push --signed: tighten what the receiving end can ask to sign
[git] / send-pack.c
1 #include "builtin.h"
2 #include "commit.h"
3 #include "refs.h"
4 #include "pkt-line.h"
5 #include "sideband.h"
6 #include "run-command.h"
7 #include "remote.h"
8 #include "connect.h"
9 #include "send-pack.h"
10 #include "quote.h"
11 #include "transport.h"
12 #include "version.h"
13 #include "sha1-array.h"
14 #include "gpg-interface.h"
15
16 static int feed_object(const unsigned char *sha1, int fd, int negative)
17 {
18         char buf[42];
19
20         if (negative && !has_sha1_file(sha1))
21                 return 1;
22
23         memcpy(buf + negative, sha1_to_hex(sha1), 40);
24         if (negative)
25                 buf[0] = '^';
26         buf[40 + negative] = '\n';
27         return write_or_whine(fd, buf, 41 + negative, "send-pack: send refs");
28 }
29
30 /*
31  * Make a pack stream and spit it out into file descriptor fd
32  */
33 static int pack_objects(int fd, struct ref *refs, struct sha1_array *extra, struct send_pack_args *args)
34 {
35         /*
36          * The child becomes pack-objects --revs; we feed
37          * the revision parameters to it via its stdin and
38          * let its stdout go back to the other end.
39          */
40         const char *argv[] = {
41                 "pack-objects",
42                 "--all-progress-implied",
43                 "--revs",
44                 "--stdout",
45                 NULL,
46                 NULL,
47                 NULL,
48                 NULL,
49                 NULL,
50         };
51         struct child_process po;
52         int i;
53
54         i = 4;
55         if (args->use_thin_pack)
56                 argv[i++] = "--thin";
57         if (args->use_ofs_delta)
58                 argv[i++] = "--delta-base-offset";
59         if (args->quiet || !args->progress)
60                 argv[i++] = "-q";
61         if (args->progress)
62                 argv[i++] = "--progress";
63         memset(&po, 0, sizeof(po));
64         po.argv = argv;
65         po.in = -1;
66         po.out = args->stateless_rpc ? -1 : fd;
67         po.git_cmd = 1;
68         if (start_command(&po))
69                 die_errno("git pack-objects failed");
70
71         /*
72          * We feed the pack-objects we just spawned with revision
73          * parameters by writing to the pipe.
74          */
75         for (i = 0; i < extra->nr; i++)
76                 if (!feed_object(extra->sha1[i], po.in, 1))
77                         break;
78
79         while (refs) {
80                 if (!is_null_sha1(refs->old_sha1) &&
81                     !feed_object(refs->old_sha1, po.in, 1))
82                         break;
83                 if (!is_null_sha1(refs->new_sha1) &&
84                     !feed_object(refs->new_sha1, po.in, 0))
85                         break;
86                 refs = refs->next;
87         }
88
89         close(po.in);
90
91         if (args->stateless_rpc) {
92                 char *buf = xmalloc(LARGE_PACKET_MAX);
93                 while (1) {
94                         ssize_t n = xread(po.out, buf, LARGE_PACKET_MAX);
95                         if (n <= 0)
96                                 break;
97                         send_sideband(fd, -1, buf, n, LARGE_PACKET_MAX);
98                 }
99                 free(buf);
100                 close(po.out);
101                 po.out = -1;
102         }
103
104         if (finish_command(&po))
105                 return -1;
106         return 0;
107 }
108
109 static int receive_status(int in, struct ref *refs)
110 {
111         struct ref *hint;
112         int ret = 0;
113         char *line = packet_read_line(in, NULL);
114         if (!starts_with(line, "unpack "))
115                 return error("did not receive remote status");
116         if (strcmp(line, "unpack ok")) {
117                 error("unpack failed: %s", line + 7);
118                 ret = -1;
119         }
120         hint = NULL;
121         while (1) {
122                 char *refname;
123                 char *msg;
124                 line = packet_read_line(in, NULL);
125                 if (!line)
126                         break;
127                 if (!starts_with(line, "ok ") && !starts_with(line, "ng ")) {
128                         error("invalid ref status from remote: %s", line);
129                         ret = -1;
130                         break;
131                 }
132
133                 refname = line + 3;
134                 msg = strchr(refname, ' ');
