1 /*
2  * Copyright (c) 2019 Ori Bernstein <ori@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/uio.h>
19 #include <sys/time.h>
20 #include <sys/stat.h>
21 
22 #include <stdint.h>
23 #include <errno.h>
24 #include <limits.h>
25 #include <signal.h>
26 #include <stdio.h>
27 #include <stdlib.h>
28 #include <string.h>
29 #include <ctype.h>
30 #include <sha1.h>
31 #include <fcntl.h>
32 #include <unistd.h>
33 #include <zlib.h>
34 #include <err.h>
35 
36 #include "got_compat.h"
37 
38 #include "got_error.h"
39 #include "got_object.h"
40 #include "got_path.h"
41 #include "got_version.h"
42 #include "got_fetch.h"
43 #include "got_reference.h"
44 
45 #include "got_lib_sha1.h"
46 #include "got_lib_delta.h"
47 #include "got_lib_object.h"
48 #include "got_lib_object_parse.h"
49 #include "got_lib_privsep.h"
50 #include "got_lib_pack.h"
51 #include "got_lib_pkt.h"
52 #include "got_lib_gitproto.h"
53 
54 #ifndef nitems
55 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
56 #endif
57 
58 struct got_object *indexed;
59 static int chattygot;
60 static struct got_object_id zhash = {.sha1={0}};
61 
62 static const struct got_capability got_capabilities[] = {
63 	{ GOT_CAPA_AGENT, "got/" GOT_VERSION_STR },
64 	{ GOT_CAPA_OFS_DELTA, NULL },
65 	{ GOT_CAPA_SIDE_BAND_64K, NULL },
66 };
67 
68 static void
69 match_remote_ref(struct got_pathlist_head *have_refs,
70     struct got_object_id *my_id, char *refname)
71 {
72 	struct got_pathlist_entry *pe;
73 
74 	/* XXX zero-hash signifies we don't have this ref;
75 	 * we should use a flag instead */
76 	memset(my_id, 0, sizeof(*my_id));
77 
78 	TAILQ_FOREACH(pe, have_refs, entry) {
79 		struct got_object_id *id = pe->data;
80 		if (strcmp(pe->path, refname) == 0) { 
81 			memcpy(my_id, id, sizeof(*my_id));
82 			break;
83 		}
84 	}
85 }
86 
87 static int
88 match_branch(const char *branch, const char *wanted_branch)
89 {
90 	if (strncmp(branch, "refs/heads/", 11) != 0)
91 		return 0;
92 
93 	if (strncmp(wanted_branch, "refs/heads/", 11) == 0)
94 		wanted_branch += 11;
95 
96 	return (strcmp(branch + 11, wanted_branch) == 0);
97 }
98 
99 static int
100 match_wanted_ref(const char *refname, const char *wanted_ref)
101 {
102 	if (strncmp(refname, "refs/", 5) != 0)
103 		return 0;
104 	refname += 5;
105 
106 	/*
107 	 * Prevent fetching of references that won't make any
108 	 * sense outside of the remote repository's context.
109 	 */
110 	if (strncmp(refname, "got/", 4) == 0)
111 		return 0;
112 	if (strncmp(refname, "remotes/", 8) == 0)
113 		return 0;
114 
115 	if (strncmp(wanted_ref, "refs/", 5) == 0)
116 		wanted_ref += 5;
117 
118 	/* Allow prefix match. */
119 	if (got_path_is_child(refname, wanted_ref, strlen(wanted_ref)))
120 		return 1;
121 
122 	/* Allow exact match. */
123 	return (strcmp(refname, wanted_ref) == 0);
124 }
125 
126 static const struct got_error *
127 send_fetch_server_progress(struct imsgbuf *ibuf, const char *msg, size_t msglen)
128 {
129 	if (msglen > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
130 		return got_error(GOT_ERR_NO_SPACE);
131 
132 	if (msglen == 0)
133 		return NULL;
134 
135 	if (imsg_compose(ibuf, GOT_IMSG_FETCH_SERVER_PROGRESS, 0, 0, -1,
136 	    msg, msglen) == -1)
137 		return got_error_from_errno(
138 		    "imsg_compose FETCH_SERVER_PROGRESS");
139 
140 	return got_privsep_flush_imsg(ibuf);
141 }
142 
143 static const struct got_error *
144 send_fetch_download_progress(struct imsgbuf *ibuf, off_t bytes)
145 {
146 	if (imsg_compose(ibuf, GOT_IMSG_FETCH_DOWNLOAD_PROGRESS, 0, 0, -1,
147 	    &bytes, sizeof(bytes)) == -1)
148 		return got_error_from_errno(
149 		    "imsg_compose FETCH_DOWNLOAD_PROGRESS");
150 
151 	return got_privsep_flush_imsg(ibuf);
152 }
153 
154 static const struct got_error *
155 send_fetch_done(struct imsgbuf *ibuf, uint8_t *pack_sha1)
156 {
157 	if (imsg_compose(ibuf, GOT_IMSG_FETCH_DONE, 0, 0, -1,
158 	    pack_sha1, SHA1_DIGEST_LENGTH) == -1)
159 		return got_error_from_errno("imsg_compose FETCH");
160 	return got_privsep_flush_imsg(ibuf);
161 }
162 
163 static const struct got_error *
164 fetch_progress(struct imsgbuf *ibuf, const char *buf, size_t len)
165 {
166 	size_t i;
167 
168 	if (len == 0)
169 		return NULL;
170 
171 	/*
172 	 * Truncate messages which exceed the maximum imsg payload size.
