Gotweb

Blob

Date:: Sat Mar 30 17:21:23 2024 UTC
Message:: display process title in syslog when a gotd child process exits
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2022, 2023 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include "got_compat.h"
18 
19 #include <sys/types.h>
20 #include <sys/queue.h>
21 #include <sys/socket.h>
22 #include <sys/stat.h>
23 #include <sys/uio.h>
24 
25 #include <errno.h>
26 #include <event.h>
27 #include <limits.h>
28 #include <signal.h>
29 #include <stdint.h>
30 #include <stdio.h>
31 #include <stdlib.h>
32 #include <string.h>
33 #include <imsg.h>
34 #include <unistd.h>
35 
36 #include "got_compat.h"
37 
38 #include "got_error.h"
39 #include "got_repository.h"
40 #include "got_object.h"
41 #include "got_path.h"
42 #include "got_reference.h"
43 #include "got_opentemp.h"
44 
45 #include "got_lib_hash.h"
46 #include "got_lib_delta.h"
47 #include "got_lib_object.h"
48 #include "got_lib_object_cache.h"
49 #include "got_lib_pack.h"
50 #include "got_lib_repository.h"
51 #include "got_lib_gitproto.h"
52 
53 #include "gotd.h"
54 #include "log.h"
55 #include "session_write.h"
56 
57 struct gotd_session_notif {
58 	STAILQ_ENTRY(gotd_session_notif) entry;
59 	int fd;
60 	enum gotd_notification_action action;
61 	char *refname;
62 	struct got_object_id old_id;
63 	struct got_object_id new_id;
64 };
65 STAILQ_HEAD(gotd_session_notifications, gotd_session_notif) notifications;
66 
67 enum gotd_session_write_state {
68 	GOTD_STATE_EXPECT_LIST_REFS,
69 	GOTD_STATE_EXPECT_CAPABILITIES,
70 	GOTD_STATE_EXPECT_REF_UPDATE,
71 	GOTD_STATE_EXPECT_MORE_REF_UPDATES,
72 	GOTD_STATE_EXPECT_PACKFILE,
73 	GOTD_STATE_NOTIFY,
74 };
75 
76 static struct gotd_session_write {
77 	pid_t pid;
78 	const char *title;
79 	struct got_repository *repo;
80 	struct gotd_repo *repo_cfg;
81 	int *pack_fds;
82 	int *temp_fds;
83 	struct gotd_imsgev parent_iev;
84 	struct gotd_imsgev notifier_iev;
85 	struct timeval request_timeout;
86 	enum gotd_session_write_state state;
87 	struct gotd_imsgev repo_child_iev;
88 } gotd_session;
89 
90 static struct gotd_session_client {
91 	struct gotd_client_capability	*capabilities;
92 	size_t				 ncapa_alloc;
93 	size_t				 ncapabilities;
94 	uint32_t			 id;
95 	int				 fd;
96 	int				 delta_cache_fd;
97 	struct gotd_imsgev		 iev;
98 	struct event			 tmo;
99 	uid_t				 euid;
100 	gid_t				 egid;
101 	char				*username;
102 	char				*packfile_path;
103 	char				*packidx_path;
104 	int				 nref_updates;
105 	int				 accept_flush_pkt;
106 	int				 flush_disconnect;
107 } gotd_session_client;
108 
109 static void session_write_shutdown(void);
110 
111 static void
112 disconnect(struct gotd_session_client *client)
113 {
114 	log_debug("uid %d: disconnecting", client->euid);
115 
116 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
117 	    GOTD_IMSG_DISCONNECT, PROC_SESSION_WRITE, -1, NULL, 0) == -1)
118 		log_warn("imsg compose DISCONNECT");
119 
120 	imsg_clear(&gotd_session.repo_child_iev.ibuf);
121 	event_del(&gotd_session.repo_child_iev.ev);
122 	evtimer_del(&client->tmo);
123 	close(client->fd);
124 	if (client->delta_cache_fd != -1)
125 		close(client->delta_cache_fd);
126 	if (client->packfile_path) {
127 		if (unlink(client->packfile_path) == -1 && errno != ENOENT)
128 			log_warn("unlink %s: ", client->packfile_path);
129 		free(client->packfile_path);
130 	}
131 	if (client->packidx_path) {
132 		if (unlink(client->packidx_path) == -1 && errno != ENOENT)
133 			log_warn("unlink %s: ", client->packidx_path);
134 		free(client->packidx_path);
135 	}
136 	free(client->capabilities);
137 
138 	session_write_shutdown();
139 }
140 
141 static void
142 disconnect_on_error(struct gotd_session_client *client,
143     const struct got_error *err)
144 {
145 	struct imsgbuf ibuf;
146 
147 	if (err->code != GOT_ERR_EOF) {
148 		log_warnx("uid %d: %s", client->euid, err->msg);
149 		imsg_init(&ibuf, client->fd);
150 		gotd_imsg_send_error(&ibuf, 0, PROC_SESSION_WRITE, err);
151 		imsg_clear(&ibuf);
152 	}
153 
154 	disconnect(client);
155 }
156 
157 static void
158 gotd_request_timeout(int fd, short events, void *arg)
159 {
160 	struct gotd_session_client *client = arg;
161 
162 	log_debug("disconnecting uid %d due to timeout", client->euid);
163 	disconnect(client);
164 }
165 
166 static void
167 session_write_sighdlr(int sig, short event, void *arg)
168 {
169 	/*
170 	 * Normal signal handler rules don't apply because libevent
171 	 * decouples for us.
172 	 */
173 
174 	switch (sig) {
175 	case SIGHUP:
176 		log_info("%s: ignoring SIGHUP", __func__);
177 		break;
178 	case SIGUSR1:
179 		log_info("%s: ignoring SIGUSR1", __func__);
180 		break;
181 	case SIGTERM:
182 	case SIGINT:
183 		session_write_shutdown();
184 		/* NOTREACHED */
185 		break;
186 	default:
187 		fatalx("unexpected signal");
188 	}
189 }
190 
191 static const struct got_error *
192 recv_packfile_install(struct imsg *imsg)
193 {
194 	struct gotd_imsg_packfile_install inst;
195 	size_t datalen;
196 
197 	log_debug("packfile-install received");
198 
199 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
200 	if (datalen != sizeof(inst))
201 		return got_error(GOT_ERR_PRIVSEP_LEN);
202 	memcpy(&inst, imsg->data, sizeof(inst));
203 
204 	return NULL;
205 }
206 
207 static const struct got_error *
208 recv_ref_updates_start(struct imsg *imsg)
209 {
210 	struct gotd_imsg_ref_updates_start istart;
211 	size_t datalen;
212 
213 	log_debug("ref-updates-start received");
214 
215 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
216 	if (datalen != sizeof(istart))
217 		return got_error(GOT_ERR_PRIVSEP_LEN);
218 	memcpy(&istart, imsg->data, sizeof(istart));
219 
220 	return NULL;
221 }
222 
223 static const struct got_error *
224 recv_ref_update(struct imsg *imsg)
225 {
226 	struct gotd_imsg_ref_update iref;
227 	size_t datalen;
228 
229 	log_debug("ref-update received");
230 
231 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
232 	if (datalen < sizeof(iref))
233 		return got_error(GOT_ERR_PRIVSEP_LEN);
234 	memcpy(&iref, imsg->data, sizeof(iref));
235 
236 	return NULL;
237 }
238 
239 static const struct got_error *
240 send_ref_update_ok(struct gotd_session_client *client,
241     struct gotd_imsg_ref_update *iref, const char *refname)
242 {
243 	struct gotd_imsg_ref_update_ok iok;
244 	struct gotd_imsgev *iev = &client->iev;
245 	struct ibuf *wbuf;
246 	size_t len;
247 
248 	memset(&iok, 0, sizeof(iok));
249 	memcpy(iok.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
250 	memcpy(iok.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
251 	iok.name_len = strlen(refname);
