Gotweb

Blob

Date:: Sat Apr 1 21:36:12 2023 UTC
Message:: fix an off-by-one in got_serve_parse_command() canonpath allocation ok op@, tracey@
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/queue.h>
19 #include <sys/uio.h>
20 
21 #include <errno.h>
22 #include <event.h>
23 #include <poll.h>
24 #include <limits.h>
25 #include <stdio.h>
26 #include <stdint.h>
27 #include <stdlib.h>
28 #include <string.h>
29 #include <imsg.h>
30 #include <unistd.h>
31 
32 #include "got_error.h"
33 #include "got_serve.h"
34 #include "got_path.h"
35 #include "got_version.h"
36 #include "got_reference.h"
37 #include "got_object.h"
38 
39 #include "got_lib_pkt.h"
40 #include "got_lib_dial.h"
41 #include "got_lib_gitproto.h"
42 #include "got_lib_hash.h"
43 #include "got_lib_poll.h"
44 
45 #include "gotd.h"
46 
47 #ifndef nitems
48 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
49 #endif
50 
51 static const struct got_capability read_capabilities[] = {
52 	{ GOT_CAPA_AGENT, "got/" GOT_VERSION_STR },
53 	{ GOT_CAPA_OFS_DELTA, NULL },
54 	{ GOT_CAPA_SIDE_BAND_64K, NULL },
55 };
56 
57 static const struct got_capability write_capabilities[] = {
58 	{ GOT_CAPA_AGENT, "got/" GOT_VERSION_STR },
59 	{ GOT_CAPA_OFS_DELTA, NULL },
60 	{ GOT_CAPA_REPORT_STATUS, NULL },
61 	{ GOT_CAPA_NO_THIN, NULL },
62 	{ GOT_CAPA_DELETE_REFS, NULL },
63 };
64 
65 const struct got_error *
66 got_serve_parse_command(char **command, char **repo_path, const char *gitcmd)
67 {
68 	const struct got_error *err = NULL;
69 	size_t len, cmdlen, pathlen;
70 	char *path0 = NULL, *path, *abspath = NULL, *canonpath = NULL;
71 	const char *relpath;
72 
73 	*command = NULL;
74 	*repo_path = NULL;
75 
76 	len = strlen(gitcmd);
77 
78 	if (len >= strlen(GOT_SERVE_CMD_SEND) &&
79 	    strncmp(gitcmd, GOT_SERVE_CMD_SEND,
80 	    strlen(GOT_SERVE_CMD_SEND)) == 0)
81 		cmdlen = strlen(GOT_SERVE_CMD_SEND);
82 	else if (len >= strlen(GOT_SERVE_CMD_FETCH) &&
83 	    strncmp(gitcmd, GOT_SERVE_CMD_FETCH,
84 	    strlen(GOT_SERVE_CMD_FETCH)) == 0)
85 		cmdlen = strlen(GOT_SERVE_CMD_FETCH);
86 	else
87 		return got_error(GOT_ERR_BAD_PACKET);
88 
89 	if (len <= cmdlen + 1 || gitcmd[cmdlen] != ' ')
90 		return got_error(GOT_ERR_BAD_PACKET);
91 
92 	if (memchr(&gitcmd[cmdlen + 1], '\0', len - cmdlen) == NULL)
93 		return got_error(GOT_ERR_BAD_PATH);
94 
95 	/* Forbid linefeeds in paths, like Git does. */
96 	if (memchr(&gitcmd[cmdlen + 1], '\n', len - cmdlen) != NULL)
97 		return got_error(GOT_ERR_BAD_PATH);
98 
99 	path0 = strdup(&gitcmd[cmdlen + 1]);
100 	if (path0 == NULL)
101 		return got_error_from_errno("strdup");
102 	path = path0;
103 	pathlen = strlen(path);
104 
105 	/*
106 	 * Git clients send a shell command.
107 	 * Trim spaces and quotes around the path.
108 	 */
109 	while (path[0] == '\'' || path[0] == '\"' || path[0] == ' ') {
110 		path++;
111 		pathlen--;
112 	}
113 	while (pathlen > 0 &&
114 	    (path[pathlen - 1] == '\'' || path[pathlen - 1] == '\"' ||
115 	    path[pathlen - 1] == ' ')) {
116 		path[pathlen - 1] = '\0';
117 		pathlen--;
118 	}
119 
120 	/* Deny an empty repository path. */
121 	if (path[0] == '\0' || got_path_is_root_dir(path)) {
122 		err = got_error(GOT_ERR_NOT_GIT_REPO);
123 		goto done;
124 	}
125 
126 	if (asprintf(&abspath, "/%s", path) == -1) {
127 		err = got_error_from_errno("asprintf");
128 		goto done;
129 	}
130 	pathlen = strlen(abspath);
131 	canonpath = malloc(pathlen + 1);
132 	if (canonpath == NULL) {
133 		err = got_error_from_errno("malloc");
134 		goto done;
135 	}
136 	err = got_canonpath(abspath, canonpath, pathlen + 1);
137 	if (err)
138 		goto done;
139 
140 	relpath = canonpath;
141 	while (relpath[0] == '/')
142 		relpath++;
143 	*repo_path = strdup(relpath);
144 	if (*repo_path == NULL) {
145 		err = got_error_from_errno("strdup");
146 		goto done;
147 	}
148 	*command = strndup(gitcmd, cmdlen);
149 	if (*command == NULL)
150 		err = got_error_from_errno("strndup");
151 done:
152 	free(path0);
153 	free(abspath);
154 	free(canonpath);
155 	if (err) {
156 		free(*repo_path);
157 		*repo_path = NULL;
158 	}
159 	return err;
160 }
161 
162 static const struct got_error *
163 append_read_capabilities(size_t *capalen, size_t len, const char *symrefstr,
164     uint8_t *buf, size_t bufsize)
165 {
166 	struct got_capability capa[nitems(read_capabilities) + 1];
167 	size_t ncapa;
168 
169 	memcpy(&capa, read_capabilities, sizeof(read_capabilities));
170 	if (symrefstr) {
171 		capa[nitems(read_capabilities)].key = "symref";
172 		capa[nitems(read_capabilities)].value = symrefstr;
173 		ncapa = nitems(capa);
174 	} else
175 		ncapa = nitems(read_capabilities);
176 
177 	return got_gitproto_append_capabilities(capalen, buf, len,
178 	    bufsize, capa, ncapa);
179 }
180 
181 static const struct got_error *
182 send_ref(int outfd, uint8_t *id, const char *refname, int send_capabilities,
183     int client_is_reading, const char *symrefstr, int chattygot)
184 {
185 	const struct got_error *err = NULL;
186 	char hex[SHA1_DIGEST_STRING_LENGTH];
187 	char buf[GOT_PKT_MAX];
188 	size_t len, capalen = 0;
189 
190 	if (got_sha1_digest_to_str(id, hex, sizeof(hex)) == NULL)
191 		return got_error(GOT_ERR_BAD_OBJ_ID);
192 
193 	len = snprintf(buf, sizeof(buf), "%s %s", hex, refname);
194 	if (len >= sizeof(buf))
195 		return got_error(GOT_ERR_NO_SPACE);