135                 if (msg)
136                         *msg++ = '\0';
137
138                 /* first try searching at our hint, falling back to all refs */
139                 if (hint)
140                         hint = find_ref_by_name(hint, refname);
141                 if (!hint)
142                         hint = find_ref_by_name(refs, refname);
143                 if (!hint) {
144                         warning("remote reported status on unknown ref: %s",
145                                         refname);
146                         continue;
147                 }
148                 if (hint->status != REF_STATUS_EXPECTING_REPORT) {
149                         warning("remote reported status on unexpected ref: %s",
150                                         refname);
151                         continue;
152                 }
153
154                 if (line[0] == 'o' && line[1] == 'k')
155                         hint->status = REF_STATUS_OK;
156                 else {
157                         hint->status = REF_STATUS_REMOTE_REJECT;
158                         ret = -1;
159                 }
160                 if (msg)
161                         hint->remote_status = xstrdup(msg);
162                 /* start our next search from the next ref */
163                 hint = hint->next;
164         }
165         return ret;
166 }
167
168 static int sideband_demux(int in, int out, void *data)
169 {
170         int *fd = data, ret;
171 #ifdef NO_PTHREADS
172         close(fd[1]);
173 #endif
174         ret = recv_sideband("send-pack", fd[0], out);
175         close(out);
176         return ret;
177 }
178
179 static int advertise_shallow_grafts_cb(const struct commit_graft *graft, void *cb)
180 {
181         struct strbuf *sb = cb;
182         if (graft->nr_parent == -1)
183                 packet_buf_write(sb, "shallow %s\n", sha1_to_hex(graft->sha1));
184         return 0;
185 }
186
187 static void advertise_shallow_grafts_buf(struct strbuf *sb)
188 {
189         if (!is_repository_shallow())
190                 return;
191         for_each_commit_graft(advertise_shallow_grafts_cb, sb);
192 }
193
194 static int ref_update_to_be_sent(const struct ref *ref, const struct send_pack_args *args)
195 {
196         if (!ref->peer_ref && !args->send_mirror)
197                 return 0;
198
199         /* Check for statuses set by set_ref_status_for_push() */
200         switch (ref->status) {
201         case REF_STATUS_REJECT_NONFASTFORWARD:
202         case REF_STATUS_REJECT_ALREADY_EXISTS:
203         case REF_STATUS_REJECT_FETCH_FIRST:
204         case REF_STATUS_REJECT_NEEDS_FORCE:
205         case REF_STATUS_REJECT_STALE:
206         case REF_STATUS_REJECT_NODELETE:
207         case REF_STATUS_UPTODATE:
208                 return 0;
209         default:
210                 return 1;
211         }
212 }
213
214 /*
215  * the beginning of the next line, or the end of buffer.
216  *
217  * NEEDSWORK: perhaps move this to git-compat-util.h or somewhere and
218  * convert many similar uses found by "git grep -A4 memchr".
219  */
220 static const char *next_line(const char *line, size_t len)
221 {
222         const char *nl = memchr(line, '\n', len);
223         if (!nl)
224                 return line + len; /* incomplete line */
225         return nl + 1;
226 }
227
228 static int generate_push_cert(struct strbuf *req_buf,
229                               const struct ref *remote_refs,
230                               struct send_pack_args *args,
231                               const char *cap_string,
232                               const char *push_cert_nonce)
233 {
234         const struct ref *ref;
235         char stamp[60];
236         char *signing_key = xstrdup(get_signing_key());
237         const char *cp, *np;
238         struct strbuf cert = STRBUF_INIT;
239         int update_seen = 0;
240
241         datestamp(stamp, sizeof(stamp));
242         strbuf_addf(&cert, "certificate version 0.1\n");
243         strbuf_addf(&cert, "pusher %s %s\n", signing_key, stamp);
244         if (args->url && *args->url) {
245                 char *anon_url = transport_anonymize_url(args->url);
246                 strbuf_addf(&cert, "pushee %s\n", anon_url);
247                 free(anon_url);
248         }
249         if (push_cert_nonce[0])
250                 strbuf_addf(&cert, "nonce %s\n", push_cert_nonce);
251         strbuf_addstr(&cert, "\n");
252
253         for (ref = remote_refs; ref; ref = ref->next) {
254                 if (!ref_update_to_be_sent(ref, args))
