Gotweb

Blob

Date:: Tue Jan 10 14:22:25 2023 UTC
Message:: remove support for showing client capabilities in 'gotctl info' The gotd parent process has lost access to client capabilities. Take the easy way out and remove related code. If needed, client capabilities can still be found in the debug log with 'gotd -v'. ok op, jamsek
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/queue.h>
18 #include <sys/tree.h>
19 #include <sys/time.h>
20 #include <sys/types.h>
21 #include <sys/stat.h>
22 #include <sys/socket.h>
23 #include <sys/un.h>
24 #include <sys/wait.h>
25 
26 #include <fcntl.h>
27 #include <err.h>
28 #include <errno.h>
29 #include <event.h>
30 #include <limits.h>
31 #include <pwd.h>
32 #include <imsg.h>
33 #include <sha1.h>
34 #include <signal.h>
35 #include <siphash.h>
36 #include <stdarg.h>
37 #include <stdio.h>
38 #include <stdlib.h>
39 #include <string.h>
40 #include <syslog.h>
41 #include <unistd.h>
42 
43 #include "got_error.h"
44 #include "got_opentemp.h"
45 #include "got_path.h"
46 #include "got_repository.h"
47 #include "got_object.h"
48 #include "got_reference.h"
49 
50 #include "got_lib_delta.h"
51 #include "got_lib_object.h"
52 #include "got_lib_object_cache.h"
53 #include "got_lib_sha1.h"
54 #include "got_lib_gitproto.h"
55 #include "got_lib_pack.h"
56 #include "got_lib_repository.h"
57 
58 #include "gotd.h"
59 #include "log.h"
60 #include "listen.h"
61 #include "auth.h"
62 #include "session.h"
63 #include "repo_read.h"
64 #include "repo_write.h"
65 
66 #ifndef nitems
67 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
68 #endif
69 
70 struct gotd_client {
71 	STAILQ_ENTRY(gotd_client)	 entry;
72 	enum gotd_client_state		 state;
73 	uint32_t			 id;
74 	int				 fd;
75 	struct gotd_imsgev		 iev;
76 	struct event			 tmo;
77 	uid_t				 euid;
78 	gid_t				 egid;
79 	struct gotd_child_proc		*repo_read;
80 	struct gotd_child_proc		*repo_write;
81 	struct gotd_child_proc		*auth;
82 	struct gotd_child_proc		*session;
83 	int				 required_auth;
84 };
85 STAILQ_HEAD(gotd_clients, gotd_client);
86 
87 static struct gotd_clients gotd_clients[GOTD_CLIENT_TABLE_SIZE];
88 static SIPHASH_KEY clients_hash_key;
89 volatile int client_cnt;
90 static struct timeval auth_timeout = { 5, 0 };
91 static struct gotd gotd;
92 
93 void gotd_sighdlr(int sig, short event, void *arg);
94 static void gotd_shutdown(void);
95 static const struct got_error *start_session_child(struct gotd_client *,
96     struct gotd_repo *, char *, const char *, int, int);
97 static const struct got_error *start_repo_child(struct gotd_client *,
98     enum gotd_procid, struct gotd_repo *, char *, const char *, int, int);
99 static const struct got_error *start_auth_child(struct gotd_client *, int,
100     struct gotd_repo *, char *, const char *, int, int);
101 static void kill_proc(struct gotd_child_proc *, int);
102 
103 __dead static void
104 usage()
105 {
106 	fprintf(stderr, "usage: %s [-dv] [-f config-file]\n", getprogname());
107 	exit(1);
108 }
109 
110 static int
111 unix_socket_listen(const char *unix_socket_path, uid_t uid, gid_t gid)
112 {
113 	struct sockaddr_un sun;
114 	int fd = -1;
115 	mode_t old_umask, mode;
116 
117 	fd = socket(AF_UNIX, SOCK_STREAM | SOCK_NONBLOCK| SOCK_CLOEXEC, 0);
118 	if (fd == -1) {
119 		log_warn("socket");
120 		return -1;
121 	}
122 
123 	sun.sun_family = AF_UNIX;
124 	if (strlcpy(sun.sun_path, unix_socket_path,
125 	    sizeof(sun.sun_path)) >= sizeof(sun.sun_path)) {
126 		log_warnx("%s: name too long", unix_socket_path);
127 		close(fd);
128 		return -1;
129 	}
130 
131 	if (unlink(unix_socket_path) == -1) {
132 		if (errno != ENOENT) {
133 			log_warn("unlink %s", unix_socket_path);
134 			close(fd);
135 			return -1;
136 		}
137 	}
138 
139 	old_umask = umask(S_IXUSR|S_IXGRP|S_IWOTH|S_IROTH|S_IXOTH);
140 	mode = S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH;
141 
142 	if (bind(fd, (struct sockaddr *)&sun, sizeof(sun)) == -1) {
143 		log_warn("bind: %s", unix_socket_path);
144 		close(fd);
145 		umask(old_umask);
146 		return -1;
147 	}
148 
149 	umask(old_umask);
150 
151 	if (chmod(unix_socket_path, mode) == -1) {
152 		log_warn("chmod %o %s", mode, unix_socket_path);
153 		close(fd);
154 		unlink(unix_socket_path);
155 		return -1;
156 	}
157 
158 	if (chown(unix_socket_path, uid, gid) == -1) {
159 		log_warn("chown %s uid=%d gid=%d", unix_socket_path, uid, gid);
160 		close(fd);
161 		unlink(unix_socket_path);
162 		return -1;
163 	}
164 
165 	if (listen(fd, GOTD_UNIX_SOCKET_BACKLOG) == -1) {
166 		log_warn("listen");
167 		close(fd);
168 		unlink(unix_socket_path);
169 		return -1;
170 	}
171 
172 	return fd;
173 }
174 
175 static uint64_t
176 client_hash(uint32_t client_id)
177 {
178 	return SipHash24(&clients_hash_key, &client_id, sizeof(client_id));
179 }
180 
181 static void
182 add_client(struct gotd_client *client)
183 {
184 	uint64_t slot = client_hash(client->id) % nitems(gotd_clients);
185 	STAILQ_INSERT_HEAD(&gotd_clients[slot], client, entry);
186 	client_cnt++;
187 }
188 
189 static struct gotd_client *
190 find_client(uint32_t client_id)
191 {
192 	uint64_t slot;
193 	struct gotd_client *c;
194 
195 	slot = client_hash(client_id) % nitems(gotd_clients);
196 	STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
197 		if (c->id == client_id)
198 			return c;
199 	}
200 
201 	return NULL;
202 }
203 
204 static struct gotd_child_proc *
205 get_client_repo_proc(struct gotd_client *client)
206 {
207 	if (client->repo_read && client->repo_write) {
208 		fatalx("uid %d is reading and writing in the same session",
209 		    client->euid);
210 		/* NOTREACHED */
211 	}
212 
213 	if (client->repo_read)
214 		return client->repo_read;
215 	else if (client->repo_write)
216 		return client->repo_write;
217 
218 	return NULL;
219 }
220 
221 static struct gotd_client *
222 find_client_by_proc_fd(int fd)
223 {
224 	uint64_t slot;
225 
226 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
227 		struct gotd_client *c;
228 
229 		STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
230 			struct gotd_child_proc *proc = get_client_repo_proc(c);
231 			if (proc && proc->iev.ibuf.fd == fd)
232 				return c;
233 			if (c->auth && c->auth->iev.ibuf.fd == fd)
234 				return c;
235 			if (c->session && c->session->iev.ibuf.fd == fd)
236 				return c;
237 		}
238 	}
239 
240 	return NULL;
241 }
242 
243 static int
244 client_is_reading(struct gotd_client *client)
245 {
246 	return client->repo_read != NULL;
247 }
248 
249 static int
250 client_is_writing(struct gotd_client *client)
251 {
252 	return client->repo_write != NULL;
253 }
254 
255 static const struct got_error *
256 ensure_client_is_not_writing(struct gotd_client *client)
257 {
258 	if (client_is_writing(client)) {
259 		return got_error_fmt(GOT_ERR_BAD_PACKET,
260 		    "uid %d made a read-request but is writing to "
261 		    "a repository", client->euid);
262 	}
263 
264 	return NULL;
265 }
266 
267 static const struct got_error *
268 ensure_client_is_not_reading(struct gotd_client *client)
269 {
270 	if (client_is_reading(client)) {
271 		return got_error_fmt(GOT_ERR_BAD_PACKET,
272 		    "uid %d made a write-request but is reading from "
273 		    "a repository", client->euid);
274 	}
275 
276 	return NULL;
277 }
278 
279 static void
280 wait_for_child(pid_t child_pid)
281 {
282 	pid_t pid;
283 	int status;
284 
285 	log_debug("waiting for child PID %ld to terminate",
286 	    (long)child_pid);
287 
288 	do {
289 		pid = waitpid(child_pid, &status, WNOHANG);
290 		if (pid == -1) {
291 			if (errno != EINTR && errno != ECHILD)
292 				fatal("wait");
293 		} else if (WIFSIGNALED(status)) {
294 			log_warnx("child PID %ld terminated; signal %d",
295 			    (long)pid, WTERMSIG(status));
296 		}
297 	} while (pid != -1 || (pid == -1 && errno == EINTR));
298 }
299 
300 static void
301 proc_done(struct gotd_child_proc *proc)
302 {
303 	event_del(&proc->iev.ev);
304 	msgbuf_clear(&proc->iev.ibuf.w);
305 	close(proc->iev.ibuf.fd);
306 	kill_proc(proc, 0);
307 	wait_for_child(proc->pid);
308 	free(proc);
309 }
310 
311 static void
312 kill_auth_proc(struct gotd_client *client)
313 {
314 	struct gotd_child_proc *proc;
315 