252 
253 	len = sizeof(iok) + iok.name_len;
254 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE_OK,
255 	    PROC_SESSION_WRITE, gotd_session.pid, len);
256 	if (wbuf == NULL)
257 		return got_error_from_errno("imsg_create REF_UPDATE_OK");
258 
259 	if (imsg_add(wbuf, &iok, sizeof(iok)) == -1)
260 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
261 	if (imsg_add(wbuf, refname, iok.name_len) == -1)
262 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
263 
264 	imsg_close(&iev->ibuf, wbuf);
265 	gotd_imsg_event_add(iev);
266 	return NULL;
267 }
268 
269 static void
270 send_refs_updated(struct gotd_session_client *client)
271 {
272 	if (gotd_imsg_compose_event(&client->iev, GOTD_IMSG_REFS_UPDATED,
273 	    PROC_SESSION_WRITE, -1, NULL, 0) == -1)
274 		log_warn("imsg compose REFS_UPDATED");
275 }
276 
277 static const struct got_error *
278 send_ref_update_ng(struct gotd_session_client *client,
279     struct gotd_imsg_ref_update *iref, const char *refname,
280     const char *reason)
281 {
282 	const struct got_error *ng_err;
283 	struct gotd_imsg_ref_update_ng ing;
284 	struct gotd_imsgev *iev = &client->iev;
285 	struct ibuf *wbuf;
286 	size_t len;
287 
288 	memset(&ing, 0, sizeof(ing));
289 	memcpy(ing.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
290 	memcpy(ing.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
291 	ing.name_len = strlen(refname);
292 
293 	ng_err = got_error_fmt(GOT_ERR_REF_BUSY, "%s", reason);
294 	ing.reason_len = strlen(ng_err->msg);
295 
296 	len = sizeof(ing) + ing.name_len + ing.reason_len;
297 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE_NG,
298 	    PROC_SESSION_WRITE, gotd_session.pid, len);
299 	if (wbuf == NULL)
300 		return got_error_from_errno("imsg_create REF_UPDATE_NG");
301 
302 	if (imsg_add(wbuf, &ing, sizeof(ing)) == -1)
303 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
304 	if (imsg_add(wbuf, refname, ing.name_len) == -1)
305 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
306 	if (imsg_add(wbuf, ng_err->msg, ing.reason_len) == -1)
307 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
308 
309 	imsg_close(&iev->ibuf, wbuf);
310 	gotd_imsg_event_add(iev);
311 	return NULL;
312 }
313 
314 static const struct got_error *
315 install_pack(struct gotd_session_client *client, const char *repo_path,
316     struct imsg *imsg)
317 {
318 	const struct got_error *err = NULL;
319 	struct gotd_imsg_packfile_install inst;
320 	char hex[SHA1_DIGEST_STRING_LENGTH];
321 	size_t datalen;
322 	char *packfile_path = NULL, *packidx_path = NULL;
323 
324 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
325 	if (datalen != sizeof(inst))
326 		return got_error(GOT_ERR_PRIVSEP_LEN);
327 	memcpy(&inst, imsg->data, sizeof(inst));
328 
329 	if (client->packfile_path == NULL)
330 		return got_error_msg(GOT_ERR_BAD_REQUEST,
331 		    "client has no pack file");
332 	if (client->packidx_path == NULL)
333 		return got_error_msg(GOT_ERR_BAD_REQUEST,
334 		    "client has no pack file index");
335 
336 	if (got_sha1_digest_to_str(inst.pack_sha1, hex, sizeof(hex)) == NULL)
337 		return got_error_msg(GOT_ERR_NO_SPACE,
338 		    "could not convert pack file SHA1 to hex");
339 
340 	if (asprintf(&packfile_path, "/%s/%s/pack-%s.pack",
341 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
342 		err = got_error_from_errno("asprintf");
343 		goto done;
344 	}
345 
346 	if (asprintf(&packidx_path, "/%s/%s/pack-%s.idx",
347 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
348 		err = got_error_from_errno("asprintf");
349 		goto done;
350 	}
351 
352 	if (rename(client->packfile_path, packfile_path) == -1) {
353 		err = got_error_from_errno3("rename", client->packfile_path,
354 		    packfile_path);
355 		goto done;
356 	}
357 
358 	free(client->packfile_path);
359 	client->packfile_path = NULL;
360 
361 	if (rename(client->packidx_path, packidx_path) == -1) {
362 		err = got_error_from_errno3("rename", client->packidx_path,
363 		    packidx_path);
364 		goto done;
365 	}
366 
367 	/* Ensure we re-read the pack index list upon next access. */
368 	gotd_session.repo->pack_path_mtime.tv_sec = 0;
369 	gotd_session.repo->pack_path_mtime.tv_nsec = 0;
370 
371 	free(client->packidx_path);
372 	client->packidx_path = NULL;
373 done:
374 	free(packfile_path);
375 	free(packidx_path);
376 	return err;
377 }
378 
379 static const struct got_error *
380 begin_ref_updates(struct gotd_session_client *client, struct imsg *imsg)
381 {
382 	struct gotd_imsg_ref_updates_start istart;
383 	size_t datalen;
384 
385 	if (client->nref_updates != -1)
386 		return got_error(GOT_ERR_PRIVSEP_MSG);
387 
388 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
389 	if (datalen != sizeof(istart))
390 		return got_error(GOT_ERR_PRIVSEP_LEN);
391 	memcpy(&istart, imsg->data, sizeof(istart));
392 
393 	if (istart.nref_updates <= 0)
394 		return got_error(GOT_ERR_PRIVSEP_MSG);
395 
396 	client->nref_updates = istart.nref_updates;
397 	return NULL;
398 }
399 
400 static const struct got_error *
401 validate_namespace(const char *namespace)
402 {
403 	size_t len = strlen(namespace);
404 
405 	if (len < 5 || strncmp("refs/", namespace, 5) != 0 ||
406 	    namespace[len - 1] != '/') {
407 		return got_error_fmt(GOT_ERR_BAD_REF_NAME,
408 		    "reference namespace '%s'", namespace);
409 	}
410 
411 	return NULL;
412 }
413 
414 static const struct got_error *
415 queue_notification(struct got_object_id *old_id, struct got_object_id *new_id,
416     struct got_repository *repo, struct got_reference *ref)
417 {
418 	const struct got_error *err = NULL;
419 	struct gotd_repo *repo_cfg = gotd_session.repo_cfg;
420 	struct gotd_imsgev *iev = &gotd_session.repo_child_iev;
421 	struct got_pathlist_entry *pe;
422 	struct gotd_session_notif *notif;
423 
424 	if (iev->ibuf.fd == -1 ||
425 	    STAILQ_EMPTY(&repo_cfg->notification_targets))
426 		return NULL; /* notifications unused */
427 
428 	TAILQ_FOREACH(pe, &repo_cfg->notification_refs, entry) {
429 		const char *refname = pe->path;
430 		if (strcmp(got_ref_get_name(ref), refname) == 0)
431 			break;
432 	}
433 	if (pe == NULL) {
434 		TAILQ_FOREACH(pe, &repo_cfg->notification_ref_namespaces,
435 		    entry) {
436 			const char *namespace = pe->path;
437 
438 			err = validate_namespace(namespace);
439 			if (err)
440 				return err;
441 			if (strncmp(namespace, got_ref_get_name(ref),
442 			    strlen(namespace)) == 0)
443 				break;
444 		}
445 	}
446 
447 	/*
448 	 * If a branch or a reference namespace was specified in the
449 	 * configuration file then only send notifications if a match
450 	 * was found.
