/src/git/promisor-remote.c

Source
#define USE_THE_REPOSITORY_VARIABLE

#include "git-compat-util.h"
#include "gettext.h"
#include "hex.h"
#include "odb.h"
#include "promisor-remote.h"
#include "config.h"
#include "trace2.h"
#include "transport.h"
#include "strvec.h"
#include "packfile.h"
#include "environment.h"
#include "url.h"
#include "urlmatch.h"
#include "version.h"
#include "wildmatch.h"

struct promisor_remote_config {
  struct promisor_remote *promisors;
  struct promisor_remote **promisors_tail;
};

static int fetch_objects(struct repository *repo,
       const char *remote_name,
       const struct object_id *oids,
       int oid_nr, int depth)
{
  struct child_process child = CHILD_PROCESS_INIT;
  int i;
  FILE *child_in;
  int quiet;

  child.git_cmd = 1;
  child.in = -1;
  if (repo != the_repository)
    prepare_other_repo_env(&child.env, repo->gitdir);
  strvec_pushl(&child.args, "-c", "fetch.negotiationAlgorithm=noop",
         "fetch", remote_name, "--no-tags",
         "--no-write-fetch-head", "--recurse-submodules=no",
         "--filter=blob:none", "--stdin", NULL);
  if (!repo_config_get_bool(repo, "promisor.quiet", &quiet) && quiet)
    strvec_push(&child.args, "--quiet");
  strvec_pushf(&child.env, "%s=%d", LAZY_FETCH_DEPTH_ENVIRONMENT, depth + 1);
  if (start_command(&child))
    die(_("promisor-remote: unable to fork off fetch subprocess"));
  child_in = xfdopen(child.in, "w");

  trace2_data_intmax("promisor", repo, "fetch_count", oid_nr);

  for (i = 0; i < oid_nr; i++) {
    if (fputs(oid_to_hex(&oids[i]), child_in) < 0)
      die_errno(_("promisor-remote: could not write to fetch subprocess"));
    if (fputc('\n', child_in) < 0)
      die_errno(_("promisor-remote: could not write to fetch subprocess"));
  }

  if (fclose(child_in) < 0)
    die_errno(_("promisor-remote: could not close stdin to fetch subprocess"));
  return finish_command(&child) ? -1 : 0;
}

static struct promisor_remote *promisor_remote_new(struct promisor_remote_config *config,
               const char *remote_name)
{
  struct promisor_remote *r;

  if (*remote_name == '/') {
    warning(_("promisor remote name cannot begin with '/': %s"),
      remote_name);
    return NULL;
  }

  FLEX_ALLOC_STR(r, name, remote_name);

  *config->promisors_tail = r;
  config->promisors_tail = &r->next;

  return r;
}

static struct promisor_remote *promisor_remote_lookup(struct promisor_remote_config *config,
                  const char *remote_name,
                  struct promisor_remote **previous)
{
  struct promisor_remote *r, *p;

  for (p = NULL, r = config->promisors; r; p = r, r = r->next)
    if (!strcmp(r->name, remote_name)) {
      if (previous)
        *previous = p;
      return r;
    }

  return NULL;
}

static void promisor_remote_move_to_tail(struct promisor_remote_config *config,
           struct promisor_remote *r,
           struct promisor_remote *previous)
{
  if (!r->next)
    return;

  if (previous)
    previous->next = r->next;
  else
    config->promisors = r->next ? r->next : r;
  r->next = NULL;
  *config->promisors_tail = r;
  config->promisors_tail = &r->next;
}

static int promisor_remote_config(const char *var, const char *value,
          const struct config_context *ctx UNUSED,
          void *data)
{
  struct promisor_remote_config *config = data;
  const char *name;
  size_t namelen;
  const char *subkey;

  if (parse_config_key(var, "remote", &name, &namelen, &subkey) < 0)
    return 0;

  if (!strcmp(subkey, "promisor")) {
    char *remote_name;

    if (!git_config_bool(var, value))
      return 0;

    remote_name = xmemdupz(name, namelen);

    if (!promisor_remote_lookup(config, remote_name, NULL))
      promisor_remote_new(config, remote_name);

    free(remote_name);
    return 0;
  }
  if (!strcmp(subkey, "partialclonefilter")) {
    struct promisor_remote *r;
    char *remote_name = xmemdupz(name, namelen);

    r = promisor_remote_lookup(config, remote_name, NULL);
    if (!r)
      r = promisor_remote_new(config, remote_name);

    free(remote_name);

    if (!r)
      return 0;