316 	if (client->auth == NULL)
317 		return;
318 
319 	proc = client->auth;
320 	client->auth = NULL;
321 
322 	proc_done(proc);
323 }
324 
325 static void
326 kill_session_proc(struct gotd_client *client)
327 {
328 	struct gotd_child_proc *proc;
329 
330 	if (client->session == NULL)
331 		return;
332 
333 	proc = client->session;
334 	client->session = NULL;
335 
336 	proc_done(proc);
337 }
338 
339 static void
340 disconnect(struct gotd_client *client)
341 {
342 	struct gotd_imsg_disconnect idisconnect;
343 	struct gotd_child_proc *proc = get_client_repo_proc(client);
344 	struct gotd_child_proc *listen_proc = &gotd.listen_proc;
345 	uint64_t slot;
346 
347 	log_debug("uid %d: disconnecting", client->euid);
348 
349 	kill_auth_proc(client);
350 	kill_session_proc(client);
351 
352 	idisconnect.client_id = client->id;
353 	if (proc) {
354 		if (gotd_imsg_compose_event(&proc->iev,
355 		    GOTD_IMSG_DISCONNECT, PROC_GOTD, -1,
356 		    &idisconnect, sizeof(idisconnect)) == -1)
357 			log_warn("imsg compose DISCONNECT");
358 
359 		msgbuf_clear(&proc->iev.ibuf.w);
360 		close(proc->iev.ibuf.fd);
361 		kill_proc(proc, 0);
362 		wait_for_child(proc->pid);
363 		free(proc);
364 		proc = NULL;
365 	}
366 
367 	if (gotd_imsg_compose_event(&listen_proc->iev,
368 	    GOTD_IMSG_DISCONNECT, PROC_GOTD, -1,
369 	    &idisconnect, sizeof(idisconnect)) == -1)
370 		log_warn("imsg compose DISCONNECT");
371 
372 	slot = client_hash(client->id) % nitems(gotd_clients);
373 	STAILQ_REMOVE(&gotd_clients[slot], client, gotd_client, entry);
374 	imsg_clear(&client->iev.ibuf);
375 	event_del(&client->iev.ev);
376 	evtimer_del(&client->tmo);
377 	if (client->fd != -1)
378 		close(client->fd);
379 	else if (client->iev.ibuf.fd != -1)
380 		close(client->iev.ibuf.fd);
381 	free(client);
382 	client_cnt--;
383 }
384 
385 static void
386 disconnect_on_error(struct gotd_client *client, const struct got_error *err)
387 {
388 	struct imsgbuf ibuf;
389 
390 	log_warnx("uid %d: %s", client->euid, err->msg);
391 	if (err->code != GOT_ERR_EOF && client->fd != -1) {
392 		imsg_init(&ibuf, client->fd);
393 		gotd_imsg_send_error(&ibuf, 0, PROC_GOTD, err);
394 		imsg_clear(&ibuf);
395 	}
396 	disconnect(client);
397 }
398 
399 static const struct got_error *
400 send_repo_info(struct gotd_imsgev *iev, struct gotd_repo *repo)
401 {
402 	const struct got_error *err = NULL;
403 	struct gotd_imsg_info_repo irepo;
404 
405 	memset(&irepo, 0, sizeof(irepo));
406 
407 	if (strlcpy(irepo.repo_name, repo->name, sizeof(irepo.repo_name))
408 	    >= sizeof(irepo.repo_name))
409 		return got_error_msg(GOT_ERR_NO_SPACE, "repo name too long");
410 	if (strlcpy(irepo.repo_path, repo->path, sizeof(irepo.repo_path))
411 	    >= sizeof(irepo.repo_path))
412 		return got_error_msg(GOT_ERR_NO_SPACE, "repo path too long");
413 
414 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_INFO_REPO, PROC_GOTD, -1,
415 	    &irepo, sizeof(irepo)) == -1) {
416 		err = got_error_from_errno("imsg compose INFO_REPO");
417 		if (err)
418 			return err;
419 	}
420 
421 	return NULL;
422 }
423 
424 static const struct got_error *
425 send_client_info(struct gotd_imsgev *iev, struct gotd_client *client)
426 {
427 	const struct got_error *err = NULL;
428 	struct gotd_imsg_info_client iclient;
429 	struct gotd_child_proc *proc;
430 
431 	memset(&iclient, 0, sizeof(iclient));
432 	iclient.euid = client->euid;
433 	iclient.egid = client->egid;
434 
435 	proc = get_client_repo_proc(client);
436 	if (proc) {
437 		if (strlcpy(iclient.repo_name, proc->repo_path,
438 		    sizeof(iclient.repo_name)) >= sizeof(iclient.repo_name)) {
439 			return got_error_msg(GOT_ERR_NO_SPACE,
440 			    "repo name too long");
441 		}
442 		if (client_is_writing(client))
443 			iclient.is_writing = 1;
444 
445 		iclient.repo_child_pid = proc->pid;
446 	}
447 
448 	iclient.state = client->state;
449 	if (client->session)
450 		iclient.session_child_pid = client->session->pid;
451 
452 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_INFO_CLIENT, PROC_GOTD, -1,
453 	    &iclient, sizeof(iclient)) == -1) {
454 		err = got_error_from_errno("imsg compose INFO_CLIENT");
455 		if (err)
456 			return err;
457 	}
458 
459 	return NULL;
460 }
461 
462 static const struct got_error *
463 send_info(struct gotd_client *client)
464 {
465 	const struct got_error *err = NULL;
466 	struct gotd_imsg_info info;
467 	uint64_t slot;
468 	struct gotd_repo *repo;
469 
470 	if (client->euid != 0)
471 		return got_error_set_errno(EPERM, "info");
472 
473 	info.pid = gotd.pid;
474 	info.verbosity = gotd.verbosity;
475 	info.nrepos = gotd.nrepos;
476 	info.nclients = client_cnt - 1;
477 
478 	if (gotd_imsg_compose_event(&client->iev, GOTD_IMSG_INFO, PROC_GOTD, -1,
479 	    &info, sizeof(info)) == -1) {
480 		err = got_error_from_errno("imsg compose INFO");
481 		if (err)
482 			return err;
483 	}
484 
485 	TAILQ_FOREACH(repo, &gotd.repos, entry) {
486 		err = send_repo_info(&client->iev, repo);
487 		if (err)
488 			return err;
489 	}
490 
491 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
492 		struct gotd_client *c;
493 		STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
494 			if (c->id == client->id)
495 				continue;
496 			err = send_client_info(&client->iev, c);
497 			if (err)
498 				return err;
499 		}
500 	}
501 
502 	return NULL;
503 }
504 
505 static const struct got_error *
506 stop_gotd(struct gotd_client *client)
507 {
508 
509 	if (client->euid != 0)
510 		return got_error_set_errno(EPERM, "stop");
511 
512 	gotd_shutdown();
513 	/* NOTREACHED */
514 	return NULL;
515 }
516 
517 static struct gotd_repo *
518 find_repo_by_name(const char *repo_name)
519 {
520 	struct gotd_repo *repo;
521 	size_t namelen;
522 
523 	TAILQ_FOREACH(repo, &gotd.repos, entry) {
524 		namelen = strlen(repo->name);
525 		if (strncmp(repo->name, repo_name, namelen) != 0)
526 			continue;
527 		if (repo_name[namelen] == '\0' ||
528 		    strcmp(&repo_name[namelen], ".git") == 0)
529 			return repo;
530 	}
531 
532 	return NULL;
533 }
534 
535 static const struct got_error *
536 start_client_authentication(struct gotd_client *client, struct imsg *imsg)
537 {
538 	const struct got_error *err;
539 	struct gotd_imsg_list_refs ireq;
540 	struct gotd_repo *repo = NULL;
541 	size_t datalen;
542 
543 	log_debug("list-refs request from uid %d", client->euid);
544 
545 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
546 		return got_error_msg(GOT_ERR_BAD_REQUEST,
547 		    "unexpected list-refs request received");
548 
549 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
550 	if (datalen != sizeof(ireq))
551 		return got_error(GOT_ERR_PRIVSEP_LEN);
552 
553 	memcpy(&ireq, imsg->data, datalen);
554 
555 	if (ireq.client_is_reading) {
556 		err = ensure_client_is_not_writing(client);
557 		if (err)
558 			return err;
559 		repo = find_repo_by_name(ireq.repo_name);
560 		if (repo == NULL)
561 			return got_error(GOT_ERR_NOT_GIT_REPO);
562 		err = start_auth_child(client, GOTD_AUTH_READ, repo,
563 		    gotd.argv0, gotd.confpath, gotd.daemonize,
564 		    gotd.verbosity);
565 		if (err)
566 			return err;
567 	} else {
568 		err = ensure_client_is_not_reading(client);
569 		if (err)
570 			return err;
571 		repo = find_repo_by_name(ireq.repo_name);
572 		if (repo == NULL)
573 			return got_error(GOT_ERR_NOT_GIT_REPO);
574 		err = start_auth_child(client,
575 		    GOTD_AUTH_READ | GOTD_AUTH_WRITE,
576 		    repo, gotd.argv0, gotd.confpath, gotd.daemonize,
577 		    gotd.verbosity);
578 		if (err)
579 			return err;
580 	}
581 
582 	evtimer_add(&client->tmo, &auth_timeout);
583 
584 	/* Flow continues upon authentication successs/failure or timeout. */
585 	return NULL;
586 }
587 
588 static void
589 gotd_request(int fd, short events, void *arg)
590 {
591 	struct gotd_imsgev *iev = arg;
592 	struct imsgbuf *ibuf = &iev->ibuf;
593 	struct gotd_client *client = iev->handler_arg;
594 	const struct got_error *err = NULL;
595 	struct imsg imsg;
596 	ssize_t n;
597 
598 	if (events & EV_WRITE) {
599 		while (ibuf->w.queued) {
600 			n = msgbuf_write(&ibuf->w);
601 			if (n == -1 && errno == EPIPE) {
602 				/*
603 				 * The client has closed its socket.