451 	 */
452 	if (pe == NULL && (!TAILQ_EMPTY(&repo_cfg->notification_refs) ||
453 	    !TAILQ_EMPTY(&repo_cfg->notification_ref_namespaces)))
454 		return NULL;
455 
456 	notif = calloc(1, sizeof(*notif));
457 	if (notif == NULL)
458 		return got_error_from_errno("calloc");
459 
460 	notif->fd = -1;
461 
462 	if (old_id == NULL)
463 		notif->action = GOTD_NOTIF_ACTION_CREATED;
464 	else if (new_id == NULL)
465 		notif->action = GOTD_NOTIF_ACTION_REMOVED;
466 	else
467 		notif->action = GOTD_NOTIF_ACTION_CHANGED;
468 
469 	if (old_id != NULL)
470 		memcpy(&notif->old_id, old_id, sizeof(notif->old_id));
471 	if (new_id != NULL)
472 		memcpy(&notif->new_id, new_id, sizeof(notif->new_id));
473 
474 	notif->refname = strdup(got_ref_get_name(ref));
475 	if (notif->refname == NULL) {
476 		err = got_error_from_errno("strdup");
477 		goto done;
478 	}
479 
480 	STAILQ_INSERT_TAIL(&notifications, notif, entry);
481 done:
482 	if (err && notif) {
483 		free(notif->refname);
484 		free(notif);
485 	}
486 	return err;
487 }
488 
489 /* Forward notification content to the NOTIFY process. */
490 static const struct got_error *
491 forward_notification(struct gotd_session_client *client, struct imsg *imsg)
492 {
493 	const struct got_error *err = NULL;
494 	struct gotd_imsgev *iev = &gotd_session.notifier_iev;
495 	struct gotd_session_notif *notif;
496 	struct gotd_imsg_notification_content icontent;
497 	char *refname = NULL;
498 	size_t datalen;
499 	struct gotd_imsg_notify inotify;
500 	const char *action;
501 
502 	memset(&inotify, 0, sizeof(inotify));
503 
504 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
505 	if (datalen < sizeof(icontent))
506 		return got_error(GOT_ERR_PRIVSEP_LEN);
507 	memcpy(&icontent, imsg->data, sizeof(icontent));
508 	if (datalen != sizeof(icontent) + icontent.refname_len)
509 		return got_error(GOT_ERR_PRIVSEP_LEN);
510 	refname = strndup(imsg->data + sizeof(icontent), icontent.refname_len);
511 	if (refname == NULL)
512 		return got_error_from_errno("strndup");
513 
514 	notif = STAILQ_FIRST(&notifications);
515 	if (notif == NULL)
516 		return got_error(GOT_ERR_PRIVSEP_MSG);
517 
518 	STAILQ_REMOVE(&notifications, notif, gotd_session_notif, entry);
519 
520 	if (notif->action != icontent.action || notif->fd == -1 ||
521 	    strcmp(notif->refname, refname) != 0) {
522 		err = got_error(GOT_ERR_PRIVSEP_MSG);
523 		goto done;
524 	}
525 	if (notif->action == GOTD_NOTIF_ACTION_CREATED) {
526 		if (memcmp(notif->new_id.sha1, icontent.new_id,
527 		    SHA1_DIGEST_LENGTH) != 0) {
528 			err = got_error_msg(GOT_ERR_PRIVSEP_MSG,
529 			    "received notification content for unknown event");
530 			goto done;
531 		}
532 	} else if (notif->action == GOTD_NOTIF_ACTION_REMOVED) {
533 		if (memcmp(notif->old_id.sha1, icontent.old_id,
534 		    SHA1_DIGEST_LENGTH) != 0) {
535 			err = got_error_msg(GOT_ERR_PRIVSEP_MSG,
536 			    "received notification content for unknown event");
537 			goto done;
538 		}
539 	} else if (memcmp(notif->old_id.sha1, icontent.old_id,
540 	    SHA1_DIGEST_LENGTH) != 0 ||
541 	    memcmp(notif->new_id.sha1, icontent.new_id,
542 	    SHA1_DIGEST_LENGTH) != 0) {
543 		err = got_error_msg(GOT_ERR_PRIVSEP_MSG,
544 		    "received notification content for unknown event");
545 		goto done;
546 	}
547 
548 	switch (notif->action) {
549 	case GOTD_NOTIF_ACTION_CREATED:
550 		action = "created";
551 		break;
552 	case GOTD_NOTIF_ACTION_REMOVED:
553 		action = "removed";
554 		break;
555 	case GOTD_NOTIF_ACTION_CHANGED:
556 		action = "changed";
557 		break;
558 	default:
559 		err = got_error(GOT_ERR_PRIVSEP_MSG);
560 		goto done;
561 	}
562 
563 	strlcpy(inotify.repo_name, gotd_session.repo_cfg->name,
564 	    sizeof(inotify.repo_name));
565 
566 	snprintf(inotify.subject_line, sizeof(inotify.subject_line),
567 	    "%s: %s %s %s", gotd_session.repo_cfg->name,
568 	    client->username, action, notif->refname);
569 
570 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_NOTIFY,
571 	    PROC_SESSION_WRITE, notif->fd, &inotify, sizeof(inotify))
572 	    == -1) {
573 		err = got_error_from_errno("imsg compose NOTIFY");
574 		goto done;
575 	}
576 	notif->fd = -1;
577 done:
578 	if (notif->fd != -1)
579 		close(notif->fd);
580 	free(notif);
581 	free(refname);
582 	return err;
583 }
584 
585 /* Request notification content from REPO_WRITE process. */
586 static const struct got_error *
587 request_notification(struct gotd_session_notif *notif)
588 {
589 	const struct got_error *err = NULL;
590 	struct gotd_imsgev *iev = &gotd_session.repo_child_iev;
591 	struct gotd_imsg_notification_content icontent;
592 	struct ibuf *wbuf;
593 	size_t len;
594 	int fd;
595 
596 	fd = got_opentempfd();
597 	if (fd == -1)
598 		return got_error_from_errno("got_opentemp");
599 
600 	memset(&icontent, 0, sizeof(icontent));
601 
602 	icontent.action = notif->action;
603 	memcpy(&icontent.old_id, &notif->old_id, sizeof(notif->old_id));
604 	memcpy(&icontent.new_id, &notif->new_id, sizeof(notif->new_id));
605 	icontent.refname_len = strlen(notif->refname);
606 
607 	len = sizeof(icontent) + icontent.refname_len;
608 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_NOTIFY,
609 	    PROC_SESSION_WRITE, gotd_session.pid, len);
610 	if (wbuf == NULL) {
611 		err = got_error_from_errno("imsg_create NOTIFY");
612 		goto done;
613 	}
614 	if (imsg_add(wbuf, &icontent, sizeof(icontent)) == -1) {
615 		err = got_error_from_errno("imsg_add NOTIFY");
616 		goto done;
617 	}
618 	if (imsg_add(wbuf, notif->refname, icontent.refname_len) == -1) {
619 		err = got_error_from_errno("imsg_add NOTIFY");
620 		goto done;
621 	}
622 
623 	notif->fd = dup(fd);
624 	if (notif->fd == -1) {
625 		err = got_error_from_errno("dup");
626 		goto done;
627 	}
628 
629 	ibuf_fd_set(wbuf, fd);
630 	fd = -1;
631 
632 	imsg_close(&iev->ibuf, wbuf);
633 	gotd_imsg_event_add(iev);
634 done:
635 	if (err && fd != -1)
636 		close(fd);
637 	return err;
638 }
639 
640 static const struct got_error *
641 update_ref(int *shut, struct gotd_session_client *client,
642     const char *repo_path, struct imsg *imsg)
643 {
644 	const struct got_error *err = NULL;
645 	struct got_repository *repo = gotd_session.repo;
646 	struct got_reference *ref = NULL;
647 	struct gotd_imsg_ref_update iref;
648 	struct got_object_id old_id, new_id;
649 	struct gotd_session_notif *notif;
650 	struct got_object_id *id = NULL;
651 	char *refname = NULL;
652 	size_t datalen;
653 	int locked = 0;
654 	char hex1[SHA1_DIGEST_STRING_LENGTH];
655 	char hex2[SHA1_DIGEST_STRING_LENGTH];
656 
657 	log_debug("update-ref from uid %d", client->euid);
