builtin/receive-pack.c

   1 #include "builtin.h"
   2 #include "repository.h"
   3 #include "config.h"
   4 #include "lockfile.h"
   5 #include "pack.h"
   6 #include "refs.h"
   7 #include "pkt-line.h"
   8 #include "sideband.h"
   9 #include "run-command.h"
  10 #include "exec-cmd.h"
  11 #include "commit.h"
  12 #include "object.h"
  13 #include "remote.h"
  14 #include "connect.h"
  15 #include "transport.h"
  16 #include "string-list.h"
  17 #include "sha1-array.h"
  18 #include "connected.h"
  19 #include "argv-array.h"
  20 #include "version.h"
  21 #include "tag.h"
  22 #include "gpg-interface.h"
  23 #include "sigchain.h"
  24 #include "fsck.h"
  25 #include "tmp-objdir.h"
  26 #include "oidset.h"
  27 #include "packfile.h"
  28 #include "object-store.h"
  29 #include "protocol.h"
  30 #include "commit-reach.h"
  31
  32 static const char * const receive_pack_usage[] = {
  33         N_("git receive-pack <git-dir>"),
  34         NULL
  35 };
  36
  37 enum deny_action {
  38         DENY_UNCONFIGURED,
  39         DENY_IGNORE,
  40         DENY_WARN,
  41         DENY_REFUSE,
  42         DENY_UPDATE_INSTEAD
  43 };
  44
  45 static int deny_deletes;
  46 static int deny_non_fast_forwards;
  47 static enum deny_action deny_current_branch = DENY_UNCONFIGURED;
  48 static enum deny_action deny_delete_current = DENY_UNCONFIGURED;
  49 static int receive_fsck_objects = -1;
  50 static int transfer_fsck_objects = -1;
  51 static struct strbuf fsck_msg_types = STRBUF_INIT;
  52 static int receive_unpack_limit = -1;
  53 static int transfer_unpack_limit = -1;
  54 static int advertise_atomic_push = 1;
  55 static int advertise_push_options;
  56 static int unpack_limit = 100;
  57 static off_t max_input_size;
  58 static int report_status;
  59 static int use_sideband;
  60 static int use_atomic;
  61 static int use_push_options;
  62 static int quiet;
  63 static int prefer_ofs_delta = 1;
  64 static int auto_update_server_info;
  65 static int auto_gc = 1;
  66 static int reject_thin;
  67 static int stateless_rpc;
  68 static const char *service_dir;
  69 static const char *head_name;
  70 static void *head_name_to_free;
  71 static int sent_capabilities;
  72 static int shallow_update;
  73 static const char *alt_shallow_file;
  74 static struct strbuf push_cert = STRBUF_INIT;
  75 static struct object_id push_cert_oid;
  76 static struct signature_check sigcheck;
  77 static const char *push_cert_nonce;
  78 static const char *cert_nonce_seed;
  79
  80 static const char *NONCE_UNSOLICITED = "UNSOLICITED";
  81 static const char *NONCE_BAD = "BAD";
  82 static const char *NONCE_MISSING = "MISSING";
  83 static const char *NONCE_OK = "OK";
  84 static const char *NONCE_SLOP = "SLOP";
  85 static const char *nonce_status;
  86 static long nonce_stamp_slop;
  87 static timestamp_t nonce_stamp_slop_limit;
  88 static struct ref_transaction *transaction;
  89
  90 static enum {
  91         KEEPALIVE_NEVER = 0,
  92         KEEPALIVE_AFTER_NUL,
  93         KEEPALIVE_ALWAYS
  94 } use_keepalive;
  95 static int keepalive_in_sec = 5;
  96
  97 static struct tmp_objdir *tmp_objdir;
  98
  99 static enum deny_action parse_deny_action(const char *var, const char *value)
 100 {
 101         if (value) {
 102                 if (!strcasecmp(value, "ignore"))
 103                         return DENY_IGNORE;
 104                 if (!strcasecmp(value, "warn"))
 105                         return DENY_WARN;
 106                 if (!strcasecmp(value, "refuse"))
 107                         return DENY_REFUSE;
 108                 if (!strcasecmp(value, "updateinstead"))
 109                         return DENY_UPDATE_INSTEAD;
 110         }
 111         if (git_config_bool(var, value))
 112                 return DENY_REFUSE;
 113         return DENY_IGNORE;
 114 }
 115
 116 static int receive_pack_config(const char *var, const char *value, void *cb)
 117 {
 118         int status = parse_hide_refs_config(var, value, "receive");
 119
 120         if (status)
 121                 return status;
 122
 123         if (strcmp(var, "receive.denydeletes") == 0) {
 124                 deny_deletes = git_config_bool(var, value);
 125                 return 0;
 126         }
 127
 128         if (strcmp(var, "receive.denynonfastforwards") == 0) {
 129                 deny_non_fast_forwards = git_config_bool(var, value);
 130                 return 0;
 131         }
 132
 133         if (strcmp(var, "receive.unpacklimit") == 0) {
 134                 receive_unpack_limit = git_config_int(var, value);
 135                 return 0;
 136         }
 137
 138         if (strcmp(var, "transfer.unpacklimit") == 0) {
 139                 transfer_unpack_limit = git_config_int(var, value);
 140                 return 0;
 141         }
 142
 143         if (strcmp(var, "receive.fsck.skiplist") == 0) {
 144                 const char *path;
 145
 146                 if (git_config_pathname(&path, var, value))
 147                         return 1;
 148                 strbuf_addf(&fsck_msg_types, "%cskiplist=%s",
 149                         fsck_msg_types.len ? ',' : '=', path);
 150                 free((char *)path);
 151                 return 0;
 152         }
 153
 154         if (skip_prefix(var, "receive.fsck.", &var)) {
 155                 if (is_valid_msg_type(var, value))
 156                         strbuf_addf(&fsck_msg_types, "%c%s=%s",
 157                                 fsck_msg_types.len ? ',' : '=', var, value);
 158                 else
 159                         warning("Skipping unknown msg id '%s'", var);
 160                 return 0;
 161         }
 162
 163         if (strcmp(var, "receive.fsckobjects") == 0) {
 164                 receive_fsck_objects = git_config_bool(var, value);
 165                 return 0;
 166         }
 167
 168         if (strcmp(var, "transfer.fsckobjects") == 0) {
 169                 transfer_fsck_objects = git_config_bool(var, value);
 170                 return 0;
 171         }
 172
 173         if (!strcmp(var, "receive.denycurrentbranch")) {
 174                 deny_current_branch = parse_deny_action(var, value);
 175                 return 0;
 176         }
 177
 178         if (strcmp(var, "receive.denydeletecurrent") == 0) {
 179                 deny_delete_current = parse_deny_action(var, value);
 180                 return 0;
 181         }
 182
 183         if (strcmp(var, "repack.usedeltabaseoffset") == 0) {
 184                 prefer_ofs_delta = git_config_bool(var, value);
 185                 return 0;
 186         }
 187
 188         if (strcmp(var, "receive.updateserverinfo") == 0) {
 189                 auto_update_server_info = git_config_bool(var, value);
 190                 return 0;
 191         }
 192
 193         if (strcmp(var, "receive.autogc") == 0) {
 194                 auto_gc = git_config_bool(var, value);
 195                 return 0;
 196         }
 197
 198         if (strcmp(var, "receive.shallowupdate") == 0) {
 199                 shallow_update = git_config_bool(var, value);
 200                 return 0;
 201         }
 202
 203         if (strcmp(var, "receive.certnonceseed") == 0)
 204                 return git_config_string(&cert_nonce_seed, var, value);
 205
 206         if (strcmp(var, "receive.certnonceslop") == 0) {
 207                 nonce_stamp_slop_limit = git_config_ulong(var, value);
 208                 return 0;
 209         }
 210
 211         if (strcmp(var, "receive.advertiseatomic") == 0) {
 212                 advertise_atomic_push = git_config_bool(var, value);
 213                 return 0;
 214         }
 215
 216         if (strcmp(var, "receive.advertisepushoptions") == 0) {
 217                 advertise_push_options = git_config_bool(var, value);
 218                 return 0;
 219         }
 220
 221         if (strcmp(var, "receive.keepalive") == 0) {
 222                 keepalive_in_sec = git_config_int(var, value);
 223                 return 0;
 224         }
 225
 226         if (strcmp(var, "receive.maxinputsize") == 0) {
 227                 max_input_size = git_config_int64(var, value);
 228                 return 0;
 229         }
 230
 231         return git_default_config(var, value, cb);
 232 }
 233
 234 static void show_ref(const char *path, const struct object_id *oid)
 235 {
 236         if (sent_capabilities) {
 237                 packet_write_fmt(1, "%s %s\n", oid_to_hex(oid), path);
 238         } else {
 239                 struct strbuf cap = STRBUF_INIT;
 240
 241                 strbuf_addstr(&cap,
 242                               "report-status delete-refs side-band-64k quiet");
 243                 if (advertise_atomic_push)
 244                         strbuf_addstr(&cap, " atomic");
 245                 if (prefer_ofs_delta)
 246                         strbuf_addstr(&cap, " ofs-delta");
 247                 if (push_cert_nonce)
 248                         strbuf_addf(&cap, " push-cert=%s", push_cert_nonce);
 249                 if (advertise_push_options)
 250                         strbuf_addstr(&cap, " push-options");
 251                 strbuf_addf(&cap, " agent=%s", git_user_agent_sanitized());
 252                 packet_write_fmt(1, "%s %s%c%s\n",
 253                              oid_to_hex(oid), path, 0, cap.buf);
 254                 strbuf_release(&cap);
 255                 sent_capabilities = 1;
 256         }
 257 }
 258
 259 static int show_ref_cb(const char *path_full, const struct object_id *oid,
 260                        int flag, void *data)
 261 {
 262         struct oidset *seen = data;
 263         const char *path = strip_namespace(path_full);
 264
 265         if (ref_is_hidden(path, path_full))
 266                 return 0;
 267
 268         /*
 269          * Advertise refs outside our current namespace as ".have"
 270          * refs, so that the client can use them to minimize data
 271          * transfer but will otherwise ignore them.