196 
197 	if (send_capabilities) {
198 		if (client_is_reading) {
199 			err = append_read_capabilities(&capalen, len,
200 			    symrefstr, buf, sizeof(buf));
201 		} else {
202 			err = got_gitproto_append_capabilities(&capalen,
203 			    buf, len, sizeof(buf), write_capabilities,
204 			    nitems(write_capabilities));
205 		}
206 		if (err)
207 			return err;
208 		len += capalen;
209 	}
210 
211 	if (len + 1 >= sizeof(buf))
212 		return got_error(GOT_ERR_NO_SPACE);
213 	buf[len] = '\n';
214 	len++;
215 	buf[len] = '\0';
216 
217 	return got_pkt_writepkt(outfd, buf, len, chattygot);
218 }
219 
220 static const struct got_error *
221 send_zero_refs(int outfd, int client_is_reading, int chattygot)
222 {
223 	const struct got_error *err = NULL;
224 	const char *line = GOT_SHA1_STRING_ZERO " capabilities^{}";
225 	char buf[GOT_PKT_MAX];
226 	size_t len, capalen = 0;
227 
228 	len = strlcpy(buf, line, sizeof(buf));
229 	if (len >= sizeof(buf))
230 		return got_error(GOT_ERR_NO_SPACE);
231 
232 	if (client_is_reading) {
233 		err = got_gitproto_append_capabilities(&capalen, buf, len,
234 		    sizeof(buf), read_capabilities, nitems(read_capabilities));
235 		if (err)
236 			return err;
237 	} else {
238 		err = got_gitproto_append_capabilities(&capalen, buf, len,
239 		    sizeof(buf), write_capabilities,
240 		    nitems(write_capabilities));
241 		if (err)
242 			return err;
243 	}
244 
245 	return got_pkt_writepkt(outfd, buf, len + capalen, chattygot);
246 }
247 
248 static void
249 echo_error(const struct got_error *err, int outfd, int chattygot)
250 {
251 	char buf[4 + GOT_ERR_MAX_MSG_SIZE];
252 	size_t len;
253 
254 	/*
255 	 * Echo the error to the client on a pkt-line.
256 	 * The client should then terminate its session.
257 	 */
258 	buf[0] = 'E'; buf[1] = 'R'; buf[2] = 'R'; buf[3] = ' '; buf[4] = '\0';
259 	len = strlcat(buf, err->msg, sizeof(buf));
260 	got_pkt_writepkt(outfd, buf, len, chattygot);
261 }
262 
263 static const struct got_error *
264 announce_refs(int outfd, struct imsgbuf *ibuf, int client_is_reading,
265     const char *repo_path, int chattygot)
266 {
267 	const struct got_error *err = NULL;
268 	struct imsg imsg;
269 	size_t datalen;
270 	struct gotd_imsg_list_refs lsref;
271 	struct gotd_imsg_reflist ireflist;
272 	struct gotd_imsg_ref iref;
273 	struct gotd_imsg_symref isymref;
274 	size_t nrefs = 0;
275 	int have_nrefs = 0, sent_capabilities = 0;
276 	char *symrefname = NULL, *symreftarget = NULL, *symrefstr = NULL;
277 	char *refname = NULL;
278 
279 	memset(&imsg, 0, sizeof(imsg));
280 	memset(&lsref, 0, sizeof(lsref));
281 
282 	if (strlcpy(lsref.repo_name, repo_path, sizeof(lsref.repo_name)) >=
283 	    sizeof(lsref.repo_name))
284 		return got_error(GOT_ERR_NO_SPACE);
285 	lsref.client_is_reading = client_is_reading;
286 
287 	if (imsg_compose(ibuf, GOTD_IMSG_LIST_REFS, 0, 0, -1,
288 	    &lsref, sizeof(lsref)) == -1)
289 		return got_error_from_errno("imsg_compose LIST_REFS");
290 
291 	err = gotd_imsg_flush(ibuf);
292 	if (err)
293 		return err;
294 
295 	while (!have_nrefs || nrefs > 0) {
296 		err = gotd_imsg_poll_recv(&imsg, ibuf, 0);
297 		if (err)
298 			goto done;
299 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
300 		switch (imsg.hdr.type) {
301 		case GOTD_IMSG_ERROR:
302 			err = gotd_imsg_recv_error(NULL, &imsg);
303 			goto done;
304 		case GOTD_IMSG_REFLIST:
305 			if (have_nrefs || nrefs > 0) {
306 				err = got_error(GOT_ERR_PRIVSEP_MSG);
307 				goto done;
308 			}
309 			if (datalen != sizeof(ireflist)) {
310 				err = got_error(GOT_ERR_PRIVSEP_MSG);
311 				goto done;
312 			}
313 			memcpy(&ireflist, imsg.data, sizeof(ireflist));
314 			nrefs = ireflist.nrefs;
315 			have_nrefs = 1;
316 			if (nrefs == 0)
317 				err = send_zero_refs(outfd, client_is_reading,
318 				    chattygot);
319 			break;
320 		case GOTD_IMSG_REF:
321 			if (!have_nrefs || nrefs == 0) {
322 				err = got_error(GOT_ERR_PRIVSEP_MSG);
323 				goto done;
324 			}
325 			if (datalen < sizeof(iref)) {
326 				err = got_error(GOT_ERR_PRIVSEP_MSG);
327 				goto done;
328 			}
329 			memcpy(&iref, imsg.data, sizeof(iref));
330 			if (datalen != sizeof(iref) + iref.name_len) {
331 				err = got_error(GOT_ERR_PRIVSEP_LEN);
332 				goto done;
333 			}
334 			refname = strndup(imsg.data + sizeof(iref),
335 			    iref.name_len);
336 			if (refname == NULL) {
337 				err = got_error_from_errno("strndup");
338 				goto done;
339 			}
340 			err = send_ref(outfd, iref.id, refname,
341 			    !sent_capabilities, client_is_reading,
342 			    NULL, chattygot);
343 			free(refname);
344 			refname = NULL;
345 			if (err)
346 				goto done;
347 			sent_capabilities = 1;
348 			if (nrefs > 0)
349 				nrefs--;
350 			break;
351 		case GOTD_IMSG_SYMREF:
352 			if (!have_nrefs || nrefs == 0) {
353 				err = got_error(GOT_ERR_PRIVSEP_MSG);
354 				goto done;
355 			}
356 			if (datalen < sizeof(isymref)) {
357 				err = got_error(GOT_ERR_PRIVSEP_LEN);
358 				goto done;
359 			}
360 			memcpy(&isymref, imsg.data, sizeof(isymref));
361 			if (datalen != sizeof(isymref) + isymref.name_len +
362 			    isymref.target_len) {
363 				err = got_error(GOT_ERR_PRIVSEP_LEN);
364 				goto done;
365 			}
366 
367 			/*
368 			 * For now, we only announce one symbolic ref,
369 			 * as part of our capability advertisement.