604 				 * This can happen when Git clients are
605 				 * done sending pack file data.
606 				 */
607 				msgbuf_clear(&ibuf->w);
608 				continue;
609 			} else if (n == -1 && errno != EAGAIN) {
610 				err = got_error_from_errno("imsg_flush");
611 				disconnect_on_error(client, err);
612 				return;
613 			}
614 			if (n == 0) {
615 				/* Connection closed. */
616 				err = got_error(GOT_ERR_EOF);
617 				disconnect_on_error(client, err);
618 				return;
619 			}
620 		}
621 
622 		/* Disconnect gotctl(8) now that messages have been sent. */
623 		if (!client_is_reading(client) && !client_is_writing(client)) {
624 			disconnect(client);
625 			return;
626 		}
627 	}
628 
629 	if ((events & EV_READ) == 0)
630 		return;
631 
632 	memset(&imsg, 0, sizeof(imsg));
633 
634 	while (err == NULL) {
635 		err = gotd_imsg_recv(&imsg, ibuf, 0);
636 		if (err) {
637 			if (err->code == GOT_ERR_PRIVSEP_READ)
638 				err = NULL;
639 			break;
640 		}
641 
642 		evtimer_del(&client->tmo);
643 
644 		switch (imsg.hdr.type) {
645 		case GOTD_IMSG_INFO:
646 			err = send_info(client);
647 			break;
648 		case GOTD_IMSG_STOP:
649 			err = stop_gotd(client);
650 			break;
651 		case GOTD_IMSG_LIST_REFS:
652 			err = start_client_authentication(client, &imsg);
653 			break;
654 		default:
655 			log_debug("unexpected imsg %d", imsg.hdr.type);
656 			err = got_error(GOT_ERR_PRIVSEP_MSG);
657 			break;
658 		}
659 
660 		imsg_free(&imsg);
661 	}
662 
663 	if (err) {
664 		if (err->code != GOT_ERR_EOF ||
665 		    client->state != GOTD_STATE_EXPECT_PACKFILE)
666 			disconnect_on_error(client, err);
667 	} else {
668 		gotd_imsg_event_add(&client->iev);
669 	}
670 }
671 
672 static void
673 gotd_auth_timeout(int fd, short events, void *arg)
674 {
675 	struct gotd_client *client = arg;
676 
677 	log_debug("disconnecting uid %d due to authentication timeout",
678 	    client->euid);
679 	disconnect(client);
680 }
681 
682 static const struct got_error *
683 recv_connect(uint32_t *client_id, struct imsg *imsg)
684 {
685 	const struct got_error *err = NULL;
686 	struct gotd_imsg_connect iconnect;
687 	size_t datalen;
688 	int s = -1;
689 	struct gotd_client *client = NULL;
690 
691 	*client_id = 0;
692 
693 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
694 	if (datalen != sizeof(iconnect))
695 		return got_error(GOT_ERR_PRIVSEP_LEN);
696 	memcpy(&iconnect, imsg->data, sizeof(iconnect));
697 
698 	s = imsg->fd;
699 	if (s == -1) {
700 		err = got_error(GOT_ERR_PRIVSEP_NO_FD);
701 		goto done;
702 	}
703 
704 	if (find_client(iconnect.client_id)) {
705 		err = got_error_msg(GOT_ERR_CLIENT_ID, "duplicate client ID");
706 		goto done;
707 	}
708 
709 	client = calloc(1, sizeof(*client));
710 	if (client == NULL) {
711 		err = got_error_from_errno("calloc");
712 		goto done;
713 	}
714 
715 	*client_id = iconnect.client_id;
716 
717 	client->state = GOTD_STATE_EXPECT_LIST_REFS;
718 	client->id = iconnect.client_id;
719 	client->fd = s;
720 	s = -1;
721 	/* The auth process will verify UID/GID for us. */
722 	client->euid = iconnect.euid;
723 	client->egid = iconnect.egid;
724 
725 	imsg_init(&client->iev.ibuf, client->fd);
726 	client->iev.handler = gotd_request;
727 	client->iev.events = EV_READ;
728 	client->iev.handler_arg = client;
729 
730 	event_set(&client->iev.ev, client->fd, EV_READ, gotd_request,
731 	    &client->iev);
732 	gotd_imsg_event_add(&client->iev);
733 
734 	evtimer_set(&client->tmo, gotd_auth_timeout, client);
735 
736 	add_client(client);
737 	log_debug("%s: new client uid %d connected on fd %d", __func__,
738 	    client->euid, client->fd);
739 done:
740 	if (err) {
741 		struct gotd_child_proc *listen_proc = &gotd.listen_proc;
742 		struct gotd_imsg_disconnect idisconnect;
743 
744 		idisconnect.client_id = client->id;
745 		if (gotd_imsg_compose_event(&listen_proc->iev,
746 		    GOTD_IMSG_DISCONNECT, PROC_GOTD, -1,
747 		    &idisconnect, sizeof(idisconnect)) == -1)
748 			log_warn("imsg compose DISCONNECT");
749 
750 		if (s != -1)
751 			close(s);
752 	}
753 
754 	return err;
755 }
756 
757 static const char *gotd_proc_names[PROC_MAX] = {
758 	"parent",
759 	"listen",
760 	"auth",
761 	"session",
762 	"repo_read",
763 	"repo_write"
764 };
765 
766 static void
767 kill_proc(struct gotd_child_proc *proc, int fatal)
768 {
769 	if (fatal) {
770 		log_warnx("sending SIGKILL to PID %d", proc->pid);
771 		kill(proc->pid, SIGKILL);
772 	} else
773 		kill(proc->pid, SIGTERM);
774 }
775 
776 static void
777 gotd_shutdown(void)
778 {
779 	struct gotd_child_proc *proc;
780 	uint64_t slot;
781 
782 	log_debug("shutting down");
783 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
784 		struct gotd_client *c, *tmp;
785 
786 		STAILQ_FOREACH_SAFE(c, &gotd_clients[slot], entry, tmp)
787 			disconnect(c);
788 	}
789 
790 	proc = &gotd.listen_proc;
791 	msgbuf_clear(&proc->iev.ibuf.w);
792 	close(proc->iev.ibuf.fd);
793 	kill_proc(proc, 0);
794 	wait_for_child(proc->pid);
795 
796 	log_info("terminating");
797 	exit(0);
798 }
799 
800 void
801 gotd_sighdlr(int sig, short event, void *arg)
802 {
803 	/*
804 	 * Normal signal handler rules don't apply because libevent
805 	 * decouples for us.