 272          */
 273         if (!path) {
 274                 if (oidset_insert(seen, oid))
 275                         return 0;
 276                 path = ".have";
 277         } else {
 278                 oidset_insert(seen, oid);
 279         }
 280         show_ref(path, oid);
 281         return 0;
 282 }
 283
 284 static void show_one_alternate_ref(const char *refname,
 285                                    const struct object_id *oid,
 286                                    void *data)
 287 {
 288         struct oidset *seen = data;
 289
 290         if (oidset_insert(seen, oid))
 291                 return;
 292
 293         show_ref(".have", oid);
 294 }
 295
 296 static void write_head_info(void)
 297 {
 298         static struct oidset seen = OIDSET_INIT;
 299
 300         for_each_ref(show_ref_cb, &seen);
 301         for_each_alternate_ref(show_one_alternate_ref, &seen);
 302         oidset_clear(&seen);
 303         if (!sent_capabilities)
 304                 show_ref("capabilities^{}", &null_oid);
 305
 306         advertise_shallow_grafts(1);
 307
 308         /* EOF */
 309         packet_flush(1);
 310 }
 311
 312 struct command {
 313         struct command *next;
 314         const char *error_string;
 315         unsigned int skip_update:1,
 316                      did_not_exist:1;
 317         int index;
 318         struct object_id old_oid;
 319         struct object_id new_oid;
 320         char ref_name[FLEX_ARRAY]; /* more */
 321 };
 322
 323 static void rp_error(const char *err, ...) __attribute__((format (printf, 1, 2)));
 324 static void rp_warning(const char *err, ...) __attribute__((format (printf, 1, 2)));
 325
 326 static void report_message(const char *prefix, const char *err, va_list params)
 327 {
 328         int sz;
 329         char msg[4096];
 330
 331         sz = xsnprintf(msg, sizeof(msg), "%s", prefix);
 332         sz += vsnprintf(msg + sz, sizeof(msg) - sz, err, params);
 333         if (sz > (sizeof(msg) - 1))
 334                 sz = sizeof(msg) - 1;
 335         msg[sz++] = '\n';
 336
 337         if (use_sideband)
 338                 send_sideband(1, 2, msg, sz, use_sideband);
 339         else
 340                 xwrite(2, msg, sz);
 341 }
 342
 343 static void rp_warning(const char *err, ...)
 344 {
 345         va_list params;
 346         va_start(params, err);
 347         report_message("warning: ", err, params);
 348         va_end(params);
 349 }
 350
 351 static void rp_error(const char *err, ...)
 352 {
 353         va_list params;
 354         va_start(params, err);
 355         report_message("error: ", err, params);
 356         va_end(params);
 357 }
 358
 359 static int copy_to_sideband(int in, int out, void *arg)
 360 {
 361         char data[128];
 362         int keepalive_active = 0;
 363
 364         if (keepalive_in_sec <= 0)
 365                 use_keepalive = KEEPALIVE_NEVER;
 366         if (use_keepalive == KEEPALIVE_ALWAYS)
 367                 keepalive_active = 1;
 368
 369         while (1) {
 370                 ssize_t sz;
 371
 372                 if (keepalive_active) {
 373                         struct pollfd pfd;
 374                         int ret;
 375
 376                         pfd.fd = in;
 377                         pfd.events = POLLIN;
 378                         ret = poll(&pfd, 1, 1000 * keepalive_in_sec);
 379
 380                         if (ret < 0) {
 381                                 if (errno == EINTR)
 382                                         continue;
 383                                 else
 384                                         break;
 385                         } else if (ret == 0) {
 386                                 /* no data; send a keepalive packet */
 387                                 static const char buf[] = "0005\1";
 388                                 write_or_die(1, buf, sizeof(buf) - 1);
 389                                 continue;
 390                         } /* else there is actual data to read */
 391                 }
 392
 393                 sz = xread(in, data, sizeof(data));
 394                 if (sz <= 0)
 395                         break;
 396
 397                 if (use_keepalive == KEEPALIVE_AFTER_NUL && !keepalive_active) {
 398                         const char *p = memchr(data, '\0', sz);
 399                         if (p) {
 400                                 /*
 401                                  * The NUL tells us to start sending keepalives. Make
 402                                  * sure we send any other data we read along
 403                                  * with it.
 404                                  */
 405                                 keepalive_active = 1;
 406                                 send_sideband(1, 2, data, p - data, use_sideband);
 407                                 send_sideband(1, 2, p + 1, sz - (p - data + 1), use_sideband);
 408                                 continue;
 409                         }
 410                 }
 411
 412                 /*
 413                  * Either we're not looking for a NUL signal, or we didn't see
 414                  * it yet; just pass along the data.
 415                  */
 416                 send_sideband(1, 2, data, sz, use_sideband);
 417         }
 418         close(in);
 419         return 0;
 420 }
 421
 422 #define HMAC_BLOCK_SIZE 64
 423
 424 static void hmac_sha1(unsigned char *out,
 425                       const char *key_in, size_t key_len,
 426                       const char *text, size_t text_len)
 427 {
 428         unsigned char key[HMAC_BLOCK_SIZE];
 429         unsigned char k_ipad[HMAC_BLOCK_SIZE];
 430         unsigned char k_opad[HMAC_BLOCK_SIZE];
 431         int i;
 432         git_SHA_CTX ctx;
 433
 434         /* RFC 2104 2. (1) */
 435         memset(key, '\0', HMAC_BLOCK_SIZE);
 436         if (HMAC_BLOCK_SIZE < key_len) {
 437                 git_SHA1_Init(&ctx);
 438                 git_SHA1_Update(&ctx, key_in, key_len);
 439                 git_SHA1_Final(key, &ctx);
 440         } else {
 441                 memcpy(key, key_in, key_len);
 442         }
 443
 444         /* RFC 2104 2. (2) & (5) */
 445         for (i = 0; i < sizeof(key); i++) {
 446                 k_ipad[i] = key[i] ^ 0x36;
 447                 k_opad[i] = key[i] ^ 0x5c;
 448         }
 449
 450         /* RFC 2104 2. (3) & (4) */
 451         git_SHA1_Init(&ctx);
 452         git_SHA1_Update(&ctx, k_ipad, sizeof(k_ipad));
 453         git_SHA1_Update(&ctx, text, text_len);
 454         git_SHA1_Final(out, &ctx);
 455
 456         /* RFC 2104 2. (6) & (7) */
 457         git_SHA1_Init(&ctx);
 458         git_SHA1_Update(&ctx, k_opad, sizeof(k_opad));
 459         git_SHA1_Update(&ctx, out, GIT_SHA1_RAWSZ);
 460         git_SHA1_Final(out, &ctx);
 461 }
 462
 463 static char *prepare_push_cert_nonce(const char *path, timestamp_t stamp)
 464 {
 465         struct strbuf buf = STRBUF_INIT;
 466         unsigned char sha1[GIT_SHA1_RAWSZ];
 467
 468         strbuf_addf(&buf, "%s:%"PRItime, path, stamp);
 469         hmac_sha1(sha1, buf.buf, buf.len, cert_nonce_seed, strlen(cert_nonce_seed));
 470         strbuf_release(&buf);
 471
 472         /* RFC 2104 5. HMAC-SHA1-80 */
 473         strbuf_addf(&buf, "%"PRItime"-%.*s", stamp, GIT_SHA1_HEXSZ, sha1_to_hex(sha1));
 474         return strbuf_detach(&buf, NULL);
 475 }
 476
 477 /*
 478  * NEEDSWORK: reuse find_commit_header() from jk/commit-author-parsing
 479  * after dropping "_commit" from its name and possibly moving it out
 480  * of commit.c
 481  */
 482 static char *find_header(const char *msg, size_t len, const char *key,
 483                          const char **next_line)
 484 {
 485         int key_len = strlen(key);
 486         const char *line = msg;
 487
 488         while (line && line < msg + len) {
 489                 const char *eol = strchrnul(line, '\n');
 490
 491                 if ((msg + len <= eol) || line == eol)
 492                         return NULL;
 493                 if (line + key_len < eol &&
 494                     !memcmp(line, key, key_len) && line[key_len] == ' ') {
 495                         int offset = key_len + 1;
 496                         if (next_line)
 497                                 *next_line = *eol ? eol + 1 : eol;
 498                         return xmemdupz(line + offset, (eol - line) - offset);
 499                 }
 500                 line = *eol ? eol + 1 : NULL;
 501         }
 502         return NULL;
 503 }
 504
 505 static const char *check_nonce(const char *buf, size_t len)
 506 {
 507         char *nonce = find_header(buf, len, "nonce", NULL);
 508         timestamp_t stamp, ostamp;
 509         char *bohmac, *expect = NULL;
 510         const char *retval = NONCE_BAD;
 511
 512         if (!nonce) {
 513                 retval = NONCE_MISSING;
 514                 goto leave;
 515         } else if (!push_cert_nonce) {
 516                 retval = NONCE_UNSOLICITED;
 517                 goto leave;
 518         } else if (!strcmp(push_cert_nonce, nonce)) {
 519                 retval = NONCE_OK;
 520                 goto leave;
 521         }
 522
 523         if (!stateless_rpc) {
 524                 /* returned nonce MUST match what we gave out earlier */
 525                 retval = NONCE_BAD;
 526                 goto leave;
 527         }
 528
 529         /*
 530          * In stateless mode, we may be receiving a nonce issued by
 531          * another instance of the server that serving the same
 532          * repository, and the timestamps may not match, but the
 533          * nonce-seed and dir should match, so we can recompute and
 534          * report the time slop.