370 			 */
371 			if (sent_capabilities || symrefstr != NULL ||
372 			    symrefname != NULL || symreftarget != NULL)
373 				break;
374 
375 			symrefname = strndup(imsg.data + sizeof(isymref),
376 			    isymref.name_len);
377 			if (symrefname == NULL) {
378 				err = got_error_from_errno("malloc");
379 				goto done;
380 			}
381 
382 			symreftarget = strndup(
383 			    imsg.data + sizeof(isymref) + isymref.name_len,
384 			    isymref.target_len);
385 			if (symreftarget == NULL) {
386 				err = got_error_from_errno("strndup");
387 				goto done;
388 			}
389 
390 			if (asprintf(&symrefstr, "%s:%s", symrefname,
391 			    symreftarget) == -1) {
392 				err = got_error_from_errno("asprintf");
393 				goto done;
394 			}
395 			err = send_ref(outfd, isymref.target_id, symrefname,
396 			    !sent_capabilities, client_is_reading, symrefstr,
397 			    chattygot);
398 			free(refname);
399 			refname = NULL;
400 			if (err)
401 				goto done;
402 			sent_capabilities = 1;
403 			if (nrefs > 0)
404 				nrefs--;
405 			break;
406 		default:
407 			err = got_error(GOT_ERR_PRIVSEP_MSG);
408 			break;
409 		}
410 
411 		imsg_free(&imsg);
412 	}
413 
414 	err = got_pkt_flushpkt(outfd, chattygot);
415 	if (err)
416 		goto done;
417 done:
418 	free(symrefstr);
419 	free(symrefname);
420 	free(symreftarget);
421 	return err;
422 }
423 
424 static const struct got_error *
425 parse_want_line(char **common_capabilities, uint8_t *id, char *buf, size_t len)
426 {
427 	const struct got_error *err;
428 	char *id_str = NULL, *client_capabilities = NULL;
429 
430 	err = got_gitproto_parse_want_line(&id_str,
431 	    &client_capabilities, buf, len);
432 	if (err)
433 		return err;
434 
435 	if (!got_parse_hash_digest(id, id_str, GOT_HASH_SHA1)) {
436 		err = got_error_msg(GOT_ERR_BAD_PACKET,
437 		    "want-line with bad object ID");
438 		goto done;
439 	}
440 
441 	if (client_capabilities) {
442 		err = got_gitproto_match_capabilities(common_capabilities,
443 		    NULL, client_capabilities, read_capabilities,
444 		    nitems(read_capabilities));
445 		if (err)
446 			goto done;
447 	}
448 done:
449 	free(id_str);
450 	free(client_capabilities);
451 	return err;
452 }
453 
454 static const struct got_error *
455 parse_have_line(uint8_t *id, char *buf, size_t len)
456 {
457 	const struct got_error *err;
458 	char *id_str = NULL;
459 
460 	err = got_gitproto_parse_have_line(&id_str, buf, len);
461 	if (err)
462 		return err;
463 
464 	if (!got_parse_hash_digest(id, id_str, GOT_HASH_SHA1)) {
465 		err = got_error_msg(GOT_ERR_BAD_PACKET,
466 		    "have-line with bad object ID");
467 		goto done;
468 	}
469 done:
470 	free(id_str);
471 	return err;
472 }
473 
474 static const struct got_error *
475 send_capability(struct got_capability *capa, struct imsgbuf *ibuf)
476 {
477 	const struct got_error *err = NULL;
478 	struct gotd_imsg_capability icapa;
479 	size_t len;
480 	struct ibuf *wbuf;
481 
482 	memset(&icapa, 0, sizeof(icapa));
483 
484 	icapa.key_len = strlen(capa->key);
485 	len = sizeof(icapa) + icapa.key_len;
486 	if (capa->value) {
487 		icapa.value_len = strlen(capa->value);
488 		len += icapa.value_len;
489 	}
490 
491 	wbuf = imsg_create(ibuf, GOTD_IMSG_CAPABILITY, 0, 0, len);
492 	if (wbuf == NULL) {
493 		err = got_error_from_errno("imsg_create CAPABILITY");
494 		return err;
495 	}
496 
497 	if (imsg_add(wbuf, &icapa, sizeof(icapa)) == -1)
498 		return got_error_from_errno("imsg_add CAPABILITY");
499 	if (imsg_add(wbuf, capa->key, icapa.key_len) == -1)
500 		return got_error_from_errno("imsg_add CAPABILITY");
501 	if (capa->value) {
502 		if (imsg_add(wbuf, capa->value, icapa.value_len) == -1)
503 			return got_error_from_errno("imsg_add CAPABILITY");
504 	}
505 
506 	wbuf->fd = -1;
507 	imsg_close(ibuf, wbuf);
508 
509 	return NULL;
510 }
511 
512 static const struct got_error *
513 send_capabilities(int *use_sidebands, int *report_status,
514     char *capabilities_str, struct imsgbuf *ibuf)
515 {
516 	const struct got_error *err = NULL;
517 	struct gotd_imsg_capabilities icapas;
518 	struct got_capability *capa = NULL;
519 	size_t ncapa, i;
520 
521 	err = got_gitproto_split_capabilities_str(&capa, &ncapa,
522 	    capabilities_str);
523 	if (err)
524 		return err;
525 
526 	icapas.ncapabilities = ncapa;
527 	if (imsg_compose(ibuf, GOTD_IMSG_CAPABILITIES, 0, 0, -1,
528 	    &icapas, sizeof(icapas)) == -1) {
529 		err = got_error_from_errno("imsg_compose IMSG_CAPABILITIES");
530 		goto done;
531 	}
532 
533 	for (i = 0; i < ncapa; i++) {
534 		err = send_capability(&capa[i], ibuf);
535 		if (err)
536 			goto done;
537 		if (use_sidebands &&
538 		    strcmp(capa[i].key, GOT_CAPA_SIDE_BAND_64K) == 0)
539 			*use_sidebands = 1;
540 		if (report_status &&
