1 /*
2  * Copyright (c) 2019 Ori Bernstein <ori@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/uio.h>
19 #include <sys/time.h>
20 #include <sys/stat.h>
21 
22 #include <stdint.h>
23 #include <errno.h>
24 #include <limits.h>
25 #include <signal.h>
26 #include <stdio.h>
27 #include <stdlib.h>
28 #include <string.h>
29 #include <ctype.h>
30 #include <fcntl.h>
31 #include <unistd.h>
32 #include <zlib.h>
33 #include <err.h>
34 
35 #include "got_compat.h"
36 
37 #include "got_error.h"
38 #include "got_object.h"
39 #include "got_path.h"
40 #include "got_version.h"
41 #include "got_fetch.h"
42 #include "got_reference.h"
43 
44 #include "got_lib_sha1.h"
45 #include "got_lib_delta.h"
46 #include "got_lib_object.h"
47 #include "got_lib_object_parse.h"
48 #include "got_lib_privsep.h"
49 #include "got_lib_pack.h"
50 #include "got_lib_pkt.h"
51 #include "got_lib_gitproto.h"
52 #include "got_lib_ratelimit.h"
53 
54 #ifndef nitems
55 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
56 #endif
57 
58 struct got_object *indexed;
59 static int chattygot;
60 
61 static const struct got_capability got_capabilities[] = {
62 	{ GOT_CAPA_AGENT, "got/" GOT_VERSION_STR },
63 	{ GOT_CAPA_OFS_DELTA, NULL },
64 	{ GOT_CAPA_SIDE_BAND_64K, NULL },
65 };
66 
67 static void
68 match_remote_ref(struct got_pathlist_head *have_refs,
69     struct got_object_id *my_id, char *refname)
70 {
71 	struct got_pathlist_entry *pe;
72 
73 	/* XXX zero-hash signifies we don't have this ref;
74 	 * we should use a flag instead */
75 	memset(my_id, 0, sizeof(*my_id));
76 
77 	TAILQ_FOREACH(pe, have_refs, entry) {
78 		struct got_object_id *id = pe->data;
79 		if (strcmp(pe->path, refname) == 0) { 
80 			memcpy(my_id, id, sizeof(*my_id));
81 			break;
82 		}
83 	}
84 }
85 
86 static int
87 match_branch(const char *branch, const char *wanted_branch)
88 {
89 	if (strncmp(branch, "refs/heads/", 11) != 0)
90 		return 0;
91 
92 	if (strncmp(wanted_branch, "refs/heads/", 11) == 0)
93 		wanted_branch += 11;
94 
95 	return (strcmp(branch + 11, wanted_branch) == 0);
96 }
97 
98 static int
99 match_wanted_ref(const char *refname, const char *wanted_ref)
100 {
101 	if (strncmp(refname, "refs/", 5) != 0)
102 		return 0;
103 	refname += 5;
104 
105 	/*
106 	 * Prevent fetching of references that won't make any
107 	 * sense outside of the remote repository's context.
108 	 */
109 	if (strncmp(refname, "got/", 4) == 0)
110 		return 0;
111 	if (strncmp(refname, "remotes/", 8) == 0)
112 		return 0;
113 
114 	if (strncmp(wanted_ref, "refs/", 5) == 0)
115 		wanted_ref += 5;
116 
117 	/* Allow prefix match. */
118 	if (got_path_is_child(refname, wanted_ref, strlen(wanted_ref)))
119 		return 1;
120 
121 	/* Allow exact match. */
122 	return (strcmp(refname, wanted_ref) == 0);
123 }
124 
125 static const struct got_error *
126 send_fetch_server_progress(struct imsgbuf *ibuf, const char *msg, size_t msglen)
127 {
128 	if (msglen > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
129 		return got_error(GOT_ERR_NO_SPACE);
130 
131 	if (msglen == 0)
132 		return NULL;
133 
134 	if (imsg_compose(ibuf, GOT_IMSG_FETCH_SERVER_PROGRESS, 0, 0, -1,
135 	    msg, msglen) == -1)
136 		return got_error_from_errno(
137 		    "imsg_compose FETCH_SERVER_PROGRESS");
138 
139 	return got_privsep_flush_imsg(ibuf);
140 }
141 
142 static const struct got_error *
143 send_fetch_download_progress(struct imsgbuf *ibuf, off_t bytes,
144     struct got_ratelimit *rl)
145 {
146 	const struct got_error *err;
147 	int elapsed = 0;
148 
149 	if (rl) {
150 		err = got_ratelimit_check(&elapsed, rl);
151 		if (err || !elapsed)
152 			return err;
153 	}
154 
155 	if (imsg_compose(ibuf, GOT_IMSG_FETCH_DOWNLOAD_PROGRESS, 0, 0, -1,
156 	    &bytes, sizeof(bytes)) == -1)
157 		return got_error_from_errno(
158 		    "imsg_compose FETCH_DOWNLOAD_PROGRESS");
159 
160 	return got_privsep_flush_imsg(ibuf);
161 }
162 
163 static const struct got_error *
164 send_fetch_done(struct imsgbuf *ibuf, uint8_t *pack_sha1)
165 {
166 	if (imsg_compose(ibuf, GOT_IMSG_FETCH_DONE, 0, 0, -1,
167 	    pack_sha1, SHA1_DIGEST_LENGTH) == -1)
168 		return got_error_from_errno("imsg_compose FETCH");
169 	return got_privsep_flush_imsg(ibuf);
170 }
171 
172 static const struct got_error *
173 fetch_progress(struct imsgbuf *ibuf, const char *buf, size_t len)
174 {
175 	size_t i;
176 
177 	if (len == 0)
178 		return NULL;
179 
180 	/*
181 	 * Truncate messages which exceed the maximum imsg payload size.