 535          *
 536          * In addition, when a nonce issued by another instance has
 537          * timestamp within receive.certnonceslop seconds, we pretend
 538          * as if we issued that nonce when reporting to the hook.
 539          */
 540
 541         /* nonce is concat(<seconds-since-epoch>, "-", <hmac>) */
 542         if (*nonce <= '0' || '9' < *nonce) {
 543                 retval = NONCE_BAD;
 544                 goto leave;
 545         }
 546         stamp = parse_timestamp(nonce, &bohmac, 10);
 547         if (bohmac == nonce || bohmac[0] != '-') {
 548                 retval = NONCE_BAD;
 549                 goto leave;
 550         }
 551
 552         expect = prepare_push_cert_nonce(service_dir, stamp);
 553         if (strcmp(expect, nonce)) {
 554                 /* Not what we would have signed earlier */
 555                 retval = NONCE_BAD;
 556                 goto leave;
 557         }
 558
 559         /*
 560          * By how many seconds is this nonce stale?  Negative value
 561          * would mean it was issued by another server with its clock
 562          * skewed in the future.
 563          */
 564         ostamp = parse_timestamp(push_cert_nonce, NULL, 10);
 565         nonce_stamp_slop = (long)ostamp - (long)stamp;
 566
 567         if (nonce_stamp_slop_limit &&
 568             labs(nonce_stamp_slop) <= nonce_stamp_slop_limit) {
 569                 /*
 570                  * Pretend as if the received nonce (which passes the
 571                  * HMAC check, so it is not a forged by third-party)
 572                  * is what we issued.
 573                  */
 574                 free((void *)push_cert_nonce);
 575                 push_cert_nonce = xstrdup(nonce);
 576                 retval = NONCE_OK;
 577         } else {
 578                 retval = NONCE_SLOP;
 579         }
 580
 581 leave:
 582         free(nonce);
 583         free(expect);
 584         return retval;
 585 }
 586
 587 /*
 588  * Return 1 if there is no push_cert or if the push options in push_cert are
 589  * the same as those in the argument; 0 otherwise.
 590  */
 591 static int check_cert_push_options(const struct string_list *push_options)
 592 {
 593         const char *buf = push_cert.buf;
 594         int len = push_cert.len;
 595
 596         char *option;
 597         const char *next_line;
 598         int options_seen = 0;
 599
 600         int retval = 1;
 601
 602         if (!len)
 603                 return 1;
 604
 605         while ((option = find_header(buf, len, "push-option", &next_line))) {
 606                 len -= (next_line - buf);
 607                 buf = next_line;
 608                 options_seen++;
 609                 if (options_seen > push_options->nr
 610                     || strcmp(option,
 611                               push_options->items[options_seen - 1].string)) {
 612                         retval = 0;
 613                         goto leave;
 614                 }
 615                 free(option);
 616         }
 617
 618         if (options_seen != push_options->nr)
 619                 retval = 0;
 620
 621 leave:
 622         free(option);
 623         return retval;
 624 }
 625
 626 static void prepare_push_cert_sha1(struct child_process *proc)
 627 {
 628         static int already_done;
 629
 630         if (!push_cert.len)
 631                 return;
 632
 633         if (!already_done) {
 634                 int bogs /* beginning_of_gpg_sig */;
 635
 636                 already_done = 1;
 637                 if (write_object_file(push_cert.buf, push_cert.len, "blob",
 638                                       &push_cert_oid))
 639                         oidclr(&push_cert_oid);
 640
 641                 memset(&sigcheck, '\0', sizeof(sigcheck));
 642
 643                 bogs = parse_signature(push_cert.buf, push_cert.len);
 644                 check_signature(push_cert.buf, bogs, push_cert.buf + bogs,
 645                                 push_cert.len - bogs, &sigcheck);
 646
 647                 nonce_status = check_nonce(push_cert.buf, bogs);
 648         }
 649         if (!is_null_oid(&push_cert_oid)) {
 650                 argv_array_pushf(&proc->env_array, "GIT_PUSH_CERT=%s",
 651                                  oid_to_hex(&push_cert_oid));
 652                 argv_array_pushf(&proc->env_array, "GIT_PUSH_CERT_SIGNER=%s",
 653                                  sigcheck.signer ? sigcheck.signer : "");
 654                 argv_array_pushf(&proc->env_array, "GIT_PUSH_CERT_KEY=%s",
 655                                  sigcheck.key ? sigcheck.key : "");
 656                 argv_array_pushf(&proc->env_array, "GIT_PUSH_CERT_STATUS=%c",
 657                                  sigcheck.result);
 658                 if (push_cert_nonce) {
 659                         argv_array_pushf(&proc->env_array,
 660                                          "GIT_PUSH_CERT_NONCE=%s",
 661                                          push_cert_nonce);
 662                         argv_array_pushf(&proc->env_array,
 663                                          "GIT_PUSH_CERT_NONCE_STATUS=%s",
 664                                          nonce_status);
 665                         if (nonce_status == NONCE_SLOP)
 666                                 argv_array_pushf(&proc->env_array,
 667                                                  "GIT_PUSH_CERT_NONCE_SLOP=%ld",
 668                                                  nonce_stamp_slop);
 669                 }
 670         }
 671 }
 672
 673 struct receive_hook_feed_state {
 674         struct command *cmd;
 675         int skip_broken;
 676         struct strbuf buf;
 677         const struct string_list *push_options;
 678 };
 679
 680 typedef int (*feed_fn)(void *, const char **, size_t *);
 681 static int run_and_feed_hook(const char *hook_name, feed_fn feed,
 682                              struct receive_hook_feed_state *feed_state)
 683 {
 684         struct child_process proc = CHILD_PROCESS_INIT;
 685         struct async muxer;
 686         const char *argv[2];
 687         int code;
 688
 689         argv[0] = find_hook(hook_name);
 690         if (!argv[0])
 691                 return 0;
 692
 693         argv[1] = NULL;
 694
 695         proc.argv = argv;
 696         proc.in = -1;
 697         proc.stdout_to_stderr = 1;
 698         if (feed_state->push_options) {
 699                 int i;
 700                 for (i = 0; i < feed_state->push_options->nr; i++)
 701                         argv_array_pushf(&proc.env_array,
 702                                 "GIT_PUSH_OPTION_%d=%s", i,
 703                                 feed_state->push_options->items[i].string);
 704                 argv_array_pushf(&proc.env_array, "GIT_PUSH_OPTION_COUNT=%d",
 705                                  feed_state->push_options->nr);
 706         } else
 707                 argv_array_pushf(&proc.env_array, "GIT_PUSH_OPTION_COUNT");
 708
 709         if (tmp_objdir)
 710                 argv_array_pushv(&proc.env_array, tmp_objdir_env(tmp_objdir));
 711
 712         if (use_sideband) {
 713                 memset(&muxer, 0, sizeof(muxer));
 714                 muxer.proc = copy_to_sideband;
 715                 muxer.in = -1;
 716                 code = start_async(&muxer);
 717                 if (code)
 718                         return code;
 719                 proc.err = muxer.in;
 720         }
 721
 722         prepare_push_cert_sha1(&proc);
 723
 724         code = start_command(&proc);
 725         if (code) {
 726                 if (use_sideband)
 727                         finish_async(&muxer);
 728                 return code;
 729         }
 730
 731         sigchain_push(SIGPIPE, SIG_IGN);
 732
 733         while (1) {
 734                 const char *buf;
 735                 size_t n;
 736                 if (feed(feed_state, &buf, &n))
 737                         break;
 738                 if (write_in_full(proc.in, buf, n) < 0)
 739                         break;
 740         }
 741         close(proc.in);
 742         if (use_sideband)
 743                 finish_async(&muxer);
 744
 745         sigchain_pop(SIGPIPE);
 746
 747         return finish_command(&proc);
 748 }
 749
 750 static int feed_receive_hook(void *state_, const char **bufp, size_t *sizep)
 751 {
 752         struct receive_hook_feed_state *state = state_;
 753         struct command *cmd = state->cmd;
 754
 755         while (cmd &&
 756                state->skip_broken && (cmd->error_string || cmd->did_not_exist))
 757                 cmd = cmd->next;
 758         if (!cmd)
 759                 return -1; /* EOF */
 760         strbuf_reset(&state->buf);
 761         strbuf_addf(&state->buf, "%s %s %s\n",
 762                     oid_to_hex(&cmd->old_oid), oid_to_hex(&cmd->new_oid),
 763                     cmd->ref_name);
 764         state->cmd = cmd->next;
 765         if (bufp) {
 766                 *bufp = state->buf.buf;
 767                 *sizep = state->buf.len;
 768         }
 769         return 0;
 770 }
 771
 772 static int run_receive_hook(struct command *commands,
 773                             const char *hook_name,
 774                             int skip_broken,
 775                             const struct string_list *push_options)
 776 {
 777         struct receive_hook_feed_state state;
 778         int status;
 779
 780         strbuf_init(&state.buf, 0);
 781         state.cmd = commands;
 782         state.skip_broken = skip_broken;
 783         if (feed_receive_hook(&state, NULL, NULL))
 784                 return 0;