    FREE_AND_NULL(r->partial_clone_filter);
    return git_config_string(&r->partial_clone_filter, var, value);
  }

  return 0;
}

static void promisor_remote_init(struct repository *r)
{
  struct promisor_remote_config *config;

  if (r->promisor_remote_config)
    return;
  config = r->promisor_remote_config =
    xcalloc(1, sizeof(*r->promisor_remote_config));
  config->promisors_tail = &config->promisors;

  repo_config(r, promisor_remote_config, config);

  if (r->repository_format_partial_clone) {
    struct promisor_remote *o, *previous;

    o = promisor_remote_lookup(config,
             r->repository_format_partial_clone,
             &previous);
    if (o)
      promisor_remote_move_to_tail(config, o, previous);
    else
      promisor_remote_new(config, r->repository_format_partial_clone);
  }
}

void promisor_remote_clear(struct promisor_remote_config *config)
{
  while (config->promisors) {
    struct promisor_remote *r = config->promisors;
    free(r->partial_clone_filter);
    free(r->advertised_filter);
    config->promisors = config->promisors->next;
    free(r);
  }

  config->promisors_tail = &config->promisors;
}

void repo_promisor_remote_reinit(struct repository *r)
{
  promisor_remote_clear(r->promisor_remote_config);
  FREE_AND_NULL(r->promisor_remote_config);
  promisor_remote_init(r);
}

struct promisor_remote *repo_promisor_remote_find(struct repository *r,
              const char *remote_name)
{
  promisor_remote_init(r);

  if (!remote_name)
    return r->promisor_remote_config->promisors;

  return promisor_remote_lookup(r->promisor_remote_config, remote_name, NULL);
}

int repo_has_promisor_remote(struct repository *r)
{
  return !!repo_promisor_remote_find(r, NULL);
}

int repo_has_accepted_promisor_remote(struct repository *r)
{
  struct promisor_remote *p;

  promisor_remote_init(r);

  for (p = r->promisor_remote_config->promisors; p; p = p->next)
    if (p->accepted)
      return 1;
  return 0;
}

static int remove_fetched_oids(struct repository *repo,
             struct object_id **oids,
             int oid_nr, int to_free)
{
  int i, remaining_nr = 0;
  int *remaining = xcalloc(oid_nr, sizeof(*remaining));
  struct object_id *old_oids = *oids;
  struct object_id *new_oids;

  for (i = 0; i < oid_nr; i++)
    if (odb_read_object_info_extended(repo->objects, &old_oids[i], NULL,
              OBJECT_INFO_SKIP_FETCH_OBJECT)) {
      remaining[i] = 1;
      remaining_nr++;
    }

  if (remaining_nr) {
    int j = 0;
    CALLOC_ARRAY(new_oids, remaining_nr);
    for (i = 0; i < oid_nr; i++)
      if (remaining[i])
        oidcpy(&new_oids[j++], &old_oids[i]);
    *oids = new_oids;
    if (to_free)
      free(old_oids);
  }

  free(remaining);

  return remaining_nr;
}

/*
 * Fetch the remaining objects (given in '*remaining_oids', which
 * contains '*remaining_nr' object ids) from the known promisor
 * remotes. If 'accepted_only' is true, ignore promisor remotes with
 * their 'accepted' member unset.
 *
 * When a fetch from a remote fails, the objects that are still
 * missing are computed, and '*remaining_oids' and '*remaining_nr' are
 * updated accordingly before trying the next remote. In that case
 * '*remaining_oids' points to a new array that this function
 * allocated, and '*to_free' is set to 1 to tell the caller that it
 * owns that array and should free it. '*to_free' should be 0 on the
 * first call.
 *
 * Return 1 when all the requested objects have been fetched, 0
 * otherwise.
 */
static int try_promisor_remotes(struct repository *repo,
        struct object_id **remaining_oids,
        int *remaining_nr,
        int *to_free,
        int depth,
        bool accepted_only)
{
  struct promisor_remote *r = repo->promisor_remote_config->promisors;

  for (; r; r = r->next) {
    if (accepted_only != r->accepted)
      continue;
    if (fetch_objects(repo, r->name,
          *remaining_oids, *remaining_nr, depth) < 0) {
      if (*remaining_nr == 1)
        continue;
      *remaining_nr = remove_fetched_oids(repo, remaining_oids,
                  *remaining_nr, *to_free);
      if (*remaining_nr) {
        *to_free = 1;
        continue;
      }
    }
    return 1; /* all fetched */
  }
  return 0;
}

#define MAX_LAZY_FETCH_DEPTH 5

/*
 * Lazily fetch the objects given in '*remaining_oids' from the
 * promisor remotes, trying the accepted ones first. See
 * try_promisor_remotes() above for how '*remaining_oids',
 * '*remaining_nr' and '*to_free' are used.
 *
 * Return 1 when all the requested objects have been fetched, 0
 * otherwise.
 */
static int lazy_fetch_objects(struct repository *repo,
            struct object_id **remaining_oids,
            int *remaining_nr,
            int *to_free)
{
  int depth = (int)git_env_ulong(LAZY_FETCH_DEPTH_ENVIRONMENT, 0);

  if (git_env_bool(NO_LAZY_FETCH_ENVIRONMENT, 0)) {
    static int warning_shown;
    if (!warning_shown) {
      warning_shown = 1;
      warning(_("lazy fetching disabled; some objects may not be available"));
    }
    return 0;
  }

  if (depth >= MAX_LAZY_FETCH_DEPTH) {
    static int warning_shown;
    if (!warning_shown) {
      warning_shown = 1;
      warning(_("too many nested lazy fetches (%d); "
          "is a promisor remote pointing at the repository itself?"),
        depth);
    }
    return 0;
  }

  promisor_remote_init(repo);