182 	 * Server may send up to 64k.
183 	 */
184 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
185 		len = MAX_IMSGSIZE - IMSG_HEADER_SIZE;
186 
187 	/* Only allow printable ASCII. */
188 	for (i = 0; i < len; i++) {
189 		if (isprint((unsigned char)buf[i]) ||
190 		    isspace((unsigned char)buf[i]))
191 			continue;
192 		return got_error_msg(GOT_ERR_BAD_PACKET,
193 		    "non-printable progress message received from server");
194 	}
195 
196 	return send_fetch_server_progress(ibuf, buf, len);
197 }
198 
199 static const struct got_error *
200 fetch_error(const char *buf, size_t len)
201 {
202 	static char msg[1024];
203 	size_t i;
204 
205 	for (i = 0; i < len && i < sizeof(msg) - 1; i++) {
206 		if (!isprint(buf[i]))
207 			return got_error_msg(GOT_ERR_BAD_PACKET,
208 			    "non-printable error message received from server");
209 		msg[i] = buf[i];
210 	}
211 	msg[i] = '\0';
212 	return got_error_msg(GOT_ERR_FETCH_FAILED, msg);
213 }
214 
215 static const struct got_error *
216 send_fetch_symrefs(struct imsgbuf *ibuf, struct got_pathlist_head *symrefs)
217 {
218 	struct ibuf *wbuf;
219 	size_t len, nsymrefs = 0;
220 	struct got_pathlist_entry *pe;
221 
222 	len = sizeof(struct got_imsg_fetch_symrefs);
223 	TAILQ_FOREACH(pe, symrefs, entry) {
224 		const char *target = pe->data;
225 		len += sizeof(struct got_imsg_fetch_symref) +
226 		    pe->path_len + strlen(target);
227 		nsymrefs++;
228 	}
229 
230 	if (len >= MAX_IMSGSIZE - IMSG_HEADER_SIZE)
231 		return got_error(GOT_ERR_NO_SPACE);
232 
233 	wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_SYMREFS, 0, 0, len);
234 	if (wbuf == NULL)
235 		return got_error_from_errno("imsg_create FETCH_SYMREFS");
236 
237 	/* Keep in sync with struct got_imsg_fetch_symrefs definition! */
238 	if (imsg_add(wbuf, &nsymrefs, sizeof(nsymrefs)) == -1)
239 		return got_error_from_errno("imsg_add FETCH_SYMREFS");
240 
241 	TAILQ_FOREACH(pe, symrefs, entry) {
242 		const char *name = pe->path;
243 		size_t name_len = pe->path_len;
244 		const char *target = pe->data;
245 		size_t target_len = strlen(target);
246 
247 		/* Keep in sync with struct got_imsg_fetch_symref definition! */
248 		if (imsg_add(wbuf, &name_len, sizeof(name_len)) == -1)
249 			return got_error_from_errno("imsg_add FETCH_SYMREFS");
250 		if (imsg_add(wbuf, &target_len, sizeof(target_len)) == -1)
251 			return got_error_from_errno("imsg_add FETCH_SYMREFS");
252 		if (imsg_add(wbuf, name, name_len) == -1)
253 			return got_error_from_errno("imsg_add FETCH_SYMREFS");
254 		if (imsg_add(wbuf, target, target_len) == -1)
255 			return got_error_from_errno("imsg_add FETCH_SYMREFS");
256 	}
257 
258 	wbuf->fd = -1;
259 	imsg_close(ibuf, wbuf);
260 	return got_privsep_flush_imsg(ibuf);
261 }
262 
263 static const struct got_error *
264 send_fetch_ref(struct imsgbuf *ibuf, struct got_object_id *refid,
265     const char *refname)
266 {
267 	struct ibuf *wbuf;
268 	size_t len, reflen = strlen(refname);
269 
270 	len = sizeof(struct got_imsg_fetch_ref) + reflen;