 785         state.cmd = commands;
 786         state.push_options = push_options;
 787         status = run_and_feed_hook(hook_name, feed_receive_hook, &state);
 788         strbuf_release(&state.buf);
 789         return status;
 790 }
 791
 792 static int run_update_hook(struct command *cmd)
 793 {
 794         const char *argv[5];
 795         struct child_process proc = CHILD_PROCESS_INIT;
 796         int code;
 797
 798         argv[0] = find_hook("update");
 799         if (!argv[0])
 800                 return 0;
 801
 802         argv[1] = cmd->ref_name;
 803         argv[2] = oid_to_hex(&cmd->old_oid);
 804         argv[3] = oid_to_hex(&cmd->new_oid);
 805         argv[4] = NULL;
 806
 807         proc.no_stdin = 1;
 808         proc.stdout_to_stderr = 1;
 809         proc.err = use_sideband ? -1 : 0;
 810         proc.argv = argv;
 811
 812         code = start_command(&proc);
 813         if (code)
 814                 return code;
 815         if (use_sideband)
 816                 copy_to_sideband(proc.err, -1, NULL);
 817         return finish_command(&proc);
 818 }
 819
 820 static int is_ref_checked_out(const char *ref)
 821 {
 822         if (is_bare_repository())
 823                 return 0;
 824
 825         if (!head_name)
 826                 return 0;
 827         return !strcmp(head_name, ref);
 828 }
 829
 830 static char *refuse_unconfigured_deny_msg =
 831         N_("By default, updating the current branch in a non-bare repository\n"
 832            "is denied, because it will make the index and work tree inconsistent\n"
 833            "with what you pushed, and will require 'git reset --hard' to match\n"
 834            "the work tree to HEAD.\n"
 835            "\n"
 836            "You can set the 'receive.denyCurrentBranch' configuration variable\n"
 837            "to 'ignore' or 'warn' in the remote repository to allow pushing into\n"
 838            "its current branch; however, this is not recommended unless you\n"
 839            "arranged to update its work tree to match what you pushed in some\n"
 840            "other way.\n"
 841            "\n"
 842            "To squelch this message and still keep the default behaviour, set\n"
 843            "'receive.denyCurrentBranch' configuration variable to 'refuse'.");
 844
 845 static void refuse_unconfigured_deny(void)
 846 {
 847         rp_error("%s", _(refuse_unconfigured_deny_msg));
 848 }
 849
 850 static char *refuse_unconfigured_deny_delete_current_msg =
 851         N_("By default, deleting the current branch is denied, because the next\n"
 852            "'git clone' won't result in any file checked out, causing confusion.\n"
 853            "\n"
 854            "You can set 'receive.denyDeleteCurrent' configuration variable to\n"
 855            "'warn' or 'ignore' in the remote repository to allow deleting the\n"
 856            "current branch, with or without a warning message.\n"
 857            "\n"
 858            "To squelch this message, you can set it to 'refuse'.");
 859
 860 static void refuse_unconfigured_deny_delete_current(void)
 861 {
 862         rp_error("%s", _(refuse_unconfigured_deny_delete_current_msg));
 863 }
 864
 865 static int command_singleton_iterator(void *cb_data, struct object_id *oid);
 866 static int update_shallow_ref(struct command *cmd, struct shallow_info *si)
 867 {
 868         struct lock_file shallow_lock = LOCK_INIT;
 869         struct oid_array extra = OID_ARRAY_INIT;
 870         struct check_connected_options opt = CHECK_CONNECTED_INIT;
 871         uint32_t mask = 1 << (cmd->index % 32);
 872         int i;
 873
 874         trace_printf_key(&trace_shallow,
 875                          "shallow: update_shallow_ref %s\n", cmd->ref_name);
 876         for (i = 0; i < si->shallow->nr; i++)
 877                 if (si->used_shallow[i] &&
 878                     (si->used_shallow[i][cmd->index / 32] & mask) &&
 879                     !delayed_reachability_test(si, i))
 880                         oid_array_append(&extra, &si->shallow->oid[i]);
 881
 882         opt.env = tmp_objdir_env(tmp_objdir);
 883         setup_alternate_shallow(&shallow_lock, &opt.shallow_file, &extra);
 884         if (check_connected(command_singleton_iterator, cmd, &opt)) {
 885                 rollback_lock_file(&shallow_lock);
 886                 oid_array_clear(&extra);
 887                 return -1;
 888         }
 889
 890         commit_lock_file(&shallow_lock);
 891
 892         /*
 893          * Make sure setup_alternate_shallow() for the next ref does
 894          * not lose these new roots..
 895          */
 896         for (i = 0; i < extra.nr; i++)
 897                 register_shallow(the_repository, &extra.oid[i]);
 898
 899         si->shallow_ref[cmd->index] = 0;
 900         oid_array_clear(&extra);
 901         return 0;
 902 }
 903
 904 /*
 905  * NEEDSWORK: we should consolidate various implementions of "are we
 906  * on an unborn branch?" test into one, and make the unified one more
 907  * robust. !get_sha1() based check used here and elsewhere would not
 908  * allow us to tell an unborn branch from corrupt ref, for example.
 909  * For the purpose of fixing "deploy-to-update does not work when
 910  * pushing into an empty repository" issue, this should suffice for
 911  * now.
 912  */
 913 static int head_has_history(void)
 914 {
 915         struct object_id oid;
 916
 917         return !get_oid("HEAD", &oid);
 918 }
 919
 920 static const char *push_to_deploy(unsigned char *sha1,
 921                                   struct argv_array *env,
 922                                   const char *work_tree)
 923 {
 924         const char *update_refresh[] = {
 925                 "update-index", "-q", "--ignore-submodules", "--refresh", NULL
 926         };
 927         const char *diff_files[] = {
 928                 "diff-files", "--quiet", "--ignore-submodules", "--", NULL
 929         };
 930         const char *diff_index[] = {
 931                 "diff-index", "--quiet", "--cached", "--ignore-submodules",
 932                 NULL, "--", NULL
 933         };
 934         const char *read_tree[] = {
 935                 "read-tree", "-u", "-m", NULL, NULL
 936         };
 937         struct child_process child = CHILD_PROCESS_INIT;
 938
 939         child.argv = update_refresh;
 940         child.env = env->argv;
 941         child.dir = work_tree;
 942         child.no_stdin = 1;
 943         child.stdout_to_stderr = 1;
 944         child.git_cmd = 1;
 945         if (run_command(&child))
 946                 return "Up-to-date check failed";
 947
 948         /* run_command() does not clean up completely; reinitialize */
 949         child_process_init(&child);
 950         child.argv = diff_files;
 951         child.env = env->argv;
 952         child.dir = work_tree;
 953         child.no_stdin = 1;
 954         child.stdout_to_stderr = 1;
 955         child.git_cmd = 1;
 956         if (run_command(&child))
 957                 return "Working directory has unstaged changes";
 958
 959         /* diff-index with either HEAD or an empty tree */
 960         diff_index[4] = head_has_history() ? "HEAD" : empty_tree_oid_hex();
 961
 962         child_process_init(&child);
 963         child.argv = diff_index;
 964         child.env = env->argv;
 965         child.no_stdin = 1;
 966         child.no_stdout = 1;
 967         child.stdout_to_stderr = 0;
 968         child.git_cmd = 1;
 969         if (run_command(&child))
 970                 return "Working directory has staged changes";
 971
 972         read_tree[3] = sha1_to_hex(sha1);
 973         child_process_init(&child);
 974         child.argv = read_tree;
 975         child.env = env->argv;
 976         child.dir = work_tree;
 977         child.no_stdin = 1;
 978         child.no_stdout = 1;
 979         child.stdout_to_stderr = 0;
 980         child.git_cmd = 1;
 981         if (run_command(&child))
 982                 return "Could not update working tree to new HEAD";
 983
 984         return NULL;
 985 }
 986
 987 static const char *push_to_checkout_hook = "push-to-checkout";
 988
 989 static const char *push_to_checkout(unsigned char *sha1,
 990                                     struct argv_array *env,
 991                                     const char *work_tree)
 992 {
 993         argv_array_pushf(env, "GIT_WORK_TREE=%s", absolute_path(work_tree));
 994         if (run_hook_le(env->argv, push_to_checkout_hook,
 995                         sha1_to_hex(sha1), NULL))
 996                 return "push-to-checkout hook declined";
 997         else
 998                 return NULL;
 999 }
1000
1001 static const char *update_worktree(unsigned char *sha1)
1002 {
1003         const char *retval;
1004         const char *work_tree = git_work_tree_cfg ? git_work_tree_cfg : "..";
1005         struct argv_array env = ARGV_ARRAY_INIT;
1006
1007         if (is_bare_repository())
1008                 return "denyCurrentBranch = updateInstead needs a worktree";
1009
1010         argv_array_pushf(&env, "GIT_DIR=%s", absolute_path(get_git_dir()));
1011
1012         if (!find_hook(push_to_checkout_hook))
1013                 retval = push_to_deploy(sha1, &env, work_tree);
1014         else
1015                 retval = push_to_checkout(sha1, &env, work_tree);
1016
1017         argv_array_clear(&env);
1018         return retval;
1019 }
1020
1021 static const char *update(struct command *cmd, struct shallow_info *si)
1022 {
1023         const char *name = cmd->ref_name;
1024         struct strbuf namespaced_name_buf = STRBUF_INIT;
