[alioth/cvs.git] / src / server.c

/* This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; either version 2, or (at your option)
   any later version.

   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.  */

#include "cvs.h"

/* CVS */
#include "edit.h"
#include "fileattr.h"
#include "watch.h"

/* GNULIB */
#include "buffer.h"
#include "getline.h"
#include "getnline.h"

__RCSID("$MirOS: src/gnu/usr.bin/cvs/src/server.c,v 1.13 2017/04/18 22:45:01 tg Exp $");

int server_active = 0;

#if defined (SERVER_SUPPORT) || defined (CLIENT_SUPPORT)

# include "log-buffer.h"
# include "ms-buffer.h"
#endif  /* defined(SERVER_SUPPORT) || defined(CLIENT_SUPPORT) */

#if defined (HAVE_GSSAPI) && defined (SERVER_SUPPORT)
# include "canon-host.h"
# include "gssapi-client.h"

/* This stuff isn't included solely with SERVER_SUPPORT since some of these
 * functions (encryption & the like) get compiled with or without server
 * support.
 *
 * FIXME - They should be in a different file.
 */
/* We use Kerberos 5 routines to map the GSSAPI credential to a user
   name.  */
# include <krb5.h>

static void gserver_authenticate_connection (void);

/* Whether we are already wrapping GSSAPI communication.  */
static int cvs_gssapi_wrapping;

#endif  /* defined (HAVE_GSSAPI) && defined (SERVER_SUPPORT) */

#ifdef SERVER_SUPPORT

extern char *server_hostname;

# if defined (AUTH_SERVER_SUPPORT) || defined (HAVE_KERBEROS) || defined (HAVE_GSSAPI)
#   include <sys/socket.h>
# endif

# ifdef HAVE_SYSLOG_H
#   include <syslog.h>
#   ifndef LOG_DAEMON   /* for ancient syslogs */
#     define LOG_DAEMON 0
#   endif
# endif /* HAVE_SYSLOG_H */

# ifdef HAVE_KERBEROS
#   include <netinet/in.h>
#   include <krb.h>
#   ifndef HAVE_KRB_GET_ERR_TEXT
#     define krb_get_err_text(status) krb_err_txt[status]
#   endif

/* Information we need if we are going to use Kerberos encryption.  */
static C_Block kblock;
static Key_schedule sched;

# endif /* HAVE_KERBEROS */

/* for select */
# include "xselect.h"

/* for TCP_NODELAY */
# include <netinet/tcp.h>

# ifndef S_ISSOCK
#   define S_ISSOCK(m) (((m) & S_IFMT) == S_IFSOCK)
# endif

# ifndef O_NONBLOCK
#   define O_NONBLOCK O_NDELAY
# endif

/* For initgroups().  */
# if HAVE_INITGROUPS
#   include <grp.h>
# endif /* HAVE_INITGROUPS */

# ifdef AUTH_SERVER_SUPPORT

#   ifdef HAVE_GETSPNAM
#     include <shadow.h>
#   endif

/* The cvs username sent by the client, which might or might not be
   the same as the system username the server eventually switches to
   run as.  CVS_Username gets set iff password authentication is
   successful. */
char *CVS_Username = NULL;

/* Used to check that same repos is transmitted in pserver auth and in
   later CVS protocol.  Exported because root.c also uses. */
static char *Pserver_Repos = NULL;

# endif /* AUTH_SERVER_SUPPORT */

# ifdef HAVE_PAM
#   if defined(HAVE_SECURITY_PAM_APPL_H)
#     include <security/pam_appl.h>
#   elif defined(HAVE_PAM_PAM_APPL_H)
#     include <pam/pam_appl.h>
#   endif

static pam_handle_t *pamh = NULL;

static char *pam_username;
static char *pam_password;
# endif /* HAVE_PAM */



/* While processing requests, this buffer accumulates data to be sent to
   the client, and then once we are in do_cvs_command, we use it
   for all the data to be sent.  */
static struct buffer *buf_to_net;

/* This buffer is used to read input from the client.  */
static struct buffer *buf_from_net;



# ifdef PROXY_SUPPORT
/* These are the secondary log buffers so that we can disable them after
 * creation, when it is determined that they are unneeded, regardless of what
 * other filters have been prepended to the buffer chain.
 */
static struct buffer *proxy_log;
static struct buffer *proxy_log_out;

/* Set while we are reprocessing a log so that we can avoid sending responses
 * to some requests twice.
 */
static bool reprocessing;
# endif /* PROXY_SUPPORT */



/* Arguments storage for `Argument' & `Argumentx' requests.  */
static int argument_count;
static char **argument_vector;
static int argument_vector_size;

/*
 * This is where we stash stuff we are going to use.  Format string
 * which expects a single directory within it, starting with a slash.
 */
static char *server_temp_dir;

/* This is the original value of server_temp_dir, before any possible
   changes inserted by serve_max_dotdot.  */
static char *orig_server_temp_dir;

/* Nonzero if we should keep the temp directory around after we exit.  */
static int dont_delete_temp;

static void server_write_entries (void);

cvsroot_t *referrer;



/* Populate all of the directories between BASE_DIR and its relative
   subdirectory DIR with CVSADM directories.  Return 0 for success or
   errno value.  */
static int
create_adm_p (char *base_dir, char *dir)
{
    char *dir_where_cvsadm_lives, *dir_to_register, *p, *tmp;
    int retval, done;
    FILE *f;

    if (strcmp (dir, ".") == 0)
        return 0;                       /* nothing to do */

    /* Allocate some space for our directory-munging string. */
    p = xmalloc (strlen (dir) + 1);
    if (p == NULL)
        return ENOMEM;

    dir_where_cvsadm_lives = xmalloc (strlen (base_dir) + strlen (dir) + 100);
    if (dir_where_cvsadm_lives == NULL)
    {
        free (p);
        return ENOMEM;
    }

    /* Allocate some space for the temporary string in which we will
       construct filenames. */
    tmp = xmalloc (strlen (base_dir) + strlen (dir) + 100);
    if (tmp == NULL)
    {
        free (p);
        free (dir_where_cvsadm_lives);
        return ENOMEM;
    }


    /* We make several passes through this loop.  On the first pass,
       we simply create the CVSADM directory in the deepest directory.
       For each subsequent pass, we try to remove the last path
       element from DIR, create the CVSADM directory in the remaining
       pathname, and register the subdirectory in the newly created
       CVSADM directory. */

    retval = done = 0;

    strcpy (p, dir);
    strcpy (dir_where_cvsadm_lives, base_dir);
    strcat (dir_where_cvsadm_lives, "/");
    strcat (dir_where_cvsadm_lives, p);
    dir_to_register = NULL;

    while (1)
    {
        /* Create CVSADM. */
        (void) sprintf (tmp, "%s/%s", dir_where_cvsadm_lives, CVSADM);
        if ((CVS_MKDIR (tmp, 0777) < 0) && (errno != EEXIST))
        {
            retval = errno;
            goto finish;
        }

        /* Create CVSADM_REP. */
        (void) sprintf (tmp, "%s/%s", dir_where_cvsadm_lives, CVSADM_REP);
        if (! isfile (tmp))
        {
            /* Use Emptydir as the placeholder until the client sends
               us the real value.  This code is similar to checkout.c
               (emptydir_name), but the code below returns errors
               differently.  */

            char *empty;
            empty = xmalloc (strlen (current_parsed_root->directory)
                            + sizeof (CVSROOTADM)
                            + sizeof (CVSNULLREPOS)
                            + 3);
            if (! empty)
            {
                retval = ENOMEM;
                goto finish;
            }

            /* Create the directory name. */
            (void) sprintf (empty, "%s/%s/%s", current_parsed_root->directory,
                            CVSROOTADM, CVSNULLREPOS);

            /* Create the directory if it doesn't exist. */
            if (! isfile (empty))
            {
                mode_t omask;
                omask = umask (cvsumask);
                if (CVS_MKDIR (empty, 0777) < 0)
                {
                    retval = errno;
                    free (empty);
                    goto finish;
                }
                (void) umask (omask);
            }

            f = CVS_FOPEN (tmp, "w");
            if (f == NULL)
            {
                retval = errno;
                free (empty);
                goto finish;
            }
            /* Write the directory name to CVSADM_REP. */
            if (fprintf (f, "%s\n", empty) < 0)
            {
                retval = errno;
                fclose (f);
                free (empty);
                goto finish;
            }
            if (fclose (f) == EOF)
            {
                retval = errno;
                free (empty);
                goto finish;
            }

            /* Clean up after ourselves. */
            free (empty);
        }

        /* Create CVSADM_ENT.  We open in append mode because we
           don't want to clobber an existing Entries file.  */
        (void) sprintf (tmp, "%s/%s", dir_where_cvsadm_lives, CVSADM_ENT);
        f = CVS_FOPEN (tmp, "a");
        if (f == NULL)
        {
            retval = errno;
            goto finish;
        }
        if (fclose (f) == EOF)
        {
            retval = errno;
            goto finish;
        }

        if (dir_to_register != NULL)
        {
            /* FIXME: Yes, this results in duplicate entries in the
               Entries.Log file, but it doesn't currently matter.  We
               might need to change this later on to make sure that we
               only write one entry.  */

            Subdir_Register (NULL, dir_where_cvsadm_lives, dir_to_register);
        }

        if (done)
            break;

        dir_to_register = strrchr (p, '/');
        if (dir_to_register == NULL)
        {
            dir_to_register = p;
            strcpy (dir_where_cvsadm_lives, base_dir);
            done = 1;
        }
        else
        {
            *dir_to_register = '\0';
            dir_to_register++;
            strcpy (dir_where_cvsadm_lives, base_dir);
            strcat (dir_where_cvsadm_lives, "/");
            strcat (dir_where_cvsadm_lives, p);
        }
    }

  finish:
    free (tmp);
    free (dir_where_cvsadm_lives);
    free (p);
    return retval;
}



/*
 * Make directory DIR, including all intermediate directories if necessary.
 * Returns 0 for success or errno code.
 */
static int
mkdir_p (char *dir)
{
    char *p;
    char *q = xmalloc (strlen (dir) + 1);
    int retval;

    if (q == NULL)
        return ENOMEM;

    retval = 0;

    /*
     * Skip over leading slash if present.  We won't bother to try to
     * make '/'.
     */
    p = dir + 1;
    while (1)
    {
        while (*p != '/' && *p != '\0')
            ++p;
        if (*p == '/')
        {
            strncpy (q, dir, p - dir);
            q[p - dir] = '\0';
            if (q[p - dir - 1] != '/'  &&  CVS_MKDIR (q, 0777) < 0)
            {
                int saved_errno = errno;

                if (saved_errno != EEXIST
                    && ((saved_errno != EACCES && saved_errno != EROFS)
                        || !isdir (q)))
                {
                    retval = saved_errno;
                    goto done;
                }
            }
            ++p;
        }
        else
        {
            if (CVS_MKDIR (dir, 0777) < 0)
                retval = errno;
            goto done;
        }
    }
  done:
    free (q);
    return retval;
}



/*
 * Print the error response for error code STATUS.  The caller is
 * reponsible for making sure we get back to the command loop without
 * any further output occuring.
 * Must be called only in contexts where it is OK to send output.
 */
static void
print_error (int status)
{
    char *msg;
    char tmpstr[80];

    buf_output0 (buf_to_net, "error  ");
    msg = strerror (status);
    if (msg == NULL)
    {
       sprintf (tmpstr, "unknown error %d", status);
       msg = tmpstr;
    }
    buf_output0 (buf_to_net, msg);
    buf_append_char (buf_to_net, '\n');

    buf_flush (buf_to_net, 0);
}



static int pending_error;
/*
 * Malloc'd text for pending error.  Each line must start with "E ".  The
 * last line should not end with a newline.
 */
static char *pending_error_text;
static char *pending_warning_text;

/* If an error is pending, print it and return 1.  If not, return 0.
   Also prints pending warnings, but this does not affect the return value.
   Must be called only in contexts where it is OK to send output.  */
static int
print_pending_error (void)
{
    /* Check this case first since it usually means we are out of memory and
     * the buffer output routines might try and allocate memory.
     */
    if (!pending_error_text && pending_error)
    {
        print_error (pending_error);
        pending_error = 0;
        return 1;
    }

    if (pending_warning_text)
    {
        buf_output0 (buf_to_net, pending_warning_text);
        buf_append_char (buf_to_net, '\n');
        buf_flush (buf_to_net, 0);

        free (pending_warning_text);
        pending_warning_text = NULL;
    }

    if (pending_error_text)
    {
        buf_output0 (buf_to_net, pending_error_text);
        buf_append_char (buf_to_net, '\n');
        if (pending_error)
            print_error (pending_error);
        else
            buf_output0 (buf_to_net, "error  \n");

        buf_flush (buf_to_net, 0);

        pending_error = 0;
        free (pending_error_text);
        pending_error_text = NULL;
        return 1;
    }

    return 0;
}



/* Is an error pending?  */
# define error_pending() (pending_error || pending_error_text)
# define warning_pending() (pending_warning_text)

/* Allocate SIZE bytes for pending_error_text and return nonzero
   if we could do it.  */
static inline int
alloc_pending_internal (char **dest, size_t size)
{
    *dest = malloc (size);
    if (!*dest)
    {
        pending_error = ENOMEM;
        return 0;
    }
    return 1;
}