658 
659 	if (client->nref_updates <= 0)
660 		return got_error(GOT_ERR_PRIVSEP_MSG);
661 
662 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
663 	if (datalen < sizeof(iref))
664 		return got_error(GOT_ERR_PRIVSEP_LEN);
665 	memcpy(&iref, imsg->data, sizeof(iref));
666 	if (datalen != sizeof(iref) + iref.name_len)
667 		return got_error(GOT_ERR_PRIVSEP_LEN);
668 	refname = strndup(imsg->data + sizeof(iref), iref.name_len);
669 	if (refname == NULL)
670 		return got_error_from_errno("strndup");
671 
672 	log_debug("updating ref %s for uid %d", refname, client->euid);
673 
674 	memcpy(old_id.sha1, iref.old_id, SHA1_DIGEST_LENGTH);
675 	memcpy(new_id.sha1, iref.new_id, SHA1_DIGEST_LENGTH);
676 	err = got_repo_find_object_id(iref.delete_ref ? &old_id : &new_id,
677 	    repo);
678 	if (err)
679 		goto done;
680 
681 	if (iref.ref_is_new) {
682 		err = got_ref_open(&ref, repo, refname, 0);
683 		if (err) {
684 			if (err->code != GOT_ERR_NOT_REF)
685 				goto done;
686 			err = got_ref_alloc(&ref, refname, &new_id);
687 			if (err)
688 				goto done;
689 			err = got_ref_write(ref, repo); /* will lock/unlock */
690 			if (err)
691 				goto done;
692 			err = queue_notification(NULL, &new_id, repo, ref);
693 			if (err)
694 				goto done;
695 		} else {
696 			err = got_ref_resolve(&id, repo, ref);
697 			if (err)
698 				goto done;
699 			got_object_id_hex(&new_id, hex1, sizeof(hex1));
700 			got_object_id_hex(id, hex2, sizeof(hex2));
701 			err = got_error_fmt(GOT_ERR_REF_BUSY,
702 			    "Addition %s: %s failed; %s: %s has been "
703 			    "created by someone else while transaction "
704 			    "was in progress",
705 			    got_ref_get_name(ref), hex1,
706 			    got_ref_get_name(ref), hex2);
707 			goto done;
708 		}
709 	} else if (iref.delete_ref) {
710 		err = got_ref_open(&ref, repo, refname, 1 /* lock */);
711 		if (err)
712 			goto done;
713 		locked = 1;
714 
715 		err = got_ref_resolve(&id, repo, ref);
716 		if (err)
717 			goto done;
718 
719 		if (got_object_id_cmp(id, &old_id) != 0) {
720 			got_object_id_hex(&old_id, hex1, sizeof(hex1));
721 			got_object_id_hex(id, hex2, sizeof(hex2));
722 			err = got_error_fmt(GOT_ERR_REF_BUSY,
723 			    "Deletion %s: %s failed; %s: %s has been "
724 			    "created by someone else while transaction "
725 			    "was in progress",
726 			    got_ref_get_name(ref), hex1,
727 			    got_ref_get_name(ref), hex2);
728 			goto done;
729 		}
730 
731 		err = got_ref_delete(ref, repo);
732 		if (err)
733 			goto done;
734 		err = queue_notification(&old_id, NULL, repo, ref);
735 		if (err)
736 			goto done;
737 		free(id);
738 		id = NULL;
739 	} else {
740 		err = got_ref_open(&ref, repo, refname, 1 /* lock */);
741 		if (err)
742 			goto done;
743 		locked = 1;
744 
745 		err = got_ref_resolve(&id, repo, ref);
746 		if (err)
747 			goto done;
748 
749 		if (got_object_id_cmp(id, &old_id) != 0) {
750 			got_object_id_hex(&old_id, hex1, sizeof(hex1));
751 			got_object_id_hex(id, hex2, sizeof(hex2));
752 			err = got_error_fmt(GOT_ERR_REF_BUSY,
753 			    "Update %s: %s failed; %s: %s has been "
754 			    "created by someone else while transaction "
755 			    "was in progress",
756 			    got_ref_get_name(ref), hex1,
757 			    got_ref_get_name(ref), hex2);
758 			goto done;
759 		}
760 
761 		if (got_object_id_cmp(&new_id, &old_id) != 0) {
762 			err = got_ref_change_ref(ref, &new_id);
763 			if (err)
764 				goto done;
765 			err = got_ref_write(ref, repo);
766 			if (err)
767 				goto done;
768 			err = queue_notification(&old_id, &new_id, repo, ref);
769 			if (err)
770 				goto done;
771 		}
772 
773 		free(id);
774 		id = NULL;
775 	}
776 done:
777 	if (err) {
778 		if (err->code == GOT_ERR_LOCKFILE_TIMEOUT) {
779 			err = got_error_fmt(GOT_ERR_LOCKFILE_TIMEOUT,
780 			    "could not acquire exclusive file lock for %s",
781 			    refname);
782 		}
783 		send_ref_update_ng(client, &iref, refname, err->msg);
784 	} else
785 		send_ref_update_ok(client, &iref, refname);
786 
787 	if (client->nref_updates > 0) {
788 		client->nref_updates--;
789 		if (client->nref_updates == 0) {
790 			send_refs_updated(client);
791 			notif = STAILQ_FIRST(&notifications);
792 			if (notif) {
793 				gotd_session.state = GOTD_STATE_NOTIFY;
794 				err = request_notification(notif);
795 				if (err) {
796 					log_warn("could not send notification: "
797 					    "%s", err->msg);
798 					client->flush_disconnect = 1;
799 				}
800 			} else
801 				client->flush_disconnect = 1;
802 		}
803 
804 	}
805 	if (locked) {
806 		const struct got_error *unlock_err;
807 		unlock_err = got_ref_unlock(ref);
808 		if (unlock_err && err == NULL)
809 			err = unlock_err;
810 	}
811 	if (ref)
812 		got_ref_close(ref);
813 	free(refname);
814 	free(id);
815 	return err;
816 }
817 
818 static const struct got_error *
819 recv_notification_content(struct imsg *imsg)
820 {
821 	struct gotd_imsg_notification_content inotif;
822 	size_t datalen;
823 
824 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
825 	if (datalen < sizeof(inotif))
826 		return got_error(GOT_ERR_PRIVSEP_LEN);
827 	memcpy(&inotif, imsg->data, sizeof(inotif));
828 
829 	return NULL;
830 }
831 
832 static void
833 session_dispatch_repo_child(int fd, short event, void *arg)
834 {
835 	struct gotd_imsgev *iev = arg;
836 	struct imsgbuf *ibuf = &iev->ibuf;
837 	struct gotd_session_client *client = &gotd_session_client;
838 	ssize_t n;
839 	int shut = 0;
840 	struct imsg imsg;
841 
842 	if (event & EV_READ) {
843 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
844 			fatal("imsg_read error");
845 		if (n == 0) {
846 			/* Connection closed. */
847 			shut = 1;
848 			goto done;
849 		}
850 	}
851 
852 	if (event & EV_WRITE) {
853 		n = msgbuf_write(&ibuf->w);
854 		if (n == -1 && errno != EAGAIN)
855 			fatal("msgbuf_write");
856 		if (n == 0) {
857 			/* Connection closed. */
858 			shut = 1;
859 			goto done;
860 		}
861 	}
862 
863 	for (;;) {
864 		const struct got_error *err = NULL;
865 		uint32_t client_id = 0;
866 		int do_disconnect = 0;
867 		int do_ref_updates = 0, do_ref_update = 0;
868 		int do_packfile_install = 0, do_notify = 0;
869 
870 		if ((n = imsg_get(ibuf, &imsg)) == -1)
871 			fatal("%s: imsg_get error", __func__);
872 		if (n == 0)	/* No more messages. */
873 			break;
874 
875 		switch (imsg.hdr.type) {
876 		case GOTD_IMSG_ERROR:
877 			do_disconnect = 1;
878 			err = gotd_imsg_recv_error(&client_id, &imsg);
879 			break;
880 		case GOTD_IMSG_PACKFILE_INSTALL:
881 			err = recv_packfile_install(&imsg);
882 			if (err == NULL)