173 	 * Server may send up to 64k.
174 	 */
175 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
176 		len = MAX_IMSGSIZE - IMSG_HEADER_SIZE;
177 
178 	/* Only allow printable ASCII. */
179 	for (i = 0; i < len; i++) {
180 		if (isprint((unsigned char)buf[i]) ||
181 		    isspace((unsigned char)buf[i]))
182 			continue;
183 		return got_error_msg(GOT_ERR_BAD_PACKET,
184 		    "non-printable progress message received from server");
185 	}
186 
187 	return send_fetch_server_progress(ibuf, buf, len);
188 }
189 
190 static const struct got_error *
191 fetch_error(const char *buf, size_t len)
192 {
193 	static char msg[1024];
194 	size_t i;
195 
196 	for (i = 0; i < len && i < sizeof(msg) - 1; i++) {
197 		if (!isprint(buf[i]))
198 			return got_error_msg(GOT_ERR_BAD_PACKET,
199 			    "non-printable error message received from server");
200 		msg[i] = buf[i];
201 	}
202 	msg[i] = '\0';
203 	return got_error_msg(GOT_ERR_FETCH_FAILED, msg);
204 }
205 
206 static const struct got_error *
207 send_fetch_symrefs(struct imsgbuf *ibuf, struct got_pathlist_head *symrefs)
208 {
209 	const struct got_error *err = NULL;
210 	struct ibuf *wbuf;
211 	size_t len, nsymrefs = 0;
212 	struct got_pathlist_entry *pe;
213 
214 	len = sizeof(struct got_imsg_fetch_symrefs);
215 	TAILQ_FOREACH(pe, symrefs, entry) {
216 		const char *target = pe->data;
217 		len += sizeof(struct got_imsg_fetch_symref) +
218 		    pe->path_len + strlen(target);
219 		nsymrefs++;
220 	}
221 
222 	if (len >= MAX_IMSGSIZE - IMSG_HEADER_SIZE)
223 		return got_error(GOT_ERR_NO_SPACE);
224 
225 	wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_SYMREFS, 0, 0, len);
226 	if (wbuf == NULL)
227 		return got_error_from_errno("imsg_create FETCH_SYMREFS");
228 
229 	/* Keep in sync with struct got_imsg_fetch_symrefs definition! */
230 	if (imsg_add(wbuf, &nsymrefs, sizeof(nsymrefs)) == -1) {
231 		err = got_error_from_errno("imsg_add FETCH_SYMREFS");
232 		ibuf_free(wbuf);
233 		return err;
234 	}
235 
236 	TAILQ_FOREACH(pe, symrefs, entry) {
237 		const char *name = pe->path;
238 		size_t name_len = pe->path_len;
239 		const char *target = pe->data;
240 		size_t target_len = strlen(target);
241 
242 		/* Keep in sync with struct got_imsg_fetch_symref definition! */
243 		if (imsg_add(wbuf, &name_len, sizeof(name_len)) == -1) {
244 			err = got_error_from_errno("imsg_add FETCH_SYMREFS");
245 			ibuf_free(wbuf);
246 			return err;
247 		}
248 		if (imsg_add(wbuf, &target_len, sizeof(target_len)) == -1) {
249 			err = got_error_from_errno("imsg_add FETCH_SYMREFS");
250 			ibuf_free(wbuf);
251 			return err;
252 		}
253 		if (imsg_add(wbuf, name, name_len) == -1) {
254 			err = got_error_from_errno("imsg_add FETCH_SYMREFS");
255 			ibuf_free(wbuf);
256 			return err;
257 		}
258 		if (imsg_add(wbuf, target, target_len) == -1) {
259 			err = got_error_from_errno("imsg_add FETCH_SYMREFS");
260 			ibuf_free(wbuf);
261 			return err;
262 		}
263 	}
264 
265 	wbuf->fd = -1;
266 	imsg_close(ibuf, wbuf);
267 	return got_privsep_flush_imsg(ibuf);
268 }
269 
270 static const struct got_error *
271 send_fetch_ref(struct imsgbuf *ibuf, struct got_object_id *refid,
272     const char *refname)