/* Allocate SIZE bytes for pending_error_text and return nonzero
   if we could do it.  */
static int
alloc_pending (size_t size)
{
    if (error_pending ())
        /* Probably alloc_pending callers will have already checked for
           this case.  But we might as well handle it if they don't, I
           guess.  */
        return 0;
    return alloc_pending_internal (&pending_error_text, size);
}



/* Allocate SIZE bytes for pending_error_text and return nonzero
   if we could do it.  */
static int
alloc_pending_warning (size_t size)
{
    if (warning_pending ())
        /* Warnings can be lost here.  */
        return 0;
    return alloc_pending_internal (&pending_warning_text, size);
}



static int
supported_response (char *name)
{
    struct response *rs;

    for (rs = responses; rs->name != NULL; ++rs)
        if (strcmp (rs->name, name) == 0)
            return rs->status == rs_supported;
    error (1, 0, "internal error: testing support for unknown response?");
    /* NOTREACHED */
    return 0;
}



/*
 * Return true if we need to relay write requests to a primary server
 * and false otherwise.
 *
 * NOTES
 *
 *   - primarily handles :ext: method as this seems most likely to be used in
 *     practice.
 *
 *   - :fork: method is handled for testing.
 *
 *   - Could handle pserver too, but would have to store the password
 *     the client sent us.
 *
 *
 * GLOBALS
 *   config->PrimaryServer
 *                        The parsed setting from CVSROOT/config, if any, or
 *                        NULL, otherwise.
 *   current_parsed_root  The current repository.
 *
 * RETURNS
 *   true                 If this server is configured as a secondary server.
 *   false                Otherwise.
 */
static inline bool
isProxyServer (void)
{
    assert (current_parsed_root);

    /***
     *** The following is done as a series of if/return combinations an an
     *** optimization.
     ***/

    /* If there is no primary server defined in CVSROOT/config, then we can't
     * be a secondary.
     */
    if (!config || !config->PrimaryServer) return false;

    /* The directory must not match for all methods.  */
    if (!isSamePath (config->PrimaryServer->directory,
                     current_parsed_root->directory))
        return true;

    /* Only the directory is important for fork.  */
    if (config->PrimaryServer->method == fork_method)
        return false;

    /* Must be :ext: method, then.  This is enforced when CVSROOT/config is
     * parsed.
     */
    assert (config->PrimaryServer->isremote);

    if (isThisHost (config->PrimaryServer->hostname))
        return false;

    return true;
}



static void
serve_valid_responses (char *arg)
{
    char *p = arg;
    char *q;
    struct response *rs;

# ifdef PROXY_SUPPORT
    /* Process this in the first pass since the data it gathers can be used
     * prior to a `Root' request.
     */
    if (reprocessing) return;
# endif /* PROXY_SUPPORT */

    do
    {
        q = strchr (p, ' ');
        if (q != NULL)
            *q++ = '\0';
        for (rs = responses; rs->name != NULL; ++rs)
        {
            if (strcmp (rs->name, p) == 0)
                break;
        }
        if (rs->name == NULL)
            /*
             * It is a response we have never heard of (and thus never
             * will want to use).  So don't worry about it.
             */
            ;
        else
            rs->status = rs_supported;
        p = q;
    } while (q != NULL);
    for (rs = responses; rs->name != NULL; ++rs)
    {
        if (rs->status == rs_essential)
        {
            buf_output0 (buf_to_net, "E response `");
            buf_output0 (buf_to_net, rs->name);
            buf_output0 (buf_to_net, "' not supported by client\nerror  \n");

            /* FIXME: This call to buf_flush could conceivably
               cause deadlock, as noted in server_cleanup.  */
            buf_flush (buf_to_net, 1);

            exit (EXIT_FAILURE);
        }
        else if (rs->status == rs_optional)
            rs->status = rs_not_supported;
    }
}



/*
 * Process IDs of the subprocess, or negative if that subprocess
 * does not exist.
 */
static pid_t command_pid;

static void
outbuf_memory_error (struct buffer *buf)
{
    static const char msg[] = "E Fatal server error\n\
error ENOMEM Virtual memory exhausted.\n";
    if (command_pid > 0)
        kill (command_pid, SIGTERM);

    /*
     * We have arranged things so that printing this now either will
     * be valid, or the "E fatal error" line will get glommed onto the
     * end of an existing "E" or "M" response.
     */

    /* If this gives an error, not much we could do.  syslog() it?  */
    write (STDOUT_FILENO, msg, sizeof (msg) - 1);
# ifdef HAVE_SYSLOG_H
    syslog (LOG_DAEMON | LOG_ERR, "virtual memory exhausted");
# endif /* HAVE_SYSLOG_H */
    exit (EXIT_FAILURE);
}



static void
input_memory_error (struct buffer *buf)
{
    outbuf_memory_error (buf);
}



# ifdef PROXY_SUPPORT
/* This function rewinds the net connection using the write proxy log file.
 *
 * GLOBALS
 *   proxy_log  The buffer object containing the write proxy log.
 *
 * RETURNS
 *   Nothing.
 */
static void
rewind_buf_from_net (void)
{
    struct buffer *log;

    assert (proxy_log);

    /* Free the arguments since we processed some of them in the first pass.
     */
    {
        /* argument_vector[0] is a dummy argument, we don't mess with
         * it.
         */
        char **cp;
        for (cp = argument_vector + 1;
             cp < argument_vector + argument_count;
             ++cp)
            free (*cp);

        argument_count = 1;
    }

    log = log_buffer_rewind (proxy_log);
    proxy_log = NULL;
    /* Dispose of any read but unused data in the net buffer since it will
     * already be in the log.
     */
    buf_free_data (buf_from_net);
    buf_from_net = ms_buffer_initialize (outbuf_memory_error, log,
                                         buf_from_net);
    reprocessing = true;
}
# endif /* PROXY_SUPPORT */



char *gConfigPath;



/*
 * This request cannot be ignored by a potential secondary since it is used to
 * determine if we _are_ a secondary.
 */
static void
serve_root (char *arg)
{
    char *path;

    TRACE (TRACE_FUNCTION, "serve_root (%s)", arg ? arg : "(null)");

    /* Don't process this twice or when errors are pending.  */
    if (error_pending()
# ifdef PROXY_SUPPORT
        || reprocessing
# endif /* PROXY_SUPPORT */
       ) return;

    if (!ISABSOLUTE (arg))
    {
        if (alloc_pending (80 + strlen (arg)))
            sprintf (pending_error_text,
                     "E Root %s must be an absolute pathname", arg);
        return;
    }

    /* Sending "Root" twice is invalid.

       The other way to handle a duplicate Root requests would be as a
       request to clear out all state and start over as if it was a
       new connection.  Doing this would cause interoperability
       headaches, so it should be a different request, if there is
       any reason why such a feature is needed.  */
    if (current_parsed_root != NULL)
    {
        if (alloc_pending (80 + strlen (arg)))
            sprintf (pending_error_text,
                     "E Protocol error: Duplicate Root request, for %s", arg);
        return;
    }

    /* Set original_parsed_root here, not because it can be changed in the
     * client Redirect sense, but so we don't have to switch in code that
     * runs in both modes to decide which to print.
     */
    original_parsed_root = current_parsed_root = local_cvsroot (arg);

# ifdef AUTH_SERVER_SUPPORT
    if (Pserver_Repos != NULL)
    {
        if (strcmp (Pserver_Repos, current_parsed_root->directory) != 0)
        {
            if (alloc_pending (80 + strlen (Pserver_Repos)
                               + strlen (current_parsed_root->directory)))
                /* The explicitness is to aid people who are writing clients.
                   I don't see how this information could help an
                   attacker.  */
                sprintf (pending_error_text, "\
E Protocol error: Root says \"%s\" but pserver says \"%s\"",
                         current_parsed_root->directory, Pserver_Repos);
            return;
        }
    }
# endif

    if (root_allow_used() && !root_allow_ok(arg))
    {
        if (alloc_pending (80 + strlen (arg)))
            sprintf (pending_error_text,
                     "E Bad root %s", arg);
        return;
    }

    /* For pserver, this will already have happened, and the call will do
       nothing.  But for rsh, we need to do it now.  */
    config = get_root_allow_config (current_parsed_root->directory,
                                    gConfigPath);

# ifdef PROXY_SUPPORT
    /* At this point we have enough information to determine if we are a
     * secondary server or not.
     */
    if (proxy_log && !isProxyServer ())
    {
        /* Else we are not a secondary server.  There is no point in
         * reprocessing since we handle all the requests we can receive
         * before `Root' as we receive them.  But close the logs.
         */
        log_buffer_closelog (proxy_log);
        log_buffer_closelog (proxy_log_out);
        proxy_log = NULL;
        /*
         * Don't need this.  We assume it when proxy_log == NULL.
         *
         *   proxy_log_out = NULL;
         */
    }
# endif /* PROXY_SUPPORT */

    /* Now set the TMPDIR environment variable.  If it was set in the config
     * file, we now know it.
     */
    push_env_temp_dir ();

    /* OK, now figure out where we stash our temporary files.  */
    {
        char *p;

        /* The code which wants to chdir into server_temp_dir is not set
         * up to deal with it being a relative path.  So give an error
         * for that case.
         */
        if (!ISABSOLUTE (get_cvs_tmp_dir ()))
        {
            if (alloc_pending (80 + strlen (get_cvs_tmp_dir ())))
                sprintf (pending_error_text,
                         "E Value of %s for TMPDIR is not absolute",
                         get_cvs_tmp_dir ());

            /* FIXME: we would like this error to be persistent, that
             * is, not cleared by print_pending_error.  The current client
             * will exit as soon as it gets an error, but the protocol spec
             * does not require a client to do so.
             */
        }
        else
        {
            int status;
            int i = 0;

            server_temp_dir = xmalloc (strlen (get_cvs_tmp_dir ()) + 80);
            if (!server_temp_dir)
            {
                /* Strictly speaking, we're not supposed to output anything
                 * now.  But we're about to exit(), give it a try.
                 */
                printf ("E Fatal server error, aborting.\n\
error ENOMEM Virtual memory exhausted.\n");

                exit (EXIT_FAILURE);
            }
            strcpy (server_temp_dir, get_cvs_tmp_dir ());

            /* Remove a trailing slash from TMPDIR if present.  */
            p = server_temp_dir + strlen (server_temp_dir) - 1;
            if (*p == '/')
                *p = '\0';

            /* I wanted to use cvs-serv/PID, but then you have to worry about
             * the permissions on the cvs-serv directory being right.  So
             * use cvs-servPID.
             */
            strcat (server_temp_dir, "/cvs-serv");

            p = server_temp_dir + strlen (server_temp_dir);
            sprintf (p, "%ld", (long) getpid ());

            orig_server_temp_dir = server_temp_dir;

            /* Create the temporary directory, and set the mode to
             * 700, to discourage random people from tampering with
             * it.
             */
            while ((status = mkdir_p (server_temp_dir)) == EEXIST)
            {
                static const char suffix[] = "abcdefghijklmnopqrstuvwxyz";

                if (i >= sizeof suffix - 1) break;
                if (i == 0) p = server_temp_dir + strlen (server_temp_dir);
                p[0] = suffix[i++];
                p[1] = '\0';
            }
            if (status)
            {
                if (alloc_pending (80 + strlen (server_temp_dir)))
                    sprintf (pending_error_text,
                            "E can't create temporary directory %s",
                            server_temp_dir);
                pending_error = status;
            }
#ifndef CHMOD_BROKEN
            else if (chmod (server_temp_dir, S_IRWXU) < 0)
            {
                int save_errno = errno;
                if (alloc_pending (80 + strlen (server_temp_dir)))
                    sprintf (pending_error_text,
"E cannot change permissions on temporary directory %s",
                             server_temp_dir);
                pending_error = save_errno;
            }
#endif
            else if (CVS_CHDIR (server_temp_dir) < 0)
            {
                int save_errno = errno;
                if (alloc_pending (80 + strlen (server_temp_dir)))
                    sprintf (pending_error_text,
"E cannot change to temporary directory %s",
                             server_temp_dir);
                pending_error = save_errno;
            }
        }
    }

    /* Now that we have a config, verify our compression level.  Since 
     * most clients do not send Gzip-stream requests until after the root
     * request, wait until the first request following Root to verify that
     * compression is being used when level 0 is not allowed.
     */
    if (gzip_level)
    {
        bool forced = false;

        if (gzip_level < config->MinCompressionLevel)
        {
            gzip_level = config->MinCompressionLevel;
            forced = true;
        }

        if (gzip_level > config->MaxCompressionLevel)
        {
            gzip_level = config->MaxCompressionLevel;
            forced = true;
        }

        if (forced && !quiet
            && alloc_pending_warning (120 + strlen (program_name)))
            sprintf (pending_warning_text,
"E %s server: Forcing compression level %d (allowed: %d <= z <= %d).",
                     program_name, gzip_level, config->MinCompressionLevel,
                     config->MaxCompressionLevel);
    }

    path = xmalloc (strlen (current_parsed_root->directory)
                   + sizeof (CVSROOTADM)
                   + 2);
    if (path == NULL)
    {
        pending_error = ENOMEM;
        return;
    }
    (void) sprintf (path, "%s/%s", current_parsed_root->directory, CVSROOTADM);
    if (!isaccessible (path, R_OK | X_OK))
    {
        int save_errno = errno;
        if (alloc_pending (80 + strlen (path)))
            sprintf (pending_error_text, "E Cannot access %s", path);
        pending_error = save_errno;
    }
    free (path);

    setenv (CVSROOT_ENV, current_parsed_root->directory, 1);
}



static int max_dotdot_limit = 0;

