upload-pack: allow stateless client EOF just prior to haves

During stateless packfile negotiation where a depth is given, stateless RPC clients (e.g. git-remote-curl) will send multiple upload-pack requests with the first containing only the wants/shallows/deepens/filters and the subsequent containing haves/done. When upload-pack handles such requests, entering get_common_commits without checking whether the client has hung up can result in unexpected EOF during the negotiation loop and a die() with message "fatal: the remote end hung up unexpectedly". Real world effects include: - A client speaking to git-http-backend via a server that doesn't check the exit codes of CGIs (e.g. mod_cgi) doesn't know and doesn't care about the fatal. It continues to process the response body as normal. - A client speaking to a server that does check the exit code and returns an errant HTTP status as a result will fail with the message "error: RPC failed; HTTP 500 curl 22 The requested URL returned error: 500." - Admins running servers that surface the failure must workaround it by patching code that handles execution of git-http-backend to ignore exit codes or take other heuristic approaches. - Admins may have to deal with "hung up unexpectedly" log spam related to the failures even in cases where the exit code isn't surfaced as an HTTP server-side error status. To avoid these EOF related fatals, have upload-pack gently peek for an EOF between the sending of shallow/unshallow lines (followed by flush) and the reading of client haves. If the client has hung up at this point, exit normally. Signed-off-by: Daniel Duvall <dan@mutual.io> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Daniel Duvall committed Oct 30, 2020 at 19:39 UTC fb3d1a083f776f02caa514cad8b232d8b974641f
2 files changed +29 -1
t/t5530-upload-pack-error.sh
+17
@@ -88,6 +88,23 @@ test_expect_success 'upload-pack fails due to error in pack-objects enumeration'
88 grep "pack-objects died" output.err
89 '
90
91 +test_expect_success 'upload-pack tolerates EOF just after stateless client wants' '
92 + test_commit initial &&
93 + head=$(git rev-parse HEAD) &&
94 +
95 + {
96 + packetize "want $head" &&
97 + packetize "shallow $head" &&
98 + packetize "deepen 1" &&
99 + printf "0000"
100 + } >request &&
101 +
102 + printf "0000" >expect &&
103 +
104 + git upload-pack --stateless-rpc . <request >actual &&
105 + test_cmp expect actual
106 +'
107 +
108 test_expect_success 'create empty repository' '
109
110 mkdir foo &&
upload-pack.c
+12 -1
@@ -1344,7 +1344,18 @@ void upload_pack(struct upload_pack_options *options)
1344 PACKET_READ_DIE_ON_ERR_PACKET);
1345
1346 receive_needs(&data, &reader);
1347 - if (data.want_obj.nr) {
1347 +
1348 + /*
1349 + * An EOF at this exact point in negotiation should be
1350 + * acceptable from stateless clients as they will consume the
1351 + * shallow list before doing subsequent rpc with haves/etc.
1352 + */
1353 + if (data.stateless_rpc)
1354 + reader.options |= PACKET_READ_GENTLE_ON_EOF;
1355 +
1356 + if (data.want_obj.nr &&
1357 + packet_reader_peek(&reader) != PACKET_READ_EOF) {
1358 + reader.options &= ~PACKET_READ_GENTLE_ON_EOF;
1359 get_common_commits(&data, &reader);
1360 create_pack_file(&data, NULL);
1361 }