273 {
274 	const struct got_error *err = NULL;
275 	struct ibuf *wbuf;
276 	size_t len, reflen = strlen(refname);
277 
278 	len = sizeof(struct got_imsg_fetch_ref) + reflen;
279 	if (len >= MAX_IMSGSIZE - IMSG_HEADER_SIZE)
280 		return got_error(GOT_ERR_NO_SPACE);
281 
282 	wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_REF, 0, 0, len);
283 	if (wbuf == NULL)
284 		return got_error_from_errno("imsg_create FETCH_REF");
285 
286 	/* Keep in sync with struct got_imsg_fetch_ref definition! */
287 	if (imsg_add(wbuf, refid->sha1, SHA1_DIGEST_LENGTH) == -1) {
288 		err = got_error_from_errno("imsg_add FETCH_REF");
289 		ibuf_free(wbuf);
290 		return err;
291 	}
292 	if (imsg_add(wbuf, refname, reflen) == -1) {
293 		err = got_error_from_errno("imsg_add FETCH_REF");
294 		ibuf_free(wbuf);
295 		return err;
296 	}
297 
298 	wbuf->fd = -1;
299 	imsg_close(ibuf, wbuf);
300 	return got_privsep_flush_imsg(ibuf);
301 }
302 
303 static const struct got_error *
304 fetch_pack(int fd, int packfd, uint8_t *pack_sha1,
305     struct got_pathlist_head *have_refs, int fetch_all_branches,
306     struct got_pathlist_head *wanted_branches,
307     struct got_pathlist_head *wanted_refs, int list_refs_only,
308     struct imsgbuf *ibuf)
309 {
310 	const struct got_error *err = NULL;
311 	char buf[GOT_PKT_MAX];
312 	char hashstr[SHA1_DIGEST_STRING_LENGTH];
313 	struct got_object_id *have, *want;
314 	int is_firstpkt = 1, nref = 0, refsz = 16;
315 	int i, n, nwant = 0, nhave = 0, acked = 0;
316 	off_t packsz = 0, last_reported_packsz = 0;
317 	char *id_str = NULL, *refname = NULL;
318 	char *server_capabilities = NULL, *my_capabilities = NULL;
319 	const char *default_branch = NULL;
320 	struct got_pathlist_head symrefs;
321 	struct got_pathlist_entry *pe;
322 	int sent_my_capabilites = 0, have_sidebands = 0;
323 	int found_branch = 0;
324 	SHA1_CTX sha1_ctx;
325 	uint8_t sha1_buf[SHA1_DIGEST_LENGTH];
326 	size_t sha1_buf_len = 0;
327 	ssize_t w;
328 
329 	TAILQ_INIT(&symrefs);
330 	SHA1Init(&sha1_ctx);
331 
332 	have = malloc(refsz * sizeof(have[0]));
333 	if (have == NULL)
334 		return got_error_from_errno("malloc");
335 	want = malloc(refsz * sizeof(want[0]));
336 	if (want == NULL) {
337 		err = got_error_from_errno("malloc");
338 		goto done;
339 	}
340 	while (1) {
341 		err = got_pkt_readpkt(&n, fd, buf, sizeof(buf), chattygot);
342 		if (err)
343 			goto done;
344 		if (n == 0)
345 			break;
346 		if (n >= 4 && strncmp(buf, "ERR ", 4) == 0) {
347 			err = fetch_error(&buf[4], n - 4);
348 			goto done;
349 		}
350 		err = got_gitproto_parse_refline(&id_str, &refname,
351 		    &server_capabilities, buf, n);
352 		if (err)
353 			goto done;
354 		if (is_firstpkt) {
355 			if (chattygot && server_capabilities[0] != '\0')
356 				fprintf(stderr, "%s: server capabilities: %s\n",
357 				    getprogname(), server_capabilities);
358 			err = got_gitproto_match_capabilities(&my_capabilities,
359 			    &symrefs, server_capabilities,
360 			    got_capabilities, nitems(got_capabilities));
361 			if (err)
362 				goto done;
363 			if (chattygot)
364 				fprintf(stderr, "%s: my capabilities:%s\n",
365 				    getprogname(), my_capabilities != NULL ?