/* Is this pathname OK to recurse into when we are running as the server?
   If not, call error() with a fatal error.  */
void
server_pathname_check (char *path)
{
    TRACE (TRACE_FUNCTION, "server_pathname_check (%s)",
           path ? path : "(null)");

    /* An absolute pathname is almost surely a path on the *client* machine,
       and is unlikely to do us any good here.  It also is probably capable
       of being a security hole in the anonymous readonly case.  */
    if (ISABSOLUTE (path))
        /* Giving an error is actually kind of a cop-out, in the sense
           that it would be nice for "cvs co -d /foo/bar/baz" to work.
           A quick fix in the server would be requiring Max-dotdot of
           at least one if pathnames are absolute, and then putting
           /abs/foo/bar/baz in the temp dir beside the /d/d/d stuff.
           A cleaner fix in the server might be to decouple the
           pathnames we pass back to the client from pathnames in our
           temp directory (this would also probably remove the need
           for Max-dotdot).  A fix in the client would have the client
           turn it into "cd /foo/bar; cvs co -d baz" (more or less).
           This probably has some problems with pathnames which appear
           in messages.  */
        error ( 1, 0,
                "absolute pathnames invalid for server (specified `%s')",
                path );
    if (pathname_levels (path) > max_dotdot_limit)
    {
        /* Similar to the ISABSOLUTE case in security implications.  */
        error (0, 0, "protocol error: `%s' contains more leading ..", path);
        error (1, 0, "than the %d which Max-dotdot specified",
               max_dotdot_limit);
    }
}



/* Is file or directory REPOS an absolute pathname within the
   current_parsed_root->directory?  If yes, return 0.  If no, set pending_error
   and return 1.  */
static int
outside_root (char *repos)
{
    size_t repos_len = strlen (repos);
    size_t root_len = strlen (current_parsed_root->directory);

    /* ISABSOLUTE (repos) should always be true, but
       this is a good security precaution regardless. -DRP
     */
    if (!ISABSOLUTE (repos))
    {
        if (alloc_pending (repos_len + 80))
            sprintf (pending_error_text, "\
E protocol error: %s is not absolute", repos);
        return 1;
    }

    if (repos_len < root_len
        || strncmp (current_parsed_root->directory, repos, root_len) != 0)
    {
    not_within:
        if (alloc_pending (strlen (current_parsed_root->directory)
                           + strlen (repos)
                           + 80))
            sprintf (pending_error_text, "\
E protocol error: directory '%s' not within root '%s'",
                     repos, current_parsed_root->directory);
        return 1;
    }
    if (repos_len > root_len)
    {
        if (repos[root_len] != '/')
            goto not_within;
        if (pathname_levels (repos + root_len + 1) > 0)
            goto not_within;
    }
    return 0;
}



/* Is file or directory FILE outside the current directory (that is, does
   it contain '/')?  If no, return 0.  If yes, set pending_error
   and return 1.  */
static int
outside_dir (char *file)
{
    if (strchr (file, '/') != NULL)
    {
        if (alloc_pending (strlen (file)
                           + 80))
            sprintf (pending_error_text, "\
E protocol error: directory '%s' not within current directory",
                     file);
        return 1;
    }
    return 0;
}



/*
 * Add as many directories to the temp directory as the client tells us it
 * will use "..", so we never try to access something outside the temp
 * directory via "..".
 */
static void
serve_max_dotdot (char *arg)
{
    int lim = atoi (arg);
    int i;
    char *p;

#ifdef PROXY_SUPPORT
    if (proxy_log) return;
#endif /* PROXY_SUPPORT */

    if (lim < 0 || lim > 10000)
        return;
    p = xmalloc (strlen (server_temp_dir) + 2 * lim + 10);
    if (p == NULL)
    {
        pending_error = ENOMEM;
        return;
    }
    strcpy (p, server_temp_dir);
    for (i = 0; i < lim; ++i)
        strcat (p, "/d");
    if (server_temp_dir != orig_server_temp_dir)
        free (server_temp_dir);
    server_temp_dir = p;
    max_dotdot_limit = lim;
}



static char *gDirname;
static char *gupdate_dir;

static void
dirswitch (char *dir, char *repos)
{
    int status;
    FILE *f;
    size_t dir_len;

    TRACE (TRACE_FUNCTION, "dirswitch (%s, %s)", dir ? dir : "(null)",
           repos ? repos : "(null)");

    server_write_entries ();

    if (error_pending()) return;

    /* Check for bad directory name.

       FIXME: could/should unify these checks with server_pathname_check
       except they need to report errors differently.  */
    if (ISABSOLUTE (dir))
    {
        if (alloc_pending (80 + strlen (dir)))
            sprintf ( pending_error_text,
                      "E absolute pathnames invalid for server (specified `%s')",
                      dir);
        return;
    }
    if (pathname_levels (dir) > max_dotdot_limit)
    {
        if (alloc_pending (80 + strlen (dir)))
            sprintf (pending_error_text,
                     "E protocol error: `%s' has too many ..", dir);
        return;
    }

    dir_len = strlen (dir);

    /* Check for a trailing '/'.  This is not ISSLASH because \ in the
       protocol is an ordinary character, not a directory separator (of
       course, it is perhaps unwise to use it in directory names, but that
       is another issue).  */
    if (dir_len > 0
        && dir[dir_len - 1] == '/')
    {
        if (alloc_pending (80 + dir_len))
            sprintf (pending_error_text,
                     "E protocol error: invalid directory syntax in %s", dir);
        return;
    }

    if (gDirname != NULL)
        free (gDirname);
    if (gupdate_dir != NULL)
        free (gupdate_dir);

    if (!strcmp (dir, "."))
        gupdate_dir = xstrdup ("");
    else
        gupdate_dir = xstrdup (dir);

    gDirname = xmalloc (strlen (server_temp_dir) + dir_len + 40);
    if (gDirname == NULL)
    {
        pending_error = ENOMEM;
        return;
    }

    strcpy (gDirname, server_temp_dir);
    strcat (gDirname, "/");
    strcat (gDirname, dir);

    status = mkdir_p (gDirname);
    if (status != 0
        && status != EEXIST)
    {
        if (alloc_pending (80 + strlen (gDirname)))
            sprintf (pending_error_text, "E cannot mkdir %s", gDirname);
        pending_error = status;
        return;
    }

    /* We need to create adm directories in all path elements because
       we want the server to descend them, even if the client hasn't
       sent the appropriate "Argument xxx" command to match the
       already-sent "Directory xxx" command.  See recurse.c
       (start_recursion) for a big discussion of this.  */

    status = create_adm_p (server_temp_dir, dir);
    if (status != 0)
    {
        if (alloc_pending (80 + strlen (gDirname)))
            sprintf (pending_error_text, "E cannot create_adm_p %s", gDirname);
        pending_error = status;
        return;
    }

    if ( CVS_CHDIR (gDirname) < 0)
    {
        int save_errno = errno;
        if (alloc_pending (80 + strlen (gDirname)))
            sprintf (pending_error_text, "E cannot change to %s", gDirname);
        pending_error = save_errno;
        return;
    }
    /*
     * This is pretty much like calling Create_Admin, but Create_Admin doesn't
     * report errors in the right way for us.
     */
    if ((CVS_MKDIR (CVSADM, 0777) < 0) && (errno != EEXIST))
    {
        int save_errno = errno;
        if (alloc_pending (80 + strlen (gDirname) + strlen (CVSADM)))
            sprintf (pending_error_text,
                     "E cannot mkdir %s/%s", gDirname, CVSADM);
        pending_error = save_errno;
        return;
    }

    /* The following will overwrite the contents of CVSADM_REP.  This
       is the correct behavior -- mkdir_p may have written a
       placeholder value to this file and we need to insert the
       correct value. */

    f = CVS_FOPEN (CVSADM_REP, "w");
    if (f == NULL)
    {
        int save_errno = errno;
        if (alloc_pending (80 + strlen (gDirname) + strlen (CVSADM_REP)))
            sprintf (pending_error_text,
                     "E cannot open %s/%s", gDirname, CVSADM_REP);
        pending_error = save_errno;
        return;
    }
    if (fprintf (f, "%s", repos) < 0)
    {
        int save_errno = errno;
        if (alloc_pending (80 + strlen (gDirname) + strlen (CVSADM_REP)))
            sprintf (pending_error_text,
                     "E error writing %s/%s", gDirname, CVSADM_REP);
        pending_error = save_errno;
        fclose (f);
        return;
    }
    /* Non-remote CVS handles a module representing the entire tree
       (e.g., an entry like ``world -a .'') by putting /. at the end
       of the Repository file, so we do the same.  */
    if (strcmp (dir, ".") == 0
        && current_parsed_root != NULL
        && current_parsed_root->directory != NULL
        && strcmp (current_parsed_root->directory, repos) == 0)
    {
        if (fprintf (f, "/.") < 0)
        {
            int save_errno = errno;
            if (alloc_pending (80 + strlen (gDirname) + strlen (CVSADM_REP)))
                sprintf (pending_error_text,
                         "E error writing %s/%s", gDirname, CVSADM_REP);
            pending_error = save_errno;
            fclose (f);
            return;
        }
    }
    if (fprintf (f, "\n") < 0)
    {
        int save_errno = errno;
        if (alloc_pending (80 + strlen (gDirname) + strlen (CVSADM_REP)))
            sprintf (pending_error_text,
                     "E error writing %s/%s", gDirname, CVSADM_REP);
        pending_error = save_errno;
        fclose (f);
        return;
    }
    if (fclose (f) == EOF)
    {
        int save_errno = errno;
        if (alloc_pending (80 + strlen (gDirname) + strlen (CVSADM_REP)))
            sprintf (pending_error_text,
                     "E error closing %s/%s", gDirname, CVSADM_REP);
        pending_error = save_errno;
        return;
    }
    /* We open in append mode because we don't want to clobber an
       existing Entries file.  */
    f = CVS_FOPEN (CVSADM_ENT, "a");
    if (f == NULL)
    {
        int save_errno = errno;
        if (alloc_pending (80 + strlen (CVSADM_ENT)))
            sprintf (pending_error_text, "E cannot open %s", CVSADM_ENT);
        pending_error = save_errno;
        return;
    }
    if (fclose (f) == EOF)
    {
        int save_errno = errno;
        if (alloc_pending (80 + strlen (CVSADM_ENT)))
            sprintf (pending_error_text, "E cannot close %s", CVSADM_ENT);
        pending_error = save_errno;
        return;
    }
}



static void
serve_repository (char *arg)
{
# ifdef PROXY_SUPPORT
    assert (!proxy_log);
# endif /* PROXY_SUPPORT */

    if (alloc_pending (80))
        strcpy (pending_error_text,
                "E Repository request is obsolete; aborted");
    return;
}



static void
serve_directory (char *arg)
{
    int status;
    char *repos;

    TRACE (TRACE_FUNCTION, "serve_directory (%s)", arg ? arg : "(null)");