883 				do_packfile_install = 1;
884 			break;
885 		case GOTD_IMSG_REF_UPDATES_START:
886 			err = recv_ref_updates_start(&imsg);
887 			if (err == NULL)
888 				do_ref_updates = 1;
889 			break;
890 		case GOTD_IMSG_REF_UPDATE:
891 			err = recv_ref_update(&imsg);
892 			if (err == NULL)
893 				do_ref_update = 1;
894 			break;
895 		case GOTD_IMSG_NOTIFY:
896 			err = recv_notification_content(&imsg);
897 			if (err == NULL)
898 				do_notify = 1;
899 			break;
900 		default:
901 			log_debug("unexpected imsg %d", imsg.hdr.type);
902 			break;
903 		}
904 
905 		if (do_disconnect) {
906 			if (err)
907 				disconnect_on_error(client, err);
908 			else
909 				disconnect(client);
910 		} else {
911 			struct gotd_session_notif *notif;
912 
913 			if (do_packfile_install)
914 				err = install_pack(client,
915 				    gotd_session.repo->path, &imsg);
916 			else if (do_ref_updates)
917 				err = begin_ref_updates(client, &imsg);
918 			else if (do_ref_update)
919 				err = update_ref(&shut, client,
920 				    gotd_session.repo->path, &imsg);
921 			else if (do_notify)
922 				err = forward_notification(client, &imsg);
923 			if (err)
924 				log_warnx("uid %d: %s", client->euid, err->msg);
925 
926 			notif = STAILQ_FIRST(&notifications);
927 			if (notif && do_notify) {
928 				/* Request content for next notification. */
929 				err = request_notification(notif);
930 				if (err) {
931 					log_warn("could not send notification: "
932 					    "%s", err->msg);
933 					shut = 1;
934 				}
935 			}
936 		}
937 		imsg_free(&imsg);
938 	}
939 done:
940 	if (!shut) {
941 		gotd_imsg_event_add(iev);
942 	} else {
943 		/* This pipe is dead. Remove its event handler */
944 		event_del(&iev->ev);
945 		event_loopexit(NULL);
946 	}
947 }
948 
949 static const struct got_error *
950 recv_capabilities(struct gotd_session_client *client, struct imsg *imsg)
951 {
952 	struct gotd_imsg_capabilities icapas;
953 	size_t datalen;
954 
955 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
956 	if (datalen != sizeof(icapas))
957 		return got_error(GOT_ERR_PRIVSEP_LEN);
958 	memcpy(&icapas, imsg->data, sizeof(icapas));
959 
960 	client->ncapa_alloc = icapas.ncapabilities;
961 	client->capabilities = calloc(client->ncapa_alloc,
962 	    sizeof(*client->capabilities));
963 	if (client->capabilities == NULL) {
964 		client->ncapa_alloc = 0;
965 		return got_error_from_errno("calloc");
966 	}
967 
968 	log_debug("expecting %zu capabilities from uid %d",
969 	    client->ncapa_alloc, client->euid);
970 	return NULL;
971 }
972 
973 static const struct got_error *
974 recv_capability(struct gotd_session_client *client, struct imsg *imsg)
975 {
976 	struct gotd_imsg_capability icapa;
977 	struct gotd_client_capability *capa;
978 	size_t datalen;
979 	char *key, *value = NULL;
980 
981 	if (client->capabilities == NULL ||
982 	    client->ncapabilities >= client->ncapa_alloc) {
983 		return got_error_msg(GOT_ERR_BAD_REQUEST,
984 		    "unexpected capability received");
985 	}
986 
987 	memset(&icapa, 0, sizeof(icapa));
988 
989 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
990 	if (datalen < sizeof(icapa))
991 		return got_error(GOT_ERR_PRIVSEP_LEN);
992 	memcpy(&icapa, imsg->data, sizeof(icapa));
993 
994 	if (datalen != sizeof(icapa) + icapa.key_len + icapa.value_len)
995 		return got_error(GOT_ERR_PRIVSEP_LEN);
996 
997 	key = strndup(imsg->data + sizeof(icapa), icapa.key_len);
998 	if (key == NULL)
999 		return got_error_from_errno("strndup");
1000 	if (icapa.value_len > 0) {
1001 		value = strndup(imsg->data + sizeof(icapa) + icapa.key_len,
1002 		    icapa.value_len);
1003 		if (value == NULL) {
1004 			free(key);
1005 			return got_error_from_errno("strndup");
1006 		}
1007 	}
1008 
1009 	capa = &client->capabilities[client->ncapabilities++];
1010 	capa->key = key;
1011 	capa->value = value;
1012 
1013 	if (value)
1014 		log_debug("uid %d: capability %s=%s", client->euid, key, value);
1015 	else
1016 		log_debug("uid %d: capability %s", client->euid, key);
1017 
1018 	return NULL;
1019 }
1020 
1021 static const struct got_error *
1022 forward_ref_update(struct gotd_session_client *client, struct imsg *imsg)
1023 {
1024 	const struct got_error *err = NULL;
1025 	struct gotd_imsg_ref_update ireq;
1026 	struct gotd_imsg_ref_update *iref = NULL;
1027 	size_t datalen;
1028 
1029 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1030 	if (datalen < sizeof(ireq))
1031 		return got_error(GOT_ERR_PRIVSEP_LEN);
1032 	memcpy(&ireq, imsg->data, sizeof(ireq));
1033 	if (datalen != sizeof(ireq) + ireq.name_len)
1034 		return got_error(GOT_ERR_PRIVSEP_LEN);
1035 
1036 	iref = malloc(datalen);
1037 	if (iref == NULL)
1038 		return got_error_from_errno("malloc");
1039 	memcpy(iref, imsg->data, datalen);
1040 
1041 	if (gotd_imsg_compose_event(&gotd_session.repo_child_iev,
1042 	    GOTD_IMSG_REF_UPDATE, PROC_SESSION_WRITE, -1,
1043 	    iref, datalen) == -1)
1044 		err = got_error_from_errno("imsg compose REF_UPDATE");
1045 	free(iref);
1046 	return err;
1047 }
1048 
1049 static int
1050 client_has_capability(struct gotd_session_client *client, const char *capastr)
1051 {
1052 	struct gotd_client_capability *capa;
1053 	size_t i;
1054 
1055 	if (client->ncapabilities == 0)
1056 		return 0;
1057 
1058 	for (i = 0; i < client->ncapabilities; i++) {
1059 		capa = &client->capabilities[i];
1060 		if (strcmp(capa->key, capastr) == 0)
1061 			return 1;
1062 	}
1063 
1064 	return 0;
1065 }
1066 
1067 static const struct got_error *
1068 recv_packfile(struct gotd_session_client *client)
1069 {
1070 	const struct got_error *err = NULL;
1071 	struct gotd_imsg_recv_packfile ipack;
1072 	char *basepath = NULL, *pack_path = NULL, *idx_path = NULL;
1073 	int packfd = -1, idxfd = -1;
1074 	int pipe[2] = { -1, -1 };
1075 
1076 	if (client->packfile_path) {
1077 		return got_error_fmt(GOT_ERR_PRIVSEP_MSG,
1078 		    "uid %d already has a pack file", client->euid);
1079 	}
1080 
1081 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
1082 		return got_error_from_errno("socketpair");
1083 
1084 	/* Send pack pipe end 0 to repo child process. */
1085 	if (gotd_imsg_compose_event(&gotd_session.repo_child_iev,
1086 	    GOTD_IMSG_PACKFILE_PIPE, PROC_SESSION_WRITE, pipe[0],
1087 	        NULL, 0) == -1) {
1088 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
1089 		pipe[0] = -1;
1090 		goto done;
1091 	}
1092 	pipe[0] = -1;
1093 
1094 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
1095 	if (gotd_imsg_compose_event(&client->iev,
1096 	    GOTD_IMSG_PACKFILE_PIPE, PROC_SESSION_WRITE, pipe[1],