1025         static char *namespaced_name;
1026         const char *ret;
1027         struct object_id *old_oid = &cmd->old_oid;
1028         struct object_id *new_oid = &cmd->new_oid;
1029
1030         /* only refs/... are allowed */
1031         if (!starts_with(name, "refs/") || check_refname_format(name + 5, 0)) {
1032                 rp_error("refusing to create funny ref '%s' remotely", name);
1033                 return "funny refname";
1034         }
1035
1036         strbuf_addf(&namespaced_name_buf, "%s%s", get_git_namespace(), name);
1037         free(namespaced_name);
1038         namespaced_name = strbuf_detach(&namespaced_name_buf, NULL);
1039
1040         if (is_ref_checked_out(namespaced_name)) {
1041                 switch (deny_current_branch) {
1042                 case DENY_IGNORE:
1043                         break;
1044                 case DENY_WARN:
1045                         rp_warning("updating the current branch");
1046                         break;
1047                 case DENY_REFUSE:
1048                 case DENY_UNCONFIGURED:
1049                         rp_error("refusing to update checked out branch: %s", name);
1050                         if (deny_current_branch == DENY_UNCONFIGURED)
1051                                 refuse_unconfigured_deny();
1052                         return "branch is currently checked out";
1053                 case DENY_UPDATE_INSTEAD:
1054                         ret = update_worktree(new_oid->hash);
1055                         if (ret)
1056                                 return ret;
1057                         break;
1058                 }
1059         }
1060
1061         if (!is_null_oid(new_oid) && !has_object_file(new_oid)) {
1062                 error("unpack should have generated %s, "
1063                       "but I can't find it!", oid_to_hex(new_oid));
1064                 return "bad pack";
1065         }
1066
1067         if (!is_null_oid(old_oid) && is_null_oid(new_oid)) {
1068                 if (deny_deletes && starts_with(name, "refs/heads/")) {
1069                         rp_error("denying ref deletion for %s", name);
1070                         return "deletion prohibited";
1071                 }
1072
1073                 if (head_name && !strcmp(namespaced_name, head_name)) {
1074                         switch (deny_delete_current) {
1075                         case DENY_IGNORE:
1076                                 break;
1077                         case DENY_WARN:
1078                                 rp_warning("deleting the current branch");
1079                                 break;
1080                         case DENY_REFUSE:
1081                         case DENY_UNCONFIGURED:
1082                         case DENY_UPDATE_INSTEAD:
1083                                 if (deny_delete_current == DENY_UNCONFIGURED)
1084                                         refuse_unconfigured_deny_delete_current();
1085                                 rp_error("refusing to delete the current branch: %s", name);
1086                                 return "deletion of the current branch prohibited";
1087                         default:
1088                                 return "Invalid denyDeleteCurrent setting";
1089                         }
1090                 }
1091         }
1092
1093         if (deny_non_fast_forwards && !is_null_oid(new_oid) &&
1094             !is_null_oid(old_oid) &&
1095             starts_with(name, "refs/heads/")) {
1096                 struct object *old_object, *new_object;
1097                 struct commit *old_commit, *new_commit;
1098
1099                 old_object = parse_object(the_repository, old_oid);
1100                 new_object = parse_object(the_repository, new_oid);
1101
1102                 if (!old_object || !new_object ||
1103                     old_object->type != OBJ_COMMIT ||
1104                     new_object->type != OBJ_COMMIT) {
1105                         error("bad sha1 objects for %s", name);
1106                         return "bad ref";
1107                 }
1108                 old_commit = (struct commit *)old_object;
1109                 new_commit = (struct commit *)new_object;
1110                 if (!in_merge_bases(old_commit, new_commit)) {
1111                         rp_error("denying non-fast-forward %s"
1112                                  " (you should pull first)", name);
1113                         return "non-fast-forward";
1114                 }
1115         }
1116         if (run_update_hook(cmd)) {
1117                 rp_error("hook declined to update %s", name);
1118                 return "hook declined";
1119         }
1120
1121         if (is_null_oid(new_oid)) {
1122                 struct strbuf err = STRBUF_INIT;
1123                 if (!parse_object(the_repository, old_oid)) {
1124                         old_oid = NULL;
1125                         if (ref_exists(name)) {
1126                                 rp_warning("Allowing deletion of corrupt ref.");
1127                         } else {
1128                                 rp_warning("Deleting a non-existent ref.");
1129                                 cmd->did_not_exist = 1;
1130                         }
1131                 }
1132                 if (ref_transaction_delete(transaction,
1133                                            namespaced_name,
1134                                            old_oid,
1135                                            0, "push", &err)) {
1136                         rp_error("%s", err.buf);
1137                         strbuf_release(&err);
1138                         return "failed to delete";
1139                 }
1140                 strbuf_release(&err);
1141                 return NULL; /* good */
1142         }
1143         else {
1144                 struct strbuf err = STRBUF_INIT;
1145                 if (shallow_update && si->shallow_ref[cmd->index] &&
1146                     update_shallow_ref(cmd, si))
1147                         return "shallow error";
1148
1149                 if (ref_transaction_update(transaction,
1150                                            namespaced_name,
1151                                            new_oid, old_oid,
1152                                            0, "push",
1153                                            &err)) {
1154                         rp_error("%s", err.buf);
1155                         strbuf_release(&err);
1156
1157                         return "failed to update ref";
1158                 }
1159                 strbuf_release(&err);
1160
1161                 return NULL; /* good */
1162         }
1163 }
1164
1165 static void run_update_post_hook(struct command *commands)
1166 {
1167         struct command *cmd;
1168         struct child_process proc = CHILD_PROCESS_INIT;
1169         const char *hook;
1170
1171         hook = find_hook("post-update");
1172         if (!hook)
1173                 return;
1174
1175         for (cmd = commands; cmd; cmd = cmd->next) {
1176                 if (cmd->error_string || cmd->did_not_exist)
1177                         continue;
1178                 if (!proc.args.argc)
1179                         argv_array_push(&proc.args, hook);
1180                 argv_array_push(&proc.args, cmd->ref_name);
1181         }
1182         if (!proc.args.argc)
1183                 return;
1184
1185         proc.no_stdin = 1;
1186         proc.stdout_to_stderr = 1;
1187         proc.err = use_sideband ? -1 : 0;
1188
1189         if (!start_command(&proc)) {
1190                 if (use_sideband)
1191                         copy_to_sideband(proc.err, -1, NULL);
1192                 finish_command(&proc);
1193         }
1194 }
1195
1196 static void check_aliased_update(struct command *cmd, struct string_list *list)
1197 {
1198         struct strbuf buf = STRBUF_INIT;
1199         const char *dst_name;
1200         struct string_list_item *item;
1201         struct command *dst_cmd;
1202         int flag;
1203
1204         strbuf_addf(&buf, "%s%s", get_git_namespace(), cmd->ref_name);
1205         dst_name = resolve_ref_unsafe(buf.buf, 0, NULL, &flag);
1206         strbuf_release(&buf);
1207
1208         if (!(flag & REF_ISSYMREF))
1209                 return;
1210
1211         if (!dst_name) {
1212                 rp_error("refusing update to broken symref '%s'", cmd->ref_name);
1213                 cmd->skip_update = 1;
1214                 cmd->error_string = "broken symref";
1215                 return;
1216         }
1217         dst_name = strip_namespace(dst_name);
1218
1219         if ((item = string_list_lookup(list, dst_name)) == NULL)
1220                 return;
1221
1222         cmd->skip_update = 1;
1223
1224         dst_cmd = (struct command *) item->util;
1225
1226         if (oideq(&cmd->old_oid, &dst_cmd->old_oid) &&
1227             oideq(&cmd->new_oid, &dst_cmd->new_oid))
1228                 return;
1229
1230         dst_cmd->skip_update = 1;
1231
1232         rp_error("refusing inconsistent update between symref '%s' (%s..%s) and"
1233                  " its target '%s' (%s..%s)",
1234                  cmd->ref_name,
1235                  find_unique_abbrev(&cmd->old_oid, DEFAULT_ABBREV),
1236                  find_unique_abbrev(&cmd->new_oid, DEFAULT_ABBREV),
1237                  dst_cmd->ref_name,
1238                  find_unique_abbrev(&dst_cmd->old_oid, DEFAULT_ABBREV),
1239                  find_unique_abbrev(&dst_cmd->new_oid, DEFAULT_ABBREV));
1240
1241         cmd->error_string = dst_cmd->error_string =
1242                 "inconsistent aliased update";