271 	if (len >= MAX_IMSGSIZE - IMSG_HEADER_SIZE)
272 		return got_error(GOT_ERR_NO_SPACE);
273 
274 	wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_REF, 0, 0, len);
275 	if (wbuf == NULL)
276 		return got_error_from_errno("imsg_create FETCH_REF");
277 
278 	/* Keep in sync with struct got_imsg_fetch_ref definition! */
279 	if (imsg_add(wbuf, refid->sha1, SHA1_DIGEST_LENGTH) == -1)
280 		return got_error_from_errno("imsg_add FETCH_REF");
281 	if (imsg_add(wbuf, refname, reflen) == -1)
282 		return got_error_from_errno("imsg_add FETCH_REF");
283 
284 	wbuf->fd = -1;
285 	imsg_close(ibuf, wbuf);
286 	return got_privsep_flush_imsg(ibuf);
287 }
288 
289 static const struct got_error *
290 fetch_pack(int fd, int packfd, uint8_t *pack_sha1,
291     struct got_pathlist_head *have_refs, int fetch_all_branches,
292     struct got_pathlist_head *wanted_branches,
293     struct got_pathlist_head *wanted_refs, int list_refs_only,
294     struct imsgbuf *ibuf)
295 {
296 	const struct got_error *err = NULL;
297 	char buf[GOT_PKT_MAX];
298 	char hashstr[SHA1_DIGEST_STRING_LENGTH];
299 	struct got_object_id *have, *want;
300 	int is_firstpkt = 1, nref = 0, refsz = 16;
301 	int i, n, nwant = 0, nhave = 0, acked = 0;
302 	off_t packsz = 0, last_reported_packsz = 0;
303 	char *id_str = NULL, *refname = NULL;
304 	char *server_capabilities = NULL, *my_capabilities = NULL;
305 	const char *default_branch = NULL;
306 	struct got_pathlist_head symrefs;
307 	struct got_pathlist_entry *pe;
308 	int sent_my_capabilites = 0, have_sidebands = 0;
309 	int found_branch = 0;
310 	SHA1_CTX sha1_ctx;
311 	uint8_t sha1_buf[SHA1_DIGEST_LENGTH];
312 	size_t sha1_buf_len = 0;
313 	ssize_t w;
314 	struct got_ratelimit rl;
315 
316 	TAILQ_INIT(&symrefs);
317 	SHA1Init(&sha1_ctx);
318 	got_ratelimit_init(&rl, 0, 500);
319 
320 	have = malloc(refsz * sizeof(have[0]));
321 	if (have == NULL)
322 		return got_error_from_errno("malloc");
323 	want = malloc(refsz * sizeof(want[0]));
324 	if (want == NULL) {
325 		err = got_error_from_errno("malloc");
326 		goto done;
327 	}
328 	while (1) {
329 		err = got_pkt_readpkt(&n, fd, buf, sizeof(buf), chattygot);
330 		if (err)
331 			goto done;
332 		if (n == 0)
333 			break;
334 		if (n >= 4 && strncmp(buf, "ERR ", 4) == 0) {
335 			err = fetch_error(&buf[4], n - 4);
336 			goto done;
337 		}
338 		free(id_str);
339 		free(refname);
340 		err = got_gitproto_parse_refline(&id_str, &refname,
341 		    &server_capabilities, buf, n);
342 		if (err)
343 			goto done;
344 		if (is_firstpkt) {
345 			if (chattygot && server_capabilities[0] != '\0')
346 				fprintf(stderr, "%s: server capabilities: %s\n",
347 				    getprogname(), server_capabilities);
348 			err = got_gitproto_match_capabilities(&my_capabilities,
349 			    &symrefs, server_capabilities,
350 			    got_capabilities, nitems(got_capabilities));
351 			if (err)
352 				goto done;
353 			if (chattygot)
354 				fprintf(stderr, "%s: my capabilities:%s\n",
355 				    getprogname(), my_capabilities != NULL ?