806 	 */
807 
808 	switch (sig) {
809 	case SIGHUP:
810 		log_info("%s: ignoring SIGHUP", __func__);
811 		break;
812 	case SIGUSR1:
813 		log_info("%s: ignoring SIGUSR1", __func__);
814 		break;
815 	case SIGTERM:
816 	case SIGINT:
817 		gotd_shutdown();
818 		break;
819 	default:
820 		fatalx("unexpected signal");
821 	}
822 }
823 
824 static const struct got_error *
825 ensure_proc_is_reading(struct gotd_client *client,
826     struct gotd_child_proc *proc)
827 {
828 	if (!client_is_reading(client)) {
829 		kill_proc(proc, 1);
830 		return got_error_fmt(GOT_ERR_BAD_PACKET,
831 		    "PID %d handled a read-request for uid %d but this "
832 		    "user is not reading from a repository", proc->pid,
833 		    client->euid);
834 	}
835 
836 	return NULL;
837 }
838 
839 static const struct got_error *
840 ensure_proc_is_writing(struct gotd_client *client,
841     struct gotd_child_proc *proc)
842 {
843 	if (!client_is_writing(client)) {
844 		kill_proc(proc, 1);
845 		return got_error_fmt(GOT_ERR_BAD_PACKET,
846 		    "PID %d handled a write-request for uid %d but this "
847 		    "user is not writing to a repository", proc->pid,
848 		    client->euid);
849 	}
850 
851 	return NULL;
852 }
853 
854 static int
855 verify_imsg_src(struct gotd_client *client, struct gotd_child_proc *proc,
856     struct imsg *imsg)
857 {
858 	const struct got_error *err;
859 	struct gotd_child_proc *client_proc;
860 	int ret = 0;
861 
862 	if (proc->type == PROC_REPO_READ || proc->type == PROC_REPO_WRITE) {
863 		client_proc = get_client_repo_proc(client);
864 		if (client_proc == NULL)
865 			fatalx("no process found for uid %d", client->euid);
866 		if (proc->pid != client_proc->pid) {
867 			kill_proc(proc, 1);
868 			log_warnx("received message from PID %d for uid %d, "
869 			    "while PID %d is the process serving this user",
870 			    proc->pid, client->euid, client_proc->pid);
871 			return 0;
872 		}
873 	}
874 	if (proc->type == PROC_SESSION) {
875 		if (client->session == NULL) {
876 			log_warnx("no session found for uid %d", client->euid);
877 			return 0;
878 		}
879 		if (proc->pid != client->session->pid) {
880 			kill_proc(proc, 1);
881 			log_warnx("received message from PID %d for uid %d, "
882 			    "while PID %d is the process serving this user",
883 			    proc->pid, client->euid, client->session->pid);
884 			return 0;
885 		}
886 	}
887 
888 	switch (imsg->hdr.type) {
889 	case GOTD_IMSG_ERROR:
890 		ret = 1;
891 		break;
892 	case GOTD_IMSG_CONNECT:
893 		if (proc->type != PROC_LISTEN) {
894 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
895 			    "new connection for uid %d from PID %d "
896 			    "which is not the listen process",
897 			    proc->pid, client->euid);
898 		} else
899 			ret = 1;
900 		break;
901 	case GOTD_IMSG_ACCESS_GRANTED:
902 		if (proc->type != PROC_AUTH) {
903 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
904 			    "authentication of uid %d from PID %d "
905 			    "which is not the auth process",
906 			    proc->pid, client->euid);
907 		} else
908 			ret = 1;
909 		break;
910 	case GOTD_IMSG_CLIENT_SESSION_READY:
911 		if (proc->type != PROC_SESSION) {
912 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
913 			    "unexpected \"ready\" signal from PID %d",
914 			    proc->pid);
915 		} else
916 			ret = 1;
917 		break;
918 	case GOTD_IMSG_REPO_CHILD_READY:
919 		if (proc->type != PROC_REPO_READ &&
920 		    proc->type != PROC_REPO_WRITE) {
921 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
922 			    "unexpected \"ready\" signal from PID %d",
923 			    proc->pid);
924 		} else
925 			ret = 1;
926 		break;
927 	case GOTD_IMSG_PACKFILE_DONE:
928 		err = ensure_proc_is_reading(client, proc);
929 		if (err)
930 			log_warnx("uid %d: %s", client->euid, err->msg);
931 		else
932 			ret = 1;
933 		break;
934 	case GOTD_IMSG_PACKFILE_INSTALL:
935 	case GOTD_IMSG_REF_UPDATES_START:
936 	case GOTD_IMSG_REF_UPDATE:
937 		err = ensure_proc_is_writing(client, proc);
938 		if (err)
939 			log_warnx("uid %d: %s", client->euid, err->msg);
940 		else
941 			ret = 1;
942 		break;
943 	default:
944 		log_debug("%s: unexpected imsg %d", __func__, imsg->hdr.type);
945 		break;
946 	}
947 
948 	return ret;
949 }
950 
951 static const struct got_error *
952 connect_repo_child(struct gotd_client *client,
953     struct gotd_child_proc *repo_proc)
954 {
955 	static const struct got_error *err;
956 	struct gotd_imsgev *session_iev = &client->session->iev;
957 	struct gotd_imsg_connect_repo_child ireq;
958 	int pipe[2];
959 
960 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
961 		return got_error_msg(GOT_ERR_BAD_REQUEST,
962 		    "unexpected repo child ready signal received");
963 
964 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
965 	    PF_UNSPEC, pipe) == -1)
966 		fatal("socketpair");
967 
968 	memset(&ireq, 0, sizeof(ireq));
969 	ireq.client_id = client->id;
970 	ireq.proc_id = repo_proc->type;
971 
972 	/* Pass repo child pipe to session child process. */
973 	if (gotd_imsg_compose_event(session_iev, GOTD_IMSG_CONNECT_REPO_CHILD,
974 	    PROC_GOTD, pipe[0], &ireq, sizeof(ireq)) == -1) {
975 		err = got_error_from_errno("imsg compose CONNECT_REPO_CHILD");
976 		close(pipe[0]);
977 		close(pipe[1]);
978 		return err;
979 	}
980 
981 	/* Pass session child pipe to repo child process. */
982 	if (gotd_imsg_compose_event(&repo_proc->iev,
983 	    GOTD_IMSG_CONNECT_REPO_CHILD, PROC_GOTD, pipe[1], NULL, 0) == -1) {
984 		err = got_error_from_errno("imsg compose CONNECT_REPO_CHILD");
985 		close(pipe[1]);
986 		return err;
987 	}
988 
989 	return NULL;
990 }
991 
992 static void
993 gotd_dispatch_listener(int fd, short event, void *arg)
994 {
995 	struct gotd_imsgev *iev = arg;
996 	struct imsgbuf *ibuf = &iev->ibuf;
997 	struct gotd_child_proc *proc = &gotd.listen_proc;
998 	ssize_t n;
999 	int shut = 0;
1000 	struct imsg imsg;
1001 
1002 	if (proc->iev.ibuf.fd != fd)
1003 		fatalx("%s: unexpected fd %d", __func__, fd);
1004 
1005 	if (event & EV_READ) {
1006 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1007 			fatal("imsg_read error");
1008 		if (n == 0) {
1009 			/* Connection closed. */
1010 			shut = 1;
1011 			goto done;
1012 		}
1013 	}
1014 
1015 	if (event & EV_WRITE) {
1016 		n = msgbuf_write(&ibuf->w);
1017 		if (n == -1 && errno != EAGAIN)
1018 			fatal("msgbuf_write");
1019 		if (n == 0) {
1020 			/* Connection closed. */
1021 			shut = 1;
1022 			goto done;
1023 		}
1024 	}
1025 
1026 	for (;;) {
1027 		const struct got_error *err = NULL;
1028 		struct gotd_client *client = NULL;
1029 		uint32_t client_id = 0;
1030 		int do_disconnect = 0;
1031 
1032 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1033 			fatal("%s: imsg_get error", __func__);
1034 		if (n == 0)	/* No more messages. */
1035 			break;
1036 
1037 		switch (imsg.hdr.type) {
1038 		case GOTD_IMSG_ERROR:
1039 			do_disconnect = 1;
1040 			err = gotd_imsg_recv_error(&client_id, &imsg);