541 		    strcmp(capa[i].key, GOT_CAPA_REPORT_STATUS) == 0)
542 			*report_status = 1;
543 	}
544 done:
545 	free(capa);
546 	return err;
547 }
548 
549 static const struct got_error *
550 forward_flushpkt(struct imsgbuf *ibuf)
551 {
552 	if (imsg_compose(ibuf, GOTD_IMSG_FLUSH, 0, 0, -1, NULL, 0) == -1)
553 		return got_error_from_errno("imsg_compose FLUSH");
554 
555 	return gotd_imsg_flush(ibuf);
556 }
557 
558 static const struct got_error *
559 recv_ack(struct imsg *imsg, uint8_t *expected_id)
560 {
561 	struct gotd_imsg_ack iack;
562 	size_t datalen;
563 
564 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
565 	if (datalen != sizeof(iack))
566 		return got_error(GOT_ERR_PRIVSEP_LEN);
567 
568 	memcpy(&iack, imsg->data, sizeof(iack));
569 	if (memcmp(iack.object_id, expected_id, SHA1_DIGEST_LENGTH) != 0)
570 		return got_error(GOT_ERR_BAD_OBJ_ID);
571 
572 	return NULL;
573 }
574 
575 static const struct got_error *
576 recv_nak(struct imsg *imsg, uint8_t *expected_id)
577 {
578 	struct gotd_imsg_ack inak;
579 	size_t datalen;
580 
581 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
582 	if (datalen != sizeof(inak))
583 		return got_error(GOT_ERR_PRIVSEP_LEN);
584 
585 	memcpy(&inak, imsg->data, sizeof(inak));
586 	if (memcmp(inak.object_id, expected_id, SHA1_DIGEST_LENGTH) != 0)
587 		return got_error(GOT_ERR_BAD_OBJ_ID);
588 
589 	return NULL;
590 }
591 
592 
593 static const struct got_error *
594 recv_want(int *use_sidebands, int outfd, struct imsgbuf *ibuf,
595     char *buf, size_t len, int expect_capabilities, int chattygot)
596 {
597 	const struct got_error *err;
598 	struct gotd_imsg_want iwant;
599 	char *capabilities_str;
600 	int done = 0;
601 	struct imsg imsg;
602 
603 	memset(&iwant, 0, sizeof(iwant));
604 	memset(&imsg, 0, sizeof(imsg));
605 
606 	err = parse_want_line(&capabilities_str, iwant.object_id, buf, len);
607 	if (err)
608 		return err;
609 
610 	if (capabilities_str) {
611 		if (!expect_capabilities) {
612 			err = got_error_msg(GOT_ERR_BAD_PACKET,
613 			    "unexpected capability announcement received");
614 			goto done;
615 		}
616 		err = send_capabilities(use_sidebands, NULL, capabilities_str,
617 		    ibuf);
618 		if (err)
619 			goto done;
620 
621 	}
622 
623 	if (imsg_compose(ibuf, GOTD_IMSG_WANT, 0, 0, -1,
624 	    &iwant, sizeof(iwant)) == -1) {
625 		err = got_error_from_errno("imsg_compose WANT");
626 		goto done;
627 	}
628 
629 	err = gotd_imsg_flush(ibuf);
630 	if (err)
631 		goto done;
632 
633 	/*
634 	 * Wait for an ACK, or an error in case the desired object
635 	 * does not exist.
636 	 */
637 	while (!done && err == NULL) {
638 		err = gotd_imsg_poll_recv(&imsg, ibuf, 0);
639 		if (err)
640 			break;
641 		switch (imsg.hdr.type) {
642 		case GOTD_IMSG_ERROR:
643 			err = gotd_imsg_recv_error(NULL, &imsg);
644 			break;
645 		case GOTD_IMSG_ACK:
646 			err = recv_ack(&imsg, iwant.object_id);
647 			if (err)
648 				break;
649 			done = 1;
650 			break;
651 		default:
652 			err = got_error(GOT_ERR_PRIVSEP_MSG);
653 			break;
654 		}
655 
656 		imsg_free(&imsg);
657 	}
658 done:
659 	free(capabilities_str);
660 	return err;
661 }
662 
663 static const struct got_error *
664 send_ack(int outfd, uint8_t *id, int chattygot)
665 {
666 	char hex[SHA1_DIGEST_STRING_LENGTH];
667 	char buf[GOT_PKT_MAX];
668 	int len;
669 
670 	if (got_sha1_digest_to_str(id, hex, sizeof(hex)) == NULL)
671 		return got_error(GOT_ERR_BAD_OBJ_ID);
672 
673 	len = snprintf(buf, sizeof(buf), "ACK %s\n", hex);
674 	if (len >= sizeof(buf))
675 		return got_error(GOT_ERR_NO_SPACE);
676 
677 	return got_pkt_writepkt(outfd, buf, len, chattygot);
678 }
679 
680 static const struct got_error *
681 send_nak(int outfd, int chattygot)
682 {
683 	char buf[5];
684 	int len;
685 
686 	len = snprintf(buf, sizeof(buf), "NAK\n");
687 	if (len >= sizeof(buf))
688 		return got_error(GOT_ERR_NO_SPACE);
689 
690 	return got_pkt_writepkt(outfd, buf, len, chattygot);
691 }
692 
693 static const struct got_error *
694 recv_have(int *have_ack, int outfd, struct imsgbuf *ibuf, char *buf,
695     size_t len, int chattygot)
696 {
697 	const struct got_error *err;
698 	struct gotd_imsg_have ihave;
699 	int done = 0;
700 	struct imsg imsg;
701 
702 	memset(&ihave, 0, sizeof(ihave));
703 	memset(&imsg, 0, sizeof(imsg));
704 
705 	err = parse_have_line(ihave.object_id, buf, len);
706 	if (err)
707 		return err;
708 
709 	if (imsg_compose(ibuf, GOTD_IMSG_HAVE, 0, 0, -1,
710 	    &ihave, sizeof(ihave)) == -1)
711 		return got_error_from_errno("imsg_compose HAVE");
712 
713 	err = gotd_imsg_flush(ibuf);
714 	if (err)
715 		return err;
716 
717 	/*
718 	 * Wait for an ACK or a NAK, indicating whether a common
719 	 * commit object has been found.