356 				    my_capabilities : "");
357 			err = send_fetch_symrefs(ibuf, &symrefs);
358 			if (err)
359 				goto done;
360 			is_firstpkt = 0;
361 			if (!fetch_all_branches) {
362 				TAILQ_FOREACH(pe, &symrefs, entry) {
363 					const char *name = pe->path;
364 					const char *symref_target = pe->data;
365 					if (strcmp(name, GOT_REF_HEAD) != 0)
366 						continue;
367 					default_branch = symref_target;
368 					break;
369 				}
370 			}
371 			continue;
372 		}
373 		if (strstr(refname, "^{}")) {
374 			if (chattygot) {
375 				fprintf(stderr, "%s: ignoring %s\n",
376 				    getprogname(), refname);
377 			}
378 			continue;
379 		}
380 
381 		if (strncmp(refname, "refs/heads/", 11) == 0) {
382 			if (fetch_all_branches || list_refs_only) {
383 				found_branch = 1;
384 			} else if (!TAILQ_EMPTY(wanted_branches)) {
385 				TAILQ_FOREACH(pe, wanted_branches, entry) {
386 					if (match_branch(refname, pe->path))
387 						break;
388 				}
389 				if (pe == NULL) {
390 					if (chattygot) {
391 						fprintf(stderr,
392 						    "%s: ignoring %s\n",
393 						    getprogname(), refname);
394 					}
395 					continue;
396 				}
397 				found_branch = 1;
398 			} else if (default_branch != NULL) {
399 				if (!match_branch(refname, default_branch)) {
400 					if (chattygot) {
401 						fprintf(stderr,
402 						    "%s: ignoring %s\n",
403 						    getprogname(), refname);
404 					}
405 					continue;
406 				}
407 				found_branch = 1;
408 			}
409 		} else if (strncmp(refname, "refs/tags/", 10) != 0) {
410 			if (!TAILQ_EMPTY(wanted_refs)) {
411 				TAILQ_FOREACH(pe, wanted_refs, entry) {
412 					if (match_wanted_ref(refname, pe->path))
413 						break;
414 				}
415 				if (pe == NULL) {
416 					if (chattygot) {
417 						fprintf(stderr,
418 						    "%s: ignoring %s\n",
419 						    getprogname(), refname);
420 					}
421 					continue;
422 				}
423 				found_branch = 1;
424 			} else if (!list_refs_only) {
425 				if (chattygot) {
426 					fprintf(stderr, "%s: ignoring %s\n",
427 					    getprogname(), refname);
428 				}
429 				continue;
430 			}
431 		}
432 
433 		if (refsz == nref + 1) {
434 			refsz *= 2;
435 			have = reallocarray(have, refsz, sizeof(have[0]));
436 			if (have == NULL) {
437 				err = got_error_from_errno("reallocarray");
438 				goto done;
439 			}
440 			want = reallocarray(want, refsz, sizeof(want[0]));
441 			if (want == NULL) {
442 				err = got_error_from_errno("reallocarray");
443 				goto done;
444 			}
445 		}
446 		if (!got_parse_sha1_digest(want[nref].sha1, id_str)) {
447 			err = got_error(GOT_ERR_BAD_OBJ_ID_STR);
448 			goto done;
449 		}
450 		match_remote_ref(have_refs, &have[nref], refname);
451 		err = send_fetch_ref(ibuf, &want[nref], refname);
452 		if (err)
453 			goto done;
454 
455 		if (chattygot)
456 			fprintf(stderr, "%s: %s will be fetched\n",
457 			    getprogname(), refname);
458 		if (chattygot > 1) {
459 			char *theirs, *mine;
460 			err = got_object_id_str(&theirs, &want[nref]);
461 			if (err)
462 				goto done;
463 			err = got_object_id_str(&mine, &have[nref]);
464 			if (err) {
465 				free(theirs);
466 				goto done;
467 			}
468 			fprintf(stderr, "%s: remote: %s\n%s: local:  %s\n",
469 			    getprogname(), theirs, getprogname(), mine);
470 			free(theirs);
471 			free(mine);
472 		}
473 		nref++;
474 	}
475 
476 	if (list_refs_only)
477 		goto done;
478 
479 	/* Abort if we haven't found any branch to fetch. */
480 	if (!found_branch) {
481 		err = got_error(GOT_ERR_FETCH_NO_BRANCH);
482 		goto done;
483 	}
484 
485 	for (i = 0; i < nref; i++) {
486 		if (got_object_id_cmp(&have[i], &want[i]) == 0)
487 			continue;
488 		got_sha1_digest_to_str(want[i].sha1, hashstr, sizeof(hashstr));
489 		n = snprintf(buf, sizeof(buf), "want %s%s\n", hashstr,
490 		    sent_my_capabilites || my_capabilities == NULL ?