1041 			break;
1042 		case GOTD_IMSG_CONNECT:
1043 			err = recv_connect(&client_id, &imsg);
1044 			break;
1045 		default:
1046 			log_debug("unexpected imsg %d", imsg.hdr.type);
1047 			break;
1048 		}
1049 
1050 		client = find_client(client_id);
1051 		if (client == NULL) {
1052 			log_warnx("%s: client not found", __func__);
1053 			imsg_free(&imsg);
1054 			continue;
1055 		}
1056 
1057 		if (err)
1058 			log_warnx("uid %d: %s", client->euid, err->msg);
1059 
1060 		if (do_disconnect) {
1061 			if (err)
1062 				disconnect_on_error(client, err);
1063 			else
1064 				disconnect(client);
1065 		}
1066 
1067 		imsg_free(&imsg);
1068 	}
1069 done:
1070 	if (!shut) {
1071 		gotd_imsg_event_add(iev);
1072 	} else {
1073 		/* This pipe is dead. Remove its event handler */
1074 		event_del(&iev->ev);
1075 		event_loopexit(NULL);
1076 	}
1077 }
1078 
1079 static void
1080 gotd_dispatch_auth_child(int fd, short event, void *arg)
1081 {
1082 	const struct got_error *err = NULL;
1083 	struct gotd_imsgev *iev = arg;
1084 	struct imsgbuf *ibuf = &iev->ibuf;
1085 	struct gotd_client *client;
1086 	struct gotd_repo *repo = NULL;
1087 	ssize_t n;
1088 	int shut = 0;
1089 	struct imsg imsg;
1090 	uint32_t client_id = 0;
1091 	int do_disconnect = 0;
1092 
1093 	client = find_client_by_proc_fd(fd);
1094 	if (client == NULL)
1095 		fatalx("cannot find client for fd %d", fd);
1096 
1097 	if (client->auth == NULL)
1098 		fatalx("cannot find auth child process for fd %d", fd);
1099 
1100 	if (event & EV_READ) {
1101 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1102 			fatal("imsg_read error");
1103 		if (n == 0) {
1104 			/* Connection closed. */
1105 			shut = 1;
1106 			goto done;
1107 		}
1108 	}
1109 
1110 	if (event & EV_WRITE) {
1111 		n = msgbuf_write(&ibuf->w);
1112 		if (n == -1 && errno != EAGAIN)
1113 			fatal("msgbuf_write");
1114 		if (n == 0) {
1115 			/* Connection closed. */
1116 			shut = 1;
1117 		}
1118 		goto done;
1119 	}
1120 
1121 	if (client->auth->iev.ibuf.fd != fd)
1122 		fatalx("%s: unexpected fd %d", __func__, fd);
1123 
1124 	if ((n = imsg_get(ibuf, &imsg)) == -1)
1125 		fatal("%s: imsg_get error", __func__);
1126 	if (n == 0)	/* No more messages. */
1127 		return;
1128 
1129 	evtimer_del(&client->tmo);
1130 
1131 	switch (imsg.hdr.type) {
1132 	case GOTD_IMSG_ERROR:
1133 		do_disconnect = 1;
1134 		err = gotd_imsg_recv_error(&client_id, &imsg);
1135 		break;
1136 	case GOTD_IMSG_ACCESS_GRANTED:
1137 		break;
1138 	default:
1139 		do_disconnect = 1;
1140 		log_debug("unexpected imsg %d", imsg.hdr.type);
1141 		break;
1142 	}
1143 
1144 	if (!verify_imsg_src(client, client->auth, &imsg)) {
1145 		do_disconnect = 1;
1146 		log_debug("dropping imsg type %d from PID %d",
1147 		    imsg.hdr.type, client->auth->pid);
1148 	}
1149 	imsg_free(&imsg);
1150 
1151 	if (do_disconnect) {
1152 		if (err)
1153 			disconnect_on_error(client, err);
1154 		else
1155 			disconnect(client);
1156 		goto done;
1157 	}
1158 
1159 	repo = find_repo_by_name(client->auth->repo_name);
1160 	if (repo == NULL) {
1161 		err = got_error(GOT_ERR_NOT_GIT_REPO);
1162 		goto done;
1163 	}
1164 	kill_auth_proc(client);
1165 
1166 	log_info("authenticated uid %d for repository %s\n",
1167 	    client->euid, repo->name);
1168 
1169 	err = start_session_child(client, repo, gotd.argv0,
1170 	    gotd.confpath, gotd.daemonize, gotd.verbosity);
1171 	if (err)
1172 		goto done;
1173 done:
1174 	if (err)
1175 		log_warnx("uid %d: %s", client->euid, err->msg);
1176 
1177 	/* We might have killed the auth process by now. */
1178 	if (client->auth != NULL) {
1179 		if (!shut) {
1180 			gotd_imsg_event_add(iev);
1181 		} else {
1182 			/* This pipe is dead. Remove its event handler */
1183 			event_del(&iev->ev);
1184 		}
1185 	}
1186 }
1187 
1188 static const struct got_error *
1189 connect_session(struct gotd_client *client)
1190 {
1191 	const struct got_error *err = NULL;
1192 	struct gotd_imsg_connect iconnect;
1193 	int s;
1194 
1195 	memset(&iconnect, 0, sizeof(iconnect));
1196 
1197 	s = dup(client->fd);
1198 	if (s == -1)
1199 		return got_error_from_errno("dup");
1200 
1201 	iconnect.client_id = client->id;
1202 	iconnect.euid = client->euid;
1203 	iconnect.egid = client->egid;
1204 
1205 	if (gotd_imsg_compose_event(&client->session->iev, GOTD_IMSG_CONNECT,
1206 	    PROC_GOTD, s, &iconnect, sizeof(iconnect)) == -1) {
1207 		err = got_error_from_errno("imsg compose CONNECT");
1208 		close(s);
1209 		return err;
1210 	}
1211 
1212 	/*
1213 	 * We are no longer interested in messages from this client.
1214 	 * Further client requests will be handled by the session process.
1215 	 */
1216 	msgbuf_clear(&client->iev.ibuf.w);
1217 	imsg_clear(&client->iev.ibuf);
1218 	event_del(&client->iev.ev);
1219 	client->fd = -1; /* will be closed via copy in client->iev.ibuf.fd */
1220 
1221 	return NULL;
1222 }
1223 
1224 static void
1225 gotd_dispatch_client_session(int fd, short event, void *arg)
1226 {
1227 	struct gotd_imsgev *iev = arg;
1228 	struct imsgbuf *ibuf = &iev->ibuf;
1229 	struct gotd_child_proc *proc = NULL;
1230 	struct gotd_client *client = NULL;
1231 	ssize_t n;
1232 	int shut = 0;
1233 	struct imsg imsg;
1234 
1235 	client = find_client_by_proc_fd(fd);
1236 	if (client == NULL)
1237 		fatalx("cannot find client for fd %d", fd);
1238 
1239 	if (event & EV_READ) {
1240 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1241 			fatal("imsg_read error");
1242 		if (n == 0) {
1243 			/* Connection closed. */
1244 			shut = 1;
1245 			goto done;
1246 		}
1247 	}
1248 
1249 	if (event & EV_WRITE) {
1250 		n = msgbuf_write(&ibuf->w);
1251 		if (n == -1 && errno != EAGAIN)
1252 			fatal("msgbuf_write");
1253 		if (n == 0) {
1254 			/* Connection closed. */
1255 			shut = 1;
1256 			goto done;
1257 		}
1258 	}
1259 
1260 	proc = client->session;
1261 	if (proc == NULL)
1262 		fatalx("cannot find session child process for fd %d", fd);
1263 
1264 	for (;;) {
1265 		const struct got_error *err = NULL;
1266 		uint32_t client_id = 0;
1267 		int do_disconnect = 0, do_start_repo_child = 0;
1268 
1269 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1270 			fatal("%s: imsg_get error", __func__);
1271 		if (n == 0)	/* No more messages. */
1272 			break;
1273 
1274 		switch (imsg.hdr.type) {
1275 		case GOTD_IMSG_ERROR:
1276 			do_disconnect = 1;
1277 			err = gotd_imsg_recv_error(&client_id, &imsg);
1278 			break;
1279 		case GOTD_IMSG_CLIENT_SESSION_READY:
1280 			if (client->state != GOTD_STATE_EXPECT_LIST_REFS) {
1281 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1282 				break;
1283 			}
1284 			do_start_repo_child = 1;
1285 			break;
1286 		case GOTD_IMSG_DISCONNECT:
1287 			do_disconnect = 1;
1288 			break;
1289 		default:
1290 			log_debug("unexpected imsg %d", imsg.hdr.type);
1291 			break;
1292 		}
1293 
1294 		if (!verify_imsg_src(client, proc, &imsg)) {
1295 			log_debug("dropping imsg type %d from PID %d",
