(po.out);
101 po.out = -1;
104 if (finish_command(&po))
105 return -1;
106 return 0;
109 static int receive_status(int in, struct ref *refs)
111 struct ref *hint;
112 int ret = 0;
113 char *line = packet_read_line(in, NULL);
114 if (!starts_with(line, "unpack "))
115 return error("did not receive remote status");
116 if (strcmp(line, "unpack ok")) {
117 error("unpack failed: %s", line + 7);
118 ret = -1;
120 hint = NULL;
121 while (1) {
122 char *refname;
123 char *msg;
124 line = packet_read_line(in, NULL);
125 if (!line)
126 break;
127 if (!starts_with(line, "ok ") && !starts_with(line, "ng ")) {
128 error("invalid ref status from remote: %s", line);
129 ret = -1;
130 break;
133 refname = line + 3;
134 msg = strchr(refname, ' ');
135 if (msg)
136 *msg++ = '\0';
138 /* first try searching at our hint, falling back to all refs */
139 if (hint)
140 hint = find_ref_by_name(hint, refname);
141 if (!hint)
142 hint = find_ref_by_name(refs, refname);
143 if (!hint) {
144 warning("remote reported status on unknown ref: %s",
145 refname);
146 continue;
148 if (hint->status != REF_STATUS_EXPECTING_REPORT) {
149 warning("remote reported status on unexpected ref: %s",
150 refname);
151 continue;
154 if (line[0] == 'o' && line[1] == 'k')
155 hint->status = REF_STATUS_OK;
156 else {
157 hint->status = REF_STATUS_REMOTE_REJECT;
158 ret = -1;
160 if (msg)
161 hint->remote_status = xstrdup(msg);
162 /* start our next search from the next ref */
163 hint = hint->next;
165 return ret;
168 static int sideband_demux(int in, int out, void *data)
170 int *fd = data, ret;
171 #ifdef NO_PTHREADS
172 close(fd[1]);
173 #endif
174 ret = recv_sideband("send-pack", fd[0], out);
175 close(out);
176 return ret;
179 static int advertise_shallow_grafts_cb(const struct commit_graft *graft, void *cb)
181 struct strbuf *sb = cb;
182 if (graft->nr_parent == -1)
183 packet_buf_write(sb, "shallow %s\n", sha1_to_hex(graft->sha1));
184 return 0;
187 static void advertise_shallow_grafts_buf(struct strbuf *sb)
189 if (!is_repository_shallow())
190 return;
191 for_each_commit_graft(advertise_shallow_grafts_cb, sb);
194 static int ref_update_to_be_sent(const struct ref *ref, const struct send_pack_args *args)
196 if (!ref->peer_ref && !args->send_mirror)
197 return 0;
199 /* Check for statuses set by set_ref_status_for_push() */
200 switch (ref->status) {
201 case REF_STATUS_REJECT_NONFASTFORWARD:
202 case REF_STATUS_REJECT_ALREADY_EXISTS:
203 case REF_STATUS_REJECT_FETCH_FIRST:
204 case REF_STATUS_REJECT_NEEDS_FORCE:
205 case REF_STATUS_REJECT_STALE:
206 case REF_STATUS_REJECT_NODELETE:
207 case REF_STATUS_UPTODATE:
208 return 0;
209 default:
210 return 1;
215 * the beginning of the next line, or the end of buffer.
217 * NEEDSWORK: perhaps move this to git-compat-util.h or somewhere and
218 * convert many similar uses found by "git grep -A4 memchr".