491 		    "" : my_capabilities);
492 		if (n >= sizeof(buf)) {
493 			err = got_error(GOT_ERR_NO_SPACE);
494 			goto done;
495 		}
496 		err = got_pkt_writepkt(fd, buf, n, chattygot);
497 		if (err)
498 			goto done;
499 		sent_my_capabilites = 1;
500 		nwant++;
501 	}
502 	err = got_pkt_flushpkt(fd, chattygot);
503 	if (err)
504 		goto done;
505 
506 	if (nwant == 0)
507 		goto done;
508 
509 	TAILQ_FOREACH(pe, have_refs, entry) {
510 		struct got_object_id *id = pe->data;
511 		got_sha1_digest_to_str(id->sha1, hashstr, sizeof(hashstr));
512 		n = snprintf(buf, sizeof(buf), "have %s\n", hashstr);
513 		if (n >= sizeof(buf)) {
514 			err = got_error(GOT_ERR_NO_SPACE);
515 			goto done;
516 		}
517 		err = got_pkt_writepkt(fd, buf, n, chattygot);
518 		if (err)
519 			goto done;
520 		nhave++;
521 	}
522 
523 	while (nhave > 0 && !acked) {
524 		struct got_object_id common_id;
525 
526 		/* The server should ACK the object IDs we need. */
527 		err = got_pkt_readpkt(&n, fd, buf, sizeof(buf), chattygot);
528 		if (err)
529 			goto done;
530 		if (n >= 4 && strncmp(buf, "ERR ", 4) == 0) {
531 			err = fetch_error(&buf[4], n - 4);
532 			goto done;
533 		}
534 		if (n >= 4 && strncmp(buf, "NAK\n", 4) == 0) {
535 			/* Server has not located our objects yet. */
536 			continue;
537 		}
538 		if (n < 4 + SHA1_DIGEST_STRING_LENGTH ||
539 		    strncmp(buf, "ACK ", 4) != 0) {
540 			err = got_error_msg(GOT_ERR_BAD_PACKET,
541 			    "unexpected message from server");
542 			goto done;
543 		}
544 		if (!got_parse_sha1_digest(common_id.sha1, buf + 4)) {
545 			err = got_error_msg(GOT_ERR_BAD_PACKET,
546 			    "bad object ID in ACK packet from server");
547 			goto done;
548 		}
549 		acked++;
550 	}
551 
552 	n = snprintf(buf, sizeof(buf), "done\n");
553 	err = got_pkt_writepkt(fd, buf, n, chattygot);
554 	if (err)
555 		goto done;
556 
557 	if (nhave == 0) {
558 		err = got_pkt_readpkt(&n, fd, buf, sizeof(buf), chattygot);
559 		if (err)
560 			goto done;
561 		if (n != 4 || strncmp(buf, "NAK\n", n) != 0) {
562 			err = got_error_msg(GOT_ERR_BAD_PACKET,
563 			    "unexpected message from server");
564 			goto done;
565 		}
566 	}
567 
568 	if (chattygot)
569 		fprintf(stderr, "%s: fetching...\n", getprogname());
570 
571 	if (my_capabilities != NULL &&
572 	    strstr(my_capabilities, GOT_CAPA_SIDE_BAND_64K) != NULL)
573 		have_sidebands = 1;
574 
575 	while (1) {
576 		ssize_t r = 0;
577 		int datalen = -1;
578 
579 		if (have_sidebands) {
580 			err = got_pkt_readhdr(&datalen, fd, chattygot);
581 			if (err)
582 				goto done;
583 			if (datalen <= 0)
584 				break;
585 
586 			/* Read sideband channel ID (one byte). */
587 			r = read(fd, buf, 1);
588 			if (r == -1) {
589 				err = got_error_from_errno("read");
590 				goto done;
591 			}
592 			if (r != 1) {
593 				err = got_error_msg(GOT_ERR_BAD_PACKET,
594 				    "short packet");
595 				goto done;
596 			}
597 			if (datalen > sizeof(buf) - 5) {
598 				err = got_error_msg(GOT_ERR_BAD_PACKET,
599 				    "bad packet length");
600 				goto done;
601 			}
602 			datalen--; /* sideband ID has been read */
603 			if (buf[0] == GOT_SIDEBAND_PACKFILE_DATA) {
604 				/* Read packfile data. */
605 				err = got_pkt_readn(&r, fd, buf, datalen);
606 				if (err)
607 					goto done;
608 				if (r != datalen) {
609 					err = got_error_msg(GOT_ERR_BAD_PACKET,
610 					    "packet too short");
611 					goto done;
612 				}
613 			} else if (buf[0] == GOT_SIDEBAND_PROGRESS_INFO) {
614 				err = got_pkt_readn(&r, fd, buf, datalen);
615 				if (err)
616 					goto done;
617 				if (r != datalen) {
618 					err = got_error_msg(GOT_ERR_BAD_PACKET,
619 					    "packet too short");
620 					goto done;
621 				}
622 				err = fetch_progress(ibuf, buf, r);
623 				if (err)
624 					goto done;
625 				continue;
626 			} else if (buf[0] == GOT_SIDEBAND_ERROR_INFO) {
627 				err = got_pkt_readn(&r, fd, buf, datalen);
628 				if (err)
629 					goto done;
630 				if (r != datalen) {
631 					err = got_error_msg(GOT_ERR_BAD_PACKET,
632 					    "packet too short");
633 					goto done;
634 				}
635 				err = fetch_error(buf, r);
636 				goto done;
637 			} else if (buf[0] == 'A') {
638 				err = got_pkt_readn(&r, fd, buf, datalen);
639 				if (err)
640 					goto done;
641 				if (r != datalen) {
642 					err = got_error_msg(GOT_ERR_BAD_PACKET,
643 					    "packet too short");
644 					goto done;
645 				}
646 				/*
647 				 * Git server responds with ACK after 'done'
648 				 * even though multi_ack is disabled?!?