720 	 */
721 	while (!done && err == NULL) {
722 		err = gotd_imsg_poll_recv(&imsg, ibuf, 0);
723 		if (err)
724 			return err;
725 		switch (imsg.hdr.type) {
726 		case GOTD_IMSG_ERROR:
727 			err = gotd_imsg_recv_error(NULL, &imsg);
728 			break;
729 		case GOTD_IMSG_ACK:
730 			err = recv_ack(&imsg, ihave.object_id);
731 			if (err)
732 				break;
733 			if (!*have_ack) {
734 				err = send_ack(outfd, ihave.object_id,
735 				    chattygot);
736 				if (err)
737 					return err;
738 				*have_ack = 1;
739 			}
740 			done = 1;
741 			break;
742 		case GOTD_IMSG_NAK:
743 			err = recv_nak(&imsg, ihave.object_id);
744 			if (err)
745 				break;
746 			done = 1;
747 			break;
748 		default:
749 			err = got_error(GOT_ERR_PRIVSEP_MSG);
750 			break;
751 		}
752 
753 		imsg_free(&imsg);
754 	}
755 
756 	return err;
757 }
758 
759 static const struct got_error *
760 recv_done(int *packfd, int outfd, struct imsgbuf *ibuf, int chattygot)
761 {
762 	const struct got_error *err;
763 	struct imsg imsg;
764 
765 	*packfd = -1;
766 
767 	if (imsg_compose(ibuf, GOTD_IMSG_DONE, 0, 0, -1, NULL, 0) == -1)
768 		return got_error_from_errno("imsg_compose DONE");
769 
770 	err = gotd_imsg_flush(ibuf);
771 	if (err)
772 		return err;
773 
774 	while (*packfd == -1 && err == NULL) {
775 		err = gotd_imsg_poll_recv(&imsg, ibuf, 0);
776 		if (err)
777 			break;
778 
779 		switch (imsg.hdr.type) {
780 		case GOTD_IMSG_ERROR:
781 			err = gotd_imsg_recv_error(NULL, &imsg);
782 			break;
783 		case GOTD_IMSG_PACKFILE_PIPE:
784 			if (imsg.fd != -1)
785 				*packfd = imsg.fd;
786 			else
787 				err = got_error(GOT_ERR_PRIVSEP_NO_FD);
788 			break;
789 		default:
790 			err = got_error(GOT_ERR_PRIVSEP_MSG);
791 			break;
792 		}
793 
794 		imsg_free(&imsg);
795 	}
796 
797 	return err;
798 }
799 
800 static const struct got_error *
801 relay_progress_reports(struct imsgbuf *ibuf, int outfd, int chattygot)
802 {
803 	const struct got_error *err = NULL;
804 	int pack_starting = 0;
805 	struct gotd_imsg_packfile_progress iprog;
806 	char buf[GOT_PKT_MAX];
807 	struct imsg imsg;
808 	size_t datalen;
809 	int p_deltify = 0, n;
810 	const char *eol = "\r";
811 
812 	memset(&imsg, 0, sizeof(imsg));
813 
814 	while (!pack_starting && err == NULL) {
815 		err = gotd_imsg_poll_recv(&imsg, ibuf, 0);
816 		if (err)
817 			break;
818 
819 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
820 		switch (imsg.hdr.type) {
821 		case GOTD_IMSG_ERROR:
822 			err = gotd_imsg_recv_error(NULL, &imsg);
823 			break;
824 		case GOTD_IMSG_PACKFILE_READY:
825 			eol = "\n";
826 			pack_starting = 1;
827 			/* fallthrough */
828 		case GOTD_IMSG_PACKFILE_PROGRESS:
829 			if (datalen != sizeof(iprog)) {
830 				err = got_error(GOT_ERR_PRIVSEP_LEN);
831 				break;
832 			}
833 			memcpy(&iprog, imsg.data, sizeof(iprog));
834 			if (iprog.nobj_total > 0) {
835 				p_deltify = (iprog.nobj_deltify * 100) /
836 				    iprog.nobj_total;
837 			}
838 			buf[0] = GOT_SIDEBAND_PROGRESS_INFO;
839 			n = snprintf(&buf[1], sizeof(buf) - 1,
840 			    "%d commits colored, "
841 			    "%d objects found, "
842 			    "deltify %d%%%s",
843 			    iprog.ncolored,
844 			    iprog.nfound,
845 			    p_deltify, eol);
846 			if (n >= sizeof(buf) - 1)
847 				break;
848 			err = got_pkt_writepkt(outfd, buf, 1 + n, chattygot);
849 			break;
850 		default:
851 			err = got_error(GOT_ERR_PRIVSEP_MSG);
852 			break;
853 		}
854 
855 		imsg_free(&imsg);
856 	}
857 
858 	return err;
859 }
860 
861 static const struct got_error *
862 serve_read(int infd, int outfd, int gotd_sock, const char *repo_path,
863     int chattygot)
864 {
865 	const struct got_error *err = NULL;
866 	char buf[GOT_PKT_MAX];
867 	struct imsgbuf ibuf;
868 	enum protostate {
869 		STATE_EXPECT_WANT,
870 		STATE_EXPECT_MORE_WANT,
871 		STATE_EXPECT_HAVE,
872 		STATE_EXPECT_DONE,
873 		STATE_DONE,
874 	};
875 	enum protostate curstate = STATE_EXPECT_WANT;
876 	int have_ack = 0, use_sidebands = 0, seen_have = 0;
877 	int packfd = -1;
878 	size_t pack_chunksize;
879 
880 	imsg_init(&ibuf, gotd_sock);
881 
882 	err = announce_refs(outfd, &ibuf, 1, repo_path, chattygot);
883 	if (err)
884 		goto done;
885 
886 	while (curstate != STATE_DONE) {
887 		int n;
888 		buf[0] = '\0';
889 		err = got_pkt_readpkt(&n, infd, buf, sizeof(buf), chattygot);
890 		if (err)
891 			goto done;
892 		if (n == 0) {
893 			if (curstate != STATE_EXPECT_WANT &&
894 			    curstate != STATE_EXPECT_MORE_WANT &&
895 			    curstate != STATE_EXPECT_HAVE &&
896 			    curstate != STATE_EXPECT_DONE) {
897 				err = got_error_msg(GOT_ERR_BAD_PACKET,
898 				    "unexpected flush packet received");
899 				goto done;
900 			}
901 
902 			if (curstate == STATE_EXPECT_WANT) {
903 				ssize_t r;
904 				/*
905 				 * If the client does not want to fetch
906 				 * anything we should receive a flush
907 				 * packet followed by EOF.