1097 	    NULL, 0) == -1)
1098 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
1099 	pipe[1] = -1;
1100 
1101 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.pack",
1102 	    got_repo_get_path(gotd_session.repo), GOT_OBJECTS_PACK_DIR,
1103 	    client->euid) == -1) {
1104 		err = got_error_from_errno("asprintf");
1105 		goto done;
1106 	}
1107 
1108 	err = got_opentemp_named_fd(&pack_path, &packfd, basepath, "");
1109 	if (err)
1110 		goto done;
1111 	if (fchmod(packfd, GOT_DEFAULT_PACK_MODE) == -1) {
1112 		err = got_error_from_errno2("fchmod", pack_path);
1113 		goto done;
1114 	}
1115 
1116 	free(basepath);
1117 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.idx",
1118 	    got_repo_get_path(gotd_session.repo), GOT_OBJECTS_PACK_DIR,
1119 	    client->euid) == -1) {
1120 		err = got_error_from_errno("asprintf");
1121 		basepath = NULL;
1122 		goto done;
1123 	}
1124 	err = got_opentemp_named_fd(&idx_path, &idxfd, basepath, "");
1125 	if (err)
1126 		goto done;
1127 	if (fchmod(idxfd, GOT_DEFAULT_PACK_MODE) == -1) {
1128 		err = got_error_from_errno2("fchmod", idx_path);
1129 		goto done;
1130 	}
1131 
1132 	if (gotd_imsg_compose_event(&gotd_session.repo_child_iev,
1133 	    GOTD_IMSG_PACKIDX_FILE, PROC_SESSION_WRITE,
1134 	    idxfd, NULL, 0) == -1) {
1135 		err = got_error_from_errno("imsg compose PACKIDX_FILE");
1136 		idxfd = -1;
1137 		goto done;
1138 	}
1139 	idxfd = -1;
1140 
1141 	memset(&ipack, 0, sizeof(ipack));
1142 	if (client_has_capability(client, GOT_CAPA_REPORT_STATUS))
1143 		ipack.report_status = 1;
1144 
1145 	if (gotd_imsg_compose_event(&gotd_session.repo_child_iev,
1146 	    GOTD_IMSG_RECV_PACKFILE, PROC_SESSION_WRITE, packfd,
1147 	    &ipack, sizeof(ipack)) == -1) {
1148 		err = got_error_from_errno("imsg compose RECV_PACKFILE");
1149 		packfd = -1;
1150 		goto done;
1151 	}
1152 	packfd = -1;
1153 
1154 done:
1155 	free(basepath);
1156 	if (pipe[0] != -1 && close(pipe[0]) == -1 && err == NULL)
1157 		err = got_error_from_errno("close");
1158 	if (pipe[1] != -1 && close(pipe[1]) == -1 && err == NULL)
1159 		err = got_error_from_errno("close");
1160 	if (packfd != -1 && close(packfd) == -1 && err == NULL)
1161 		err = got_error_from_errno("close");
1162 	if (idxfd != -1 && close(idxfd) == -1 && err == NULL)
1163 		err = got_error_from_errno("close");
1164 	if (err) {
1165 		free(pack_path);
1166 		free(idx_path);
1167 	} else {
1168 		client->packfile_path = pack_path;
1169 		client->packidx_path = idx_path;
1170 	}
1171 	return err;
1172 }
1173 
1174 static void
1175 session_dispatch_client(int fd, short events, void *arg)
1176 {
1177 	struct gotd_imsgev *iev = arg;
1178 	struct imsgbuf *ibuf = &iev->ibuf;
1179 	struct gotd_session_client *client = &gotd_session_client;
1180 	const struct got_error *err = NULL;
1181 	struct imsg imsg;
1182 	ssize_t n;
1183 
1184 	if (events & EV_WRITE) {
1185 		while (ibuf->w.queued) {
1186 			n = msgbuf_write(&ibuf->w);
1187 			if (n == -1 && errno == EPIPE) {
1188 				/*
1189 				 * The client has closed its socket.
1190 				 * This can happen when Git clients are
1191 				 * done sending pack file data.
1192 				 */
1193 				msgbuf_clear(&ibuf->w);
1194 				continue;
1195 			} else if (n == -1 && errno != EAGAIN) {
1196 				err = got_error_from_errno("imsg_flush");
1197 				disconnect_on_error(client, err);
1198 				return;
1199 			}
1200 			if (n == 0) {
1201 				/* Connection closed. */
1202 				err = got_error(GOT_ERR_EOF);
1203 				disconnect_on_error(client, err);
1204 				return;
1205 			}
1206 		}
1207 
1208 		if (client->flush_disconnect) {
1209 			disconnect(client);
1210 			return;
1211 		}
1212 	}
1213 
1214 	if ((events & EV_READ) == 0)
1215 		return;
1216 
1217 	memset(&imsg, 0, sizeof(imsg));
1218 
1219 	while (err == NULL) {
1220 		err = gotd_imsg_recv(&imsg, ibuf, 0);
1221 		if (err) {
1222 			if (err->code == GOT_ERR_PRIVSEP_READ)
1223 				err = NULL;
1224 			else if (err->code == GOT_ERR_EOF &&
1225 			    gotd_session.state ==
1226 			    GOTD_STATE_EXPECT_CAPABILITIES) {
1227 				/*
1228 				 * The client has closed its socket before
1229 				 * sending its capability announcement.
1230 				 * This can happen when Git clients have
1231 				 * no ref-updates to send.
1232 				 */
1233 				disconnect_on_error(client, err);
1234 				return;
1235 			}
1236 			break;
1237 		}
1238 
1239 		evtimer_del(&client->tmo);
1240 
1241 		switch (imsg.hdr.type) {
1242 		case GOTD_IMSG_CAPABILITIES:
1243 			if (gotd_session.state !=
1244 			    GOTD_STATE_EXPECT_CAPABILITIES) {
1245 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1246 				    "unexpected capabilities received");
1247 				break;
1248 			}
1249 			log_debug("receiving capabilities from uid %d",
1250 			    client->euid);
1251 			err = recv_capabilities(client, &imsg);
1252 			break;
1253 		case GOTD_IMSG_CAPABILITY:
1254 			if (gotd_session.state != GOTD_STATE_EXPECT_CAPABILITIES) {
1255 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1256 				    "unexpected capability received");
1257 				break;
1258 			}
1259 			err = recv_capability(client, &imsg);
1260 			if (err || client->ncapabilities < client->ncapa_alloc)
1261 				break;
1262 			gotd_session.state = GOTD_STATE_EXPECT_REF_UPDATE;
1263 			client->accept_flush_pkt = 1;
1264 			log_debug("uid %d: expecting ref-update-lines",
1265 			    client->euid);
1266 			break;
1267 		case GOTD_IMSG_REF_UPDATE:
1268 			if (gotd_session.state != GOTD_STATE_EXPECT_REF_UPDATE &&
1269 			    gotd_session.state !=
1270 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1271 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1272 				    "unexpected ref-update-line received");
1273 				break;
1274 			}
1275 			log_debug("received ref-update-line from uid %d",
1276 			    client->euid);
1277 			err = forward_ref_update(client, &imsg);
1278 			if (err)
1279 				break;
1280 			gotd_session.state = GOTD_STATE_EXPECT_MORE_REF_UPDATES;
1281 			client->accept_flush_pkt = 1;
1282 			break;
1283 		case GOTD_IMSG_FLUSH:
1284 			if (gotd_session.state !=
1285 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1286 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1287 				    "unexpected flush-pkt received");
1288 				break;
1289 			}
1290 			if (!client->accept_flush_pkt) {
1291 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1292 				    "unexpected flush-pkt received");
1293 				break;
1294 			}
1295 
1296 			/*
1297 			 * Accept just one flush packet at a time.
1298 			 * Future client state transitions will set this flag
1299 			 * again if another flush packet is expected.