366 				    my_capabilities : "");
367 			err = send_fetch_symrefs(ibuf, &symrefs);
368 			if (err)
369 				goto done;
370 			is_firstpkt = 0;
371 			if (!fetch_all_branches) {
372 				TAILQ_FOREACH(pe, &symrefs, entry) {
373 					const char *name = pe->path;
374 					const char *symref_target = pe->data;
375 					if (strcmp(name, GOT_REF_HEAD) != 0)
376 						continue;
377 					default_branch = symref_target;
378 					break;
379 				}
380 			}
381 			continue;
382 		}
383 		if (strstr(refname, "^{}")) {
384 			if (chattygot) {
385 				fprintf(stderr, "%s: ignoring %s\n",
386 				    getprogname(), refname);
387 			}
388 			continue;
389 		}
390 
391 		if (strncmp(refname, "refs/heads/", 11) == 0) {
392 			if (fetch_all_branches || list_refs_only) {
393 				found_branch = 1;
394 			} else if (!TAILQ_EMPTY(wanted_branches)) {
395 				TAILQ_FOREACH(pe, wanted_branches, entry) {
396 					if (match_branch(refname, pe->path))
397 						break;
398 				}
399 				if (pe == NULL) {
400 					if (chattygot) {
401 						fprintf(stderr,
402 						    "%s: ignoring %s\n",
403 						    getprogname(), refname);
404 					}
405 					continue;
406 				}
407 				found_branch = 1;
408 			} else if (default_branch != NULL) {
409 				if (!match_branch(refname, default_branch)) {
410 					if (chattygot) {
411 						fprintf(stderr,
412 						    "%s: ignoring %s\n",
413 						    getprogname(), refname);
414 					}
415 					continue;
416 				}
417 				found_branch = 1;
418 			}
419 		} else if (strncmp(refname, "refs/tags/", 10) != 0) {
420 			if (!TAILQ_EMPTY(wanted_refs)) {
421 				TAILQ_FOREACH(pe, wanted_refs, entry) {
422 					if (match_wanted_ref(refname, pe->path))
423 						break;
424 				}
425 				if (pe == NULL) {
426 					if (chattygot) {
427 						fprintf(stderr,
428 						    "%s: ignoring %s\n",
429 						    getprogname(), refname);
430 					}
431 					continue;
432 				}
433 				found_branch = 1;
434 			} else if (!list_refs_only) {
435 				if (chattygot) {
436 					fprintf(stderr, "%s: ignoring %s\n",
437 					    getprogname(), refname);
438 				}
439 				continue;
440 			}
441 		}
442 
443 		if (refsz == nref + 1) {
444 			refsz *= 2;
445 			have = reallocarray(have, refsz, sizeof(have[0]));
446 			if (have == NULL) {
447 				err = got_error_from_errno("reallocarray");
448 				goto done;
449 			}
450 			want = reallocarray(want, refsz, sizeof(want[0]));
451 			if (want == NULL) {
452 				err = got_error_from_errno("reallocarray");
453 				goto done;
454 			}
455 		}
456 		if (!got_parse_sha1_digest(want[nref].sha1, id_str)) {
457 			err = got_error(GOT_ERR_BAD_OBJ_ID_STR);
458 			goto done;
459 		}
460 		match_remote_ref(have_refs, &have[nref], refname);
461 		err = send_fetch_ref(ibuf, &want[nref], refname);
462 		if (err)
463 			goto done;
464 
465 		if (chattygot)
466 			fprintf(stderr, "%s: %s will be fetched\n",
467 			    getprogname(), refname);
468 		if (chattygot > 1) {
469 			char *theirs, *mine;
470 			err = got_object_id_str(&theirs, &want[nref]);
471 			if (err)
472 				goto done;
473 			err = got_object_id_str(&mine, &have[nref]);
474 			if (err) {
475 				free(theirs);
476 				goto done;
477 			}
478 			fprintf(stderr, "%s: remote: %s\n%s: local:  %s\n",
479 			    getprogname(), theirs, getprogname(), mine);
480 			free(theirs);
481 			free(mine);
482 		}
483 		nref++;
484 	}
485 
486 	if (list_refs_only)
487 		goto done;
488 
489 	/* Abort if we haven't found any branch to fetch. */
490 	if (!found_branch) {
491 		err = got_error(GOT_ERR_FETCH_NO_BRANCH);
492 		goto done;
493 	}
494 
495 	for (i = 0; i < nref; i++) {
496 		if (got_object_id_cmp(&have[i], &want[i]) == 0)
497 			continue;
498 		got_sha1_digest_to_str(want[i].sha1, hashstr, sizeof(hashstr));
499 		n = snprintf(buf, sizeof(buf), "want %s%s\n", hashstr,
500 		    sent_my_capabilites || my_capabilities == NULL ?