649 				 */
650 				buf[r] = '\0';
651 				if (strncmp(buf, "CK ", 3) == 0)
652 					continue; /* ignore */
653 				err = got_error_msg(GOT_ERR_BAD_PACKET,
654 				    "unexpected message from server");
655 				goto done;
656 			} else {
657 				err = got_error_msg(GOT_ERR_BAD_PACKET,
658 				    "unknown side-band received from server");
659 				goto done;
660 			}
661 		} else {
662 			/* No sideband channel. Every byte is packfile data. */
663 			err = got_pkt_readn(&r, fd, buf, sizeof buf);
664 			if (err)
665 				goto done;
666 			if (r <= 0)
667 				break;
668 		}
669 
670 		/*
671 		 * An expected SHA1 checksum sits at the end of the pack file.
672 		 * Since we don't know the file size ahead of time we have to
673 		 * keep SHA1_DIGEST_LENGTH bytes buffered and avoid mixing
674 		 * those bytes into our SHA1 checksum computation until we
675 		 * know for sure that additional pack file data bytes follow.
676 		 *
677 		 * We can assume r > 0 since otherwise the loop would exit.
678 		 */
679 		if (r < SHA1_DIGEST_LENGTH) {
680 			if (sha1_buf_len < SHA1_DIGEST_LENGTH) {
681 				/*
682 				 * If there's enough buffered + read data to
683 				 * fill up the buffer then shift a sufficient
684 				 * amount of bytes out at the front to make
685 				 * room, mixing those bytes into the checksum.
686 				 */
687 				while (sha1_buf_len > 0 &&
688 				    sha1_buf_len + r > SHA1_DIGEST_LENGTH) {
689 					SHA1Update(&sha1_ctx, sha1_buf, 1);
690 					memmove(sha1_buf, sha1_buf + 1, 1);
691 					sha1_buf_len--;
692 				}
693 
694 				/* Buffer potential checksum bytes. */
695 				memcpy(sha1_buf + sha1_buf_len, buf, r);
696 				sha1_buf_len += r;
697 			} else {
698 				/*
699 				 * Mix in previously buffered bytes which
700 				 * are not part of the checksum after all.
701 				 */
702 				SHA1Update(&sha1_ctx, sha1_buf, r);
703 
704 				/* Update potential checksum buffer. */
705 				memmove(sha1_buf, sha1_buf + r,
706 				    sha1_buf_len - r);
707 				memcpy(sha1_buf + sha1_buf_len - r, buf, r);
708 			}
709 		} else {
710 			/* Mix in any previously buffered bytes. */
711 			SHA1Update(&sha1_ctx, sha1_buf, sha1_buf_len);
712 
713 			/* Mix in bytes read minus potential checksum bytes. */
714 			SHA1Update(&sha1_ctx, buf, r - SHA1_DIGEST_LENGTH);
715 
716 			/* Buffer potential checksum bytes. */
717 			memcpy(sha1_buf, buf + r - SHA1_DIGEST_LENGTH,
718 			    SHA1_DIGEST_LENGTH);
719 			sha1_buf_len = SHA1_DIGEST_LENGTH;
720 		}
721 
722 		/* Write packfile data to temporary pack file. */
723 		w = write(packfd, buf, r);
724 		if (w == -1) {
725 			err = got_error_from_errno("write");
726 			goto done;
727 		}
728 		if (w != r) {
729 			err = got_error(GOT_ERR_IO);
730 			goto done;
731 		}
732 		packsz += w;
733 
734 		/* Don't send too many progress privsep messages. */
735 		if (packsz > last_reported_packsz + 1024) {
736 			err = send_fetch_download_progress(ibuf, packsz, &rl);
737 			if (err)
738 				goto done;
739 			last_reported_packsz = packsz;
740 		}
741 	}
742 	err = send_fetch_download_progress(ibuf, packsz, NULL);
743 	if (err)
744 		goto done;
745 
746 	SHA1Final(pack_sha1, &sha1_ctx);
747 	if (sha1_buf_len != SHA1_DIGEST_LENGTH ||
748 	    memcmp(pack_sha1, sha1_buf, sha1_buf_len) != 0) {
749 		err = got_error_msg(GOT_ERR_BAD_PACKFILE,
750 		    "pack file checksum mismatch");
751 	}
752 done:
753 	TAILQ_FOREACH(pe, &symrefs, entry) {
754 		free((void *)pe->path);
755 		free(pe->data);
756 	}
757 	got_pathlist_free(&symrefs);
758 	free(have);
759 	free(want);
760 	free(id_str);
761 	free(refname);
762 	free(server_capabilities);
763 	return err;
764 }
765 
766 