    /* The data needs to be read into the secondary log regardless, but
     * processing of anything other than errors is skipped until later.
     */
    status = buf_read_line (buf_from_net, &repos, NULL);
    if (status == 0)
    {
        if (!ISABSOLUTE (repos))
        {
            /* Make absolute.
             *
             * FIXME: This is kinda hacky - we should probably only ever store
             * and pass SHORT_REPOS (perhaps with the occassional exception
             * for optimizations, but many, many functions end up
             * deconstructing REPOS to gain SHORT_REPOS anyhow) - the
             * CVSROOT portion of REPOS is redundant with
             * current_parsed_root->directory - but since this is the way
             * things have always been done, changing this will likely involve
             * a major overhaul.
             */
            char *short_repos;

            short_repos = repos;
            repos = Xasprintf ("%s/%s",
                              current_parsed_root->directory, short_repos);
            free (short_repos);
        }
        else
            repos = xstrdup (primary_root_translate (repos));

        if (
# ifdef PROXY_SUPPORT
            !proxy_log &&
# endif /* PROXY_SUPPORT */
            !outside_root (repos))
            dirswitch (arg, repos);
        free (repos);
    }
    else if (status == -2)
    {
        pending_error = ENOMEM;
    }
    else if (status != 0)
    {
        pending_error_text = xmalloc (80 + strlen (arg));
        if (pending_error_text == NULL)
        {
            pending_error = ENOMEM;
        }
        else if (status == -1)
        {
            sprintf (pending_error_text,
                     "E end of file reading mode for %s", arg);
        }
        else
        {
            sprintf (pending_error_text,
                     "E error reading mode for %s", arg);
            pending_error = status;
        }
    }
}



static void
serve_static_directory (char *arg)
{
    FILE *f;

    if (error_pending ()
# ifdef PROXY_SUPPORT
        || proxy_log
# endif /* PROXY_SUPPORT */
       ) return;

    f = CVS_FOPEN (CVSADM_ENTSTAT, "w+");
    if (f == NULL)
    {
        int save_errno = errno;
        if (alloc_pending (80 + strlen (CVSADM_ENTSTAT)))
            sprintf (pending_error_text, "E cannot open %s", CVSADM_ENTSTAT);
        pending_error = save_errno;
        return;
    }
    if (fclose (f) == EOF)
    {
        int save_errno = errno;
        if (alloc_pending (80 + strlen (CVSADM_ENTSTAT)))
            sprintf (pending_error_text, "E cannot close %s", CVSADM_ENTSTAT);
        pending_error = save_errno;
        return;
    }
}



static void
serve_sticky (char *arg)
{
    FILE *f;

    if (error_pending ()
# ifdef PROXY_SUPPORT
        || proxy_log
# endif /* PROXY_SUPPORT */
       ) return;

    f = CVS_FOPEN (CVSADM_TAG, "w+");
    if (f == NULL)
    {
        int save_errno = errno;
        if (alloc_pending (80 + strlen (CVSADM_TAG)))
            sprintf (pending_error_text, "E cannot open %s", CVSADM_TAG);
        pending_error = save_errno;
        return;
    }
    if (fprintf (f, "%s\n", arg) < 0)
    {
        int save_errno = errno;
        if (alloc_pending (80 + strlen (CVSADM_TAG)))
            sprintf (pending_error_text, "E cannot write to %s", CVSADM_TAG);
        pending_error = save_errno;
        return;
    }
    if (fclose (f) == EOF)
    {
        int save_errno = errno;
        if (alloc_pending (80 + strlen (CVSADM_TAG)))
            sprintf (pending_error_text, "E cannot close %s", CVSADM_TAG);
        pending_error = save_errno;
        return;
    }
}



/*
 * Read SIZE bytes from buf_from_net, write them to FILE.
 *
 * Currently this isn't really used for receiving parts of a file --
 * the file is still sent over in one chunk.  But if/when we get
 * spiffy in-process gzip support working, perhaps the compressed
 * pieces could be sent over as they're ready, if the network is fast
 * enough.  Or something.
 */
static void
receive_partial_file (size_t size, int file)
{
    while (size > 0)
    {
        int status;
        size_t nread;
        char *data;

        status = buf_read_data (buf_from_net, size, &data, &nread);
        if (status != 0)
        {
            if (status == -2)
                pending_error = ENOMEM;
            else
            {
                pending_error_text = xmalloc (80);
                if (pending_error_text == NULL)
                    pending_error = ENOMEM;
                else if (status == -1)
                {
                    sprintf (pending_error_text,
                             "E premature end of file from client");
                    pending_error = 0;
                }
                else
                {
                    sprintf (pending_error_text,
                             "E error reading from client");
                    pending_error = status;
                }
            }
            return;
        }

        size -= nread;

        while (nread > 0)
        {
            ssize_t nwrote;

            nwrote = write (file, data, nread);
            if (nwrote < 0)
            {
                int save_errno = errno;
                if (alloc_pending (40))
                    strcpy (pending_error_text, "E unable to write");
                pending_error = save_errno;

                /* Read and discard the file data.  */
                while (size > 0)
                {
                    int status;
                    size_t nread;
                    char *data;

                    status = buf_read_data (buf_from_net, size, &data, &nread);
                    if (status != 0)
                        return;
                    size -= nread;
                }

                return;
            }
            nread -= nwrote;
            data += nwrote;
        }
    }
}



/* Receive SIZE bytes, write to filename FILE.  */
static void
receive_file (size_t size, char *file, int gzipped)
{
    int fd;
    char *arg = file;

    /* Write the file.  */
    fd = CVS_OPEN (arg, O_WRONLY | O_CREAT | O_TRUNC, 0600);
    if (fd < 0)
    {
        int save_errno = errno;
        if (alloc_pending (40 + strlen (arg)))
            sprintf (pending_error_text, "E cannot open %s", arg);
        pending_error = save_errno;
        return;
    }

    if (gzipped)
    {
        /* Using gunzip_and_write isn't really a high-performance
           approach, because it keeps the whole thing in memory
           (contiguous memory, worse yet).  But it seems easier to
           code than the alternative (and less vulnerable to subtle
           bugs).  Given that this feature is mainly for
           compatibility, that is the better tradeoff.  */

        size_t toread = size;
        char *filebuf;
        char *p;

        filebuf = xmalloc (size);
        p = filebuf;
        /* If NULL, we still want to read the data and discard it.  */

        while (toread > 0)
        {
            int status;
            size_t nread;
            char *data;

            status = buf_read_data (buf_from_net, toread, &data, &nread);
            if (status != 0)
            {
                if (status == -2)
                    pending_error = ENOMEM;
                else
                {
                    pending_error_text = xmalloc (80);
                    if (pending_error_text == NULL)
                        pending_error = ENOMEM;
                    else if (status == -1)
                    {
                        sprintf (pending_error_text,
                                 "E premature end of file from client");
                        pending_error = 0;
                    }
                    else
                    {
                        sprintf (pending_error_text,
                                 "E error reading from client");
                        pending_error = status;
                    }
                }
                return;
            }

            toread -= nread;

            if (filebuf != NULL)
            {
                memcpy (p, data, nread);
                p += nread;
            }
        }
        if (filebuf == NULL)
        {
            pending_error = ENOMEM;
            goto out;
        }

        if (gunzip_and_write (fd, file, (unsigned char *) filebuf, size))
        {
            if (alloc_pending (80))
                sprintf (pending_error_text,
                         "E aborting due to compression error");
        }
        free (filebuf);
    }
    else
        receive_partial_file (size, fd);

    if (pending_error_text)
    {
        char *p = xrealloc (pending_error_text,
                           strlen (pending_error_text) + strlen (arg) + 30);
        if (p)
        {
            pending_error_text = p;
            sprintf (p + strlen (p), ", file %s", arg);
        }
        /* else original string is supposed to be unchanged */
    }

 out:
    if (close (fd) < 0 && !error_pending ())
    {
        int save_errno = errno;
        if (alloc_pending (40 + strlen (arg)))
            sprintf (pending_error_text, "E cannot close %s", arg);
        pending_error = save_errno;
        return;
    }
}



/* Kopt for the next file sent in Modified or Is-modified.  */
static char *kopt;

/* Timestamp (Checkin-time) for next file sent in Modified or
   Is-modified.  */
static int checkin_time_valid;
static time_t checkin_time;



/*
 * Used to keep track of Entry requests.
 */
struct an_entry {
    struct an_entry *next;
    char *entry;
};

static struct an_entry *entries;

static void
serve_is_modified (char *arg)
{
    struct an_entry *p;
    char *name;
    char *cp;
    char *timefield;
    /* Have we found this file in "entries" yet.  */
    int found;

    if (error_pending ()
# ifdef PROXY_SUPPORT
        || proxy_log
# endif /* PROXY_SUPPORT */
       ) return;

    if (outside_dir (arg))
        return;

    /* Rewrite entries file to have `M' in timestamp field.  */
    found = 0;
    for (p = entries; p != NULL; p = p->next)
    {
        name = p->entry + 1;
        cp = strchr (name, '/');
        if (cp != NULL
            && strlen (arg) == cp - name
            && strncmp (arg, name, cp - name) == 0)
        {
            if (!(timefield = strchr (cp + 1, '/')) || *++timefield == '\0')
            {
                /* We didn't find the record separator or it is followed by
                 * the end of the string, so just exit.
                 */
                if (alloc_pending (80))
                    sprintf (pending_error_text,
                             "E Malformed Entry encountered.");
                return;
            }
            /* If the time field is not currently empty, then one of
             * serve_modified, serve_is_modified, & serve_unchanged were
             * already called for this file.  We would like to ignore the
             * reinvocation silently or, better yet, exit with an error
             * message, but we just avoid the copy-forward and overwrite the
             * value from the last invocation instead.  See the comment below
             * for more.
             */
            if (*timefield == '/')
            {
                /* Copy forward one character.  Space was allocated for this
                 * already in serve_entry().  */
                cp = timefield + strlen (timefield);
                cp[1] = '\0';
                while (cp > timefield)
                {
                    *cp = cp[-1];
                    --cp;
                }

                /* *timefield == '/';  */
            }
            /* If *TIMEFIELD wasn't '/' and wasn't '+', we assume that it was
             * because of multiple calls to Is-modified & Unchanged by the
             * client and just overwrite the value from the last call.
             * Technically, we should probably either ignore calls after the
             * first or send the client an error, since the client/server
             * protocol specification specifies that only one call to either
             * Is-Modified or Unchanged is allowed, but broken versions of
             * CVSNT (at least 2.0.34 - 2.0.41, reported fixed in 2.0.41a) and
             * the WinCVS & TortoiseCVS clients which depend on those broken
             * versions of CVSNT (WinCVS 1.3 & at least one TortoiseCVS
             * release) rely on this behavior.
             */
            if (*timefield != '+')
                *timefield = 'M';

            if (kopt != NULL)
            {
                if (alloc_pending (strlen (name) + 80))
                    sprintf (pending_error_text,
                             "E protocol error: both Kopt and Entry for %s",
                             arg);
                free (kopt);
                kopt = NULL;
                return;
            }
            found = 1;
            break;
        }
    }
    if (!found)
    {
        /* We got Is-modified but no Entry.  Add a dummy entry.
           The "D" timestamp is what makes it a dummy.  */
        p = xmalloc (sizeof (struct an_entry));
        if (p == NULL)
        {
            pending_error = ENOMEM;
            return;
        }
        p->entry = xmalloc (strlen (arg) + 80);
        if (p->entry == NULL)
        {
            pending_error = ENOMEM;
            free (p);
            return;
        }
        strcpy (p->entry, "/");
        strcat (p->entry, arg);
        strcat (p->entry, "//D/");
        if (kopt != NULL)
        {
            strcat (p->entry, kopt);
            free (kopt);
            kopt = NULL;
        }
        strcat (p->entry, "/");
        p->next = entries;
        entries = p;
    }
}



static void
serve_modified (char *arg)
{
    size_t size;
    int read_size;
    int status;
    char *size_text;
    char *mode_text;

    int gzipped = 0;

    /*
     * This used to return immediately if error_pending () was true.
     * However, that fails, because it causes each line of the file to
     * be echoed back to the client as an unrecognized command.  The
     * client isn't reading from the socket, so eventually both
     * processes block trying to write to the other.  Now, we try to
     * read the file if we can.
     */

    status = buf_read_line (buf_from_net, &mode_text, NULL);
    if (status != 0)
    {
        if (status == -2)
            pending_error = ENOMEM;
        else
        {
            pending_error_text = xmalloc (80 + strlen (arg));
            if (pending_error_text == NULL)
                pending_error = ENOMEM;
            else
            {
                if (status == -1)
                    sprintf (pending_error_text,
                             "E end of file reading mode for %s", arg);
                else
                {
                    sprintf (pending_error_text,
                             "E error reading mode for %s", arg);
                    pending_error = status;
                }
            }
        }
        return;
    }

    status = buf_read_line (buf_from_net, &size_text, NULL);
    if (status != 0)
    {
        if (status == -2)
            pending_error = ENOMEM;
        else
        {
            pending_error_text = xmalloc (80 + strlen (arg));
            if (pending_error_text == NULL)
                pending_error = ENOMEM;
            else
            {
                if (status == -1)
                    sprintf (pending_error_text,
                             "E end of file reading size for %s", arg);
                else
                {
                    sprintf (pending_error_text,
                             "E error reading size for %s", arg);
                    pending_error = status;
                }
            }
        }
        free (mode_text);
        return;
    }
    if (size_text[0] == 'z')
    {
        gzipped = 1;
        read_size = atoi (size_text + 1);
    }
    else
        read_size = atoi (size_text);
    free (size_text);

    if (read_size < 0 && alloc_pending (80))
    {
        sprintf (pending_error_text,
                 "E client sent invalid (negative) file size");
        return;
    }
    else
        size = read_size;

    if (error_pending ())
    {
        /* Now that we know the size, read and discard the file data.  */
        while (size > 0)
        {
            int status;
            size_t nread;
            char *data;

            status = buf_read_data (buf_from_net, size, &data, &nread);
            if (status != 0)
                return;
            size -= nread;
        }
        free (mode_text);
        return;
    }

    if (
# ifdef PROXY_SUPPORT
        !proxy_log &&
# endif /* PROXY_SUPPORT */
        outside_dir (arg))
    {
        free (mode_text);
        return;
    }

    receive_file (size,
# ifdef PROXY_SUPPORT
                  proxy_log ? DEVNULL :
# endif /* PROXY_SUPPORT */
                              arg,
                  gzipped);
    if (error_pending ())
    {
        free (mode_text);
        return;
    }

# ifdef PROXY_SUPPORT
    /* We've read all the data that needed to be read if we're still logging
     * for a secondary.  Return.
     */
    if (proxy_log) return;
# endif /* PROXY_SUPPORT */

    if (checkin_time_valid)
    {
        struct utimbuf t;

        memset (&t, 0, sizeof (t));
        t.modtime = t.actime = checkin_time;
        if (utime (arg, &t) < 0)
        {
            int save_errno = errno;
            if (alloc_pending (80 + strlen (arg)))
                sprintf (pending_error_text, "E cannot utime %s", arg);
            pending_error = save_errno;
            free (mode_text);
            return;
        }
        checkin_time_valid = 0;
    }