501 		    "" : my_capabilities);
502 		if (n >= sizeof(buf)) {
503 			err = got_error(GOT_ERR_NO_SPACE);
504 			goto done;
505 		}
506 		err = got_pkt_writepkt(fd, buf, n, chattygot);
507 		if (err)
508 			goto done;
509 		sent_my_capabilites = 1;
510 		nwant++;
511 	}
512 	err = got_pkt_flushpkt(fd, chattygot);
513 	if (err)
514 		goto done;
515 
516 	if (nwant == 0)
517 		goto done;
518 
519 	for (i = 0; i < nref; i++) {
520 		if (got_object_id_cmp(&have[i], &zhash) == 0)
521 			continue;
522 		got_sha1_digest_to_str(have[i].sha1, hashstr, sizeof(hashstr));
523 		n = snprintf(buf, sizeof(buf), "have %s\n", hashstr);
524 		if (n >= sizeof(buf)) {
525 			err = got_error(GOT_ERR_NO_SPACE);
526 			goto done;
527 		}
528 		err = got_pkt_writepkt(fd, buf, n, chattygot);
529 		if (err)
530 			goto done;
531 		nhave++;
532 	}
533 
534 	while (nhave > 0 && !acked) {
535 		struct got_object_id common_id;
536 
537 		/* The server should ACK the object IDs we need. */
538 		err = got_pkt_readpkt(&n, fd, buf, sizeof(buf), chattygot);
539 		if (err)
540 			goto done;
541 		if (n >= 4 && strncmp(buf, "ERR ", 4) == 0) {
542 			err = fetch_error(&buf[4], n - 4);
543 			goto done;
544 		}
545 		if (n >= 4 && strncmp(buf, "NAK\n", 4) == 0) {
546 			/* Server has not located our objects yet. */
547 			continue;
548 		}
549 		if (n < 4 + SHA1_DIGEST_STRING_LENGTH ||
550 		    strncmp(buf, "ACK ", 4) != 0) {
551 			err = got_error_msg(GOT_ERR_BAD_PACKET,
552 			    "unexpected message from server");
553 			goto done;
554 		}
555 		if (!got_parse_sha1_digest(common_id.sha1, buf + 4)) {
556 			err = got_error_msg(GOT_ERR_BAD_PACKET,
557 			    "bad object ID in ACK packet from server");
558 			goto done;
559 		}
560 		acked++;
561 	}
562 
563 	n = snprintf(buf, sizeof(buf), "done\n");
564 	err = got_pkt_writepkt(fd, buf, n, chattygot);
565 	if (err)
566 		goto done;
567 
568 	if (nhave == 0) {
569 		err = got_pkt_readpkt(&n, fd, buf, sizeof(buf), chattygot);
570 		if (err)
571 			goto done;
572 		if (n != 4 || strncmp(buf, "NAK\n", n) != 0) {
573 			err = got_error_msg(GOT_ERR_BAD_PACKET,
574 			    "unexpected message from server");
575 			goto done;
576 		}
577 	}
578 
579 	if (chattygot)
580 		fprintf(stderr, "%s: fetching...\n", getprogname());
581 
582 	if (my_capabilities != NULL &&
583 	    strstr(my_capabilities, GOT_CAPA_SIDE_BAND_64K) != NULL)
584 		have_sidebands = 1;
585 
586 	while (1) {
587 		ssize_t r = 0;
588 		int datalen = -1;
589 
590 		if (have_sidebands) {
591 			err = got_pkt_readhdr(&datalen, fd, chattygot);
592 			if (err)
593 				goto done;
594 			if (datalen <= 0)
595 				break;
596 
597 			/* Read sideband channel ID (one byte). */
598 			r = read(fd, buf, 1);
599 			if (r == -1) {
600 				err = got_error_from_errno("read");
601 				goto done;
602 			}
603 			if (r != 1) {
604 				err = got_error_msg(GOT_ERR_BAD_PACKET,
605 				    "short packet");
606 				goto done;
607 			}
608 			if (datalen > sizeof(buf) - 5) {
609 				err = got_error_msg(GOT_ERR_BAD_PACKET,
610 				    "bad packet length");
611 				goto done;
612 			}
613 			datalen--; /* sideband ID has been read */
614 			if (buf[0] == GOT_SIDEBAND_PACKFILE_DATA) {
615 				/* Read packfile data. */
616 				err = got_pkt_readn(&r, fd, buf, datalen);
617 				if (err)
618 					goto done;
619 				if (r != datalen) {
620 					err = got_error_msg(GOT_ERR_BAD_PACKET,
621 					    "packet too short");
622 					goto done;
623 				}
624 			} else if (buf[0] == GOT_SIDEBAND_PROGRESS_INFO) {
625 				err = got_pkt_readn(&r, fd, buf, datalen);
626 				if (err)
627 					goto done;
628 				if (r != datalen) {
629 					err = got_error_msg(GOT_ERR_BAD_PACKET,
630 					    "packet too short");
631 					goto done;
632 				}
633 				err = fetch_progress(ibuf, buf, r);
634 				if (err)
635 					goto done;
636 				continue;
637 			} else if (buf[0] == GOT_SIDEBAND_ERROR_INFO) {
638 				err = got_pkt_readn(&r, fd, buf, datalen);
639 				if (err)
640 					goto done;
641 				if (r != datalen) {
642 					err = got_error_msg(GOT_ERR_BAD_PACKET,
643 					    "packet too short");
644 					goto done;
645 				}
646 				err = fetch_error(buf, r);
647 				goto done;
648 			} else if (buf[0] == 'A') {
649 				err = got_pkt_readn(&r, fd, buf, datalen);
650 				if (err)
651 					goto done;
652 				if (r != datalen) {
653 					err = got_error_msg(GOT_ERR_BAD_PACKET,
654 					    "packet too short");
655 					goto done;
656 				}
657 				/*
658 				 * Git server responds with ACK after 'done'
659 				 * even though multi_ack is disabled?!?