1296 			    imsg.hdr.type, proc->pid);
1297 			imsg_free(&imsg);
1298 			continue;
1299 		}
1300 		if (err)
1301 			log_warnx("uid %d: %s", client->euid, err->msg);
1302 
1303 		if (do_start_repo_child) {
1304 			struct gotd_repo *repo;
1305 
1306 			repo = find_repo_by_name(client->session->repo_name);
1307 			if (repo != NULL) {
1308 				enum gotd_procid proc_type;
1309 
1310 				if (client->required_auth & GOTD_AUTH_WRITE)
1311 					proc_type = PROC_REPO_WRITE;
1312 				else
1313 					proc_type = PROC_REPO_READ;
1314 
1315 				err = start_repo_child(client, proc_type, repo,
1316 				    gotd.argv0, gotd.confpath, gotd.daemonize,
1317 				    gotd.verbosity);
1318 			} else
1319 				err = got_error(GOT_ERR_NOT_GIT_REPO);
1320 
1321 			if (err) {
1322 				log_warnx("uid %d: %s", client->euid, err->msg);
1323 				do_disconnect = 1;
1324 			}
1325 		}
1326 
1327 		if (do_disconnect) {
1328 			if (err)
1329 				disconnect_on_error(client, err);
1330 			else
1331 				disconnect(client);
1332 		}
1333 
1334 		imsg_free(&imsg);
1335 	}
1336 done:
1337 	if (!shut) {
1338 		gotd_imsg_event_add(iev);
1339 	} else {
1340 		/* This pipe is dead. Remove its event handler */
1341 		event_del(&iev->ev);
1342 		disconnect(client);
1343 	}
1344 }
1345 
1346 static void
1347 gotd_dispatch_repo_child(int fd, short event, void *arg)
1348 {
1349 	struct gotd_imsgev *iev = arg;
1350 	struct imsgbuf *ibuf = &iev->ibuf;
1351 	struct gotd_child_proc *proc = NULL;
1352 	struct gotd_client *client;
1353 	ssize_t n;
1354 	int shut = 0;
1355 	struct imsg imsg;
1356 
1357 	client = find_client_by_proc_fd(fd);
1358 	if (client == NULL)
1359 		fatalx("cannot find client for fd %d", fd);
1360 
1361 	if (event & EV_READ) {
1362 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1363 			fatal("imsg_read error");
1364 		if (n == 0) {
1365 			/* Connection closed. */
1366 			shut = 1;
1367 			goto done;
1368 		}
1369 	}
1370 
1371 	if (event & EV_WRITE) {
1372 		n = msgbuf_write(&ibuf->w);
1373 		if (n == -1 && errno != EAGAIN)
1374 			fatal("msgbuf_write");
1375 		if (n == 0) {
1376 			/* Connection closed. */
1377 			shut = 1;
1378 			goto done;
1379 		}
1380 	}
1381 
1382 	proc = get_client_repo_proc(client);
1383 	if (proc == NULL)
1384 		fatalx("cannot find child process for fd %d", fd);
1385 
1386 	for (;;) {
1387 		const struct got_error *err = NULL;
1388 		uint32_t client_id = 0;
1389 		int do_disconnect = 0;
1390 
1391 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1392 			fatal("%s: imsg_get error", __func__);
1393 		if (n == 0)	/* No more messages. */
1394 			break;
1395 
1396 		switch (imsg.hdr.type) {
1397 		case GOTD_IMSG_ERROR:
1398 			do_disconnect = 1;
1399 			err = gotd_imsg_recv_error(&client_id, &imsg);
1400 			break;
1401 		case GOTD_IMSG_REPO_CHILD_READY:
1402 			err = connect_session(client);
1403 			if (err)
1404 				break;
1405 			err = connect_repo_child(client, proc);
1406 			break;
1407 		default:
1408 			log_debug("unexpected imsg %d", imsg.hdr.type);
1409 			break;
1410 		}
1411 
1412 		if (!verify_imsg_src(client, proc, &imsg)) {
1413 			log_debug("dropping imsg type %d from PID %d",
1414 			    imsg.hdr.type, proc->pid);
1415 			imsg_free(&imsg);
1416 			continue;
1417 		}
1418 		if (err)
1419 			log_warnx("uid %d: %s", client->euid, err->msg);
1420 
1421 		if (do_disconnect) {
1422 			if (err)
1423 				disconnect_on_error(client, err);
1424 			else
1425 				disconnect(client);
1426 		}
1427 
1428 		imsg_free(&imsg);
1429 	}
1430 done:
1431 	if (!shut) {
1432 		gotd_imsg_event_add(iev);
1433 	} else {
1434 		/* This pipe is dead. Remove its event handler */
1435 		event_del(&iev->ev);
1436 		disconnect(client);
1437 	}
1438 }
1439 
1440 static pid_t
1441 start_child(enum gotd_procid proc_id, const char *repo_path,
1442     char *argv0, const char *confpath, int fd, int daemonize, int verbosity)
1443 {
1444 	char	*argv[11];
1445 	int	 argc = 0;
1446 	pid_t	 pid;
1447 
1448 	switch (pid = fork()) {
1449 	case -1:
1450 		fatal("cannot fork");
1451 	case 0:
1452 		break;
1453 	default:
1454 		close(fd);
1455 		return pid;
1456 	}
1457 
1458 	if (fd != GOTD_FILENO_MSG_PIPE) {
1459 		if (dup2(fd, GOTD_FILENO_MSG_PIPE) == -1)
1460 			fatal("cannot setup imsg fd");
1461 	} else if (fcntl(fd, F_SETFD, 0) == -1)
1462 		fatal("cannot setup imsg fd");
1463 
1464 	argv[argc++] = argv0;
1465 	switch (proc_id) {
1466 	case PROC_LISTEN:
1467 		argv[argc++] = (char *)"-L";
1468 		break;
1469 	case PROC_AUTH:
1470 		argv[argc++] = (char *)"-A";
1471 		break;
1472 	case PROC_SESSION:
1473 		argv[argc++] = (char *)"-S";
1474 		break;
1475 	case PROC_REPO_READ:
1476 		argv[argc++] = (char *)"-R";
1477 		break;
1478 	case PROC_REPO_WRITE:
1479 		argv[argc++] = (char *)"-W";
1480 		break;
1481 	default:
1482 		fatalx("invalid process id %d", proc_id);
1483 	}
1484 
1485 	argv[argc++] = (char *)"-f";
1486 	argv[argc++] = (char *)confpath;
1487 
1488 	if (repo_path) {
1489 		argv[argc++] = (char *)"-P";
1490 		argv[argc++] = (char *)repo_path;
1491 	}
1492 
1493 	if (!daemonize)
1494 		argv[argc++] = (char *)"-d";
1495 	if (verbosity > 0)
1496 		argv[argc++] = (char *)"-v";
1497 	if (verbosity > 1)
1498 		argv[argc++] = (char *)"-v";
1499 	argv[argc++] = NULL;
1500 
1501 	execvp(argv0, argv);
1502 	fatal("execvp");
1503 }
1504 
1505 static void
1506 start_listener(char *argv0, const char *confpath, int daemonize, int verbosity)
1507 {
1508 	struct gotd_child_proc *proc = &gotd.listen_proc;
1509 
1510 	proc->type = PROC_LISTEN;
1511 
1512 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1513 	    PF_UNSPEC, proc->pipe) == -1)
1514 		fatal("socketpair");
1515 
1516 	proc->pid = start_child(proc->type, NULL, argv0, confpath,
1517 	    proc->pipe[1], daemonize, verbosity);
1518 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1519 	proc->iev.handler = gotd_dispatch_listener;
1520 	proc->iev.events = EV_READ;
1521 	proc->iev.handler_arg = NULL;
1522 }
1523 
1524 static const struct got_error *
1525 start_session_child(struct gotd_client *client, struct gotd_repo *repo,
1526     char *argv0, const char *confpath, int daemonize, int verbosity)
1527 {
1528 	struct gotd_child_proc *proc;
1529 
1530 	proc = calloc(1, sizeof(*proc));
1531 	if (proc == NULL)
1532 		return got_error_from_errno("calloc");
1533 
1534 	proc->type = PROC_SESSION;
1535 	if (strlcpy(proc->repo_name, repo->name,
1536 	    sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
1537 		fatalx("repository name too long: %s", repo->name);
1538 	log_debug("starting client uid %d session for repository %s",
1539 	    client->euid, repo->name);
1540 	if (strlcpy(proc->repo_path, repo->path, sizeof(proc->repo_path)) >=
1541 	    sizeof(proc->repo_path))
1542 		fatalx("repository path too long: %s", repo->path);
1543 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1544 	    PF_UNSPEC, proc->pipe) == -1)
1545 		fatal("socketpair");