1300 			 */
1301 			client->accept_flush_pkt = 0;
1302 
1303 			log_debug("received flush-pkt from uid %d",
1304 			    client->euid);
1305 			if (gotd_session.state ==
1306 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1307 				gotd_session.state = GOTD_STATE_EXPECT_PACKFILE;
1308 				log_debug("uid %d: expecting packfile",
1309 				    client->euid);
1310 				err = recv_packfile(client);
1311 			} else {
1312 				/* should not happen, see above */
1313 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1314 				    "unexpected client state");
1315 				break;
1316 			}
1317 			break;
1318 		default:
1319 			log_debug("unexpected imsg %d", imsg.hdr.type);
1320 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1321 			break;
1322 		}
1323 
1324 		imsg_free(&imsg);
1325 	}
1326 
1327 	if (err) {
1328 		if (err->code != GOT_ERR_EOF ||
1329 		    gotd_session.state != GOTD_STATE_EXPECT_PACKFILE)
1330 			disconnect_on_error(client, err);
1331 	} else {
1332 		gotd_imsg_event_add(iev);
1333 		evtimer_add(&client->tmo, &gotd_session.request_timeout);
1334 	}
1335 }
1336 
1337 static const struct got_error *
1338 list_refs_request(void)
1339 {
1340 	static const struct got_error *err;
1341 	struct gotd_session_client *client = &gotd_session_client;
1342 	struct gotd_imsgev *iev = &gotd_session.repo_child_iev;
1343 	int fd;
1344 
1345 	if (gotd_session.state != GOTD_STATE_EXPECT_LIST_REFS)
1346 		return got_error(GOT_ERR_PRIVSEP_MSG);
1347 
1348 	fd = dup(client->fd);
1349 	if (fd == -1)
1350 		return got_error_from_errno("dup");
1351 
1352 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_LIST_REFS_INTERNAL,
1353 	    PROC_SESSION_WRITE, fd, NULL, 0) == -1) {
1354 		err = got_error_from_errno("imsg compose LIST_REFS_INTERNAL");
1355 		close(fd);
1356 		return err;
1357 	}
1358 
1359 	gotd_session.state = GOTD_STATE_EXPECT_CAPABILITIES;
1360 	log_debug("uid %d: expecting capabilities", client->euid);
1361 	return NULL;
1362 }
1363 
1364 static const struct got_error *
1365 recv_connect(struct imsg *imsg)
1366 {
1367 	struct gotd_session_client *client = &gotd_session_client;
1368 	struct gotd_imsg_connect iconnect;
1369 	size_t datalen;
1370 
1371 	if (gotd_session.state != GOTD_STATE_EXPECT_LIST_REFS)
1372 		return got_error(GOT_ERR_PRIVSEP_MSG);
1373 
1374 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1375 	if (datalen < sizeof(iconnect))
1376 		return got_error(GOT_ERR_PRIVSEP_LEN);
1377 	memcpy(&iconnect, imsg->data, sizeof(iconnect));
1378 	if (iconnect.username_len == 0 ||
1379 	    datalen != sizeof(iconnect) + iconnect.username_len)
1380 		return got_error(GOT_ERR_PRIVSEP_LEN);
1381 
1382 	client->euid = iconnect.euid;
1383 	client->egid = iconnect.egid;
1384 	client->fd = imsg_get_fd(imsg);
1385 	if (client->fd == -1)
1386 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1387 
1388 	client->username = strndup(imsg->data + sizeof(iconnect),
1389 	    iconnect.username_len);
1390 	if (client->username == NULL)
1391 		return got_error_from_errno("strndup");
1392 
1393 	imsg_init(&client->iev.ibuf, client->fd);
1394 	client->iev.handler = session_dispatch_client;
1395 	client->iev.events = EV_READ;
1396 	client->iev.handler_arg = NULL;
1397 	event_set(&client->iev.ev, client->iev.ibuf.fd, EV_READ,
1398 	    session_dispatch_client, &client->iev);
1399 	gotd_imsg_event_add(&client->iev);
1400 	evtimer_set(&client->tmo, gotd_request_timeout, client);
1401 
1402 	return NULL;
1403 }
1404 
1405 static void
1406 session_dispatch_notifier(int fd, short event, void *arg)
1407 {
1408 	const struct got_error *err;
1409 	struct gotd_session_client *client = &gotd_session_client;
1410 	struct gotd_imsgev *iev = arg;
1411 	struct imsgbuf *ibuf = &iev->ibuf;
1412 	ssize_t n;
1413 	int shut = 0;
1414 	struct imsg imsg;
1415 	struct gotd_session_notif *notif;
1416 
1417 	if (event & EV_READ) {
1418 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1419 			fatal("imsg_read error");
1420 		if (n == 0) {
1421 			/* Connection closed. */
1422 			shut = 1;
1423 			goto done;
1424 		}
1425 	}
1426 
1427 	if (event & EV_WRITE) {
1428 		n = msgbuf_write(&ibuf->w);
1429 		if (n == -1 && errno != EAGAIN)
1430 			fatal("msgbuf_write");
1431 		if (n == 0) {
1432 			/* Connection closed. */
1433 			shut = 1;
1434 			goto done;
1435 		}
1436 	}
1437 
1438 	for (;;) {
1439 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1440 			fatal("%s: imsg_get error", __func__);
1441 		if (n == 0)	/* No more messages. */
1442 			break;
1443 
1444 		switch (imsg.hdr.type) {
1445 		case GOTD_IMSG_NOTIFICATION_SENT:
1446 			if (gotd_session.state != GOTD_STATE_NOTIFY) {
1447 				log_warn("unexpected imsg %d", imsg.hdr.type);
1448 				break;
1449 			}
1450 			notif = STAILQ_FIRST(&notifications);
1451 			if (notif == NULL) {
1452 				disconnect(client);
1453 				break; /* NOTREACHED */
1454 			}
1455 			/* Request content for the next notification. */
1456 			err = request_notification(notif);
1457 			if (err) {
1458 				log_warn("could not send notification: %s",
1459 				    err->msg);
1460 				disconnect(client);
1461 			}
1462 			break;
1463 		default:
1464 			log_debug("unexpected imsg %d", imsg.hdr.type);
1465 			break;
1466 		}
1467 
1468 		imsg_free(&imsg);
1469 	}
1470 done:
1471 	if (!shut) {
1472 		gotd_imsg_event_add(iev);
1473 	} else {
1474 		/* This pipe is dead. Remove its event handler */
1475 		event_del(&iev->ev);
1476 		imsg_clear(&iev->ibuf);
1477 		imsg_init(&iev->ibuf, -1);
1478 	}
1479 }
1480 
1481 static const struct got_error *
1482 recv_notifier(struct imsg *imsg)
1483 {
1484 	struct gotd_imsgev *iev = &gotd_session.notifier_iev;
1485 	struct gotd_session_client *client = &gotd_session_client;
1486 	size_t datalen;
1487 	int fd;
1488 
1489 	if (gotd_session.state != GOTD_STATE_EXPECT_LIST_REFS)
1490 		return got_error(GOT_ERR_PRIVSEP_MSG);
1491 
1492 	/* We should already have received a pipe to the listener. */
1493 	if (client->fd == -1)
1494 		return got_error(GOT_ERR_PRIVSEP_MSG);
1495 
1496 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1497 	if (datalen != 0)
1498 		return got_error(GOT_ERR_PRIVSEP_LEN);
1499 
1500 	fd = imsg_get_fd(imsg);
1501 	if (fd == -1)
1502 		return NULL; /* notifications unused */
1503 
1504 	imsg_init(&iev->ibuf, fd);
1505 	iev->handler = session_dispatch_notifier;
1506 	iev->events = EV_READ;
1507 	iev->handler_arg = NULL;
1508 	event_set(&iev->ev, iev->ibuf.fd, EV_READ,
1509 	    session_dispatch_notifier, iev);
1510 	gotd_imsg_event_add(iev);
1511 
1512 	return NULL;
1513 }
1514 
1515 static const struct got_error *
1516 recv_repo_child(struct imsg *imsg)
1517 {
1518 	struct gotd_imsg_connect_repo_child ichild;
1519 	struct gotd_session_client *client = &gotd_session_client;
1520 	size_t datalen;
1521 	int fd;
1522 