660 				 */
661 				buf[r] = '\0';
662 				if (strncmp(buf, "CK ", 3) == 0)
663 					continue; /* ignore */
664 				err = got_error_msg(GOT_ERR_BAD_PACKET,
665 				    "unexpected message from server");
666 				goto done;
667 			} else {
668 				err = got_error_msg(GOT_ERR_BAD_PACKET,
669 				    "unknown side-band received from server");
670 				goto done;
671 			}
672 		} else {
673 			/* No sideband channel. Every byte is packfile data. */
674 			err = got_pkt_readn(&r, fd, buf, sizeof buf);
675 			if (err)
676 				goto done;
677 			if (r <= 0)
678 				break;
679 		}
680 
681 		/*
682 		 * An expected SHA1 checksum sits at the end of the pack file.
683 		 * Since we don't know the file size ahead of time we have to
684 		 * keep SHA1_DIGEST_LENGTH bytes buffered and avoid mixing
685 		 * those bytes into our SHA1 checksum computation until we
686 		 * know for sure that additional pack file data bytes follow.
687 		 *
688 		 * We can assume r > 0 since otherwise the loop would exit.
689 		 */
690 		if (r < SHA1_DIGEST_LENGTH) {
691 			if (sha1_buf_len < SHA1_DIGEST_LENGTH) {
692 				/*
693 				 * If there's enough buffered + read data to
694 				 * fill up the buffer then shift a sufficient
695 				 * amount of bytes out at the front to make
696 				 * room, mixing those bytes into the checksum.
697 				 */
698 				while (sha1_buf_len > 0 &&
699 				    sha1_buf_len + r > SHA1_DIGEST_LENGTH) {
700 					SHA1Update(&sha1_ctx, sha1_buf, 1);
701 					memmove(sha1_buf, sha1_buf + 1, 1);
702 					sha1_buf_len--;
703 				}
704 
705 				/* Buffer potential checksum bytes. */
706 				memcpy(sha1_buf + sha1_buf_len, buf, r);
707 				sha1_buf_len += r;
708 			} else {
709 				/*
710 				 * Mix in previously buffered bytes which
711 				 * are not part of the checksum after all.
712 				 */
713 				SHA1Update(&sha1_ctx, sha1_buf, r);
714 
715 				/* Update potential checksum buffer. */
716 				memmove(sha1_buf, sha1_buf + r,
717 				    sha1_buf_len - r);
718 				memcpy(sha1_buf + sha1_buf_len - r, buf, r);
719 			}
720 		} else {
721 			/* Mix in any previously buffered bytes. */
722 			SHA1Update(&sha1_ctx, sha1_buf, sha1_buf_len);
723 
724 			/* Mix in bytes read minus potential checksum bytes. */
725 			SHA1Update(&sha1_ctx, buf, r - SHA1_DIGEST_LENGTH);
726 
727 			/* Buffer potential checksum bytes. */
728 			memcpy(sha1_buf, buf + r - SHA1_DIGEST_LENGTH,
729 			    SHA1_DIGEST_LENGTH);
730 			sha1_buf_len = SHA1_DIGEST_LENGTH;
731 		}
732 
733 		/* Write packfile data to temporary pack file. */
734 		w = write(packfd, buf, r);
735 		if (w == -1) {
736 			err = got_error_from_errno("write");
737 			goto done;
738 		}
739 		if (w != r) {
740 			err = got_error(GOT_ERR_IO);
741 			goto done;
742 		}
743 		packsz += w;
744 
745 		/* Don't send too many progress privsep messages. */
746 		if (packsz > last_reported_packsz + 1024) {
747 			err = send_fetch_download_progress(ibuf, packsz);
748 			if (err)
749 				goto done;
750 			last_reported_packsz = packsz;
751 		}
752 	}
753 	err = send_fetch_download_progress(ibuf, packsz);
754 	if (err)
755 		goto done;
756 
757 	SHA1Final(pack_sha1, &sha1_ctx);
758 	if (sha1_buf_len != SHA1_DIGEST_LENGTH ||
759 	    memcmp(pack_sha1, sha1_buf, sha1_buf_len) != 0) {
760 		err = got_error_msg(GOT_ERR_BAD_PACKFILE,
761 		    "pack file checksum mismatch");
762 	}
763 done:
764 	TAILQ_FOREACH(pe, &symrefs, entry) {
765 		free((void *)pe->path);
766 		free(pe->data);
767 	}
768 	got_pathlist_free(&symrefs);
769 	free(have);
770 	free(want);