    {
        int status = change_mode (arg, mode_text, 0);
        free (mode_text);
        if (status)
        {
            if (alloc_pending (40 + strlen (arg)))
                sprintf (pending_error_text,
                         "E cannot change mode for %s", arg);
            pending_error = status;
            return;
        }
    }

    /* Make sure that the Entries indicate the right kopt.  We probably
       could do this even in the non-kopt case and, I think, save a stat()
       call in time_stamp_server.  But for conservatism I'm leaving the
       non-kopt case alone.  */
    if (kopt != NULL)
        serve_is_modified (arg);
}



static void
serve_enable_unchanged (char *arg)
{
# ifdef PROXY_SUPPORT
    /* Might as well skip this since this function does nothing anyhow.  If
     * it did do anything and could generate errors, then the line below would
     * be necessary since this can be processed before a `Root' request.
     *
     *     if (reprocessing) return;
     */
# endif /* PROXY_SUPPORT */
}



static void
serve_unchanged (char *arg)
{
    struct an_entry *p;
    char *name;
    char *cp;
    char *timefield;

    if (error_pending ()
# ifdef PROXY_SUPPORT
        || proxy_log
# endif /* PROXY_SUPPORT */
       ) return;

    if (outside_dir (arg))
        return;

    /* Rewrite entries file to have `=' in timestamp field.  */
    for (p = entries; p != NULL; p = p->next)
    {
        name = p->entry + 1;
        cp = strchr (name, '/');
        if (cp != NULL
            && strlen (arg) == cp - name
            && strncmp (arg, name, cp - name) == 0)
        {
            if (!(timefield = strchr (cp + 1, '/')) || *++timefield == '\0')
            {
                /* We didn't find the record separator or it is followed by
                 * the end of the string, so just exit.
                 */
                if (alloc_pending (80))
                    sprintf (pending_error_text,
                             "E Malformed Entry encountered.");
                return;
            }
            /* If the time field is not currently empty, then one of
             * serve_modified, serve_is_modified, & serve_unchanged were
             * already called for this file.  We would like to ignore the
             * reinvocation silently or, better yet, exit with an error
             * message, but we just avoid the copy-forward and overwrite the
             * value from the last invocation instead.  See the comment below
             * for more.
             */
            if (*timefield == '/')
            {
                /* Copy forward one character.  Space was allocated for this
                 * already in serve_entry().  */
                cp = timefield + strlen (timefield);
                cp[1] = '\0';
                while (cp > timefield)
                {
                    *cp = cp[-1];
                    --cp;
                }

                /* *timefield == '/';  */
            }
            if (*timefield != '+')
            {
                /* '+' is a conflict marker and we don't want to mess with it
                 * until Version_TS catches it.
                 */
                if (timefield[1] != '/')
                {
                    /* Obliterate anything else in TIMEFIELD.  This is again to
                     * support the broken CVSNT clients mentioned below, in
                     * conjunction with strict timestamp string boundry
                     * checking in time_stamp_server() from vers_ts.c &
                     * file_has_conflict() from subr.c, since the broken
                     * clients used to send malformed timestamp fields in the
                     * Entry request that they then depended on the subsequent
                     * Unchanged request to overwrite.
                     */
                    char *d = timefield + 1;
                    if ((cp = strchr (d, '/')))
                    {
                        while (*cp)
                        {
                            *d++ = *cp++;
                        }
                        *d = '\0';
                    }
                }
                /* If *TIMEFIELD wasn't '/', we assume that it was because of
                 * multiple calls to Is-modified & Unchanged by the client and
                 * just overwrite the value from the last call.  Technically,
                 * we should probably either ignore calls after the first or
                 * send the client an error, since the client/server protocol
                 * specification specifies that only one call to either
                 * Is-Modified or Unchanged is allowed, but broken versions of
                 * CVSNT (at least 2.0.34 - 2.0.41, reported fixed in 2.0.41a)
                 * and the WinCVS & TortoiseCVS clients which depend on those
                 * broken versions of CVSNT (WinCVS 1.3 & at least one
                 * TortoiseCVS release) rely on this behavior.
                 */
                *timefield = '=';
            }
            break;
        }
    }
}



static void
serve_entry (char *arg)
{
    struct an_entry *p;
    char *cp;
    int i = 0;

    if (error_pending()
# ifdef PROXY_SUPPORT
        || proxy_log
# endif /* PROXY_SUPPORT */
       ) return;

    /* Verify that the entry is well-formed.  This can avoid problems later.
     * At the moment we only check that the Entry contains five slashes in
     * approximately the correct locations since some of the code makes
     * assumptions about this.
     */
    cp = arg;
    if (*cp == 'D') cp++;
    while (i++ < 5)
    {
        if (!cp || *cp != '/')
        {
            if (alloc_pending (80))
                sprintf (pending_error_text,
                         "E protocol error: Malformed Entry");
            return;
        }
        cp = strchr (cp + 1, '/');
    }

    p = xmalloc (sizeof (struct an_entry));
    if (p == NULL)
    {
        pending_error = ENOMEM;
        return;
    }
    /* Leave space for serve_unchanged to write '=' if it wants.  */
    cp = xmalloc (strlen (arg) + 2);
    if (cp == NULL)
    {
        free (p);
        pending_error = ENOMEM;
        return;
    }
    strcpy (cp, arg);
    p->next = entries;
    p->entry = cp;
    entries = p;
}



static void
serve_kopt (char *arg)
{
    if (error_pending ()
# ifdef PROXY_SUPPORT
        || proxy_log
# endif /* PROXY_SUPPORT */
       )
        return;

    if (kopt != NULL)
    {
        if (alloc_pending (80 + strlen (arg)))
            sprintf (pending_error_text,
                     "E protocol error: duplicate Kopt request: %s", arg);
        return;
    }

    /* Do some sanity checks.  In particular, that it is not too long.
       This lets the rest of the code not worry so much about buffer
       overrun attacks.  Probably should call RCS_check_kflag here,
       but that would mean changing RCS_check_kflag to handle errors
       other than via exit(), fprintf(), and such.  */
    if (strlen (arg) > 10)
    {
        if (alloc_pending (80 + strlen (arg)))
            sprintf (pending_error_text,
                     "E protocol error: invalid Kopt request: %s", arg);
        return;
    }

    kopt = xmalloc (strlen (arg) + 1);
    if (kopt == NULL)
    {
        pending_error = ENOMEM;
        return;
    }
    strcpy (kopt, arg);
}



static void
serve_checkin_time (char *arg)
{
    struct timespec t;

    if (error_pending ()
# ifdef PROXY_SUPPORT
        || proxy_log
# endif /* PROXY_SUPPORT */
       )
        return;

    if (checkin_time_valid)
    {
        if (alloc_pending (80 + strlen (arg)))
            sprintf (pending_error_text,
                     "E protocol error: duplicate Checkin-time request: %s",
                     arg);
        return;
    }

    if (!get_date (&t, arg, NULL))
    {
        if (alloc_pending (80 + strlen (arg)))
            sprintf (pending_error_text, "E cannot parse date %s", arg);
        return;
    }

    /* Truncate any nanoseconds returned by get_date().  */
    checkin_time = t.tv_sec;
    checkin_time_valid = 1;
}



static void
server_write_entries (void)
{
    FILE *f;
    struct an_entry *p;
    struct an_entry *q;

    if (entries == NULL)
        return;

    f = NULL;
    /* Note that we free all the entries regardless of errors.  */
    if (!error_pending ())
    {
        /* We open in append mode because we don't want to clobber an
           existing Entries file.  If we are checking out a module
           which explicitly lists more than one file in a particular
           directory, then we will wind up calling
           server_write_entries for each such file.  */
        f = CVS_FOPEN (CVSADM_ENT, "a");
        if (f == NULL)
        {
            int save_errno = errno;
            if (alloc_pending (80 + strlen (CVSADM_ENT)))
                sprintf (pending_error_text, "E cannot open %s", CVSADM_ENT);
            pending_error = save_errno;
        }
    }
    for (p = entries; p != NULL;)
    {
        if (!error_pending ())
        {
            if (fprintf (f, "%s\n", p->entry) < 0)
            {
                int save_errno = errno;
                if (alloc_pending (80 + strlen(CVSADM_ENT)))
                    sprintf (pending_error_text,
                             "E cannot write to %s", CVSADM_ENT);
                pending_error = save_errno;
            }
        }
        free (p->entry);
        q = p->next;
        free (p);
        p = q;
    }
    entries = NULL;
    if (f != NULL && fclose (f) == EOF && !error_pending ())
    {
        int save_errno = errno;
        if (alloc_pending (80 + strlen (CVSADM_ENT)))
            sprintf (pending_error_text, "E cannot close %s", CVSADM_ENT);
        pending_error = save_errno;
    }
}



# ifdef PROXY_SUPPORT
/*
 * callback proc to run a script when admin finishes.
 */
static int
prepost_proxy_proc (const char *repository, const char *filter, void *closure)
{
    char *cmdline;
    bool *pre = closure;

    /* %c = cvs_cmd_name
     * %I = commit ID
     * %p = shortrepos
     * %r = repository
     */
    TRACE (TRACE_FUNCTION, "prepost_proxy_proc (%s, %s, %s)", repository,
           filter, *pre ? "pre" : "post");

    /*
     * Cast any NULL arguments as appropriate pointers as this is an
     * stdarg function and we need to be certain the caller gets what
     * is expected.
     */
    cmdline = format_cmdline (
# ifdef SUPPORT_OLD_INFO_FMT_STRINGS
                              0, ".",
# endif /* SUPPORT_OLD_INFO_FMT_STRINGS */
                              filter,
                              "c", "s", cvs_cmd_name,
                              "I", "s", global_session_id,
                              "R", "s", referrer ? referrer->original : "NONE",
                              "p", "s", ".",
                              "r", "s", current_parsed_root->directory,
                              "P", "s", config->PrimaryServer->original,
                              (char *) NULL);

    if (!cmdline || !strlen (cmdline))
    {
        if (cmdline) free (cmdline);
        if (*pre)
            error (0, 0, "preadmin proc resolved to the empty string!");
        else
            error (0, 0, "postadmin proc resolved to the empty string!");
        return 1;
    }

    run_setup (cmdline);

    free (cmdline);

    /* FIXME - read the comment in verifymsg_proc() about why we use abs()
     * below() and shouldn't.
     */
    return abs (run_exec (RUN_TTY, RUN_TTY, RUN_TTY,
                          RUN_NORMAL | RUN_SIGIGNORE));
}



/* Become a secondary write proxy to a master server.
 *
 * This function opens the connection to the primary, dumps the secondary log
 * to the primary, then reads data from any available connection and writes it
 * to its partner:
 *
 *   buf_from_net -> buf_to_primary
 *   buf_from_primary -> buf_to_net
 *
 * When all "from" connections have sent EOF and all data has been sent to
 * "to" connections, this function closes the "to" pipes and returns.
 */
static void
become_proxy (void)
{
    struct buffer *buf_to_primary;
    struct buffer *buf_from_primary;

    /* Close the client log and open it for read.  */
    struct buffer *buf_clientlog = log_buffer_rewind (proxy_log_out);
    int status, to_primary_fd, from_primary_fd, to_net_fd, from_net_fd;

    /* Call presecondary script.  */
    bool pre = true;

            char *data;
            size_t thispass, got;
            int s;
            char *newdata;

    Parse_Info (CVSROOTADM_PREPROXY, current_parsed_root->directory,
                prepost_proxy_proc, PIOPT_ALL, &pre);

    /* Open connection to primary server.  */
    open_connection_to_server (config->PrimaryServer, &buf_to_primary,
                               &buf_from_primary);
    setup_logfiles ("CVS_SECONDARY_LOG", &buf_to_primary, &buf_from_primary);
    if ((status = set_nonblock (buf_from_primary)))
        error (1, status, "failed to set nonblocking io from primary");
    if ((status = set_nonblock (buf_from_net)))
        error (1, status, "failed to set nonblocking io from client");
    if ((status = set_nonblock (buf_to_primary)))
        error (1, status, "failed to set nonblocking io to primary");
    if ((status = set_nonblock (buf_to_net)))
        error (1, status, "failed to set nonblocking io to client");

    to_primary_fd = buf_get_fd (buf_to_primary);
    from_primary_fd = buf_get_fd (buf_from_primary);
    to_net_fd = buf_get_fd (buf_to_net);
    assert (to_primary_fd >= 0 && from_primary_fd >= 0 && to_net_fd >= 0);

    /* Close the client log and open it for read.  */
    rewind_buf_from_net ();

    while (from_primary_fd >= 0 || to_primary_fd >= 0)
    {
        fd_set readfds, writefds;
        int status, numfds = -1;
        struct timeval *timeout_ptr;
        struct timeval timeout;
        size_t toread;

        FD_ZERO (&readfds);
        FD_ZERO (&writefds);