220 static const char *next_line(const char *line, size_t len)
222 const char *nl = memchr(line, '\n', len);
223 if (!nl)
224 return line + len; /* incomplete line */
225 return nl + 1;
228 static int generate_push_cert(struct strbuf *req_buf,
229 const struct ref *remote_refs,
230 struct send_pack_args *args,
231 const char *cap_string,
232 const char *push_cert_nonce)
234 const struct ref *ref;
235 char stamp[60];
236 char *signing_key = xstrdup(get_signing_key());
237 const char *cp, *np;
238 struct strbuf cert = STRBUF_INIT;
239 int update_seen = 0;
241 datestamp(stamp, sizeof(stamp));
242 strbuf_addf(&cert, "certificate version 0.1\n");
243 strbuf_addf(&cert, "pusher %s %s\n", signing_key, stamp);
244 if (args->url && *args->url) {
245 char *anon_url = transport_anonymize_url(args->url);
246 strbuf_addf(&cert, "pushee %s\n", anon_url);
247 free(anon_url);
249 if (push_cert_nonce[0])
250 strbuf_addf(&cert, "nonce %s\n", push_cert_nonce);
251 strbuf_addstr(&cert, "\n");
253 for (ref = remote_refs; ref; ref = ref->next) {
254 if (!ref_update_to_be_sent(ref, args))
255 continue;
256 update_seen = 1;
257 strbuf_addf(&cert, "%s %s %s\n",
258 sha1_to_hex(ref->old_sha1),
259 sha1_to_hex(ref->new_sha1),
260 ref->name);
262 if (!update_seen)
263 goto free_return;
265 if (sign_buffer(&cert, &cert, signing_key))
266 die(_("failed to sign the push certificate"));
268 packet_buf_write(req_buf, "push-cert%c%s", 0, cap_string);
269 for (cp = cert.buf; cp < cert.buf + cert.len; cp = np) {
270 np = next_line(cp, cert.buf + cert.len - cp);
271 packet_buf_write(req_buf,
272 "%.*s", (int)(np - cp), cp);
274 packet_buf_write(req_buf, "push-cert-end\n");
276 free_return:
277 free(signing_key);
278 strbuf_release(&cert);
279 return update_seen;
282 #define NONCE_LEN_LIMIT 256
284 static void reject_invalid_nonce(const char *nonce, int len)
286 int i = 0;
288 if (NONCE_LEN_LIMIT <= len)
289 die("the receiving end asked to sign an invalid nonce <%.*s>",
290 len, nonce);
292 for (i = 0; i < len; i++) {
293 int ch = nonce[i] & 0xFF;
294 if (isalnum(ch) ||
295 ch == '-' || ch == '.' ||
296 ch == '/' || ch == '+' ||
297 ch == '=' || ch == '_')
298 continue;
299 die("the receiving end asked to sign an invalid nonce <%.*s>",
300 len, nonce);
304 int send_pack(struct send_pack_args *args,
305 int fd[], struct child_process *conn,
306 struct ref *remote_refs,
307 struct sha1_array *extra_have)
309 int in = fd[0];
310 int out = fd[1];
311 struct strbuf req_buf = STRBUF_INIT;
312 struct strbuf cap_buf = STRBUF_INIT;
313 struct ref *ref;
314 int need_pack_data = 0;
315 int allow_deleting_refs = 0;
316 int status_report = 0;
317 int use_sideband = 0;
318 int quiet_supported = 0;
319 int agent_supported = 0;
320 unsigned cmds_sent = 0;
321 int ret;
322 struct async demux;
323 const char *push_cert_nonce = NULL;
325 /* Does the other end support the reporting? */
326 if (server_supports("report-status"))
327 status_report = 1;
328 if (server_supports("delete-refs"))
329 allow_deleting_refs = 1;
330 if (server_supports("ofs-delta"))
331 args->use_ofs_delta = 1;
332 if (server_supports("side-band-64k"))
333 use_sideband = 1;
334 if (server_supports("quiet"))
335 quiet_supported = 1;
336 if (server_supports("agent"))
337 agent_supported = 1;
338 if (server_supports("no-thin"))
339 args->use_thin_pack = 0;
340 if (args->push_cert) {
341 int len;
343 push_cert_nonce = server_feature_value("push-cert", &len);
344 if (!push_cert_nonce)
345 die(_("the receiving end does not support --signed push"));
346 reject_invalid_nonce(push_cert_nonce, len);
347 push_cert_nonce = xmemdupz(push_cert_nonce, len);
350 if (!remote_refs) {
351 fprintf(stderr, "No refs in common and none specified; doing nothing.\n"
352 "Perhaps you should specify a branch such as 'master'.\n");
353 return 0;
356 if (status_report)
357 strbuf_addstr(&cap_buf, " report-status");
358 if (use_sideband)
359 strbuf_addstr(&cap_buf, " side-band-64k");
360 if (quiet_supported && (args->quiet || !args->progress))
361 strbuf_addstr(&cap_buf, " quiet");
362 if (agent_supported)
363 strbuf_addf(&cap_buf, " agent=%s", git_user_agent_sanitized());
366 * NEEDSWORK: why does delete-refs have to be so specific to
367 * send-pack machinery that set_ref_status_for_push() cannot
368 * set this bit for us???