  /* Try accepted remotes first (those the server told us to use) */
  return try_promisor_remotes(repo, remaining_oids, remaining_nr,
            to_free, depth, true) ||
    try_promisor_remotes(repo, remaining_oids, remaining_nr,
             to_free, depth, false);
}

void promisor_remote_get_direct(struct repository *repo,
        const struct object_id *oids,
        int oid_nr)
{
  struct object_id *remaining_oids = (struct object_id *)oids;
  int remaining_nr = oid_nr;
  int to_free = 0;

  if (oid_nr == 0)
    return;

  if (!lazy_fetch_objects(repo, &remaining_oids, &remaining_nr, &to_free)) {
    for (int i = 0; i < remaining_nr; i++) {
      if (is_promisor_object(repo, &remaining_oids[i]))
        die(_("could not fetch %s from promisor remote"),
            oid_to_hex(&remaining_oids[i]));
    }
  }

  if (to_free)
    free(remaining_oids);
}

static int allow_unsanitized(char ch)
{
  if (ch == ',' || ch == ';' || ch == '%')
    return 0;
  return ch > 32 && ch < 127;
}

/*
 * All the fields used in "promisor-remote" protocol capability,
 * including the mandatory "name" and "url" ones.
 */
static const char promisor_field_name[] = "name";
static const char promisor_field_url[] = "url";
static const char promisor_field_filter[] = "partialCloneFilter";
static const char promisor_field_token[] = "token";

/*
 * List of optional field names that can be used in the
 * "promisor-remote" protocol capability (others must be
 * ignored). Each field should correspond to a configurable property
 * of a remote that can be relevant for the client.
 */
static const char *known_fields[] = {
  promisor_field_filter, /* Filter used for partial clone */
  promisor_field_token,  /* Authentication token for the remote */
  NULL
};

/*
 * Check if 'field' is in the list of the known field names for the
 * "promisor-remote" protocol capability.
 */
static int is_known_field(const char *field)
{
  const char **p;

  for (p = known_fields; *p; p++)
    if (!strcasecmp(*p, field))
      return 1;
  return 0;
}

static int is_valid_field(struct string_list_item *item, void *cb_data)
{
  const char *field = item->string;
  const char *config_key = (const char *)cb_data;

  if (!is_known_field(field)) {
    warning(_("unsupported field '%s' in '%s' config"), field, config_key);
    return 0;
  }
  return 1;
}

static char *fields_from_config(struct string_list *fields_list, const char *config_key)
{
  char *fields = NULL;

  if (!repo_config_get_string(the_repository, config_key, &fields) && *fields) {
    string_list_split_in_place_f(fields_list, fields, ",", -1,
               STRING_LIST_SPLIT_TRIM |
               STRING_LIST_SPLIT_NONEMPTY);
    filter_string_list(fields_list, 0, is_valid_field, (void *)config_key);
  }

  return fields;
}

static struct string_list *initialize_fields_list(struct string_list *fields_list, int *initialized,
              const char *config_key)
{
  if (!*initialized) {
    fields_list->cmp = strcasecmp;
    fields_from_config(fields_list, config_key);
    *initialized = 1;
  }

  return fields_list;
}

static struct string_list *fields_sent(void)
{
  static struct string_list fields_list = STRING_LIST_INIT_NODUP;
  static int initialized;

  return initialize_fields_list(&fields_list, &initialized, "promisor.sendFields");
}

static struct string_list *fields_checked(void)
{
  static struct string_list fields_list = STRING_LIST_INIT_NODUP;
  static int initialized;

  return initialize_fields_list(&fields_list, &initialized, "promisor.checkFields");
}

static struct string_list *fields_stored(void)
{
  static struct string_list fields_list = STRING_LIST_INIT_NODUP;
  static int initialized;

  return initialize_fields_list(&fields_list, &initialized, "promisor.storeFields");
}

/*
 * Struct for promisor remotes involved in the "promisor-remote"
 * protocol capability.
 *
 * Except for "name" and "local_name", each <member> in this struct
 * and its <value> should correspond (either on the client side or on
 * the server side) to a "remote.<name>.<member>" config variable set
 * to <value> where "<name>" is a promisor remote name.
 */
struct promisor_info {
  const char *name; /* name the server advertised */
  const char *local_name; /* name used locally (may be auto-generated) */
  const char *url;
  const char *filter;
  const char *token;
};

static void promisor_info_free(struct promisor_info *p)
{
  free((char *)p->name);
  free((char *)p->local_name);
  free((char *)p->url);
  free((char *)p->filter);
  free((char *)p->token);
  free(p);
}

static void promisor_info_list_clear(struct string_list *list)
{
  for (size_t i = 0; i < list->nr; i++)
    promisor_info_free(list->items[i].util);
  string_list_clear(list, 0);
}

static const char *promisor_info_local_name(struct promisor_info *p)
{
  return p->local_name ? p->local_name : p->name;
}

static void set_one_field(struct promisor_info *p,
        const char *field, const char *value)
{
  if (!strcasecmp(field, promisor_field_filter))
    p->filter = xstrdup(value);
  else if (!strcasecmp(field, promisor_field_token))
    p->token = xstrdup(value);
  else
    BUG("invalid field '%s'", field);
}

static void set_fields(struct promisor_info *p,
           struct string_list *field_names)
{
  struct string_list_item *item;

  for_each_string_list_item(item, field_names) {
    char *key = xstrfmt("remote.%s.%s", p->name, item->string);
    const char *val;
    if (!repo_config_get_string_tmp(the_repository, key, &val) && *val)
      set_one_field(p, item->string, val);
    free(key);
  }
}