771 	free(id_str);
772 	free(refname);
773 	free(server_capabilities);
774 	return err;
775 }
776 
777 
778 int
779 main(int argc, char **argv)
780 {
781 	const struct got_error *err = NULL;
782 	int fetchfd, packfd = -1, i;
783 	uint8_t pack_sha1[SHA1_DIGEST_LENGTH];
784 	struct imsgbuf ibuf;
785 	struct imsg imsg;
786 	struct got_pathlist_head have_refs;
787 	struct got_pathlist_head wanted_branches;
788 	struct got_pathlist_head wanted_refs;
789 	struct got_pathlist_entry *pe;
790 	struct got_imsg_fetch_request fetch_req;
791 	struct got_imsg_fetch_have_ref href;
792 	struct got_imsg_fetch_wanted_branch wbranch;
793 	struct got_imsg_fetch_wanted_ref wref;
794 	size_t datalen;
795 #if 0
796 	static int attached;
797 	while (!attached)
798 		sleep (1);
799 #endif
800 
801 	TAILQ_INIT(&have_refs);
802 	TAILQ_INIT(&wanted_branches);
803 	TAILQ_INIT(&wanted_refs);
804 
805 	imsg_init(&ibuf, GOT_IMSG_FD_CHILD);
806 #ifndef PROFILE
807 	/* revoke access to most system calls */
808 	if (pledge("stdio recvfd", NULL) == -1) {
809 		err = got_error_from_errno("pledge");
810 		got_privsep_send_error(&ibuf, err);
811 		return 1;
812 	}
813 #endif
814 	err = got_privsep_recv_imsg(&imsg, &ibuf, 0);
815 	if (err) {
816 		if (err->code == GOT_ERR_PRIVSEP_PIPE)
817 			err = NULL;
818 		goto done;
819 	}
820 	if (imsg.hdr.type == GOT_IMSG_STOP)
821 		goto done;
822 	if (imsg.hdr.type != GOT_IMSG_FETCH_REQUEST) {
823 		err = got_error(GOT_ERR_PRIVSEP_MSG);
824 		goto done;
825 	}
826 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
827 	if (datalen < sizeof(fetch_req)) {
828 		err = got_error(GOT_ERR_PRIVSEP_LEN);
829 		goto done;
830 	}
831 	memcpy(&fetch_req, imsg.data, sizeof(fetch_req));
832 	fetchfd = imsg.fd;
833 	imsg_free(&imsg);
834 
835 	if (fetch_req.verbosity > 0)
836 		chattygot += fetch_req.verbosity;
837 
838 	for (i = 0; i < fetch_req.n_have_refs; i++) {
839 		struct got_object_id *id;
840 		char *refname;
841 
842 		err = got_privsep_recv_imsg(&imsg, &ibuf, 0);
843 		if (err) {
844 			if (err->code == GOT_ERR_PRIVSEP_PIPE)
845 				err = NULL;
846 			goto done;
847 		}
848 		if (imsg.hdr.type == GOT_IMSG_STOP)
849 			goto done;
850 		if (imsg.hdr.type != GOT_IMSG_FETCH_HAVE_REF) {
851 			err = got_error(GOT_ERR_PRIVSEP_MSG);
852 			goto done;
853 		}
854 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
855 		if (datalen < sizeof(href)) {
856 			err = got_error(GOT_ERR_PRIVSEP_LEN);
857 			goto done;
858 		}
859 		memcpy(&href, imsg.data, sizeof(href));
860 		if (datalen - sizeof(href) < href.name_len) {
861 			err = got_error(GOT_ERR_PRIVSEP_LEN);
862 			goto done;
863 		}
864 		refname = malloc(href.name_len + 1);
865 		if (refname == NULL) {
866 			err = got_error_from_errno("malloc");
867 			goto done;
868 		}
869 		memcpy(refname, imsg.data + sizeof(href), href.name_len);
870 		refname[href.name_len] = '\0';
871 
872 		id = malloc(sizeof(*id));
873 		if (id == NULL) {
874 			free(refname);
875 			err = got_error_from_errno("malloc");
876 			goto done;
877 		}
878 		memcpy(id->sha1, href.id, SHA1_DIGEST_LENGTH);
879 		err = got_pathlist_append(&have_refs, refname, id);
880 		if (err) {
881 			free(refname);
882 			free(id);
883 			goto done;
884 		}
885 
886 		imsg_free(&imsg);
887 	}
888 
889 	for (i = 0; i < fetch_req.n_wanted_branches; i++) {
890 		char *refname;
891 
892 		err = got_privsep_recv_imsg(&imsg, &ibuf, 0);
893 		if (err) {
894 			if (err->code == GOT_ERR_PRIVSEP_PIPE)
895 				err = NULL;
896 			goto done;
897 		}
898 		if (imsg.hdr.type == GOT_IMSG_STOP)