1243 }
1244
1245 static void check_aliased_updates(struct command *commands)
1246 {
1247         struct command *cmd;
1248         struct string_list ref_list = STRING_LIST_INIT_NODUP;
1249
1250         for (cmd = commands; cmd; cmd = cmd->next) {
1251                 struct string_list_item *item =
1252                         string_list_append(&ref_list, cmd->ref_name);
1253                 item->util = (void *)cmd;
1254         }
1255         string_list_sort(&ref_list);
1256
1257         for (cmd = commands; cmd; cmd = cmd->next) {
1258                 if (!cmd->error_string)
1259                         check_aliased_update(cmd, &ref_list);
1260         }
1261
1262         string_list_clear(&ref_list, 0);
1263 }
1264
1265 static int command_singleton_iterator(void *cb_data, struct object_id *oid)
1266 {
1267         struct command **cmd_list = cb_data;
1268         struct command *cmd = *cmd_list;
1269
1270         if (!cmd || is_null_oid(&cmd->new_oid))
1271                 return -1; /* end of list */
1272         *cmd_list = NULL; /* this returns only one */
1273         oidcpy(oid, &cmd->new_oid);
1274         return 0;
1275 }
1276
1277 static void set_connectivity_errors(struct command *commands,
1278                                     struct shallow_info *si)
1279 {
1280         struct command *cmd;
1281
1282         for (cmd = commands; cmd; cmd = cmd->next) {
1283                 struct command *singleton = cmd;
1284                 struct check_connected_options opt = CHECK_CONNECTED_INIT;
1285
1286                 if (shallow_update && si->shallow_ref[cmd->index])
1287                         /* to be checked in update_shallow_ref() */
1288                         continue;
1289
1290                 opt.env = tmp_objdir_env(tmp_objdir);
1291                 if (!check_connected(command_singleton_iterator, &singleton,
1292                                      &opt))
1293                         continue;
1294
1295                 cmd->error_string = "missing necessary objects";
1296         }
1297 }
1298
1299 struct iterate_data {
1300         struct command *cmds;
1301         struct shallow_info *si;
1302 };
1303
1304 static int iterate_receive_command_list(void *cb_data, struct object_id *oid)
1305 {
1306         struct iterate_data *data = cb_data;
1307         struct command **cmd_list = &data->cmds;
1308         struct command *cmd = *cmd_list;
1309
1310         for (; cmd; cmd = cmd->next) {
1311                 if (shallow_update && data->si->shallow_ref[cmd->index])
1312                         /* to be checked in update_shallow_ref() */
1313                         continue;
1314                 if (!is_null_oid(&cmd->new_oid) && !cmd->skip_update) {
1315                         oidcpy(oid, &cmd->new_oid);
1316                         *cmd_list = cmd->next;
1317                         return 0;
1318                 }
1319         }
1320         *cmd_list = NULL;
1321         return -1; /* end of list */
1322 }
1323
1324 static void reject_updates_to_hidden(struct command *commands)
1325 {
1326         struct strbuf refname_full = STRBUF_INIT;
1327         size_t prefix_len;
1328         struct command *cmd;
1329
1330         strbuf_addstr(&refname_full, get_git_namespace());
1331         prefix_len = refname_full.len;
1332
1333         for (cmd = commands; cmd; cmd = cmd->next) {
1334                 if (cmd->error_string)
1335                         continue;
1336
1337                 strbuf_setlen(&refname_full, prefix_len);
1338                 strbuf_addstr(&refname_full, cmd->ref_name);
1339
1340                 if (!ref_is_hidden(cmd->ref_name, refname_full.buf))
1341                         continue;
1342                 if (is_null_oid(&cmd->new_oid))
1343                         cmd->error_string = "deny deleting a hidden ref";
1344                 else
1345                         cmd->error_string = "deny updating a hidden ref";
1346         }
1347
1348         strbuf_release(&refname_full);
1349 }
1350
1351 static int should_process_cmd(struct command *cmd)
1352 {
1353         return !cmd->error_string && !cmd->skip_update;
1354 }
1355
1356 static void warn_if_skipped_connectivity_check(struct command *commands,
1357                                                struct shallow_info *si)
1358 {
1359         struct command *cmd;
1360         int checked_connectivity = 1;
1361
1362         for (cmd = commands; cmd; cmd = cmd->next) {
1363                 if (should_process_cmd(cmd) && si->shallow_ref[cmd->index]) {
1364                         error("BUG: connectivity check has not been run on ref %s",
1365                               cmd->ref_name);
1366                         checked_connectivity = 0;
1367                 }
1368         }
1369         if (!checked_connectivity)
1370                 BUG("connectivity check skipped???");
1371 }
1372
1373 static void execute_commands_non_atomic(struct command *commands,
1374                                         struct shallow_info *si)
1375 {
1376         struct command *cmd;
1377         struct strbuf err = STRBUF_INIT;
1378
1379         for (cmd = commands; cmd; cmd = cmd->next) {
1380                 if (!should_process_cmd(cmd))
1381                         continue;
1382
1383                 transaction = ref_transaction_begin(&err);
1384                 if (!transaction) {
1385                         rp_error("%s", err.buf);
1386                         strbuf_reset(&err);
1387                         cmd->error_string = "transaction failed to start";
1388                         continue;
1389                 }
1390
1391                 cmd->error_string = update(cmd, si);
1392
1393                 if (!cmd->error_string
1394                     && ref_transaction_commit(transaction, &err)) {
1395                         rp_error("%s", err.buf);
1396                         strbuf_reset(&err);
1397                         cmd->error_string = "failed to update ref";
1398                 }
1399                 ref_transaction_free(transaction);
1400         }
1401         strbuf_release(&err);
1402 }
1403
1404 static void execute_commands_atomic(struct command *commands,
1405                                         struct shallow_info *si)
1406 {
1407         struct command *cmd;
1408         struct strbuf err = STRBUF_INIT;
1409         const char *reported_error = "atomic push failure";
1410
1411         transaction = ref_transaction_begin(&err);
1412         if (!transaction) {
1413                 rp_error("%s", err.buf);
1414                 strbuf_reset(&err);
1415                 reported_error = "transaction failed to start";
1416                 goto failure;
1417         }
1418
1419         for (cmd = commands; cmd; cmd = cmd->next) {
1420                 if (!should_process_cmd(cmd))
1421                         continue;
1422
1423                 cmd->error_string = update(cmd, si);
1424
1425                 if (cmd->error_string)
1426                         goto failure;
1427         }
1428
1429         if (ref_transaction_commit(transaction, &err)) {
1430                 rp_error("%s", err.buf);
1431                 reported_error = "atomic transaction failed";
1432                 goto failure;
1433         }
1434         goto cleanup;
1435
1436 failure:
1437         for (cmd = commands; cmd; cmd = cmd->next)
1438                 if (!cmd->error_string)
1439                         cmd->error_string = reported_error;
1440
1441 cleanup:
1442         ref_transaction_free(transaction);
1443         strbuf_release(&err);
1444 }
1445
1446 static void execute_commands(struct command *commands,
1447                              const char *unpacker_error,
1448                              struct shallow_info *si,
1449                              const struct string_list *push_options)
1450 {
1451         struct check_connected_options opt = CHECK_CONNECTED_INIT;
1452         struct command *cmd;
1453         struct iterate_data data;
1454         struct async muxer;
1455         int err_fd = 0;
1456
1457         if (unpacker_error) {
1458                 for (cmd = commands; cmd; cmd = cmd->next)
1459                         cmd->error_string = "unpacker error";
1460                 return;
1461         }
1462
1463         if (use_sideband) {
1464                 memset(&muxer, 0, sizeof(muxer));
1465                 muxer.proc = copy_to_sideband;
1466                 muxer.in = -1;
1467                 if (!start_async(&muxer))
1468                         err_fd = muxer.in;
1469                 /* ...else, continue without relaying sideband */
1470         }
1471
1472         data.cmds = commands;
1473         data.si = si;
1474         opt.err_fd = err_fd;
1475         opt.progress = err_fd && !quiet;
1476         opt.env = tmp_objdir_env(tmp_objdir);
1477         if (check_connected(iterate_receive_command_list, &data, &opt))
1478                 set_connectivity_errors(commands, si);
1479
1480         if (use_sideband)
1481                 finish_async(&muxer);
1482
1483         reject_updates_to_hidden(commands);
1484
1485         if (run_receive_hook(commands, "pre-receive", 0, push_options)) {
1486                 for (cmd = commands; cmd; cmd = cmd->next) {
1487                         if (!cmd->error_string)
1488                                 cmd->error_string = "pre-receive hook declined";
1489                 }
1490                 return;
1491         }
1492
1493         /*
1494          * Now we'll start writing out refs, which means the objects need
1495          * to be in their final positions so that other processes can see them.