/*
 * Populate 'list' with promisor remote information from the config.
 * The 'util' pointer of each list item will hold a 'struct
 * promisor_info'. Except "name" and "url", only members of that
 * struct specified by the 'field_names' list are set (using values
 * from the configuration).
 */
static void promisor_config_info_list(struct repository *repo,
              struct string_list *list,
              struct string_list *field_names)
{
  struct promisor_remote *r;

  promisor_remote_init(repo);

  for (r = repo->promisor_remote_config->promisors; r; r = r->next) {
    const char *url;
    char *url_key = xstrfmt("remote.%s.url", r->name);

    /* Only add remotes with a non empty URL */
    if (!repo_config_get_string_tmp(the_repository, url_key, &url) && *url) {
      struct promisor_info *new_info = xcalloc(1, sizeof(*new_info));
      struct string_list_item *item;

      new_info->name = xstrdup(r->name);
      new_info->url = xstrdup(url);

      if (field_names)
        set_fields(new_info, field_names);

      item = string_list_append(list, new_info->name);
      item->util = new_info;
    }

    free(url_key);
  }
}

char *promisor_remote_info(struct repository *repo)
{
  struct strbuf sb = STRBUF_INIT;
  int advertise_promisors = 0;
  struct string_list config_info = STRING_LIST_INIT_NODUP;
  struct string_list_item *item;

  repo_config_get_bool(the_repository, "promisor.advertise", &advertise_promisors);

  if (!advertise_promisors)
    return NULL;

  promisor_config_info_list(repo, &config_info, fields_sent());

  if (!config_info.nr)
    return NULL;

  for_each_string_list_item(item, &config_info) {
    struct promisor_info *p = item->util;

    if (item != config_info.items)
      strbuf_addch(&sb, ';');

    strbuf_addf(&sb, "%s=", promisor_field_name);
    strbuf_addstr_urlencode(&sb, p->name, allow_unsanitized);
    strbuf_addf(&sb, ",%s=", promisor_field_url);
    strbuf_addstr_urlencode(&sb, p->url, allow_unsanitized);

    if (p->filter) {
      strbuf_addf(&sb, ",%s=", promisor_field_filter);
      strbuf_addstr_urlencode(&sb, p->filter, allow_unsanitized);
    }
    if (p->token) {
      strbuf_addf(&sb, ",%s=", promisor_field_token);
      strbuf_addstr_urlencode(&sb, p->token, allow_unsanitized);
    }
  }

  promisor_info_list_clear(&config_info);

  return strbuf_detach(&sb, NULL);
}

enum accept_promisor {
  ACCEPT_NONE = 0,
  ACCEPT_KNOWN_URL,
  ACCEPT_KNOWN_NAME,
  ACCEPT_ALL
};

/*
 * Check if a specific field and its advertised value match the local
 * configuration of a given promisor remote.
 *
 * Returns 1 if they match, 0 otherwise.
 */
static int match_field_against_config(const char *field, const char *value,
              struct promisor_info *config_info)
{
  if (config_info->filter && !strcasecmp(field, promisor_field_filter))
    return !strcmp(config_info->filter, value);
  else if (config_info->token && !strcasecmp(field, promisor_field_token))
    return !strcmp(config_info->token, value);

  return 0;
}

/*
 * Check that the advertised fields match the local configuration.
 *
 * When 'config_entry' is NULL (ACCEPT_ALL mode), every checked field
 * must match at least one remote in 'config_info'.
 *
 * When 'config_entry' points to a specific remote's config, the
 * checked fields are compared against that single remote only.
 */
static int all_fields_match(struct promisor_info *advertised,
          struct string_list *config_info,
          struct promisor_info *config_entry)
{
  struct string_list *fields = fields_checked();
  struct string_list_item *item_checked;

  for_each_string_list_item(item_checked, fields) {
    int match = 0;
    const char *field = item_checked->string;
    const char *value = NULL;

    if (!strcasecmp(field, promisor_field_filter))
      value = advertised->filter;
    else if (!strcasecmp(field, promisor_field_token))
      value = advertised->token;

    if (!value)
      return 0;

    if (config_entry) {
      match = match_field_against_config(field, value,
                 config_entry);
    } else {
      struct string_list_item *item;
      for_each_string_list_item(item, config_info) {
        struct promisor_info *p = item->util;
        if (match_field_against_config(field, value, p)) {
          match = 1;
          break;
        }
      }
    }

    if (!match)
      return 0;
  }

  return 1;
}

static bool has_control_char(const char *s)
{
  for (const char *c = s; *c; c++)
    if (iscntrl(*c))
      return true;
  return false;
}

struct allowed_url {
  char *remote_name;
  char *url_pattern;
  struct url_info pattern_info;
};

static void allowed_url_free(void *util, const char *str UNUSED)
{
  struct allowed_url *allowed = util;

  if (!allowed)
    return;