899 			goto done;
900 		if (imsg.hdr.type != GOT_IMSG_FETCH_WANTED_BRANCH) {
901 			err = got_error(GOT_ERR_PRIVSEP_MSG);
902 			goto done;
903 		}
904 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
905 		if (datalen < sizeof(wbranch)) {
906 			err = got_error(GOT_ERR_PRIVSEP_LEN);
907 			goto done;
908 		}
909 		memcpy(&wbranch, imsg.data, sizeof(wbranch));
910 		if (datalen - sizeof(wbranch) < wbranch.name_len) {
911 			err = got_error(GOT_ERR_PRIVSEP_LEN);
912 			goto done;
913 		}
914 		refname = malloc(wbranch.name_len + 1);
915 		if (refname == NULL) {
916 			err = got_error_from_errno("malloc");
917 			goto done;
918 		}
919 		memcpy(refname, imsg.data + sizeof(wbranch), wbranch.name_len);
920 		refname[wbranch.name_len] = '\0';
921 
922 		err = got_pathlist_append(&wanted_branches, refname, NULL);
923 		if (err) {
924 			free(refname);
925 			goto done;
926 		}
927 
928 		imsg_free(&imsg);
929 	}
930 
931 	for (i = 0; i < fetch_req.n_wanted_refs; i++) {
932 		char *refname;
933 
934 		err = got_privsep_recv_imsg(&imsg, &ibuf, 0);
935 		if (err) {
936 			if (err->code == GOT_ERR_PRIVSEP_PIPE)
937 				err = NULL;
938 			goto done;
939 		}
940 		if (imsg.hdr.type == GOT_IMSG_STOP)
941 			goto done;
942 		if (imsg.hdr.type != GOT_IMSG_FETCH_WANTED_REF) {
943 			err = got_error(GOT_ERR_PRIVSEP_MSG);
944 			goto done;
945 		}
946 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
947 		if (datalen < sizeof(wref)) {
948 			err = got_error(GOT_ERR_PRIVSEP_LEN);
949 			goto done;
950 		}
951 		memcpy(&wref, imsg.data, sizeof(wref));
952 		if (datalen - sizeof(wref) < wref.name_len) {
953 			err = got_error(GOT_ERR_PRIVSEP_LEN);
954 			goto done;
955 		}
956 		refname = malloc(wref.name_len + 1);
957 		if (refname == NULL) {
958 			err = got_error_from_errno("malloc");
959 			goto done;
960 		}
961 		memcpy(refname, imsg.data + sizeof(wref), wref.name_len);
962 		refname[wref.name_len] = '\0';
963 
964 		err = got_pathlist_append(&wanted_refs, refname, NULL);
965 		if (err) {
966 			free(refname);
967 			goto done;
968 		}
969 
970 		imsg_free(&imsg);
971 	}
972 
973 	err = got_privsep_recv_imsg(&imsg, &ibuf, 0);
974 	if (err) {
975 		if (err->code == GOT_ERR_PRIVSEP_PIPE)
976 			err = NULL;
977 		goto done;
978 	}
979 	if (imsg.hdr.type == GOT_IMSG_STOP)
980 		goto done;
981 	if (imsg.hdr.type != GOT_IMSG_FETCH_OUTFD) {
982 		err = got_error(GOT_ERR_PRIVSEP_MSG);
983 		goto done;
984 	}
985 	if (imsg.hdr.len - IMSG_HEADER_SIZE != 0) {
986 		err = got_error(GOT_ERR_PRIVSEP_LEN);
987 		goto done;
988 	}
989 	packfd = imsg.fd;
990 
991 	err = fetch_pack(fetchfd, packfd, pack_sha1, &have_refs,
992 	    fetch_req.fetch_all_branches, &wanted_branches,
993 	    &wanted_refs, fetch_req.list_refs_only, &ibuf);
994 done:
995 	TAILQ_FOREACH(pe, &have_refs, entry) {
996 		free((char *)pe->path);
997 		free(pe->data);
998 	}
999 	got_pathlist_free(&have_refs);
1000 	TAILQ_FOREACH(pe, &wanted_branches, entry)
1001 		free((char *)pe->path);
1002 	got_pathlist_free(&wanted_branches);
1003 	if (fetchfd != -1 && close(fetchfd) == -1 && err == NULL)
1004 		err = got_error_from_errno("close");
1005 	if (packfd != -1 && close(packfd) == -1 && err == NULL)
1006 		err = got_error_from_errno("close");
1007 	if (err != NULL)
1008 		got_privsep_send_error(&ibuf, err);
1009 	else
1010 		err = send_fetch_done(&ibuf, pack_sha1);
1011 	if (err != NULL) {
1012 		fprintf(stderr, "%s: %s\n", getprogname(), err->msg);
1013 		got_privsep_send_error(&ibuf, err);
1014 	}
1015 
1016 	exit(0);
1017 }