        /* The fd for a multi-source buffer can change with any read.  */
        from_net_fd = buf_from_net ? buf_get_fd (buf_from_net) : -1;

        if ((buf_from_net && !buf_empty_p (buf_from_net))
            || (buf_from_primary && !buf_empty_p (buf_from_primary)))
        {
            /* There is data pending so don't block if we don't find any new
             * data on the fds.
             */
            timeout.tv_sec = 0;
            timeout.tv_usec = 0;
            timeout_ptr = &timeout;
        }
        else
            /* block indefinately */
            timeout_ptr = NULL;

        /* Set writefds if data is pending.  */
        if (to_net_fd >= 0 && !buf_empty_p (buf_to_net))
        {
            FD_SET (to_net_fd, &writefds);
            numfds = MAX (numfds, to_net_fd);
        }
        if (to_primary_fd >= 0 && !buf_empty_p (buf_to_primary))
        {
            FD_SET (to_primary_fd, &writefds);
            numfds = MAX (numfds, to_primary_fd);
        }

        /* Set readfds if descriptors are still open.  */
        if (from_net_fd >= 0)
        {
            FD_SET (from_net_fd, &readfds);
            numfds = MAX (numfds, from_net_fd);
        }
        if (from_primary_fd >= 0)
        {
            FD_SET (from_primary_fd, &readfds);
            numfds = MAX (numfds, from_primary_fd);
        }

        /* NUMFDS needs to be the highest descriptor + 1 according to the
         * select spec.
         */
        numfds++;

        do {
            /* This used to select on exceptions too, but as far
               as I know there was never any reason to do that and
               SCO doesn't let you select on exceptions on pipes.  */
            numfds = select (numfds, &readfds, &writefds,
                             NULL, timeout_ptr);
            if (numfds < 0 && errno != EINTR)
            {
                /* Sending an error to the client, possibly in the middle of a
                 * separate protocol message, will likely not mean much to the
                 * client, but it's better than nothing, I guess.
                 */
                buf_output0 (buf_to_net, "E select failed\n");
                print_error (errno);
                exit (EXIT_FAILURE);
            }
        } while (numfds < 0);

        if (numfds == 0)
        {
            FD_ZERO (&readfds);
            FD_ZERO (&writefds);
        }

        if (to_net_fd >= 0 && FD_ISSET (to_net_fd, &writefds))
        {
            /* What should we do with errors?  syslog() them?  */
            buf_send_output (buf_to_net);
            buf_flush (buf_to_net, false);
        }

        status = 0;
        if (from_net_fd >= 0 && (FD_ISSET (from_net_fd, &readfds)))
            status = buf_input_data (buf_from_net, NULL);

        if (buf_from_net && !buf_empty_p (buf_from_net))
        {
            if (buf_to_primary)
                buf_append_buffer (buf_to_primary, buf_from_net);
            else
                /* (Sys?)log this?  */;
                
        }

        if (status == -1 /* EOF */)
        {
            SIG_beginCrSect();
            /* Need only to shut this down and set to NULL, really, in
             * crit sec, to ensure no double-dispose and to make sure
             * network pipes are closed as properly as possible, but I
             * don't see much optimization potential in saving values and
             * postponing the free.
             */
            buf_shutdown (buf_from_net);
            buf_free (buf_from_net);
            buf_from_net = NULL;
            /* So buf_to_primary will be closed at the end of this loop.  */
            from_net_fd = -1;
            SIG_endCrSect();
        }
        else if (status > 0 /* ERRNO */)
        {
            buf_output0 (buf_to_net,
                         "E buf_input_data failed reading from client\n");
            print_error (status);
            exit (EXIT_FAILURE);
        }

        if (to_primary_fd >= 0 && FD_ISSET (to_primary_fd, &writefds))
        {
            /* What should we do with errors?  syslog() them?  */
            buf_send_output (buf_to_primary);
            buf_flush (buf_to_primary, false);
        }

        status = 0;
        if (from_primary_fd >= 0 && FD_ISSET (from_primary_fd, &readfds))
            status = buf_input_data (buf_from_primary, &toread);

        /* Avoid resending data from the server which we already sent to the
         * client.  Otherwise clients get really confused.
         */
        if (buf_clientlog
            && buf_from_primary && !buf_empty_p (buf_from_primary))
        {
            /* Dispose of data we already sent to the client.  */
            while (buf_clientlog && toread > 0)
            {
                s = buf_read_data (buf_clientlog, toread, &data, &got);
                if (s == -2)
                    error (1, ENOMEM, "Failed to read data.");
                if (s == -1)
                {
                    buf_shutdown (buf_clientlog);
                    buf_clientlog = NULL;
                }
                else if (s)
                    error (1, s, "Error reading writeproxy log.");
                else
                {
                    thispass = got;
                    while (thispass > 0)
                    {
                        /* No need to check for errors here since we know we
                         * won't read more than buf_input read into
                         * BUF_FROM_PRIMARY (see how TOREAD is set above).
                         */
                        buf_read_data (buf_from_primary, thispass, &newdata,
                                       &got);
                        /* Verify that we are throwing away what we think we
                         * are.
                         *
                         * It is valid to assume that the secondary and primary
                         * are closely enough in sync that this portion of the
                         * communication will be in sync beacuse if they were
                         * not, then the secondary might provide a
                         * valid-request string to the client which contained a
                         * request that the primary didn't support.  If the
                         * client later used the request, the primary server
                         * would exit anyhow.
                         *
                         * FIXME?
                         * An alternative approach might be to make sure that
                         * the secondary provides the same string as the
                         * primary regardless, for purposes like pointing a
                         * secondary at an unwitting primary, in which case it
                         * might be useful to have some way to override the
                         * valid-requests string on a secondary, but it seems
                         * much easier to simply sync the versions, at the
                         * moment.
                         */
                        if (memcmp (data, newdata, got))
                            error (1, 0, "Secondary out of sync with primary!");
                        data += got;
                        thispass -= got;
                    }
                    toread -= got;
                }
            }
        }

        if (buf_from_primary && !buf_empty_p (buf_from_primary))
        {
            if (buf_to_net)
                buf_append_buffer (buf_to_net, buf_from_primary);
            else
                /* (Sys?)log this?  */;
                
        }

        if (status == -1 /* EOF */)
        {
            buf_shutdown (buf_from_primary);
            buf_from_primary = NULL;
            from_primary_fd = -1;
        }
        else if (status > 0 /* ERRNO */)
        {
            buf_output0 (buf_to_net,
                         "E buf_input_data failed reading from primary\n");
            print_error (status);
            exit (EXIT_FAILURE);
        }

        /* If our "source pipe" is closed and all data has been sent, avoid
         * selecting it for writability, but don't actually close the buffer in
         * case other routines want to use it later.  The buffer will be closed
         * in server_cleanup ().
         */
        if (from_primary_fd < 0
            && buf_to_net && buf_empty_p (buf_to_net))
            to_net_fd = -1;

        if (buf_to_primary
            && (/* Assume that there is no further reason to keep the buffer to
                 * the primary open if we can no longer read its responses.
                 */
                (from_primary_fd < 0 && buf_to_primary)
                /* Also close buf_to_primary when it becomes impossible to find
                 * more data to send to it.  We don't close buf_from_primary
                 * yet since there may be data pending or the primary may react
                 * to the EOF on its input pipe.
                 */
                || (from_net_fd < 0 && buf_empty_p (buf_to_primary))))
        {
            buf_shutdown (buf_to_primary);
            buf_free (buf_to_primary);
            buf_to_primary = NULL;

            /* Setting the fd < 0 with from_primary_fd already < 0 will cause
             * an escape from this while loop.
             */
            to_primary_fd = -1;
        }
    }

    /* Call postsecondary script.  */
    pre = false;
    Parse_Info (CVSROOTADM_POSTPROXY, current_parsed_root->directory,
                prepost_proxy_proc, PIOPT_ALL, &pre);
}
# endif /* PROXY_SUPPORT */



struct notify_note {
    /* Directory in which this notification happens.  xmalloc'd*/
    char *dir;

    /* xmalloc'd.  */
    char *update_dir;

    /* xmalloc'd.  */
    char *filename;

    /* The following three all in one xmalloc'd block, pointed to by TYPE.
       Each '\0' terminated.  */
    /* "E" or "U".  */
    char *type;
    /* time+host+dir */
    char *val;
    char *watches;

    struct notify_note *next;
};

static struct notify_note *notify_list;
/* Used while building list, to point to the last node that already exists.  */
static struct notify_note *last_node;

static void
serve_notify (char *arg)
{
    struct notify_note *new = NULL;
    char *data = NULL;
    int status;

    if (error_pending ()) return;

    if (isProxyServer())
    {
# ifdef PROXY_SUPPORT
        if (!proxy_log)
        {
# endif /* PROXY_SUPPORT */
            if (alloc_pending (160) + strlen (program_name))
                sprintf (pending_error_text, 
"E This CVS server does not support disconnected `%s edit'.  For now, remove all `%s' files in your workspace and try your command again.",
                         program_name, CVSADM_NOTIFY);
        return;
# ifdef PROXY_SUPPORT
        }
        else
        {
            /* This is effectively a write command, so run it on the primary.  */
            become_proxy ();
            exit (EXIT_SUCCESS);
        }
# endif /* PROXY_SUPPORT */
    }

    if (outside_dir (arg))
        return;

    if (gDirname == NULL)
        goto error;

    new = xmalloc (sizeof (struct notify_note));
    if (new == NULL)
    {
        pending_error = ENOMEM;
        return;
    }
    new->dir = xmalloc (strlen (gDirname) + 1);
    new->update_dir = xmalloc (strlen (gupdate_dir) + 1);
    new->filename = xmalloc (strlen (arg) + 1);
    if (new->dir == NULL || new->update_dir == NULL || new->filename == NULL)
    {
        pending_error = ENOMEM;
        if (new->dir != NULL)
            free (new->dir);
        free (new);
        return;
    }
    strcpy (new->dir, gDirname);
    strcpy (new->update_dir, gupdate_dir);
    strcpy (new->filename, arg);

    status = buf_read_line (buf_from_net, &data, NULL);
    if (status != 0)
    {
        if (status == -2)
            pending_error = ENOMEM;
        else
        {
            pending_error_text = xmalloc (80 + strlen (arg));
            if (pending_error_text == NULL)
                pending_error = ENOMEM;
            else
            {
                if (status == -1)
                    sprintf (pending_error_text,
                             "E end of file reading notification for %s", arg);
                else
                {
                    sprintf (pending_error_text,
                             "E error reading notification for %s", arg);
                    pending_error = status;
                }
            }
        }
        free (new->filename);
        free (new->dir);
        free (new);
    }
    else
    {
        char *cp;

        if (!data[0])
            goto error;

        if (strchr (data, '+'))
            goto error;

        new->type = data;
        if (data[1] != '\t')
            goto error;
        data[1] = '\0';
        cp = data + 2;
        new->val = cp;
        cp = strchr (cp, '\t');
        if (cp == NULL)
            goto error;
        *cp++ = '+';
        cp = strchr (cp, '\t');
        if (cp == NULL)
            goto error;
        *cp++ = '+';
        cp = strchr (cp, '\t');
        if (cp == NULL)
            goto error;
        *cp++ = '\0';
        new->watches = cp;
        /* If there is another tab, ignore everything after it,
           for future expansion.  */
        cp = strchr (cp, '\t');
        if (cp != NULL)
            *cp = '\0';

        new->next = NULL;

        if (last_node == NULL)
            notify_list = new;
        else
            last_node->next = new;
        last_node = new;
    }
    return;
  error:
    pending_error = 0;
    if (alloc_pending (80))
        strcpy (pending_error_text,
                "E Protocol error; misformed Notify request");
    if (data != NULL)
        free (data);
    if (new != NULL)
    {
        free (new->filename);
        free (new->update_dir);
        free (new->dir);
        free (new);
    }
    return;
}



static void
serve_hostname (char *arg)
{
    free (hostname);
    hostname = xstrdup (arg);
    return;
}



static void
serve_localdir (char *arg)
{
    if (CurDir) free (CurDir);
    CurDir = xstrdup (arg);
}



/* Process all the Notify requests that we have stored up.  Returns 0
   if successful, if not prints error message (via error()) and
   returns negative value.  */
static int
server_notify (void)
{
    struct notify_note *p;
    char *repos;

    TRACE (TRACE_FUNCTION, "server_notify()");

    while (notify_list != NULL)
    {
        if (CVS_CHDIR (notify_list->dir) < 0)
        {
            error (0, errno, "cannot change to %s", notify_list->dir);
            return -1;
        }
        repos = Name_Repository (NULL, NULL);

        lock_dir_for_write (repos);

        fileattr_startdir (repos);

        notify_do (*notify_list->type, notify_list->filename,
                   notify_list->update_dir, getcaller(), notify_list->val,
                   notify_list->watches, repos);

        buf_output0 (buf_to_net, "Notified ");
        {
            char *dir = notify_list->dir + strlen (server_temp_dir) + 1;
            if (dir[0] == '\0')
                buf_append_char (buf_to_net, '.');
            else
                buf_output0 (buf_to_net, dir);
            buf_append_char (buf_to_net, '/');
            buf_append_char (buf_to_net, '\n');
        }
        buf_output0 (buf_to_net, repos);
        buf_append_char (buf_to_net, '/');
        buf_output0 (buf_to_net, notify_list->filename);
        buf_append_char (buf_to_net, '\n');
        free (repos);

        p = notify_list->next;
        free (notify_list->filename);
        free (notify_list->dir);
        free (notify_list->type);
        free (notify_list);
        notify_list = p;

        fileattr_write ();
        fileattr_free ();