908 				 */
909 				r = read(infd, buf, sizeof(buf));
910 				if (r == -1) {
911 					err = got_error_from_errno("read");
912 					goto done;
913 				}
914 				if (r == 0) /* EOF */
915 					goto done;
916 
917 				/* Zero-length field followed by payload. */
918 				err = got_error_msg(GOT_ERR_BAD_PACKET,
919 				    "unexpected flush packet received");
920 				goto done;
921 			}
922 
923 			if (curstate == STATE_EXPECT_WANT ||
924 			    curstate == STATE_EXPECT_MORE_WANT ||
925 			    curstate == STATE_EXPECT_HAVE) {
926 				err = forward_flushpkt(&ibuf);
927 				if (err)
928 					goto done;
929 			}
930 			if (curstate == STATE_EXPECT_HAVE && !have_ack) {
931 				err = send_nak(outfd, chattygot);
932 				if (err)
933 					goto done;
934 			}
935 			if (curstate == STATE_EXPECT_MORE_WANT)
936 				curstate = STATE_EXPECT_HAVE;
937 			else
938 				curstate = STATE_EXPECT_DONE;
939 		} else if (n >= 5 && strncmp(buf, "want ", 5) == 0) {
940 			if (curstate != STATE_EXPECT_WANT &&
941 			    curstate != STATE_EXPECT_MORE_WANT) {
942 				err = got_error_msg(GOT_ERR_BAD_PACKET,
943 				    "unexpected 'want' packet");
944 				goto done;
945 			}
946 			err = recv_want(&use_sidebands, outfd, &ibuf, buf, n,
947 			    curstate == STATE_EXPECT_WANT ? 1 : 0, chattygot);
948 			if (err)
949 				goto done;
950 			if (curstate == STATE_EXPECT_WANT)
951 				curstate = STATE_EXPECT_MORE_WANT;
952 		} else if (n >= 5 && strncmp(buf, "have ", 5) == 0) {
953 			if (curstate != STATE_EXPECT_HAVE &&
954 			    curstate != STATE_EXPECT_DONE) {
955 				err = got_error_msg(GOT_ERR_BAD_PACKET,
956 				    "unexpected 'have' packet");
957 				goto done;
958 			}
959 			if (curstate == STATE_EXPECT_HAVE) {
960 				err = recv_have(&have_ack, outfd, &ibuf,
961 				    buf, n, chattygot);
962 				if (err)
963 					goto done;
964 				seen_have = 1;
965 			}
966 		} else if (n == 5 && strncmp(buf, "done\n", 5) == 0) {
967 			if (curstate != STATE_EXPECT_HAVE &&
968 			    curstate != STATE_EXPECT_DONE) {
969 				err = got_error_msg(GOT_ERR_BAD_PACKET,
970 				    "unexpected 'done' packet");
971 				goto done;
972 			}
973 			err = recv_done(&packfd, outfd, &ibuf, chattygot);
974 			if (err)
975 				goto done;
976 			curstate = STATE_DONE;
977 			break;
978 		} else {
979 			err = got_error(GOT_ERR_BAD_PACKET);
980 			goto done;
981 		}
982 	}
983 
984 	if (!seen_have) {
985 		err = send_nak(outfd, chattygot);
986 		if (err)
987 			goto done;
988 	}
989 
990 	if (use_sidebands) {
991 		err = relay_progress_reports(&ibuf, outfd, chattygot);
992 		if (err)
993 			goto done;
994 		pack_chunksize = GOT_SIDEBAND_64K_PACKFILE_DATA_MAX;
995 	} else
996 		pack_chunksize = sizeof(buf);
997 
998 	for (;;) {
999 		ssize_t r;
1000 
1001 		r = read(packfd, use_sidebands ? &buf[1] : buf,
1002 		    pack_chunksize);
1003 		if (r == -1) {
1004 			err = got_error_from_errno("read");
1005 			break;
1006 		} else if (r == 0) {
1007 			err = got_pkt_flushpkt(outfd, chattygot);
1008 			break;
1009 		}
1010 
1011 		if (use_sidebands) {
1012 			buf[0] = GOT_SIDEBAND_PACKFILE_DATA;
1013 			err = got_pkt_writepkt(outfd, buf, 1 + r, chattygot);
1014 			if (err)
1015 				break;
1016 		} else {
1017 			err = got_poll_write_full(outfd, buf, r);
1018 			if (err) {
1019 				if (err->code == GOT_ERR_EOF)
1020 					err = NULL;
1021 				break;
1022 			}
1023 		}
1024 	}
1025 done:
1026 	imsg_clear(&ibuf);
1027 	if (packfd != -1 && close(packfd) == -1 && err == NULL)
1028 		err = got_error_from_errno("close");
1029 	if (err)
1030 		echo_error(err, outfd, chattygot);
1031 	return err;
1032 }
1033 
1034 static const struct got_error *
1035 parse_ref_update_line(char **common_capabilities, char **refname,
1036     uint8_t *old_id, uint8_t *new_id, char *buf, size_t len)
1037 {
1038 	const struct got_error *err;
1039 	char *old_id_str = NULL, *new_id_str = NULL;
1040 	char *client_capabilities = NULL;
1041 
1042 	*refname = NULL;
1043 
1044 	err = got_gitproto_parse_ref_update_line(&old_id_str, &new_id_str,
1045 	    refname, &client_capabilities, buf, len);
1046 	if (err)
1047 		return err;
1048 
1049 	if (!got_parse_hash_digest(old_id, old_id_str, GOT_HASH_SHA1) ||
1050 	    !got_parse_hash_digest(new_id, new_id_str, GOT_HASH_SHA1)) {
1051 		err = got_error_msg(GOT_ERR_BAD_PACKET,
1052 		    "ref-update with bad object ID");
1053 		goto done;
1054 	}
1055 	if (!got_ref_name_is_valid(*refname)) {
1056 		err = got_error_msg(GOT_ERR_BAD_PACKET,
1057 		    "ref-update with bad reference name");
1058 		goto done;
1059 	}
1060 
1061 	if (client_capabilities) {
1062 		err = got_gitproto_match_capabilities(common_capabilities,
1063 		    NULL, client_capabilities, write_capabilities,
1064 		    nitems(write_capabilities));
1065 		if (err)
1066 			goto done;
1067 	}
1068 done:
1069 	free(old_id_str);
1070 	free(new_id_str);
1071 	free(client_capabilities);
1072 	if (err) {
1073 		free(*refname);
1074 		*refname = NULL;
1075 	}
1076 	return err;
1077 }
1078 
1079 static const struct got_error *
1080 recv_ref_update(int *report_status, int outfd, struct imsgbuf *ibuf,
1081     char *buf, size_t len, int expect_capabilities, int chattygot)
1082 {
1083 	const struct got_error *err;
1084 	struct gotd_imsg_ref_update iref;
1085 	struct ibuf *wbuf;
1086 	char *capabilities_str = NULL, *refname = NULL;
1087 	int done = 0;
1088 	struct imsg imsg;
1089 
1090 	memset(&iref, 0, sizeof(iref));
1091 	memset(&imsg, 0, sizeof(imsg));
1092 
1093 	err = parse_ref_update_line(&capabilities_str, &refname,
1094 	    iref.old_id, iref.new_id, buf, len);
1095 	if (err)
1096 		return err;
1097 
1098 	if (capabilities_str) {
1099 		if (!expect_capabilities) {