  /* Depending on prefix, free either remote_name or url_pattern */
  free(allowed->remote_name ? allowed->remote_name : allowed->url_pattern);
  free(allowed->pattern_info.url);
  free(allowed);
}

static struct allowed_url *valid_accept_url(const char *url)
{
  char *dup, *p;
  struct allowed_url *allowed;

  if (!url)
    return NULL;

  dup = xstrdup(url);
  p = strchr(dup, '=');
  if (p) {
    *p = '\0';
    if (!valid_remote_name(dup)) {
      warning(_("invalid remote name '%s' before '=' sign "
          "in '%s' from promisor.acceptFromServerUrl config"),
        dup, url);
      free(dup);
      return NULL;
    }
    p++;
  } else {
    p = dup;
  }

  if (has_control_char(p)) {
    warning(_("invalid url pattern '%s' "
        "in '%s' from promisor.acceptFromServerUrl config"), p, url);
    free(dup);
    return NULL;
  }

  allowed = xmalloc(sizeof(*allowed));
  allowed->remote_name = (p == dup) ? NULL : dup;
  allowed->url_pattern = p;
  allowed->pattern_info.url = url_normalize_pattern(p, &allowed->pattern_info);
  if (!allowed->pattern_info.url) {
    warning(_("invalid url pattern '%s' "
        "in '%s' from promisor.acceptFromServerUrl config"), p, url);
    free(dup);
    free(allowed);
    return NULL;
  }

  return allowed;
}

static void load_accept_from_server_url(struct repository *repo,
          struct string_list *accept_urls)
{
  const struct string_list *config_urls;

  if (!repo_config_get_string_multi(repo, "promisor.acceptfromserverurl", &config_urls)) {
    struct string_list_item *item;

    for_each_string_list_item(item, config_urls) {
      struct allowed_url *allowed = valid_accept_url(item->string);
      if (allowed) {
        struct string_list_item *new;
        new = string_list_append(accept_urls, item->string);
        new->util = allowed;
      }
    }
  }
}

static bool match_pattern_url(const char *pat, size_t pat_len,
            const char *url, size_t url_len)
{
  char *p_str = xstrndup(pat, pat_len);
  char *u_str = xstrndup(url, url_len);
  bool res = !wildmatch(p_str, u_str, 0);

  free(p_str);
  free(u_str);

  return res;
}

static bool match_one_url(const struct url_info *pi, const struct url_info *ui)
{
  const char *pat = pi->url;
  const char *url = ui->url;

  /*
   * Schemes must match exactly. They are case-folded by
   * url_normalize(), so strncmp() suffices.
   */
  if (pi->scheme_len != ui->scheme_len || strncmp(pat, url, pi->scheme_len))
    return false;

  /*
   * Ports must match exactly. url_normalize() strips default
   * ports (like 443 for https), so length and content
   * comparisons are sufficient.
   */
  if (pi->port_len != ui->port_len ||
      strncmp(pat + pi->port_off, url + ui->port_off, pi->port_len))
    return false;

  /*
   * Match host and path separately to prevent a '*' in the host
   * portion of the pattern from matching across the '/'
   * boundary into the path.
   */

  return match_pattern_url(pat + pi->host_off, pi->host_len,
         url + ui->host_off, ui->host_len) &&
    match_pattern_url(pat + pi->path_off, pi->path_len,
          url + ui->path_off, ui->path_len);
}

static struct allowed_url *url_matches_accept_list(
    struct string_list *accept_urls, const char *url)
{
  struct string_list_item *item;
  struct url_info url_info;

  url_info.url = url_normalize(url, &url_info);

  if (!url_info.url)
    return NULL;

  for_each_string_list_item(item, accept_urls) {
    struct allowed_url *allowed = item->util;

    if (match_one_url(&allowed->pattern_info, &url_info)) {
      free(url_info.url);
      return allowed;
    }
  }

  free(url_info.url);
  return NULL;
}

/*
 * Sanitize the buffer to make it a valid remote name coming from the
 * server by:
 *
 * - replacing any non alphanumeric character with a '-'
 * - stripping any leading '-',
 * - condensing multiple '-' into one,
 * - prepending "promisor-auto-",
 * - validating the result.
 */
static int sanitize_remote_name(struct strbuf *buf, const char *url)
{
  char prev = '-';
  for (size_t i = 0; i < buf->len; ) {
    if (!isalnum(buf->buf[i]))
      buf->buf[i] = '-';
    if (prev == '-' && buf->buf[i] == '-') {
      strbuf_remove(buf, i, 1);
    } else {
      prev = buf->buf[i];
      i++;
    }
  }

  strbuf_strip_suffix(buf, "-");

  if (!buf->len) {
    warning(_("couldn't generate a valid remote name from "
        "advertised url '%s', ignoring this remote"), url);
    return -1;
  }

  strbuf_insertstr(buf, 0, "promisor-auto-");

  if (!valid_remote_name(buf->buf)) {
    warning(_("generated remote name '%s' from advertised url '%s' "
        "is invalid, ignoring this remote"), buf->buf, url);
    return -1;
  }

  return 0;
}

static char *promisor_remote_name_from_url(const char *url)
{
  struct url_info url_info = { 0 };
  char *normalized = url_normalize(url, &url_info);
  struct strbuf buf = STRBUF_INIT;