1496          */
1497         if (tmp_objdir_migrate(tmp_objdir) < 0) {
1498                 for (cmd = commands; cmd; cmd = cmd->next) {
1499                         if (!cmd->error_string)
1500                                 cmd->error_string = "unable to migrate objects to permanent storage";
1501                 }
1502                 return;
1503         }
1504         tmp_objdir = NULL;
1505
1506         check_aliased_updates(commands);
1507
1508         free(head_name_to_free);
1509         head_name = head_name_to_free = resolve_refdup("HEAD", 0, NULL, NULL);
1510
1511         if (use_atomic)
1512                 execute_commands_atomic(commands, si);
1513         else
1514                 execute_commands_non_atomic(commands, si);
1515
1516         if (shallow_update)
1517                 warn_if_skipped_connectivity_check(commands, si);
1518 }
1519
1520 static struct command **queue_command(struct command **tail,
1521                                       const char *line,
1522                                       int linelen)
1523 {
1524         struct object_id old_oid, new_oid;
1525         struct command *cmd;
1526         const char *refname;
1527         int reflen;
1528         const char *p;
1529
1530         if (parse_oid_hex(line, &old_oid, &p) ||
1531             *p++ != ' ' ||
1532             parse_oid_hex(p, &new_oid, &p) ||
1533             *p++ != ' ')
1534                 die("protocol error: expected old/new/ref, got '%s'", line);
1535
1536         refname = p;
1537         reflen = linelen - (p - line);
1538         FLEX_ALLOC_MEM(cmd, ref_name, refname, reflen);
1539         oidcpy(&cmd->old_oid, &old_oid);
1540         oidcpy(&cmd->new_oid, &new_oid);
1541         *tail = cmd;
1542         return &cmd->next;
1543 }
1544
1545 static void queue_commands_from_cert(struct command **tail,
1546                                      struct strbuf *push_cert)
1547 {
1548         const char *boc, *eoc;
1549
1550         if (*tail)
1551                 die("protocol error: got both push certificate and unsigned commands");
1552
1553         boc = strstr(push_cert->buf, "\n\n");
1554         if (!boc)
1555                 die("malformed push certificate %.*s", 100, push_cert->buf);
1556         else
1557                 boc += 2;
1558         eoc = push_cert->buf + parse_signature(push_cert->buf, push_cert->len);
1559
1560         while (boc < eoc) {
1561                 const char *eol = memchr(boc, '\n', eoc - boc);
1562                 tail = queue_command(tail, boc, eol ? eol - boc : eoc - boc);
1563                 boc = eol ? eol + 1 : eoc;
1564         }
1565 }
1566
1567 static struct command *read_head_info(struct oid_array *shallow)
1568 {
1569         struct command *commands = NULL;
1570         struct command **p = &commands;
1571         for (;;) {
1572                 char *line;
1573                 int len, linelen;
1574
1575                 line = packet_read_line(0, &len);
1576                 if (!line)
1577                         break;
1578
1579                 if (len > 8 && starts_with(line, "shallow ")) {
1580                         struct object_id oid;
1581                         if (get_oid_hex(line + 8, &oid))
1582                                 die("protocol error: expected shallow sha, got '%s'",
1583                                     line + 8);
1584                         oid_array_append(shallow, &oid);
1585                         continue;
1586                 }
1587
1588                 linelen = strlen(line);
1589                 if (linelen < len) {
1590                         const char *feature_list = line + linelen + 1;
1591                         if (parse_feature_request(feature_list, "report-status"))
1592                                 report_status = 1;
1593                         if (parse_feature_request(feature_list, "side-band-64k"))
1594                                 use_sideband = LARGE_PACKET_MAX;
1595                         if (parse_feature_request(feature_list, "quiet"))
1596                                 quiet = 1;
1597                         if (advertise_atomic_push
1598                             && parse_feature_request(feature_list, "atomic"))
1599                                 use_atomic = 1;
1600                         if (advertise_push_options
1601                             && parse_feature_request(feature_list, "push-options"))
1602                                 use_push_options = 1;
1603                 }
1604
1605                 if (!strcmp(line, "push-cert")) {
1606                         int true_flush = 0;
1607                         char certbuf[1024];
1608
1609                         for (;;) {
1610                                 len = packet_read(0, NULL, NULL,
1611                                                   certbuf, sizeof(certbuf), 0);
1612                                 if (!len) {
1613                                         true_flush = 1;
1614                                         break;
1615                                 }
1616                                 if (!strcmp(certbuf, "push-cert-end\n"))
1617                                         break; /* end of cert */
1618                                 strbuf_addstr(&push_cert, certbuf);
1619                         }
1620
1621                         if (true_flush)
1622                                 break;
1623                         continue;
1624                 }
1625
1626                 p = queue_command(p, line, linelen);
1627         }
1628
1629         if (push_cert.len)
1630                 queue_commands_from_cert(p, &push_cert);
1631
1632         return commands;
1633 }
1634
1635 static void read_push_options(struct string_list *options)
1636 {
1637         while (1) {
1638                 char *line;
1639                 int len;
1640
1641                 line = packet_read_line(0, &len);
1642
1643                 if (!line)
1644                         break;
1645
1646                 string_list_append(options, line);
1647         }
1648 }
1649
1650 static const char *parse_pack_header(struct pack_header *hdr)
1651 {
1652         switch (read_pack_header(0, hdr)) {
1653         case PH_ERROR_EOF:
1654                 return "eof before pack header was fully read";
1655
1656         case PH_ERROR_PACK_SIGNATURE:
1657                 return "protocol error (pack signature mismatch detected)";
1658
1659         case PH_ERROR_PROTOCOL:
1660                 return "protocol error (pack version unsupported)";
1661
1662         default:
1663                 return "unknown error in parse_pack_header";
1664
1665         case 0:
1666                 return NULL;
1667         }
1668 }
1669
1670 static const char *pack_lockfile;
1671
1672 static void push_header_arg(struct argv_array *args, struct pack_header *hdr)
1673 {
1674         argv_array_pushf(args, "--pack_header=%"PRIu32",%"PRIu32,
1675                         ntohl(hdr->hdr_version), ntohl(hdr->hdr_entries));
1676 }
1677
1678 static const char *unpack(int err_fd, struct shallow_info *si)
1679 {
1680         struct pack_header hdr;
1681         const char *hdr_err;
1682         int status;
1683         struct child_process child = CHILD_PROCESS_INIT;
1684         int fsck_objects = (receive_fsck_objects >= 0
1685                             ? receive_fsck_objects
1686                             : transfer_fsck_objects >= 0
1687                             ? transfer_fsck_objects
1688                             : 0);
1689
1690         hdr_err = parse_pack_header(&hdr);
1691         if (hdr_err) {
1692                 if (err_fd > 0)
1693                         close(err_fd);
1694                 return hdr_err;
1695         }
1696
1697         if (si->nr_ours || si->nr_theirs) {
1698                 alt_shallow_file = setup_temporary_shallow(si->shallow);
1699                 argv_array_push(&child.args, "--shallow-file");
1700                 argv_array_push(&child.args, alt_shallow_file);
1701         }
1702
1703         tmp_objdir = tmp_objdir_create();
1704         if (!tmp_objdir) {
1705                 if (err_fd > 0)
1706                         close(err_fd);
1707                 return "unable to create temporary object directory";
1708         }
1709         child.env = tmp_objdir_env(tmp_objdir);
1710
1711         /*
1712          * Normally we just pass the tmp_objdir environment to the child
1713          * processes that do the heavy lifting, but we may need to see these
1714          * objects ourselves to set up shallow information.
1715          */
1716         tmp_objdir_add_as_alternate(tmp_objdir);
1717
1718         if (ntohl(hdr.hdr_entries) < unpack_limit) {
1719                 argv_array_push(&child.args, "unpack-objects");
1720                 push_header_arg(&child.args, &hdr);
1721                 if (quiet)
1722                         argv_array_push(&child.args, "-q");
1723                 if (fsck_objects)
1724                         argv_array_pushf(&child.args, "--strict%s",
1725                                 fsck_msg_types.buf);
1726                 if (max_input_size)
1727                         argv_array_pushf(&child.args, "--max-input-size=%"PRIuMAX,
1728                                 (uintmax_t)max_input_size);
1729                 child.no_stdout = 1;
1730                 child.err = err_fd;
1731                 child.git_cmd = 1;
1732                 status = run_command(&child);
1733                 if (status)
1734                         return "unpack-objects abnormal exit";
1735         } else {
1736                 char hostname[HOST_NAME_MAX + 1];
1737
1738                 argv_array_pushl(&child.args, "index-pack", "--stdin", NULL);
1739                 push_header_arg(&child.args, &hdr);
1740
1741                 if (xgethostname(hostname, sizeof(hostname)))
1742                         xsnprintf(hostname, sizeof(hostname), "localhost");
1743                 argv_array_pushf(&child.args,
1744                                  "--keep=receive-pack %"PRIuMAX" on %s",
1745                                  (uintmax_t)getpid(),
1746                                  hostname);
1747
1748                 if (!quiet && err_fd)
1749                         argv_array_push(&child.args, "--show-resolving-progress");
1750                 if (use_sideband)
1751                         argv_array_push(&child.args, "--report-end-of-input");
1752                 if (fsck_objects)
1753                         argv_array_pushf(&child.args, "--strict%s",
1754                                 fsck_msg_types.buf);
1755                 if (!reject_thin)
1756                         argv_array_push(&child.args, "--fix-thin");
1757                 if (max_input_size)
1758                         argv_array_pushf(&child.args, "--max-input-size=%"PRIuMAX,
1759                                 (uintmax_t)max_input_size);
1760                 child.out = -1;
1761                 child.err = err_fd;
1762                 child.git_cmd = 1;
1763                 status = start_command(&child);
1764                 if (status)
1765                         return "index-pack fork failed";
1766                 pack_lockfile = index_pack_lockfile(child.out);
1767                 close(child.out);
1768                 status = finish_command(&child);
1769                 if (status)
1770                         return "index-pack abnormal exit";
1771                 reprepare_packed_git(the_repository);
1772         }
1773         return NULL;
1774 }
1775
1776 static const char *unpack_with_sideband(struct shallow_info *si)
1777 {
1778         struct async muxer;
1779         const char *ret;
1780
1781         if (!use_sideband)
1782                 return unpack(0, si);
1783
1784         use_keepalive = KEEPALIVE_AFTER_NUL;
1785         memset(&muxer, 0, sizeof(muxer));
1786         muxer.proc = copy_to_sideband;
1787         muxer.in = -1;
1788         if (start_async(&muxer))
1789                 return NULL;
1790
1791         ret = unpack(muxer.in, si);
1792
1793         finish_async(&muxer);
1794         return ret;
1795 }
1796
1797 static void prepare_shallow_update(struct command *commands,
1798                                    struct shallow_info *si)
1799 {
1800         int i, j, k, bitmap_size = DIV_ROUND_UP(si->ref->nr, 32);
1801
1802         ALLOC_ARRAY(si->used_shallow, si->shallow->nr);
1803         assign_shallow_commits_to_refs(si, si->used_shallow, NULL);
1804
1805         si->need_reachability_test =
1806                 xcalloc(si->shallow->nr, sizeof(*si->need_reachability_test));
1807         si->reachable =
1808                 xcalloc(si->shallow->nr, sizeof(*si->reachable));
1809         si->shallow_ref = xcalloc(si->ref->nr, sizeof(*si->shallow_ref));
1810
1811         for (i = 0; i < si->nr_ours; i++)
1812                 si->need_reachability_test[si->ours[i]] = 1;
1813
1814         for (i = 0; i < si->shallow->nr; i++) {
1815                 if (!si->used_shallow[i])
1816                         continue;
1817                 for (j = 0; j < bitmap_size; j++) {
1818                         if (!si->used_shallow[i][j])
1819                                 continue;
1820                         si->need_reachability_test[i]++;
1821                         for (k = 0; k < 32; k++)
1822                                 if (si->used_shallow[i][j] & (1U << k))
1823                                         si->shallow_ref[j * 32 + k]++;
1824                 }
1825
1826                 /*
1827                  * true for those associated with some refs and belong
1828                  * in "ours" list aka "step 7 not done yet"
1829                  */
1830                 si->need_reachability_test[i] =
1831                         si->need_reachability_test[i] > 1;
1832         }
1833
1834         /*
1835          * keep hooks happy by forcing a temporary shallow file via
1836          * env variable because we can't add --shallow-file to every
1837          * command. check_connected() will be done with
1838          * true .git/shallow though.