1100 			err = got_error_msg(GOT_ERR_BAD_PACKET,
1101 			    "unexpected capability announcement received");
1102 			goto done;
1103 		}
1104 		err = send_capabilities(NULL, report_status, capabilities_str,
1105 		    ibuf);
1106 		if (err)
1107 			goto done;
1108 	}
1109 
1110 	iref.name_len = strlen(refname);
1111 	len = sizeof(iref) + iref.name_len;
1112 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF_UPDATE, 0, 0, len);
1113 	if (wbuf == NULL) {
1114 		err = got_error_from_errno("imsg_create REF_UPDATE");
1115 		goto done;
1116 	}
1117 
1118 	if (imsg_add(wbuf, &iref, sizeof(iref)) == -1)
1119 		return got_error_from_errno("imsg_add REF_UPDATE");
1120 	if (imsg_add(wbuf, refname, iref.name_len) == -1)
1121 		return got_error_from_errno("imsg_add REF_UPDATE");
1122 	wbuf->fd = -1;
1123 	imsg_close(ibuf, wbuf);
1124 
1125 	err = gotd_imsg_flush(ibuf);
1126 	if (err)
1127 		goto done;
1128 
1129 	/* Wait for ACK or an error. */
1130 	while (!done && err == NULL) {
1131 		err = gotd_imsg_poll_recv(&imsg, ibuf, 0);
1132 		if (err)
1133 			break;
1134 		switch (imsg.hdr.type) {
1135 		case GOTD_IMSG_ERROR:
1136 			err = gotd_imsg_recv_error(NULL, &imsg);
1137 			break;
1138 		case GOTD_IMSG_ACK:
1139 			err = recv_ack(&imsg, iref.new_id);
1140 			if (err)
1141 				break;
1142 			done = 1;
1143 			break;
1144 		default:
1145 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1146 			break;
1147 		}
1148 
1149 		imsg_free(&imsg);
1150 	}
1151 done:
1152 	free(capabilities_str);
1153 	free(refname);
1154 	return err;
1155 }
1156 
1157 static const struct got_error *
1158 recv_packfile(struct imsg *imsg, int infd)
1159 {
1160 	const struct got_error *err = NULL;
1161 	size_t datalen;
1162 	int packfd;
1163 	char buf[GOT_PKT_MAX];
1164 	int pack_done = 0;
1165 
1166 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1167 	if (datalen != 0)
1168 		return got_error(GOT_ERR_PRIVSEP_MSG);
1169 
1170 	if (imsg->fd == -1)
1171 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1172 
1173 	packfd = imsg->fd;
1174 	while (!pack_done) {
1175 		ssize_t r = 0;
1176 
1177 		err = got_poll_fd(infd, POLLIN, 1);
1178 		if (err) {
1179 			if (err->code != GOT_ERR_TIMEOUT)
1180 				break;
1181 			err = NULL;
1182 		} else {
1183 			r = read(infd, buf, sizeof(buf));
1184 			if (r == -1) {
1185 				err = got_error_from_errno("read");
1186 				break;
1187 			}
1188 			if (r == 0) {
1189 				/*
1190 				 * Git clients hang up their side of the
1191 				 * connection after sending the pack file.
1192 				 */
1193 				err = NULL;
1194 				pack_done = 1;
1195 				break;
1196 			}
1197 		}
1198 
1199 		if (r == 0) {
1200 			/* Detect gotd(8) closing the pack pipe when done. */
1201 			err = got_poll_fd(packfd, POLLOUT, 1);
1202 			if (err) {
1203 				if (err->code != GOT_ERR_EOF)
1204 					break;
1205 				err = NULL;
1206 				pack_done = 1;
1207 			}
1208 		} else {
1209 			/* Write pack data and/or detect pipe being closed. */
1210 			err = got_poll_write_full(packfd, buf, r);
1211 			if (err) {
1212 				if (err->code == GOT_ERR_EOF)
1213 					err = NULL;
1214 				break;
1215 			}
1216 		}
1217 	}
1218 
1219 	close(packfd);
1220 	return err;
1221 }
1222 
1223 static const struct got_error *
1224 report_unpack_status(struct imsg *imsg, int outfd, int chattygot)
1225 {
1226 	const struct got_error *err = NULL;
1227 	struct gotd_imsg_packfile_status istatus;
1228 	char buf[GOT_PKT_MAX];
1229 	size_t datalen, len;
1230 	char *reason = NULL;
1231 
1232 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1233 	if (datalen < sizeof(istatus))
1234 		return got_error(GOT_ERR_PRIVSEP_LEN);
1235 	memcpy(&istatus, imsg->data, sizeof(istatus));
1236 	if (datalen != sizeof(istatus) + istatus.reason_len)
1237 		return got_error(GOT_ERR_PRIVSEP_LEN);
1238 
1239 	reason = strndup(imsg->data + sizeof(istatus), istatus.reason_len);
1240 	if (reason == NULL) {
1241 		err = got_error_from_errno("strndup");
1242 		goto done;
1243 	}
1244 
1245 	if (err == NULL)
1246 		len = snprintf(buf, sizeof(buf), "unpack ok\n");
1247 	else
1248 		len = snprintf(buf, sizeof(buf), "unpack %s\n", reason);
1249 	if (len >= sizeof(buf)) {
1250 		err = got_error(GOT_ERR_NO_SPACE);
1251 		goto done;
1252 	}
1253 
1254 	err = got_pkt_writepkt(outfd, buf, len, chattygot);
1255 done:
1256 	free(reason);
1257 	return err;
1258 }
1259 
1260 static const struct got_error *
1261 recv_ref_update_ok(struct imsg *imsg, int outfd, int chattygot)
1262 {
1263 	const struct got_error *err = NULL;
1264 	struct gotd_imsg_ref_update_ok iok;
1265 	size_t datalen, len;
1266 	char buf[GOT_PKT_MAX];
1267 	char *refname = NULL;
1268 
1269 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1270 	if (datalen < sizeof(iok))
1271 		return got_error(GOT_ERR_PRIVSEP_LEN);
1272 	memcpy(&iok, imsg->data, sizeof(iok));
1273 	if (datalen != sizeof(iok) + iok.name_len)
1274 		return got_error(GOT_ERR_PRIVSEP_LEN);
1275 
1276 	memcpy(&iok, imsg->data, sizeof(iok));
1277 
1278 	refname = strndup(imsg->data + sizeof(iok), iok.name_len);
1279 	if (refname == NULL)
1280 		return got_error_from_errno("strndup");
1281 
1282 	len = snprintf(buf, sizeof(buf), "ok %s\n", refname);
1283 	if (len >= sizeof(buf)) {
1284 		err = got_error(GOT_ERR_NO_SPACE);
1285 		goto done;
1286 	}
1287 
1288 	err = got_pkt_writepkt(outfd, buf, len, chattygot);
1289 done:
1290 	free(refname);
1291 	return err;
1292 }
1293 
1294 static const struct got_error *
1295 recv_ref_update_ng(struct imsg *imsg, int outfd, int chattygot)
1296 {
1297 	const struct got_error *err = NULL;
1298 	struct gotd_imsg_ref_update_ng ing;
1299 	size_t datalen, len;
1300 	char buf[GOT_PKT_MAX];