767 int
768 main(int argc, char **argv)
769 {
770 	const struct got_error *err = NULL;
771 	int fetchfd, packfd = -1;
772 	uint8_t pack_sha1[SHA1_DIGEST_LENGTH];
773 	struct imsgbuf ibuf;
774 	struct imsg imsg;
775 	struct got_pathlist_head have_refs;
776 	struct got_pathlist_head wanted_branches;
777 	struct got_pathlist_head wanted_refs;
778 	struct got_pathlist_entry *pe;
779 	struct got_imsg_fetch_request fetch_req;
780 	struct got_imsg_fetch_have_ref href;
781 	struct got_imsg_fetch_wanted_branch wbranch;
782 	struct got_imsg_fetch_wanted_ref wref;
783 	size_t datalen, i;
784 #if 0
785 	static int attached;
786 	while (!attached)
787 		sleep (1);
788 #endif
789 
790 	TAILQ_INIT(&have_refs);
791 	TAILQ_INIT(&wanted_branches);
792 	TAILQ_INIT(&wanted_refs);
793 
794 	imsg_init(&ibuf, GOT_IMSG_FD_CHILD);
795 #ifndef PROFILE
796 	/* revoke access to most system calls */
797 	if (pledge("stdio recvfd", NULL) == -1) {
798 		err = got_error_from_errno("pledge");
799 		got_privsep_send_error(&ibuf, err);
800 		return 1;
801 	}
802 
803 	/* revoke fs access */
804 	if (landlock_no_fs() == -1) {
805 		err = got_error_from_errno("landlock_no_fs");
806 		got_privsep_send_error(&ibuf, err);
807 		return 1;
808 	}
809 	if (cap_enter() == -1) {
810 		err = got_error_from_errno("cap_enter");
811 		got_privsep_send_error(&ibuf, err);
812 		return 1;
813 	}
814 #endif
815 	err = got_privsep_recv_imsg(&imsg, &ibuf, 0);
816 	if (err) {
817 		if (err->code == GOT_ERR_PRIVSEP_PIPE)
818 			err = NULL;
819 		goto done;
820 	}
821 	if (imsg.hdr.type == GOT_IMSG_STOP)
822 		goto done;
823 	if (imsg.hdr.type != GOT_IMSG_FETCH_REQUEST) {
824 		err = got_error(GOT_ERR_PRIVSEP_MSG);
825 		goto done;
826 	}
827 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
828 	if (datalen < sizeof(fetch_req)) {
829 		err = got_error(GOT_ERR_PRIVSEP_LEN);
830 		goto done;
831 	}
832 	memcpy(&fetch_req, imsg.data, sizeof(fetch_req));
833 	fetchfd = imsg.fd;
834 	imsg_free(&imsg);
835 
836 	if (fetch_req.verbosity > 0)
837 		chattygot += fetch_req.verbosity;
838 
839 	for (i = 0; i < fetch_req.n_have_refs; i++) {
840 		struct got_object_id *id;
841 		char *refname;
842 
843 		err = got_privsep_recv_imsg(&imsg, &ibuf, 0);
844 		if (err) {
845 			if (err->code == GOT_ERR_PRIVSEP_PIPE)
846 				err = NULL;
847 			goto done;
848 		}
849 		if (imsg.hdr.type == GOT_IMSG_STOP)
850 			goto done;
851 		if (imsg.hdr.type != GOT_IMSG_FETCH_HAVE_REF) {
852 			err = got_error(GOT_ERR_PRIVSEP_MSG);
853 			goto done;
854 		}
855 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
856 		if (datalen < sizeof(href)) {
857 			err = got_error(GOT_ERR_PRIVSEP_LEN);
858 			goto done;
859 		}
860 		memcpy(&href, imsg.data, sizeof(href));
861 		if (datalen - sizeof(href) < href.name_len) {
862 			err = got_error(GOT_ERR_PRIVSEP_LEN);
863 			goto done;
864 		}
865 		refname = malloc(href.name_len + 1);
866 		if (refname == NULL) {
867 			err = got_error_from_errno("malloc");
868 			goto done;
869 		}
870 		memcpy(refname, imsg.data + sizeof(href), href.name_len);
871 		refname[href.name_len] = '\0';
872 
873 		id = malloc(sizeof(*id));
874 		if (id == NULL) {
875 			free(refname);
876 			err = got_error_from_errno("malloc");
877 			goto done;
878 		}
879 		memcpy(id->sha1, href.id, SHA1_DIGEST_LENGTH);
880 		err = got_pathlist_append(&have_refs, refname, id);
881 		if (err) {
882 			free(refname);
883 			free(id);
884 			goto done;
885 		}
886 
887 		imsg_free(&imsg);
888 	}
889 
890 	for (i = 0; i < fetch_req.n_wanted_branches; i++) {
891 		char *refname;
892 
893 		err = got_privsep_recv_imsg(&imsg, &ibuf, 0);
894 		if (err) {