1839          */
1840         setenv(GIT_SHALLOW_FILE_ENVIRONMENT, alt_shallow_file, 1);
1841 }
1842
1843 static void update_shallow_info(struct command *commands,
1844                                 struct shallow_info *si,
1845                                 struct oid_array *ref)
1846 {
1847         struct command *cmd;
1848         int *ref_status;
1849         remove_nonexistent_theirs_shallow(si);
1850         if (!si->nr_ours && !si->nr_theirs) {
1851                 shallow_update = 0;
1852                 return;
1853         }
1854
1855         for (cmd = commands; cmd; cmd = cmd->next) {
1856                 if (is_null_oid(&cmd->new_oid))
1857                         continue;
1858                 oid_array_append(ref, &cmd->new_oid);
1859                 cmd->index = ref->nr - 1;
1860         }
1861         si->ref = ref;
1862
1863         if (shallow_update) {
1864                 prepare_shallow_update(commands, si);
1865                 return;
1866         }
1867
1868         ALLOC_ARRAY(ref_status, ref->nr);
1869         assign_shallow_commits_to_refs(si, NULL, ref_status);
1870         for (cmd = commands; cmd; cmd = cmd->next) {
1871                 if (is_null_oid(&cmd->new_oid))
1872                         continue;
1873                 if (ref_status[cmd->index]) {
1874                         cmd->error_string = "shallow update not allowed";
1875                         cmd->skip_update = 1;
1876                 }
1877         }
1878         free(ref_status);
1879 }
1880
1881 static void report(struct command *commands, const char *unpack_status)
1882 {
1883         struct command *cmd;
1884         struct strbuf buf = STRBUF_INIT;
1885
1886         packet_buf_write(&buf, "unpack %s\n",
1887                          unpack_status ? unpack_status : "ok");
1888         for (cmd = commands; cmd; cmd = cmd->next) {
1889                 if (!cmd->error_string)
1890                         packet_buf_write(&buf, "ok %s\n",
1891                                          cmd->ref_name);
1892                 else
1893                         packet_buf_write(&buf, "ng %s %s\n",
1894                                          cmd->ref_name, cmd->error_string);
1895         }
1896         packet_buf_flush(&buf);
1897
1898         if (use_sideband)
1899                 send_sideband(1, 1, buf.buf, buf.len, use_sideband);
1900         else
1901                 write_or_die(1, buf.buf, buf.len);
1902         strbuf_release(&buf);
1903 }
1904
1905 static int delete_only(struct command *commands)
1906 {
1907         struct command *cmd;
1908         for (cmd = commands; cmd; cmd = cmd->next) {
1909                 if (!is_null_oid(&cmd->new_oid))
1910                         return 0;
1911         }
1912         return 1;
1913 }
1914
1915 int cmd_receive_pack(int argc, const char **argv, const char *prefix)
1916 {
1917         int advertise_refs = 0;
1918         struct command *commands;
1919         struct oid_array shallow = OID_ARRAY_INIT;
1920         struct oid_array ref = OID_ARRAY_INIT;
1921         struct shallow_info si;
1922
1923         struct option options[] = {
1924                 OPT__QUIET(&quiet, N_("quiet")),
1925                 OPT_HIDDEN_BOOL(0, "stateless-rpc", &stateless_rpc, NULL),
1926                 OPT_HIDDEN_BOOL(0, "advertise-refs", &advertise_refs, NULL),
1927                 OPT_HIDDEN_BOOL(0, "reject-thin-pack-for-testing", &reject_thin, NULL),
1928                 OPT_END()
1929         };
1930
1931         packet_trace_identity("receive-pack");
1932
1933         argc = parse_options(argc, argv, prefix, options, receive_pack_usage, 0);
1934
1935         if (argc > 1)
1936                 usage_msg_opt(_("Too many arguments."), receive_pack_usage, options);
1937         if (argc == 0)
1938                 usage_msg_opt(_("You must specify a directory."), receive_pack_usage, options);
1939
1940         service_dir = argv[0];
1941
1942         setup_path();
1943
1944         if (!enter_repo(service_dir, 0))
1945                 die("'%s' does not appear to be a git repository", service_dir);
1946
1947         git_config(receive_pack_config, NULL);
1948         if (cert_nonce_seed)
1949                 push_cert_nonce = prepare_push_cert_nonce(service_dir, time(NULL));
1950
1951         if (0 <= transfer_unpack_limit)
1952                 unpack_limit = transfer_unpack_limit;
1953         else if (0 <= receive_unpack_limit)
1954                 unpack_limit = receive_unpack_limit;
1955
1956         switch (determine_protocol_version_server()) {
1957         case protocol_v2:
1958                 /*
1959                  * push support for protocol v2 has not been implemented yet,
1960                  * so ignore the request to use v2 and fallback to using v0.
1961                  */
1962                 break;
1963         case protocol_v1:
1964                 /*
1965                  * v1 is just the original protocol with a version string,
1966                  * so just fall through after writing the version string.
1967                  */
1968                 if (advertise_refs || !stateless_rpc)
1969                         packet_write_fmt(1, "version 1\n");
1970
1971                 /* fallthrough */
1972         case protocol_v0:
1973                 break;
1974         case protocol_unknown_version:
1975                 BUG("unknown protocol version");
1976         }
1977
1978         if (advertise_refs || !stateless_rpc) {
1979                 write_head_info();
1980         }
1981         if (advertise_refs)
1982                 return 0;
1983
1984         if ((commands = read_head_info(&shallow)) != NULL) {
1985                 const char *unpack_status = NULL;
1986                 struct string_list push_options = STRING_LIST_INIT_DUP;
1987
1988                 if (use_push_options)
1989                         read_push_options(&push_options);
1990                 if (!check_cert_push_options(&push_options)) {
1991                         struct command *cmd;
1992                         for (cmd = commands; cmd; cmd = cmd->next)
1993                                 cmd->error_string = "inconsistent push options";
1994                 }
1995
1996                 prepare_shallow_info(&si, &shallow);
1997                 if (!si.nr_ours && !si.nr_theirs)
1998                         shallow_update = 0;
1999                 if (!delete_only(commands)) {
2000                         unpack_status = unpack_with_sideband(&si);
2001                         update_shallow_info(commands, &si, &ref);
2002                 }
2003                 use_keepalive = KEEPALIVE_ALWAYS;
2004                 execute_commands(commands, unpack_status, &si,
2005                                  &push_options);
2006                 if (pack_lockfile)
2007                         unlink_or_warn(pack_lockfile);
2008                 if (report_status)
2009                         report(commands, unpack_status);
2010                 run_receive_hook(commands, "post-receive", 1,
2011                                  &push_options);
2012                 run_update_post_hook(commands);
2013                 string_list_clear(&push_options, 0);
2014                 if (auto_gc) {
2015                         const char *argv_gc_auto[] = {
2016                                 "gc", "--auto", "--quiet", NULL,
2017                         };
2018                         struct child_process proc = CHILD_PROCESS_INIT;
2019
2020                         proc.no_stdin = 1;
2021                         proc.stdout_to_stderr = 1;
2022                         proc.err = use_sideband ? -1 : 0;
2023                         proc.git_cmd = 1;
2024                         proc.argv = argv_gc_auto;
2025
2026                         close_all_packs(the_repository->objects);
2027                         if (!start_command(&proc)) {
2028                                 if (use_sideband)
2029                                         copy_to_sideband(proc.err, -1, NULL);
2030                                 finish_command(&proc);
2031                         }
2032                 }
2033                 if (auto_update_server_info)
2034                         update_server_info(0);
2035                 clear_shallow_info(&si);
2036         }
2037         if (use_sideband)
2038                 packet_flush(1);
2039         oid_array_clear(&shallow);
2040         oid_array_clear(&ref);
2041         free((void *)push_cert_nonce);
2042         return 0;
2043 }