        Lock_Cleanup ();
    }

    last_node = NULL;

    /* The code used to call fflush (stdout) here, but that is no
       longer necessary.  The data is now buffered in buf_to_net,
       which will be flushed by the caller, do_cvs_command.  */

    return 0;
}



/* This request is processed in all passes since requests which must
 * sometimes be processed before it is known whether we are running as a
 * secondary or not, for instance the `expand-modules' request, sometimes use
 * the `Arguments'.
 */
static void
serve_argument (char *arg)
{
    char *p;

    if (error_pending()) return;

    if (argument_count >= 10000)
    {
        if (alloc_pending (80))
            sprintf (pending_error_text, 
                     "E Protocol error: too many arguments");
        return;
    }

    if (argument_vector_size <= argument_count)
    {
        argument_vector_size *= 2;
        argument_vector = xnrealloc (argument_vector,
                                     argument_vector_size, sizeof (char *));
        if (argument_vector == NULL)
        {
            pending_error = ENOMEM;
            return;
        }
    }
    p = xmalloc (strlen (arg) + 1);
    if (p == NULL)
    {
        pending_error = ENOMEM;
        return;
    }
    strcpy (p, arg);
    argument_vector[argument_count++] = p;
}



/* For secondary servers, this is handled in all passes, as is the `Argument'
 * request, and for the same reasons.
 */
static void
serve_argumentx (char *arg)
{
    char *p;

    if (error_pending()) return;
    
    if (argument_count <= 1) 
    {
        if (alloc_pending (80))
            sprintf (pending_error_text,
"E Protocol error: called argumentx without prior call to argument");
        return;
    }

    p = argument_vector[argument_count - 1];
    p = xrealloc (p, strlen (p) + 1 + strlen (arg) + 1);
    if (p == NULL)
    {
        pending_error = ENOMEM;
        return;
    }
    strcat (p, "\n");
    strcat (p, arg);
    argument_vector[argument_count - 1] = p;
}



static void
serve_global_option (char *arg)
{
# ifdef PROXY_SUPPORT
    /* This can generate error messages and termination before `Root' requests,
     * so it must be dealt with in the first pass.
     */ 
    if (reprocessing) return;
# endif /* PROXY_SUPPORT */

    if (arg[0] != '-' || arg[1] == '\0' || arg[2] != '\0')
    {
    error_return:
        if (alloc_pending (strlen (arg) + 80))
            sprintf (pending_error_text,
                     "E Protocol error: bad global option %s",
                     arg);
        return;
    }
    switch (arg[1])
    {
        case 'l':
            error(0, 0, "WARNING: global `-l' option ignored.");
            break;
        case 'n':
            noexec = 1;
            logoff = 1;
            break;
        case 'q':
            quiet = 1;
            break;
        case 'r':
            cvswrite = 0;
            break;
        case 'Q':
            really_quiet = 1;
            break;
        case 't':
            trace++;
            break;
        default:
            goto error_return;
    }
}



/* This needs to be processed before Root requests, so we allow it to be
 * be processed before knowing whether we are running as a secondary server
 * to allow `noop' and `Root' requests to generate errors as before.
 */
static void
serve_set (char *arg)
{
# ifdef PROXY_SUPPORT
    if (reprocessing) return;
# endif /* PROXY_SUPPORT */

    /* FIXME: This sends errors immediately (I think); they should be
       put into pending_error.  */
    variable_set (arg);
}

# ifdef ENCRYPTION

#   ifdef HAVE_KERBEROS

static void
serve_kerberos_encrypt( char *arg )
{
#     ifdef PROXY_SUPPORT
    assert (!proxy_log);
#     endif /* PROXY_SUPPORT */

    /* All future communication with the client will be encrypted.  */

    buf_to_net = krb_encrypt_buffer_initialize (buf_to_net, 0, sched,
                                                kblock,
                                                buf_to_net->memory_error);
    buf_from_net = krb_encrypt_buffer_initialize (buf_from_net, 1, sched,
                                                  kblock,
                                                  buf_from_net->memory_error);
}

#   endif /* HAVE_KERBEROS */

#   ifdef HAVE_GSSAPI

static void
serve_gssapi_encrypt( char *arg )
{
#     ifdef PROXY_SUPPORT
    assert (!proxy_log);
#     endif /* PROXY_SUPPORT */

    if (cvs_gssapi_wrapping)
    {
        /* We're already using a gssapi_wrap buffer for stream
           authentication.  Flush everything we've output so far, and
           turn on encryption for future data.  On the input side, we
           should only have unwrapped as far as the Gssapi-encrypt
           command, so future unwrapping will become encrypted.  */
        buf_flush (buf_to_net, 1);
        cvs_gssapi_encrypt = 1;
        return;
    }

    /* All future communication with the client will be encrypted.  */

    cvs_gssapi_encrypt = 1;

    buf_to_net = cvs_gssapi_wrap_buffer_initialize (buf_to_net, 0,
                                                    gcontext,
                                                    buf_to_net->memory_error);
    buf_from_net = cvs_gssapi_wrap_buffer_initialize (buf_from_net, 1,
                                                      gcontext,
                                                      buf_from_net->memory_error);

    cvs_gssapi_wrapping = 1;
}

#   endif /* HAVE_GSSAPI */

# endif /* ENCRYPTION */

# ifdef HAVE_GSSAPI

static void
serve_gssapi_authenticate (char *arg)
{
#   ifdef PROXY_SUPPORT
    assert (!proxy_log);
#   endif /* PROXY_SUPPORT */

    if (cvs_gssapi_wrapping)
    {
        /* We're already using a gssapi_wrap buffer for encryption.
           That includes authentication, so we don't have to do
           anything further.  */
        return;
    }

    buf_to_net = cvs_gssapi_wrap_buffer_initialize (buf_to_net, 0,
                                                    gcontext,
                                                    buf_to_net->memory_error);
    buf_from_net = cvs_gssapi_wrap_buffer_initialize (buf_from_net, 1,
                                                      gcontext,
                                                      buf_from_net->memory_error);

    cvs_gssapi_wrapping = 1;
}

# endif /* HAVE_GSSAPI */



# ifdef SERVER_FLOWCONTROL
/* The maximum we'll queue to the remote client before blocking.  */
#   ifndef SERVER_HI_WATER
#     define SERVER_HI_WATER (2 * 1024 * 1024)
#   endif /* SERVER_HI_WATER */
/* When the buffer drops to this, we restart the child */
#   ifndef SERVER_LO_WATER
#     define SERVER_LO_WATER (1 * 1024 * 1024)
#   endif /* SERVER_LO_WATER */
# endif /* SERVER_FLOWCONTROL */



static void
serve_questionable (char *arg)
{
    static int initted;

# ifdef PROXY_SUPPORT
    if (proxy_log) return;
# endif /* PROXY_SUPPORT */

    if (error_pending ()) return;

    if (!initted)
    {
        /* Pick up ignores from CVSROOTADM_IGNORE, $HOME/.cvsignore on server,
           and CVSIGNORE on server.  */
        ign_setup ();
        initted = 1;
    }

    if (gDirname == NULL)
    {
        if (alloc_pending (80))
            sprintf (pending_error_text,
"E Protocol error: `Directory' missing");
        return;
    }

    if (outside_dir (arg))
        return;

    if (!ign_name (arg))
    {
        char *update_dir;

        buf_output (buf_to_net, "M ? ", 4);
        update_dir = gDirname + strlen (server_temp_dir) + 1;
        if (!(update_dir[0] == '.' && update_dir[1] == '\0'))
        {
            buf_output0 (buf_to_net, update_dir);
            buf_output (buf_to_net, "/", 1);
        }
        buf_output0 (buf_to_net, arg);
        buf_output (buf_to_net, "\n", 1);
    }
}



static struct buffer *protocol = NULL;

/* This is the output which we are saving up to send to the server, in the
   child process.  We will push it through, via the `protocol' buffer, when
   we have a complete line.  */
static struct buffer *saved_output;

/* Likewise, but stuff which will go to stderr.  */
static struct buffer *saved_outerr;



static void
protocol_memory_error (struct buffer *buf)
{
    error (1, ENOMEM, "Virtual memory exhausted");
}



/* If command is valid, return 1.
 * Else if command is invalid and croak_on_invalid is set, then die.
 * Else just return 0 to indicate that command is invalid.
 */
static bool
check_command_valid_p (char *cmd_name)
{
    /* Right now, only pserver notices invalid commands -- namely,
     * write attempts by a read-only user.  Therefore, if CVS_Username
     * is not set, this just returns 1, because CVS_Username unset
     * means pserver is not active.
     */
# ifdef AUTH_SERVER_SUPPORT
    if (CVS_Username == NULL)
        return true;

    if (lookup_command_attribute (cmd_name) & CVS_CMD_MODIFIES_REPOSITORY)
    {
        /* This command has the potential to modify the repository, so
         * we check if the user have permission to do that.
         *
         * (Only relevant for remote users -- local users can do
         * whatever normal Unix file permissions allow them to do.)
         *
         * The decision method:
         *
         *    If $CVSROOT/CVSADMROOT_READERS exists and user is listed
         *    in it, then read-only access for user.
         *
         *    Or if $CVSROOT/CVSADMROOT_WRITERS exists and user NOT
         *    listed in it, then also read-only access for user.
         *
         *    Else read-write access for user.
         */

         char *linebuf = NULL;
         int num_red = 0;
         size_t linebuf_len = 0;
         char *fname;
         size_t flen;
         FILE *fp;
         int found_it = 0;

         /* else */
         flen = strlen (current_parsed_root->directory)
                + strlen (CVSROOTADM)
                + strlen (CVSROOTADM_READERS)
                + 3;

         fname = xmalloc (flen);
         (void) sprintf (fname, "%s/%s/%s", current_parsed_root->directory,
                        CVSROOTADM, CVSROOTADM_READERS);

         fp = fopen (fname, "r");

         if (fp == NULL)
         {
             if (!existence_error (errno))
             {
                 /* Need to deny access, so that attackers can't fool
                    us with some sort of denial of service attack.  */
                 error (0, errno, "cannot open %s", fname);
                 free (fname);
                 return false;
             }
         }
         else  /* successfully opened readers file */
         {
             while ((num_red = getline (&linebuf, &linebuf_len, fp)) >= 0)
             {
                 /* Hmmm, is it worth importing my own readline
                    library into CVS?  It takes care of chopping
                    leading and trailing whitespace, "#" comments, and
                    newlines automatically when so requested.  Would
                    save some code here...  -kff */

                 /* Chop newline by hand, for strcmp()'s sake. */
                 if (num_red > 0 && linebuf[num_red - 1] == '\n')
                     linebuf[num_red - 1] = '\0';

                 if (strcmp (linebuf, CVS_Username) == 0)
                     goto handle_invalid;
             }
             if (num_red < 0 && !feof (fp))
                 error (0, errno, "cannot read %s", fname);

             /* If not listed specifically as a reader, then this user
                has write access by default unless writers are also
                specified in a file . */
             if (fclose (fp) < 0)
                 error (0, errno, "cannot close %s", fname);
         }
         free (fname);

         /* Now check the writers file.  */

         flen = strlen (current_parsed_root->directory)
                + strlen (CVSROOTADM)
                + strlen (CVSROOTADM_WRITERS)
                + 3;

         fname = xmalloc (flen);
         (void) sprintf (fname, "%s/%s/%s", current_parsed_root->directory,
                        CVSROOTADM, CVSROOTADM_WRITERS);

         fp = fopen (fname, "r");

         if (fp == NULL)
         {
             if (linebuf)
                 free (linebuf);
             if (existence_error (errno))
             {
                 /* Writers file does not exist, so everyone is a writer,
                    by default.  */
                 free (fname);
                 return true;
             }
             else
             {
                 /* Need to deny access, so that attackers can't fool
                    us with some sort of denial of service attack.  */
                 error (0, errno, "cannot read %s", fname);
                 free (fname);
                 return false;
             }
         }

         found_it = 0;
         while ((num_red = getline (&linebuf, &linebuf_len, fp)) >= 0)
         {
             /* Chop newline by hand, for strcmp()'s sake. */
             if (num_red > 0 && linebuf[num_red - 1] == '\n')
                 linebuf[num_red - 1] = '\0';

             if (strcmp (linebuf, CVS_Username) == 0)
             {
                 found_it = 1;
                 break;
             }
         }
         if (num_red < 0 && !feof (fp))
             error (0, errno, "cannot read %s", fname);

         if (found_it)
         {
             if (fclose (fp) < 0)
                 error (0, errno, "cannot close %s", fname);
             if (linebuf)
                 free (linebuf);
             free (fname);
             return true;
         }
         else   /* writers file exists, but this user not listed in it */
         {
         handle_invalid:
             if (fclose (fp) < 0)
                 error (0, errno, "cannot close %s", fname);
             if (linebuf)
                 free (linebuf);
             free (fname);
             return false;
         }
    }
# endif /* AUTH_SERVER_SUPPORT */