895 			if (err->code == GOT_ERR_PRIVSEP_PIPE)
896 				err = NULL;
897 			goto done;
898 		}
899 		if (imsg.hdr.type == GOT_IMSG_STOP)
900 			goto done;
901 		if (imsg.hdr.type != GOT_IMSG_FETCH_WANTED_BRANCH) {
902 			err = got_error(GOT_ERR_PRIVSEP_MSG);
903 			goto done;
904 		}
905 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
906 		if (datalen < sizeof(wbranch)) {
907 			err = got_error(GOT_ERR_PRIVSEP_LEN);
908 			goto done;
909 		}
910 		memcpy(&wbranch, imsg.data, sizeof(wbranch));
911 		if (datalen - sizeof(wbranch) < wbranch.name_len) {
912 			err = got_error(GOT_ERR_PRIVSEP_LEN);
913 			goto done;
914 		}
915 		refname = malloc(wbranch.name_len + 1);
916 		if (refname == NULL) {
917 			err = got_error_from_errno("malloc");
918 			goto done;
919 		}
920 		memcpy(refname, imsg.data + sizeof(wbranch), wbranch.name_len);
921 		refname[wbranch.name_len] = '\0';
922 
923 		err = got_pathlist_append(&wanted_branches, refname, NULL);
924 		if (err) {
925 			free(refname);
926 			goto done;
927 		}
928 
929 		imsg_free(&imsg);
930 	}
931 
932 	for (i = 0; i < fetch_req.n_wanted_refs; i++) {
933 		char *refname;
934 
935 		err = got_privsep_recv_imsg(&imsg, &ibuf, 0);
936 		if (err) {
937 			if (err->code == GOT_ERR_PRIVSEP_PIPE)
938 				err = NULL;
939 			goto done;
940 		}
941 		if (imsg.hdr.type == GOT_IMSG_STOP)
942 			goto done;
943 		if (imsg.hdr.type != GOT_IMSG_FETCH_WANTED_REF) {
944 			err = got_error(GOT_ERR_PRIVSEP_MSG);
945 			goto done;
946 		}
947 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
948 		if (datalen < sizeof(wref)) {
949 			err = got_error(GOT_ERR_PRIVSEP_LEN);
950 			goto done;
951 		}
952 		memcpy(&wref, imsg.data, sizeof(wref));
953 		if (datalen - sizeof(wref) < wref.name_len) {
954 			err = got_error(GOT_ERR_PRIVSEP_LEN);
955 			goto done;
956 		}
957 		refname = malloc(wref.name_len + 1);
958 		if (refname == NULL) {
959 			err = got_error_from_errno("malloc");
960 			goto done;
961 		}
962 		memcpy(refname, imsg.data + sizeof(wref), wref.name_len);
963 		refname[wref.name_len] = '\0';
964 
965 		err = got_pathlist_append(&wanted_refs, refname, NULL);
966 		if (err) {
967 			free(refname);
968 			goto done;
969 		}
970 
971 		imsg_free(&imsg);
972 	}
973 
974 	err = got_privsep_recv_imsg(&imsg, &ibuf, 0);
975 	if (err) {
976 		if (err->code == GOT_ERR_PRIVSEP_PIPE)
977 			err = NULL;
978 		goto done;
979 	}
980 	if (imsg.hdr.type == GOT_IMSG_STOP)
981 		goto done;
982 	if (imsg.hdr.type != GOT_IMSG_FETCH_OUTFD) {
983 		err = got_error(GOT_ERR_PRIVSEP_MSG);
984 		goto done;
985 	}
986 	if (imsg.hdr.len - IMSG_HEADER_SIZE != 0) {
987 		err = got_error(GOT_ERR_PRIVSEP_LEN);
988 		goto done;
989 	}
990 	packfd = imsg.fd;
991 
992 	err = fetch_pack(fetchfd, packfd, pack_sha1, &have_refs,
993 	    fetch_req.fetch_all_branches, &wanted_branches,
994 	    &wanted_refs, fetch_req.list_refs_only, &ibuf);
995 done:
996 	TAILQ_FOREACH(pe, &have_refs, entry) {
997 		free((char *)pe->path);
998 		free(pe->data);
999 	}
1000 	got_pathlist_free(&have_refs);
1001 	TAILQ_FOREACH(pe, &wanted_branches, entry)
1002 		free((char *)pe->path);
1003 	got_pathlist_free(&wanted_branches);
1004 	if (fetchfd != -1 && close(fetchfd) == -1 && err == NULL)
1005 		err = got_error_from_errno("close");
1006 	if (packfd != -1 && close(packfd) == -1 && err == NULL)
1007 		err = got_error_from_errno("close");
1008 	if (err != NULL)
1009 		got_privsep_send_error(&ibuf, err);
1010 	else
1011 		err = send_fetch_done(&ibuf, pack_sha1);
1012 	if (err != NULL) {
1013 		fprintf(stderr, "%s: %s\n", getprogname(), err->msg);
1014 		got_privsep_send_error(&ibuf, err);
1015 	}
1016 
1017 	exit(0);
1018 }