  if (!normalized) {
    warning(_("couldn't normalize advertised url '%s', "
        "ignoring this remote"), url);
    return NULL;
  }

  if (url_info.host_len) {
    strbuf_add(&buf, normalized + url_info.host_off, url_info.host_len);
    strbuf_addch(&buf, '-');
  }

  if (url_info.port_len) {
    strbuf_add(&buf, normalized + url_info.port_off, url_info.port_len);
    strbuf_addch(&buf, '-');
  }

  if (url_info.path_len) {
    strbuf_add(&buf, normalized + url_info.path_off, url_info.path_len);
    strbuf_trim_trailing_dir_sep(&buf);
    strbuf_strip_suffix(&buf, ".git");
  }

  free(normalized);

  if (sanitize_remote_name(&buf, url)) {
    strbuf_release(&buf);
    return NULL;
  }

  return strbuf_detach(&buf, NULL);
}

static void configure_auto_promisor_remote(struct repository *repo,
             const char *name,
             const char *url,
             const char *advertised_as,
             bool reuse)
{
  char *key;

  if (!reuse) {
    fprintf(stderr, _("Auto-creating promisor remote '%s' for URL '%s'\n"),
      name, url);

    key = xstrfmt("remote.%s.url", name);
    repo_config_set_gently(repo, key, url);
    free(key);
  }

  /* NB: when reusing, this promotes an existing non-promisor remote */
  key = xstrfmt("remote.%s.promisor", name);
  repo_config_set_gently(repo, key, "true");
  free(key);

  if (advertised_as) {
    key = xstrfmt("remote.%s.advertisedAs", name);
    repo_config_set_gently(repo, key, advertised_as);
    free(key);
  }
}

#define MAX_REMOTES_WITH_SIMILAR_NAMES 20

/* Return the allocated local name, or NULL on failure */
static char *handle_matching_allowed_url(struct repository *repo,
           char *allowed_name,
           const char *remote_url,
           const char *remote_name)
{
  char *name;
  char *basename = allowed_name ?
    xstrdup(allowed_name) :
    promisor_remote_name_from_url(remote_url);
  int i = 0;
  bool reuse = false;

  if (!basename)
    return NULL;

  name = xstrdup(basename);

  while (i < MAX_REMOTES_WITH_SIMILAR_NAMES) {
    char *url_key = xstrfmt("remote.%s.url", name);
    const char *existing_url;
    int exists = !repo_config_get_string_tmp(repo, url_key, &existing_url);

    free(url_key);

    if (!exists)
      break; /* Free to use */

    if (!strcmp(existing_url, remote_url)) {
      reuse = true;
      break; /* Same URL, so safe to reuse */
    }

    i++;
    free(name);
    name = xstrfmt("%s-%d", basename, i);
  }

  if (i < MAX_REMOTES_WITH_SIMILAR_NAMES) {
    configure_auto_promisor_remote(repo, name,
                 remote_url, remote_name,
                 reuse);
  } else {
    warning(_("too many remotes accepted with name like '%s-X', "
        "ignoring this remote"), basename);
    FREE_AND_NULL(name);
  }

  free(basename);
  return name;
}

static int should_accept_new_remote_url(struct repository *repo,
          struct string_list *accept_urls,
          struct promisor_info *advertised)
{
  struct allowed_url *allowed = url_matches_accept_list(accept_urls,
                   advertised->url);
  if (allowed) {
    char *name = handle_matching_allowed_url(repo,
               allowed->remote_name,
               advertised->url,
               advertised->name);
    if (name) {
      free((char *)advertised->local_name);
      advertised->local_name = name;
      return 1;
    }
  }

  return 0;
}

static int should_accept_remote(struct repository *repo,
        enum accept_promisor accept,
        struct promisor_info *advertised,
        struct string_list *accept_urls,
        struct string_list *config_info,
        bool *reload_config)
{
  struct promisor_info *p;
  struct string_list_item *item;
  const char *remote_name = advertised->name;
  const char *remote_url = advertised->url;

  if (!remote_url || !*remote_url)
    BUG("no or empty URL advertised for remote '%s'; "
        "this remote should have been rejected earlier",
        remote_name);

  /* Get config info for that promisor remote */
  item = string_list_lookup(config_info, remote_name);

  if (!item) {
    /* We don't know about that remote */

    int res = should_accept_new_remote_url(repo, accept_urls, advertised);
    if (res) {
      *reload_config = true;
      return res;
    }

    if (accept == ACCEPT_ALL)
      return all_fields_match(advertised, config_info, NULL);
    return 0;
  }

  p = item->util;