370 for (ref = remote_refs; ref; ref = ref->next)
371 if (ref->deletion && !allow_deleting_refs)
372 ref->status = REF_STATUS_REJECT_NODELETE;
374 if (!args->dry_run)
375 advertise_shallow_grafts_buf(&req_buf);
377 if (!args->dry_run && args->push_cert)
378 cmds_sent = generate_push_cert(&req_buf, remote_refs, args,
379 cap_buf.buf, push_cert_nonce);
382 * Clear the status for each ref and see if we need to send
383 * the pack data.
385 for (ref = remote_refs; ref; ref = ref->next) {
386 if (!ref_update_to_be_sent(ref, args))
387 continue;
389 if (!ref->deletion)
390 need_pack_data = 1;
392 if (args->dry_run || !status_report)
393 ref->status = REF_STATUS_OK;
394 else
395 ref->status = REF_STATUS_EXPECTING_REPORT;
399 * Finally, tell the other end!
401 for (ref = remote_refs; ref; ref = ref->next) {
402 char *old_hex, *new_hex;
404 if (args->dry_run || args->push_cert)
405 continue;
407 if (!ref_update_to_be_sent(ref, args))
408 continue;
410 old_hex = sha1_to_hex(ref->old_sha1);
411 new_hex = sha1_to_hex(ref->new_sha1);
412 if (!cmds_sent) {
413 packet_buf_write(&req_buf,
414 "%s %s %s%c%s",
415 old_hex, new_hex, ref->name, 0,
416 cap_buf.buf);
417 cmds_sent = 1;
418 } else {
419 packet_buf_write(&req_buf, "%s %s %s",
420 old_hex, new_hex, ref->name);
424 if (args->stateless_rpc) {
425 if (!args->dry_run && (cmds_sent || is_repository_shallow())) {
426 packet_buf_flush(&req_buf);
427 send_sideband(out, -1, req_buf.buf, req_buf.len, LARGE_PACKET_MAX);
429 } else {
430 write_or_die(out, req_buf.buf, req_buf.len);
431 packet_flush(out);
433 strbuf_release(&req_buf);
434 strbuf_release(&cap_buf);
436 if (use_sideband && cmds_sent) {
437 memset(&demux, 0, sizeof(demux));
438 demux.proc = sideband_demux;
439 demux.data = fd;
440 demux.out = -1;
441 if (start_async(&demux))
442 die("send-pack: unable to fork off sideband demultiplexer");
443 in = demux.out;
446 if (need_pack_data && cmds_sent) {
447 if (pack_objects(out, remote_refs, extra_have, args) < 0) {
448 for (ref = remote_refs; ref; ref = ref->next)
449 ref->status = REF_STATUS_NONE;
450 if (args->stateless_rpc)
451 close(out);
452 if (git_connection_is_socket(conn))
453 shutdown(fd[0], SHUT_WR);
454 if (use_sideband)
455 finish_async(&demux);
456 fd[1] = -1;
457 return -1;
459 if (!args->stateless_rpc)
460 /* Closed by pack_objects() via start_command() */
461 fd[1] = -1;
463 if (args->stateless_rpc && cmds_sent)
464 packet_flush(out);
466 if (status_report && cmds_sent)
467 ret = receive_status(in, remote_refs);
468 else
469 ret = 0;
470 if (args->stateless_rpc)
471 packet_flush(out);
473 if (use_sideband && cmds_sent) {
474 if (finish_async(&demux)) {
475 error("error in sideband demultiplexer");
476 ret = -1;
478 close(demux.out);
481 if (ret < 0)
482 return ret;
484 if (args->porcelain)
485 return 0;
487 for (ref = remote_refs; ref; ref = ref->next) {
488 switch (ref->status) {
489 case REF_STATUS_NONE:
490 case REF_STATUS_UPTODATE:
491 case REF_STATUS_OK:
492 break;
493 default:
494 return -1;
497 return 0;