    /* If ever reach end of this function, command must be valid. */
    return true;
}



/* Execute COMMAND in a subprocess with the approriate funky things done.  */

static struct fd_set_wrapper { fd_set fds; } command_fds_to_drain;
# ifdef SUNOS_KLUDGE
static int max_command_fd;
# endif

# ifdef SERVER_FLOWCONTROL
static int flowcontrol_pipe[2];
# endif /* SERVER_FLOWCONTROL */



/*
 * Set buffer FD to non-blocking I/O.  Returns 0 for success or errno
 * code.
 */
int
set_nonblock_fd (int fd)
{
# if defined (F_GETFL) && defined (O_NONBLOCK) && defined (F_SETFL)
    int flags;

    flags = fcntl (fd, F_GETFL, 0);
    if (flags < 0)
        return errno;
    if (fcntl (fd, F_SETFL, flags | O_NONBLOCK) < 0)
        return errno;
# endif /* F_GETFL && O_NONBLOCK && F_SETFL */
    return 0;
}



static void
do_cvs_command (char *cmd_name, int (*command) (int, char **))
{
    /*
     * The following file descriptors are set to -1 if that file is not
     * currently open.
     */

    /* Data on these pipes is a series of '\n'-terminated lines.  */
    int stdout_pipe[2];
    int stderr_pipe[2];

    /*
     * Data on this pipe is a series of counted (see buf_send_counted)
     * packets.  Each packet must be processed atomically (i.e. not
     * interleaved with data from stdout_pipe or stderr_pipe).
     */
    int protocol_pipe[2];

    int dev_null_fd = -1;

    int errs;

    TRACE (TRACE_FUNCTION, "do_cvs_command (%s)", cmd_name);

    /* Write proxy logging is always terminated when a command is received.
     * Therefore, we wish to avoid reprocessing the command since that would
     * cause endless recursion.
     */
    if ((command != version || current_parsed_root) && isProxyServer())
    {
# ifdef PROXY_SUPPORT
        if (reprocessing)
            /* This must be the second time we've reached this point.
             * Done reprocessing.
             */
            reprocessing = false;
        else
        {
            if (lookup_command_attribute (cmd_name)
                    & CVS_CMD_MODIFIES_REPOSITORY)
            {
                become_proxy ();
                exit (EXIT_SUCCESS);
            }
            else if (/* serve_co may have called this already and missing logs
                      * should have generated an error in serve_root().
                      */
                     proxy_log)
            {
                /* Set up the log for reprocessing.  */
                rewind_buf_from_net ();
                /* And return to the main loop in server(), where we will now
                 * find the logged secondary data and reread it.
                 */
                return;
            }
        }
# else /* !PROXY_SUPPORT */
        if (lookup_command_attribute (cmd_name)
                    & CVS_CMD_MODIFIES_REPOSITORY
            && alloc_pending (120))
            sprintf (pending_error_text, 
"E You need a CVS client that supports the `Redirect' response for write requests to this server.");
        return;
# endif /* PROXY_SUPPORT */
    }

    command_pid = -1;
    stdout_pipe[0] = -1;
    stdout_pipe[1] = -1;
    stderr_pipe[0] = -1;
    stderr_pipe[1] = -1;
    protocol_pipe[0] = -1;
    protocol_pipe[1] = -1;

    server_write_entries ();

    if (print_pending_error ())
        goto free_args_and_return;

    /* Global `cvs_cmd_name' is probably "server" right now -- only
       serve_export() sets it to anything else.  So we will use local
       parameter `cmd_name' to determine if this command is valid for
       this user.  */
    if (!check_command_valid_p (cmd_name))
    {
        buf_output0 (buf_to_net, "E ");
        buf_output0 (buf_to_net, program_name);
        buf_output0 (buf_to_net, " [server aborted]: \"");
        buf_output0 (buf_to_net, cmd_name);
        buf_output0 (buf_to_net,
"\" requires write access to the repository\n\
error  \n");
        goto free_args_and_return;
    }
    cvs_cmd_name = cmd_name;

    (void) server_notify ();

    /*
     * We use a child process which actually does the operation.  This
     * is so we can intercept its standard output.  Even if all of CVS
     * were written to go to some special routine instead of writing
     * to stdout or stderr, we would still need to do the same thing
     * for the RCS commands.
     */

    if (pipe (stdout_pipe) < 0)
    {
        buf_output0 (buf_to_net, "E pipe failed\n");
        print_error (errno);
        goto error_exit;
    }
    if (pipe (stderr_pipe) < 0)
    {
        buf_output0 (buf_to_net, "E pipe failed\n");
        print_error (errno);
        goto error_exit;
    }
    if (pipe (protocol_pipe) < 0)
    {
        buf_output0 (buf_to_net, "E pipe failed\n");
        print_error (errno);
        goto error_exit;
    }
# ifdef SERVER_FLOWCONTROL
    if (pipe (flowcontrol_pipe) < 0)
    {
        buf_output0 (buf_to_net, "E pipe failed\n");
        print_error (errno);
        goto error_exit;
    }
    set_nonblock_fd (flowcontrol_pipe[0]);
    set_nonblock_fd (flowcontrol_pipe[1]);
# endif /* SERVER_FLOWCONTROL */

    dev_null_fd = CVS_OPEN (DEVNULL, O_RDONLY);
    if (dev_null_fd < 0)
    {
        buf_output0 (buf_to_net, "E open /dev/null failed\n");
        print_error (errno);
        goto error_exit;
    }

    /* We shouldn't have any partial lines from cvs_output and
       cvs_outerr, but we handle them here in case there is a bug.  */
    /* FIXME: appending a newline, rather than using "MT" as we
       do in the child process, is probably not really a very good
       way to "handle" them.  */
    if (! buf_empty_p (saved_output))
    {
        buf_append_char (saved_output, '\n');
        buf_copy_lines (buf_to_net, saved_output, 'M');
    }
    if (! buf_empty_p (saved_outerr))
    {
        buf_append_char (saved_outerr, '\n');
        buf_copy_lines (buf_to_net, saved_outerr, 'E');
    }

    /* Flush out any pending data.  */
    buf_flush (buf_to_net, 1);

    /* Don't use vfork; we're not going to exec().  */
    command_pid = fork ();
    if (command_pid < 0)
    {
        buf_output0 (buf_to_net, "E fork failed\n");
        print_error (errno);
        goto error_exit;
    }
    if (command_pid == 0)
    {
        int exitstatus;

        /* Since we're in the child, and the parent is going to take
           care of packaging up our error messages, we can clear this
           flag.  */
        error_use_protocol = 0;

        protocol = fd_buffer_initialize (protocol_pipe[1], 0, NULL, false,
                                         protocol_memory_error);

        /* At this point we should no longer be using buf_to_net and
           buf_from_net.  Instead, everything should go through
           protocol.  */
        if (buf_to_net != NULL)
        {
            buf_free (buf_to_net);
            buf_to_net = NULL;
        }
        if (buf_from_net != NULL)
        {
            buf_free (buf_from_net);
            buf_from_net = NULL;
        }

        /* These were originally set up to use outbuf_memory_error.
           Since we're now in the child, we should use the simpler
           protocol_memory_error function.  */
        saved_output->memory_error = protocol_memory_error;
        saved_outerr->memory_error = protocol_memory_error;

        if (dup2 (dev_null_fd, STDIN_FILENO) < 0)
            error (1, errno, "can't set up pipes");
        if (dup2 (stdout_pipe[1], STDOUT_FILENO) < 0)
            error (1, errno, "can't set up pipes");
        if (dup2 (stderr_pipe[1], STDERR_FILENO) < 0)
            error (1, errno, "can't set up pipes");
        close (dev_null_fd);
        close (stdout_pipe[0]);
        close (stdout_pipe[1]);
        close (stderr_pipe[0]);
        close (stderr_pipe[1]);
        close (protocol_pipe[0]);
        close_on_exec (protocol_pipe[1]);
# ifdef SERVER_FLOWCONTROL
        close_on_exec (flowcontrol_pipe[0]);
        close (flowcontrol_pipe[1]);
# endif /* SERVER_FLOWCONTROL */

        /*
         * Set this in .bashrc if you want to give yourself time to attach
         * to the subprocess with a debugger.
         */
        if (getenv("CVS_SERVER_SLEEP") && *getenv("CVS_SERVER_SLEEP"))
        {
            int secs = atoi (getenv ("CVS_SERVER_SLEEP"));
            TRACE (TRACE_DATA, "Sleeping CVS_SERVER_SLEEP (%d) seconds", secs);
            sleep (secs);
        }
        else
            TRACE (TRACE_DATA, "CVS_SERVER_SLEEP not set.");

        exitstatus = (*command) (argument_count, argument_vector);

        /* Output any partial lines.  If the client doesn't support
           "MT", we go ahead and just tack on a newline since the
           protocol doesn't support anything better.  */
        if (! buf_empty_p (saved_output))
        {
            buf_output0 (protocol, supported_response ("MT") ? "MT text " : "M ");
            buf_append_buffer (protocol, saved_output);
            buf_output (protocol, "\n", 1);
            buf_send_counted (protocol);
        }
        /* For now we just discard partial lines on stderr.  I suspect
           that CVS can't write such lines unless there is a bug.  */

        buf_free (protocol);

        /* Close the pipes explicitly in order to send an EOF to the parent,
         * then wait for the parent to close the flow control pipe.  This
         * avoids a race condition where a child which dumped more than the
         * high water mark into the pipes could complete its job and exit,
         * leaving the parent process to attempt to write a stop byte to the
         * closed flow control pipe, which earned the parent a SIGPIPE, which
         * it normally only expects on the network pipe and that causes it to
         * exit with an error message, rather than the SIGCHILD that it knows
         * how to handle correctly.
         */
        /* Let exit() close STDIN - it's from /dev/null anyhow.  */
        fclose (stderr);
        fclose (stdout);
        close (protocol_pipe[1]);
# ifdef SERVER_FLOWCONTROL
        {
            char junk;
            ssize_t status;
            while ((status = read (flowcontrol_pipe[0], &junk, 1)) > 0
                   || (status == -1 && errno == EAGAIN));
        }
        /* FIXME: No point in printing an error message with error(),
         * as STDERR is already closed, but perhaps this could be syslogged?
         */
# endif

        exit (exitstatus);
    }

    /* OK, sit around getting all the input from the child.  */
    {
        struct buffer *stdoutbuf;
        struct buffer *stderrbuf;
        struct buffer *protocol_inbuf;
        /* Number of file descriptors to check in select ().  */
        int num_to_check;
        int count_needed = 1;
# ifdef SERVER_FLOWCONTROL
        int have_flowcontrolled = 0;
# endif /* SERVER_FLOWCONTROL */

        FD_ZERO (&command_fds_to_drain.fds);
        num_to_check = stdout_pipe[0];
        FD_SET (stdout_pipe[0], &command_fds_to_drain.fds);
        num_to_check = MAX (num_to_check, stderr_pipe[0]);
        FD_SET (stderr_pipe[0], &command_fds_to_drain.fds);
        num_to_check = MAX (num_to_check, protocol_pipe[0]);
        FD_SET (protocol_pipe[0], &command_fds_to_drain.fds);
        num_to_check = MAX (num_to_check, STDOUT_FILENO);
# ifdef SUNOS_KLUDGE
        max_command_fd = num_to_check;
# endif
        /*
         * File descriptors are numbered from 0, so num_to_check needs to
         * be one larger than the largest descriptor.
         */
        ++num_to_check;
        if (num_to_check > FD_SETSIZE)
        {
            buf_output0 (buf_to_net,
                         "E internal error: FD_SETSIZE not big enough.\n\
error  \n");
            goto error_exit;
        }

        stdoutbuf = fd_buffer_initialize (stdout_pipe[0], 0, NULL, true,
                                          input_memory_error);

        stderrbuf = fd_buffer_initialize (stderr_pipe[0], 0, NULL, true,
                                          input_memory_error);

        protocol_inbuf = fd_buffer_initialize (protocol_pipe[0], 0, NULL, true,
                                               input_memory_error);

        set_nonblock (buf_to_net);
        set_nonblock (stdoutbuf);
        set_nonblock (stderrbuf);
        set_nonblock (protocol_inbuf);

        if (close (stdout_pipe[1]) < 0)
        {
            buf_output0 (buf_to_net, "E close failed\n");
            print_error (errno);
            goto error_exit;
        }
        stdout_pipe[1] = -1;

        if (close (stderr_pipe[1]) < 0)
        {
            buf_output0 (buf_to_net, "E close failed\n");
            print_error (errno);
            goto error_exit;
        }
        stderr_pipe[1] = -1;

        if (close (protocol_pipe[1]) < 0)
        {
            buf_output0 (buf_to_net, "E close failed\n");
            print_error (errno);
            goto error_exit;
        }
        protocol_pipe[1] = -1;

# ifdef SERVER_FLOWCONTROL
        if (close (flowcontrol_pipe[0]) < 0)
        {
            buf_output0 (buf_to_net, "E close failed\n");
            print_error (errno);
            goto error_exit;
        }
        flowcontrol_pipe[0] = -1;
# endif /* SERVER_FLOWCONTROL */