1546 	proc->pid = start_child(proc->type, proc->repo_path, argv0,
1547 	    confpath, proc->pipe[1], daemonize, verbosity);
1548 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1549 	log_debug("proc %s %s is on fd %d",
1550 	    gotd_proc_names[proc->type], proc->repo_path,
1551 	    proc->pipe[0]);
1552 	proc->iev.handler = gotd_dispatch_client_session;
1553 	proc->iev.events = EV_READ;
1554 	proc->iev.handler_arg = NULL;
1555 	event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
1556 	    gotd_dispatch_client_session, &proc->iev);
1557 	gotd_imsg_event_add(&proc->iev);
1558 
1559 	client->session = proc;
1560 	return NULL;
1561 }
1562 
1563 static const struct got_error *
1564 start_repo_child(struct gotd_client *client, enum gotd_procid proc_type,
1565     struct gotd_repo *repo, char *argv0, const char *confpath,
1566     int daemonize, int verbosity)
1567 {
1568 	struct gotd_child_proc *proc;
1569 
1570 	if (proc_type != PROC_REPO_READ && proc_type != PROC_REPO_WRITE)
1571 		return got_error_msg(GOT_ERR_NOT_IMPL, "bad process type");
1572 
1573 	proc = calloc(1, sizeof(*proc));
1574 	if (proc == NULL)
1575 		return got_error_from_errno("calloc");
1576 
1577 	proc->type = proc_type;
1578 	if (strlcpy(proc->repo_name, repo->name,
1579 	    sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
1580 		fatalx("repository name too long: %s", repo->name);
1581 	log_debug("starting %s for repository %s",
1582 	    proc->type == PROC_REPO_READ ? "reader" : "writer", repo->name);
1583 	if (strlcpy(proc->repo_path, repo->path, sizeof(proc->repo_path)) >=
1584 	    sizeof(proc->repo_path))
1585 		fatalx("repository path too long: %s", repo->path);
1586 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1587 	    PF_UNSPEC, proc->pipe) == -1)
1588 		fatal("socketpair");
1589 	proc->pid = start_child(proc->type, proc->repo_path, argv0,
1590 	    confpath, proc->pipe[1], daemonize, verbosity);
1591 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1592 	log_debug("proc %s %s is on fd %d",
1593 	    gotd_proc_names[proc->type], proc->repo_path,
1594 	    proc->pipe[0]);
1595 	proc->iev.handler = gotd_dispatch_repo_child;
1596 	proc->iev.events = EV_READ;
1597 	proc->iev.handler_arg = NULL;
1598 	event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
1599 	    gotd_dispatch_repo_child, &proc->iev);
1600 	gotd_imsg_event_add(&proc->iev);
1601 
1602 	if (proc->type == PROC_REPO_READ)
1603 		client->repo_read = proc;
1604 	else
1605 		client->repo_write = proc;
1606 
1607 	return NULL;
1608 }
1609 
1610 static const struct got_error *
1611 start_auth_child(struct gotd_client *client, int required_auth,
1612     struct gotd_repo *repo, char *argv0, const char *confpath,
1613     int daemonize, int verbosity)
1614 {
1615 	const struct got_error *err = NULL;
1616 	struct gotd_child_proc *proc;
1617 	struct gotd_imsg_auth iauth;
1618 	int fd;
1619 
1620 	memset(&iauth, 0, sizeof(iauth));
1621 
1622 	fd = dup(client->fd);
1623 	if (fd == -1)
1624 		return got_error_from_errno("dup");
1625 
1626 	proc = calloc(1, sizeof(*proc));
1627 	if (proc == NULL) {
1628 		err = got_error_from_errno("calloc");
1629 		close(fd);
1630 		return err;
1631 	}
1632 
1633 	proc->type = PROC_AUTH;
1634 	if (strlcpy(proc->repo_name, repo->name,
1635 	    sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
1636 		fatalx("repository name too long: %s", repo->name);
1637 	log_debug("starting auth for uid %d repository %s",
1638 	    client->euid, repo->name);
1639 	if (strlcpy(proc->repo_path, repo->path, sizeof(proc->repo_path)) >=
1640 	    sizeof(proc->repo_path))
1641 		fatalx("repository path too long: %s", repo->path);
1642 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1643 	    PF_UNSPEC, proc->pipe) == -1)
1644 		fatal("socketpair");
1645 	proc->pid = start_child(proc->type, proc->repo_path, argv0,
1646 	    confpath, proc->pipe[1], daemonize, verbosity);
1647 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1648 	log_debug("proc %s %s is on fd %d",
1649 	    gotd_proc_names[proc->type], proc->repo_path,
1650 	    proc->pipe[0]);
1651 	proc->iev.handler = gotd_dispatch_auth_child;
1652 	proc->iev.events = EV_READ;
1653 	proc->iev.handler_arg = NULL;
1654 	event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
1655 	    gotd_dispatch_auth_child, &proc->iev);
1656 	gotd_imsg_event_add(&proc->iev);
1657 
1658 	iauth.euid = client->euid;
1659 	iauth.egid = client->egid;
1660 	iauth.required_auth = required_auth;
1661 	iauth.client_id = client->id;
1662 	if (gotd_imsg_compose_event(&proc->iev, GOTD_IMSG_AUTHENTICATE,
1663 	    PROC_GOTD, fd, &iauth, sizeof(iauth)) == -1) {
1664 		log_warn("imsg compose AUTHENTICATE");
1665 		close(fd);
1666 		/* Let the auth_timeout handler tidy up. */
1667 	}
1668 
1669 	client->auth = proc;
1670 	client->required_auth = required_auth;
1671 	return NULL;
1672 }
1673 
1674 static void
1675 apply_unveil_repo_readonly(const char *repo_path)
1676 {
1677 	if (unveil(repo_path, "r") == -1)
1678 		fatal("unveil %s", repo_path);
1679 
1680 	if (unveil(NULL, NULL) == -1)
1681 		fatal("unveil");
1682 }
1683 
1684 static void
1685 apply_unveil_repo_readwrite(const char *repo_path)
1686 {
1687 	if (unveil(repo_path, "rwc") == -1)
1688 		fatal("unveil %s", repo_path);
1689 
1690 	if (unveil(GOT_TMPDIR_STR, "rwc") == -1)
1691 		fatal("unveil %s", GOT_TMPDIR_STR);
1692 
1693 	if (unveil(NULL, NULL) == -1)
1694 		fatal("unveil");
1695 }
1696 
1697 static void
1698 apply_unveil_none(void)
1699 {
1700 	if (unveil("/", "") == -1)
1701 		fatal("unveil");
1702 
1703 	if (unveil(NULL, NULL) == -1)
1704 		fatal("unveil");
1705 }
1706 
1707 static void
1708 apply_unveil_selfexec(void)
1709 {
1710 	if (unveil(gotd.argv0, "x") == -1)
1711 		fatal("unveil %s", gotd.argv0);
1712 
1713 	if (unveil(NULL, NULL) == -1)
1714 		fatal("unveil");
1715 }
1716 
1717 int
1718 main(int argc, char **argv)
1719 {
1720 	const struct got_error *error = NULL;
1721 	int ch, fd = -1, daemonize = 1, verbosity = 0, noaction = 0;
1722 	const char *confpath = GOTD_CONF_PATH;
1723 	char *argv0 = argv[0];
1724 	char title[2048];
1725 	struct passwd *pw = NULL;
1726 	char *repo_path = NULL;
1727 	enum gotd_procid proc_id = PROC_GOTD;
1728 	struct event evsigint, evsigterm, evsighup, evsigusr1;
1729 	int *pack_fds = NULL, *temp_fds = NULL;
1730 
1731 	log_init(1, LOG_DAEMON); /* Log to stderr until daemonized. */
1732 
1733 	while ((ch = getopt(argc, argv, "Adf:LnP:RSvW")) != -1) {
1734 		switch (ch) {
1735 		case 'A':
1736 			proc_id = PROC_AUTH;
1737 			break;
1738 		case 'd':
1739 			daemonize = 0;
1740 			break;
1741 		case 'f':
1742 			confpath = optarg;
1743 			break;
1744 		case 'L':
1745 			proc_id = PROC_LISTEN;
1746 			break;
1747 		case 'n':
1748 			noaction = 1;
1749 			break;
1750 		case 'P':
1751 			repo_path = realpath(optarg, NULL);
1752 			if (repo_path == NULL)
1753 				fatal("realpath '%s'", optarg);
1754 			break;
1755 		case 'R':