255                         continue;
256                 update_seen = 1;
257                 strbuf_addf(&cert, "%s %s %s\n",
258                             sha1_to_hex(ref->old_sha1),
259                             sha1_to_hex(ref->new_sha1),
260                             ref->name);
261         }
262         if (!update_seen)
263                 goto free_return;
264
265         if (sign_buffer(&cert, &cert, signing_key))
266                 die(_("failed to sign the push certificate"));
267
268         packet_buf_write(req_buf, "push-cert%c%s", 0, cap_string);
269         for (cp = cert.buf; cp < cert.buf + cert.len; cp = np) {
270                 np = next_line(cp, cert.buf + cert.len - cp);
271                 packet_buf_write(req_buf,
272                                  "%.*s", (int)(np - cp), cp);
273         }
274         packet_buf_write(req_buf, "push-cert-end\n");
275
276 free_return:
277         free(signing_key);
278         strbuf_release(&cert);
279         return update_seen;
280 }
281
282 #define NONCE_LEN_LIMIT 256
283
284 static void reject_invalid_nonce(const char *nonce, int len)
285 {
286         int i = 0;
287
288         if (NONCE_LEN_LIMIT <= len)
289                 die("the receiving end asked to sign an invalid nonce <%.*s>",
290                     len, nonce);
291
292         for (i = 0; i < len; i++) {
293                 int ch = nonce[i] & 0xFF;
294                 if (isalnum(ch) ||
295                     ch == '-' || ch == '.' ||
296                     ch == '/' || ch == '+' ||
297                     ch == '=' || ch == '_')
298                         continue;
299                 die("the receiving end asked to sign an invalid nonce <%.*s>",
300                     len, nonce);
301         }
302 }
303
304 int send_pack(struct send_pack_args *args,
305               int fd[], struct child_process *conn,
306               struct ref *remote_refs,
307               struct sha1_array *extra_have)
308 {
309         int in = fd[0];
310         int out = fd[1];
311         struct strbuf req_buf = STRBUF_INIT;
312         struct strbuf cap_buf = STRBUF_INIT;
313         struct ref *ref;
314         int need_pack_data = 0;
315         int allow_deleting_refs = 0;
316         int status_report = 0;
317         int use_sideband = 0;
318         int quiet_supported = 0;
319         int agent_supported = 0;
320         unsigned cmds_sent = 0;
321         int ret;
322         struct async demux;
323         const char *push_cert_nonce = NULL;
324
325         /* Does the other end support the reporting? */
326         if (server_supports("report-status"))
327                 status_report = 1;
328         if (server_supports("delete-refs"))
329                 allow_deleting_refs = 1;
330         if (server_supports("ofs-delta"))
331                 args->use_ofs_delta = 1;
332         if (server_supports("side-band-64k"))
333                 use_sideband = 1;
334         if (server_supports("quiet"))
335                 quiet_supported = 1;
336         if (server_supports("agent"))
337                 agent_supported = 1;
338         if (server_supports("no-thin"))
339                 args->use_thin_pack = 0;
340         if (args->push_cert) {
341                 int len;
342
343                 push_cert_nonce = server_feature_value("push-cert", &len);
344                 if (!push_cert_nonce)
345                         die(_("the receiving end does not support --signed push"));
346                 reject_invalid_nonce(push_cert_nonce, len);
347                 push_cert_nonce = xmemdupz(push_cert_nonce, len);
348         }
349
350         if (!remote_refs) {
351                 fprintf(stderr, "No refs in common and none specified; doing nothing.\n"
352                         "Perhaps you should specify a branch such as 'master'.\n");
353                 return 0;
354         }
355
356         if (status_report)
357                 strbuf_addstr(&cap_buf, " report-status");
358         if (use_sideband)
359                 strbuf_addstr(&cap_buf, " side-band-64k");
360         if (quiet_supported && (args->quiet || !args->progress))
361                 strbuf_addstr(&cap_buf, " quiet");
362         if (agent_supported)
363                 strbuf_addf(&cap_buf, " agent=%s", git_user_agent_sanitized());
364
365         /*
366          * NEEDSWORK: why does delete-refs have to be so specific to
367          * send-pack machinery that set_ref_status_for_push() cannot
368          * set this bit for us???