  /* Known remote in the allowlist? */
  if (!strcmp(p->url, remote_url) && url_matches_accept_list(accept_urls, remote_url))
    return all_fields_match(advertised, config_info, p);

  if (accept == ACCEPT_ALL)
    return all_fields_match(advertised, config_info, NULL);

  if (accept == ACCEPT_KNOWN_NAME)
    return all_fields_match(advertised, config_info, p);

  if (strcmp(p->url, remote_url)) {
    warning(_("known remote named '%s' but with URL '%s' instead of '%s', "
        "ignoring this remote"),
      remote_name, p->url, remote_url);
    return 0;
  }

  if (accept == ACCEPT_KNOWN_URL)
    return all_fields_match(advertised, config_info, p);

  if (accept != ACCEPT_NONE)
    BUG("Unhandled 'enum accept_promisor' value '%d'", accept);

  return 0;
}

static int skip_field_name_prefix(const char *elem, const char *field_name, const char **value)
{
  const char *p;
  if (!skip_prefix(elem, field_name, &p) || *p != '=')
    return 0;
  *value = p + 1;
  return 1;
}

static struct promisor_info *parse_one_advertised_remote(const char *remote_info)
{
  struct promisor_info *info = xcalloc(1, sizeof(*info));
  struct string_list elem_list = STRING_LIST_INIT_DUP;
  struct string_list_item *item;

  string_list_split(&elem_list, remote_info, ",", -1);

  for_each_string_list_item(item, &elem_list) {
    const char *elem = item->string;
    const char *p = strchr(elem, '=');

    if (!p) {
      warning(_("invalid element '%s' from remote info"), elem);
      continue;
    }

    if (skip_field_name_prefix(elem, promisor_field_name, &p))
      info->name = url_percent_decode(p);
    else if (skip_field_name_prefix(elem, promisor_field_url, &p))
      info->url = url_percent_decode(p);
    else if (skip_field_name_prefix(elem, promisor_field_filter, &p))
      info->filter = url_percent_decode(p);
    else if (skip_field_name_prefix(elem, promisor_field_token, &p))
      info->token = url_percent_decode(p);
  }

  string_list_clear(&elem_list, 0);

  if (!info->name || !*info->name || !info->url || !*info->url) {
    warning(_("server advertised a promisor remote without a name or URL: '%s', "
        "ignoring this remote"), remote_info);
    promisor_info_free(info);
    return NULL;
  }

  return info;
}

static bool store_one_field(struct repository *repo, const char *remote_name,
          const char *field_name, const char *field_key,
          const char *advertised, const char *current)
{
  if (advertised && (!current || strcmp(current, advertised))) {
    char *key = xstrfmt("remote.%s.%s", remote_name, field_key);

    fprintf(stderr, _("Storing new %s from server for remote '%s'.\n"
          "    '%s' -> '%s'\n"),
      field_name, remote_name,
      current ? current : "",
      advertised);

    repo_config_set_gently(repo, key, advertised);
    free(key);

    return true;
  }

  return false;
}

/* Check that a filter is valid by parsing it */
static bool valid_filter(const char *filter, const char *remote_name)
{
  struct list_objects_filter_options filter_opts = LIST_OBJECTS_FILTER_INIT;
  struct strbuf err = STRBUF_INIT;
  int res = gently_parse_list_objects_filter(&filter_opts, filter, &err);

  if (res)
    warning(_("invalid filter '%s' for remote '%s' "
        "will not be stored: %s"),
      filter, remote_name, err.buf);

  list_objects_filter_release(&filter_opts);
  strbuf_release(&err);

  return !res;
}

static bool valid_token(const char *token, const char *remote_name)
{
  if (has_control_char(token)) {
    warning(_("invalid token '%s' for remote '%s' "
        "will not be stored"),
      token, remote_name);
    return false;
  }

  return true;
}

struct store_info {
  struct repository *repo;
  struct string_list config_info;
  bool store_filter;
  bool store_token;
};

static struct store_info *store_info_new(struct repository *repo)
{
  struct string_list *fields_to_store = fields_stored();
  struct store_info *s = xmalloc(sizeof(*s));

  s->repo = repo;

  string_list_init_nodup(&s->config_info);
  promisor_config_info_list(repo, &s->config_info, fields_to_store);
  string_list_sort(&s->config_info);

  s->store_filter = !!string_list_lookup(fields_to_store, promisor_field_filter);
  s->store_token = !!string_list_lookup(fields_to_store, promisor_field_token);

  return s;
}

static void store_info_free(struct store_info *s)
{
  if (s) {
    promisor_info_list_clear(&s->config_info);
    free(s);
  }
}

static bool promisor_store_advertised_fields(struct promisor_info *advertised,
               struct store_info *store_info)
{
  struct promisor_info *p;
  struct string_list_item *item;
  const char *remote_name = promisor_info_local_name(advertised);
  bool reload_config = false;

  if (!(store_info->store_filter || store_info->store_token))
    return false;

  /*
   * Get existing config info for the advertised promisor
   * remote. This ensures the remote is already configured on
   * the client side.
   */
  item = string_list_lookup(&store_info->config_info, remote_name);

  if (!item)
    return false;

  p = item->util;

  if (store_info->store_filter && advertised->filter &&
      valid_filter(advertised->filter, remote_name))
    reload_config |= store_one_field(store_info->repo, remote_name,
             "filter", promisor_field_filter,
             advertised->filter, p->filter);

  if (store_info->store_token && advertised->token &&
      valid_token(advertised->token, remote_name))
    reload_config |= store_one_field(store_info->repo, remote_name,
             "token", promisor_field_token,
             advertised->token, p->token);

  return reload_config;
}

static enum accept_promisor accept_from_server(struct repository *repo)
{
  const char *accept_str;
  enum accept_promisor accept = ACCEPT_NONE;