1756 			proc_id = PROC_REPO_READ;
1757 			break;
1758 		case 'S':
1759 			proc_id = PROC_SESSION;
1760 			break;
1761 		case 'v':
1762 			if (verbosity < 3)
1763 				verbosity++;
1764 			break;
1765 		case 'W':
1766 			proc_id = PROC_REPO_WRITE;
1767 			break;
1768 		default:
1769 			usage();
1770 		}
1771 	}
1772 
1773 	argc -= optind;
1774 	argv += optind;
1775 
1776 	if (argc != 0)
1777 		usage();
1778 
1779 	/* Require an absolute path in argv[0] for reliable re-exec. */
1780 	if (!got_path_is_absolute(argv0))
1781 		fatalx("bad path \"%s\": must be an absolute path", argv0);
1782 
1783 	if (geteuid() && (proc_id == PROC_GOTD || proc_id == PROC_LISTEN))
1784 		fatalx("need root privileges");
1785 
1786 	log_init(daemonize ? 0 : 1, LOG_DAEMON);
1787 	log_setverbose(verbosity);
1788 
1789 	if (parse_config(confpath, proc_id, &gotd) != 0)
1790 		return 1;
1791 
1792 	gotd.argv0 = argv0;
1793 	gotd.daemonize = daemonize;
1794 	gotd.verbosity = verbosity;
1795 	gotd.confpath = confpath;
1796 
1797 	if (proc_id == PROC_GOTD &&
1798 	    (gotd.nrepos == 0 || TAILQ_EMPTY(&gotd.repos)))
1799 		fatalx("no repository defined in configuration file");
1800 
1801 	pw = getpwnam(gotd.user_name);
1802 	if (pw == NULL)
1803 		fatalx("user %s not found", gotd.user_name);
1804 
1805 	if (pw->pw_uid == 0) {
1806 		fatalx("cannot run %s as %s: the user running %s "
1807 		    "must not be the superuser",
1808 		    getprogname(), pw->pw_name, getprogname());
1809 	}
1810 
1811 	if (proc_id == PROC_LISTEN &&
1812 	    !got_path_is_absolute(gotd.unix_socket_path))
1813 		fatalx("bad unix socket path \"%s\": must be an absolute path",
1814 		    gotd.unix_socket_path);
1815 
1816 	if (noaction)
1817 		return 0;
1818 
1819 	if (proc_id == PROC_GOTD) {
1820 		gotd.pid = getpid();
1821 		snprintf(title, sizeof(title), "%s", gotd_proc_names[proc_id]);
1822 		start_listener(argv0, confpath, daemonize, verbosity);
1823 		arc4random_buf(&clients_hash_key, sizeof(clients_hash_key));
1824 		if (daemonize && daemon(1, 0) == -1)
1825 			fatal("daemon");
1826 	} else if (proc_id == PROC_LISTEN) {
1827 		snprintf(title, sizeof(title), "%s", gotd_proc_names[proc_id]);
1828 		if (verbosity) {
1829 			log_info("socket: %s", gotd.unix_socket_path);
1830 			log_info("user: %s", pw->pw_name);
1831 		}
1832 
1833 		fd = unix_socket_listen(gotd.unix_socket_path, pw->pw_uid,
1834 		    pw->pw_gid);
1835 		if (fd == -1) {
1836 			fatal("cannot listen on unix socket %s",
1837 			    gotd.unix_socket_path);
1838 		}
1839 		if (daemonize && daemon(0, 0) == -1)
1840 			fatal("daemon");
1841 	} else if (proc_id == PROC_AUTH) {
1842 		snprintf(title, sizeof(title), "%s %s",
1843 		    gotd_proc_names[proc_id], repo_path);
1844 		if (daemonize && daemon(0, 0) == -1)
1845 			fatal("daemon");
1846 	} else if (proc_id == PROC_REPO_READ || proc_id == PROC_REPO_WRITE ||
1847 	    proc_id == PROC_SESSION) {
1848 		error = got_repo_pack_fds_open(&pack_fds);
1849 		if (error != NULL)
1850 			fatalx("cannot open pack tempfiles: %s", error->msg);
1851 		error = got_repo_temp_fds_open(&temp_fds);
1852 		if (error != NULL)
1853 			fatalx("cannot open pack tempfiles: %s", error->msg);
1854 		if (repo_path == NULL)
1855 			fatalx("repository path not specified");
1856 		snprintf(title, sizeof(title), "%s %s",
1857 		    gotd_proc_names[proc_id], repo_path);
1858 		if (daemonize && daemon(0, 0) == -1)
1859 			fatal("daemon");
1860 	} else
1861 		fatal("invalid process id %d", proc_id);
1862 
1863 	setproctitle("%s", title);
1864 	log_procinit(title);
1865 
1866 	/* Drop root privileges. */
1867 	if (setgid(pw->pw_gid) == -1)
1868 		fatal("setgid %d failed", pw->pw_gid);
1869 	if (setuid(pw->pw_uid) == -1)
1870 		fatal("setuid %d failed", pw->pw_uid);
1871 
1872 	event_init();
1873 
1874 	switch (proc_id) {
1875 	case PROC_GOTD:
1876 #ifndef PROFILE
1877 		/* "exec" promise will be limited to argv[0] via unveil(2). */
1878 		if (pledge("stdio proc exec sendfd recvfd unveil", NULL) == -1)
1879 			err(1, "pledge");
1880 #endif
1881 		break;
1882 	case PROC_LISTEN:
1883 #ifndef PROFILE
1884 		if (pledge("stdio sendfd unix unveil", NULL) == -1)
1885 			err(1, "pledge");
1886 #endif
1887 		/*
1888 		 * Ensure that AF_UNIX bind(2) cannot be used with any other
1889 		 * sockets by revoking all filesystem access via unveil(2).
1890 		 */
1891 		apply_unveil_none();
1892 
1893 		listen_main(title, fd, gotd.connection_limits,
1894 		    gotd.nconnection_limits);
1895 		/* NOTREACHED */
1896 		break;
1897 	case PROC_AUTH:
1898 #ifndef PROFILE
1899 		if (pledge("stdio getpw recvfd unix unveil", NULL) == -1)
1900 			err(1, "pledge");
1901 #endif
1902 		/*
1903 		 * We need the "unix" pledge promise for getpeername(2) only.
1904 		 * Ensure that AF_UNIX bind(2) cannot be used by revoking all
1905 		 * filesystem access via unveil(2). Access to password database
1906 		 * files will still work since "getpw" bypasses unveil(2).
1907 		 */
1908 		apply_unveil_none();
1909 
1910 		auth_main(title, &gotd.repos, repo_path);
1911 		/* NOTREACHED */
1912 		break;
1913 	case PROC_SESSION:
1914 #ifndef PROFILE
1915 		/*
1916 		 * The "recvfd" promise is only needed during setup and
1917 		 * will be removed in a later pledge(2) call.
1918 		 */
1919 		if (pledge("stdio rpath wpath cpath recvfd sendfd fattr flock "
1920 		    "unveil", NULL) == -1)
1921 			err(1, "pledge");
1922 #endif
1923 		apply_unveil_repo_readwrite(repo_path);
1924 		session_main(title, repo_path, pack_fds, temp_fds,
1925 		    &gotd.request_timeout);
1926 		/* NOTREACHED */
1927 		break;
1928 	case PROC_REPO_READ:
1929 #ifndef PROFILE
1930 		if (pledge("stdio rpath recvfd unveil", NULL) == -1)
1931 			err(1, "pledge");
1932 #endif
1933 		apply_unveil_repo_readonly(repo_path);
1934 		repo_read_main(title, repo_path, pack_fds, temp_fds);
1935 		/* NOTREACHED */
1936 		exit(0);
1937 	case PROC_REPO_WRITE:
1938 #ifndef PROFILE
1939 		if (pledge("stdio rpath recvfd unveil", NULL) == -1)
1940 			err(1, "pledge");
1941 #endif
1942 		apply_unveil_repo_readonly(repo_path);
1943 		repo_write_main(title, repo_path, pack_fds, temp_fds);
1944 		/* NOTREACHED */
1945 		exit(0);
1946 	default:
1947 		fatal("invalid process id %d", proc_id);
1948 	}
1949 
1950 	if (proc_id != PROC_GOTD)
1951 		fatal("invalid process id %d", proc_id);
1952 
1953 	apply_unveil_selfexec();
1954 
1955 	signal_set(&evsigint, SIGINT, gotd_sighdlr, NULL);
1956 	signal_set(&evsigterm, SIGTERM, gotd_sighdlr, NULL);
1957 	signal_set(&evsighup, SIGHUP, gotd_sighdlr, NULL);
1958 	signal_set(&evsigusr1, SIGUSR1, gotd_sighdlr, NULL);
1959 	signal(SIGPIPE, SIG_IGN);
1960 
1961 	signal_add(&evsigint, NULL);
1962 	signal_add(&evsigterm, NULL);
1963 	signal_add(&evsighup, NULL);
1964 	signal_add(&evsigusr1, NULL);
1965 
1966 	gotd_imsg_event_add(&gotd.listen_proc.iev);
1967 
1968 	event_dispatch();
1969 
1970 	free(repo_path);
1971 	gotd_shutdown();
1972 
1973 	return 0;
1974 }