1523 	if (gotd_session.state != GOTD_STATE_EXPECT_LIST_REFS)
1524 		return got_error(GOT_ERR_PRIVSEP_MSG);
1525 
1526 	/* We should already have received a pipe to the listener. */
1527 	if (client->fd == -1)
1528 		return got_error(GOT_ERR_PRIVSEP_MSG);
1529 
1530 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1531 	if (datalen != sizeof(ichild))
1532 		return got_error(GOT_ERR_PRIVSEP_LEN);
1533 
1534 	memcpy(&ichild, imsg->data, sizeof(ichild));
1535 
1536 	if (ichild.proc_id != PROC_REPO_WRITE)
1537 		return got_error_msg(GOT_ERR_PRIVSEP_MSG,
1538 		    "bad child process type");
1539 
1540 	fd = imsg_get_fd(imsg);
1541 	if (fd == -1)
1542 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1543 
1544 	imsg_init(&gotd_session.repo_child_iev.ibuf, fd);
1545 	gotd_session.repo_child_iev.handler = session_dispatch_repo_child;
1546 	gotd_session.repo_child_iev.events = EV_READ;
1547 	gotd_session.repo_child_iev.handler_arg = NULL;
1548 	event_set(&gotd_session.repo_child_iev.ev,
1549 	    gotd_session.repo_child_iev.ibuf.fd, EV_READ,
1550 	    session_dispatch_repo_child, &gotd_session.repo_child_iev);
1551 	gotd_imsg_event_add(&gotd_session.repo_child_iev);
1552 
1553 	/* The "recvfd" pledge promise is no longer needed. */
1554 	if (pledge("stdio rpath wpath cpath sendfd fattr flock", NULL) == -1)
1555 		fatal("pledge");
1556 
1557 	return NULL;
1558 }
1559 
1560 static void
1561 session_dispatch(int fd, short event, void *arg)
1562 {
1563 	struct gotd_imsgev *iev = arg;
1564 	struct imsgbuf *ibuf = &iev->ibuf;
1565 	struct gotd_session_client *client = &gotd_session_client;
1566 	ssize_t n;
1567 	int shut = 0;
1568 	struct imsg imsg;
1569 
1570 	if (event & EV_READ) {
1571 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1572 			fatal("imsg_read error");
1573 		if (n == 0) {
1574 			/* Connection closed. */
1575 			shut = 1;
1576 			goto done;
1577 		}
1578 	}
1579 
1580 	if (event & EV_WRITE) {
1581 		n = msgbuf_write(&ibuf->w);
1582 		if (n == -1 && errno != EAGAIN)
1583 			fatal("msgbuf_write");
1584 		if (n == 0) {
1585 			/* Connection closed. */
1586 			shut = 1;
1587 			goto done;
1588 		}
1589 	}
1590 
1591 	for (;;) {
1592 		const struct got_error *err = NULL;
1593 		uint32_t client_id = 0;
1594 		int do_disconnect = 0, do_list_refs = 0;
1595 
1596 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1597 			fatal("%s: imsg_get error", __func__);
1598 		if (n == 0)	/* No more messages. */
1599 			break;
1600 
1601 		switch (imsg.hdr.type) {
1602 		case GOTD_IMSG_ERROR:
1603 			do_disconnect = 1;
1604 			err = gotd_imsg_recv_error(&client_id, &imsg);
1605 			break;
1606 		case GOTD_IMSG_CONNECT:
1607 			err = recv_connect(&imsg);
1608 			break;
1609 		case GOTD_IMSG_DISCONNECT:
1610 			do_disconnect = 1;
1611 			break;
1612 		case GOTD_IMSG_CONNECT_NOTIFIER:
1613 			err = recv_notifier(&imsg);
1614 			break;
1615 		case GOTD_IMSG_CONNECT_REPO_CHILD:
1616 			err = recv_repo_child(&imsg);
1617 			if (err)
1618 				break;
1619 			do_list_refs = 1;
1620 			break;
1621 		default:
1622 			log_debug("unexpected imsg %d", imsg.hdr.type);
1623 			break;
1624 		}
1625 		imsg_free(&imsg);
1626 
1627 		if (do_disconnect) {
1628 			if (err)
1629 				disconnect_on_error(client, err);
1630 			else
1631 				disconnect(client);
1632 		} else if (do_list_refs)
1633 			err = list_refs_request();
1634 
1635 		if (err)
1636 			log_warnx("uid %d: %s", client->euid, err->msg);
1637 	}
1638 done:
1639 	if (!shut) {
1640 		gotd_imsg_event_add(iev);
1641 	} else {
1642 		/* This pipe is dead. Remove its event handler */
1643 		event_del(&iev->ev);
1644 		event_loopexit(NULL);
1645 	}
1646 }
1647 
1648 void
1649 session_write_main(const char *title, const char *repo_path,
1650     int *pack_fds, int *temp_fds, struct timeval *request_timeout,
1651     struct gotd_repo *repo_cfg)
1652 {
1653 	const struct got_error *err = NULL;
1654 	struct event evsigint, evsigterm, evsighup, evsigusr1;
1655 
1656 	STAILQ_INIT(&notifications);
1657 
1658 	gotd_session.title = title;
1659 	gotd_session.pid = getpid();
1660 	gotd_session.pack_fds = pack_fds;
1661 	gotd_session.temp_fds = temp_fds;
1662 	memcpy(&gotd_session.request_timeout, request_timeout,
1663 	    sizeof(gotd_session.request_timeout));
1664 	gotd_session.repo_cfg = repo_cfg;
1665 
1666 	imsg_init(&gotd_session.notifier_iev.ibuf, -1);
1667 
1668 	err = got_repo_open(&gotd_session.repo, repo_path, NULL, pack_fds);
1669 	if (err)
1670 		goto done;
1671 	if (!got_repo_is_bare(gotd_session.repo)) {
1672 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
1673 		    "bare git repository required");
1674 		goto done;
1675 	}
1676 
1677 	got_repo_temp_fds_set(gotd_session.repo, temp_fds);
1678 
1679 	signal_set(&evsigint, SIGINT, session_write_sighdlr, NULL);
1680 	signal_set(&evsigterm, SIGTERM, session_write_sighdlr, NULL);
1681 	signal_set(&evsighup, SIGHUP, session_write_sighdlr, NULL);
1682 	signal_set(&evsigusr1, SIGUSR1, session_write_sighdlr, NULL);
1683 	signal(SIGPIPE, SIG_IGN);
1684 
1685 	signal_add(&evsigint, NULL);
1686 	signal_add(&evsigterm, NULL);
1687 	signal_add(&evsighup, NULL);
1688 	signal_add(&evsigusr1, NULL);
1689 
1690 	gotd_session.state = GOTD_STATE_EXPECT_LIST_REFS;
1691 
1692 	gotd_session_client.fd = -1;
1693 	gotd_session_client.nref_updates = -1;
1694 	gotd_session_client.delta_cache_fd = -1;
1695 	gotd_session_client.accept_flush_pkt = 1;
1696 
1697 	imsg_init(&gotd_session.parent_iev.ibuf, GOTD_FILENO_MSG_PIPE);
1698 	gotd_session.parent_iev.handler = session_dispatch;
1699 	gotd_session.parent_iev.events = EV_READ;
1700 	gotd_session.parent_iev.handler_arg = NULL;
1701 	event_set(&gotd_session.parent_iev.ev, gotd_session.parent_iev.ibuf.fd,
1702 	    EV_READ, session_dispatch, &gotd_session.parent_iev);
1703 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
1704 	    GOTD_IMSG_CLIENT_SESSION_READY, PROC_SESSION_WRITE,
1705 	    -1, NULL, 0) == -1) {
1706 		err = got_error_from_errno("imsg compose CLIENT_SESSION_READY");
1707 		goto done;
1708 	}
1709 
1710 	event_dispatch();
1711 done:
1712 	if (err)
1713 		log_warnx("%s: %s", title, err->msg);
1714 	session_write_shutdown();
1715 }
1716 
1717 static void
1718 session_write_shutdown(void)
1719 {
1720 	struct gotd_session_notif *notif;
1721 
1722 	log_debug("%s: shutting down", gotd_session.title);
1723 
1724 	while (!STAILQ_EMPTY(&notifications)) {
1725 		notif = STAILQ_FIRST(&notifications);
1726 		STAILQ_REMOVE_HEAD(&notifications, entry);
1727 		if (notif->fd != -1)
1728 			close(notif->fd);
1729 		free(notif->refname);
1730 		free(notif);
1731 	}
1732 
1733 	if (gotd_session.repo)
1734 		got_repo_close(gotd_session.repo);
1735 	got_repo_pack_fds_close(gotd_session.pack_fds);
1736 	got_repo_temp_fds_close(gotd_session.temp_fds);
1737 	free(gotd_session_client.username);
1738 	exit(0);
1739 }