  if (!repo_config_get_string_tmp(repo, "promisor.acceptfromserver", &accept_str)) {
    if (!*accept_str || !strcasecmp("None", accept_str))
      accept = ACCEPT_NONE;
    else if (!strcasecmp("KnownUrl", accept_str))
      accept = ACCEPT_KNOWN_URL;
    else if (!strcasecmp("KnownName", accept_str))
      accept = ACCEPT_KNOWN_NAME;
    else if (!strcasecmp("All", accept_str))
      accept = ACCEPT_ALL;
    else
      warning(_("unknown '%s' value for '%s' config option"),
        accept_str, "promisor.acceptfromserver");
  }

  return accept;
}

static void filter_promisor_remote(struct repository *repo,
           struct string_list *accepted_remotes,
           const char *info)
{
  struct string_list config_info = STRING_LIST_INIT_NODUP;
  struct string_list remote_info = STRING_LIST_INIT_DUP;
  struct store_info *store_info = NULL;
  struct string_list_item *item;
  bool reload_config = false;
  enum accept_promisor accept = accept_from_server(repo);
  struct string_list accept_urls = STRING_LIST_INIT_DUP;

  /* Load and validate the acceptFromServerUrl config */
  load_accept_from_server_url(repo, &accept_urls);

  if (accept == ACCEPT_NONE && !accept_urls.nr)
    return;

  /* Parse remote info received */

  string_list_split(&remote_info, info, ";", -1);

  for_each_string_list_item(item, &remote_info) {
    struct promisor_info *advertised;

    advertised = parse_one_advertised_remote(item->string);

    if (!advertised)
      continue;

    if (!config_info.nr) {
      promisor_config_info_list(repo, &config_info, fields_checked());
      string_list_sort(&config_info);
    }

    if (should_accept_remote(repo, accept, advertised, &accept_urls,
           &config_info, &reload_config)) {
      if (!store_info)
        store_info = store_info_new(repo);
      if (promisor_store_advertised_fields(advertised, store_info))
        reload_config = true;

      string_list_append(accepted_remotes, advertised->name)->util = advertised;
    } else {
      promisor_info_free(advertised);
    }
  }

  string_list_clear_func(&accept_urls, allowed_url_free);
  promisor_info_list_clear(&config_info);
  string_list_clear(&remote_info, 0);
  store_info_free(store_info);

  if (reload_config)
    repo_promisor_remote_reinit(repo);

  /* Apply accepted remotes to the stable repo state */
  for_each_string_list_item(item, accepted_remotes) {
    struct promisor_info *info = item->util;
    const char *remote_name = promisor_info_local_name(info);
    struct promisor_remote *r = repo_promisor_remote_find(repo, remote_name);

    if (r) {
      r->accepted = 1;
      if (info->filter) {
        free(r->advertised_filter);
        r->advertised_filter = xstrdup(info->filter);
      }
    }
  }
}

void promisor_remote_reply(const char *info, char **accepted_out)
{
  struct string_list accepted_remotes = STRING_LIST_INIT_NODUP;

  filter_promisor_remote(the_repository, &accepted_remotes, info);

  if (accepted_out) {
    if (accepted_remotes.nr) {
      struct strbuf reply = STRBUF_INIT;
      struct string_list_item *item;

      for_each_string_list_item(item, &accepted_remotes) {
        if (reply.len)
          strbuf_addch(&reply, ';');
        strbuf_addstr_urlencode(&reply, item->string, allow_unsanitized);
      }
      *accepted_out = strbuf_detach(&reply, NULL);
    } else {
      *accepted_out = NULL;
    }
  }

  promisor_info_list_clear(&accepted_remotes);
}

void mark_promisor_remotes_as_accepted(struct repository *r, const char *remotes)
{
  struct string_list accepted_remotes = STRING_LIST_INIT_DUP;
  struct string_list_item *item;

  string_list_split(&accepted_remotes, remotes, ";", -1);

  for_each_string_list_item(item, &accepted_remotes) {
    char *decoded_remote = url_percent_decode(item->string);
    struct promisor_remote *p = repo_promisor_remote_find(r, decoded_remote);

    if (p)
      p->accepted = 1;
    else
      warning(_("accepted promisor remote '%s' not found"),
        decoded_remote);

    free(decoded_remote);
  }

  string_list_clear(&accepted_remotes, 0);
}

char *promisor_remote_construct_filter(struct repository *repo)
{
  struct promisor_remote *r;
  struct list_objects_filter_options filter_options = LIST_OBJECTS_FILTER_INIT;
  struct strbuf err = STRBUF_INIT;
  char *result = NULL;

  promisor_remote_init(repo);

  for (r = repo->promisor_remote_config->promisors; r; r = r->next) {
    if (r->accepted && r->advertised_filter)
      if (gently_parse_list_objects_filter(&filter_options,
                   r->advertised_filter,
                   &err)) {
        warning(_("promisor remote '%s' advertised invalid filter '%s': %s"),
          r->name, r->advertised_filter, err.buf);
        strbuf_reset(&err);
        continue;
      }
  }

  if (filter_options.choice)
    result = xstrdup(expand_list_objects_filter_spec(&filter_options));

  list_objects_filter_release(&filter_options);
  strbuf_release(&err);

  return result;
}

Coverage Report

Created: 2026-11-12 06:03