1301 	char *refname = NULL, *reason = NULL;
1302 
1303 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1304 	if (datalen < sizeof(ing))
1305 		return got_error(GOT_ERR_PRIVSEP_LEN);
1306 	memcpy(&ing, imsg->data, sizeof(ing));
1307 	if (datalen != sizeof(ing) + ing.name_len + ing.reason_len)
1308 		return got_error(GOT_ERR_PRIVSEP_LEN);
1309 
1310 	memcpy(&ing, imsg->data, sizeof(ing));
1311 
1312 	refname = strndup(imsg->data + sizeof(ing), ing.name_len);
1313 	if (refname == NULL)
1314 		return got_error_from_errno("strndup");
1315 
1316 	reason = strndup(imsg->data + sizeof(ing) + ing.name_len,
1317 	    ing.reason_len);
1318 	if (reason == NULL) {
1319 		err = got_error_from_errno("strndup");
1320 		goto done;
1321 	}
1322 
1323 	len = snprintf(buf, sizeof(buf), "ng %s %s\n", refname, reason);
1324 	if (len >= sizeof(buf)) {
1325 		err = got_error(GOT_ERR_NO_SPACE);
1326 		goto done;
1327 	}
1328 
1329 	err = got_pkt_writepkt(outfd, buf, len, chattygot);
1330 done:
1331 	free(refname);
1332 	free(reason);
1333 	return err;
1334 }
1335 
1336 static const struct got_error *
1337 serve_write(int infd, int outfd, int gotd_sock, const char *repo_path,
1338     int chattygot)
1339 {
1340 	const struct got_error *err = NULL;
1341 	char buf[GOT_PKT_MAX];
1342 	struct imsgbuf ibuf;
1343 	enum protostate {
1344 		STATE_EXPECT_REF_UPDATE,
1345 		STATE_EXPECT_MORE_REF_UPDATES,
1346 		STATE_EXPECT_PACKFILE,
1347 		STATE_PACKFILE_RECEIVED,
1348 		STATE_REFS_UPDATED,
1349 	};
1350 	enum protostate curstate = STATE_EXPECT_REF_UPDATE;
1351 	struct imsg imsg;
1352 	int report_status = 0;
1353 
1354 	imsg_init(&ibuf, gotd_sock);
1355 	memset(&imsg, 0, sizeof(imsg));
1356 
1357 	err = announce_refs(outfd, &ibuf, 0, repo_path, chattygot);
1358 	if (err)
1359 		goto done;
1360 
1361 	while (curstate != STATE_EXPECT_PACKFILE) {
1362 		int n;
1363 		buf[0] = '\0';
1364 		err = got_pkt_readpkt(&n, infd, buf, sizeof(buf), chattygot);
1365 		if (err)
1366 			goto done;
1367 		if (n == 0) {
1368 			if (curstate != STATE_EXPECT_MORE_REF_UPDATES) {
1369 				err = got_error_msg(GOT_ERR_BAD_PACKET,
1370 				    "unexpected flush packet received");
1371 				goto done;
1372 			}
1373 			err = forward_flushpkt(&ibuf);
1374 			if (err)
1375 				goto done;
1376 			curstate = STATE_EXPECT_PACKFILE;
1377 		} else if (n >= (SHA1_DIGEST_STRING_LENGTH * 2) + 2) {
1378 			if (curstate != STATE_EXPECT_REF_UPDATE &&
1379 			    curstate != STATE_EXPECT_MORE_REF_UPDATES) {
1380 				err = got_error_msg(GOT_ERR_BAD_PACKET,
1381 				    "unexpected ref-update packet");
1382 				goto done;
1383 			}
1384 			if (curstate == STATE_EXPECT_REF_UPDATE) {
1385 				err = recv_ref_update(&report_status,
1386 				    outfd, &ibuf, buf, n, 1, chattygot);
1387 			} else {
1388 				err = recv_ref_update(NULL, outfd, &ibuf,
1389 				    buf, n, 0, chattygot);
1390 			}
1391 			if (err)
1392 				goto done;
1393 			curstate = STATE_EXPECT_MORE_REF_UPDATES;
1394 		} else {
1395 			err = got_error(GOT_ERR_BAD_PACKET);
1396 			goto done;
1397 		}
1398 	}
1399 
1400 	while (curstate != STATE_PACKFILE_RECEIVED) {
1401 		err = gotd_imsg_poll_recv(&imsg, &ibuf, 0);
1402 		if (err)
1403 			goto done;
1404 		switch (imsg.hdr.type) {
1405 		case GOTD_IMSG_ERROR:
1406 			err = gotd_imsg_recv_error(NULL, &imsg);
1407 			goto done;
1408 		case GOTD_IMSG_RECV_PACKFILE:
1409 			err = recv_packfile(&imsg, infd);
1410 			if (err) {
1411 				if (err->code != GOT_ERR_EOF)
1412 					goto done;
1413 				/*
1414 				 * EOF is reported when the client hangs up,
1415 				 * which can happen with Git clients.
1416 				 * The socket should stay half-open so we
1417 				 * can still send our reports if requested.
1418 				 */
1419 				err = NULL;
1420 			}
1421 			curstate = STATE_PACKFILE_RECEIVED;
1422 			break;
1423 		default:
1424 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1425 			break;
1426 		}
1427 
1428 		imsg_free(&imsg);
1429 		if (err)
1430 			goto done;
1431 	}
1432 
1433 	while (curstate != STATE_REFS_UPDATED && err == NULL) {
1434 		err = gotd_imsg_poll_recv(&imsg, &ibuf, 0);
1435 		if (err)
1436 			break;
1437 		switch (imsg.hdr.type) {
1438 		case GOTD_IMSG_ERROR:
1439 			err = gotd_imsg_recv_error(NULL, &imsg);
1440 			break;
1441 		case GOTD_IMSG_PACKFILE_STATUS:
1442 			if (!report_status)
1443 				break;
1444 			err = report_unpack_status(&imsg, outfd, chattygot);
1445 			break;
1446 		case GOTD_IMSG_REF_UPDATE_OK:
1447 			if (!report_status)
1448 				break;
1449 			err = recv_ref_update_ok(&imsg, outfd, chattygot);
1450 			break;
1451 		case GOTD_IMSG_REF_UPDATE_NG:
1452 			if (!report_status)
1453 				break;
1454 			err = recv_ref_update_ng(&imsg, outfd, chattygot);
1455 			break;
1456 		case GOTD_IMSG_REFS_UPDATED:
1457 			curstate = STATE_REFS_UPDATED;
1458 			err = got_pkt_flushpkt(outfd, chattygot);
1459 			break;
1460 		default:
1461 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1462 			break;
1463 		}
1464 
1465 		imsg_free(&imsg);
1466 	}
1467 done:
1468 	imsg_clear(&ibuf);
1469 	if (err)
1470 		echo_error(err, outfd, chattygot);
1471 	return err;
1472 }
1473 
1474 const struct got_error *
1475 got_serve(int infd, int outfd, const char *command, const char *repo_path,
1476     int gotd_sock, int chattygot)
1477 {
1478 	const struct got_error *err = NULL;
1479 
1480 	if (strcmp(command, GOT_SERVE_CMD_FETCH) == 0)
1481 		err = serve_read(infd, outfd, gotd_sock, repo_path, chattygot);
1482 	else if (strcmp(command, GOT_SERVE_CMD_SEND) == 0)
1483 		err = serve_write(infd, outfd, gotd_sock, repo_path,
1484 		    chattygot);
1485 	else
1486 		err = got_error(GOT_ERR_BAD_PACKET);
1487 
1488 	return err;
1489 }