369          */
370         for (ref = remote_refs; ref; ref = ref->next)
371                 if (ref->deletion && !allow_deleting_refs)
372                         ref->status = REF_STATUS_REJECT_NODELETE;
373
374         if (!args->dry_run)
375                 advertise_shallow_grafts_buf(&req_buf);
376
377         if (!args->dry_run && args->push_cert)
378                 cmds_sent = generate_push_cert(&req_buf, remote_refs, args,
379                                                cap_buf.buf, push_cert_nonce);
380
381         /*
382          * Clear the status for each ref and see if we need to send
383          * the pack data.
384          */
385         for (ref = remote_refs; ref; ref = ref->next) {
386                 if (!ref_update_to_be_sent(ref, args))
387                         continue;
388
389                 if (!ref->deletion)
390                         need_pack_data = 1;
391
392                 if (args->dry_run || !status_report)
393                         ref->status = REF_STATUS_OK;
394                 else
395                         ref->status = REF_STATUS_EXPECTING_REPORT;
396         }
397
398         /*
399          * Finally, tell the other end!
400          */
401         for (ref = remote_refs; ref; ref = ref->next) {
402                 char *old_hex, *new_hex;
403
404                 if (args->dry_run || args->push_cert)
405                         continue;
406
407                 if (!ref_update_to_be_sent(ref, args))
408                         continue;
409
410                 old_hex = sha1_to_hex(ref->old_sha1);
411                 new_hex = sha1_to_hex(ref->new_sha1);
412                 if (!cmds_sent) {
413                         packet_buf_write(&req_buf,
414                                          "%s %s %s%c%s",
415                                          old_hex, new_hex, ref->name, 0,
416                                          cap_buf.buf);
417                         cmds_sent = 1;
418                 } else {
419                         packet_buf_write(&req_buf, "%s %s %s",
420                                          old_hex, new_hex, ref->name);
421                 }
422         }
423
424         if (args->stateless_rpc) {
425                 if (!args->dry_run && (cmds_sent || is_repository_shallow())) {
426                         packet_buf_flush(&req_buf);
427                         send_sideband(out, -1, req_buf.buf, req_buf.len, LARGE_PACKET_MAX);
428                 }
429         } else {
430                 write_or_die(out, req_buf.buf, req_buf.len);
431                 packet_flush(out);
432         }
433         strbuf_release(&req_buf);
434         strbuf_release(&cap_buf);
435
436         if (use_sideband && cmds_sent) {
437                 memset(&demux, 0, sizeof(demux));
438                 demux.proc = sideband_demux;
439                 demux.data = fd;
440                 demux.out = -1;
441                 if (start_async(&demux))
442                         die("send-pack: unable to fork off sideband demultiplexer");
443                 in = demux.out;
444         }
445
446         if (need_pack_data && cmds_sent) {
447                 if (pack_objects(out, remote_refs, extra_have, args) < 0) {
448                         for (ref = remote_refs; ref; ref = ref->next)
449                                 ref->status = REF_STATUS_NONE;
450                         if (args->stateless_rpc)
451                                 close(out);
452                         if (git_connection_is_socket(conn))
453                                 shutdown(fd[0], SHUT_WR);
454                         if (use_sideband)
455                                 finish_async(&demux);
456                         fd[1] = -1;
457                         return -1;
458                 }
459                 if (!args->stateless_rpc)
460                         /* Closed by pack_objects() via start_command() */
461                         fd[1] = -1;
462         }
463         if (args->stateless_rpc && cmds_sent)
464                 packet_flush(out);
465
466         if (status_report && cmds_sent)
467                 ret = receive_status(in, remote_refs);
468         else
469                 ret = 0;
470         if (args->stateless_rpc)
471                 packet_flush(out);
472
473         if (use_sideband && cmds_sent) {
474                 if (finish_async(&demux)) {
475                         error("error in sideband demultiplexer");
476                         ret = -1;
477                 }
478                 close(demux.out);
479         }
480
481         if (ret < 0)
482                 return ret;
483
484         if (args->porcelain)
485                 return 0;
486
487         for (ref = remote_refs; ref; ref = ref->next) {
488                 switch (ref->status) {
489                 case REF_STATUS_NONE:
490                 case REF_STATUS_UPTODATE:
491                 case REF_STATUS_OK:
492                         break;
493                 default:
494                         return -1;
495                 }
496         }
497         return 0;
498 }