1 /*
2  * Copyright (c) 2022, 2023 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/queue.h>
19 #include <sys/socket.h>
20 #include <sys/stat.h>
21 #include <sys/uio.h>
22 
23 #include <errno.h>
24 #include <event.h>
25 #include <limits.h>
26 #include <signal.h>
27 #include <stdint.h>
28 #include <stdio.h>
29 #include <stdlib.h>
30 #include <string.h>
31 #include <imsg.h>
32 #include <unistd.h>
33 
34 #include "got_error.h"
35 #include "got_repository.h"
36 #include "got_object.h"
37 #include "got_path.h"
38 #include "got_reference.h"
39 #include "got_opentemp.h"
40 
41 #include "got_lib_hash.h"
42 #include "got_lib_delta.h"
43 #include "got_lib_object.h"
44 #include "got_lib_object_cache.h"
45 #include "got_lib_pack.h"
46 #include "got_lib_repository.h"
47 #include "got_lib_gitproto.h"
48 
49 #include "gotd.h"
50 #include "log.h"
51 #include "session.h"
52 
53 
54 static struct gotd_session {
55 	pid_t pid;
56 	const char *title;
57 	struct got_repository *repo;
58 	int *pack_fds;
59 	int *temp_fds;
60 	struct gotd_imsgev parent_iev;
61 	struct timeval request_timeout;
62 } gotd_session;
63 
64 static struct gotd_session_client {
65 	enum gotd_session_state		 state;
66 	int				 is_writing;
67 	struct gotd_client_capability	*capabilities;
68 	size_t				 ncapa_alloc;
69 	size_t				 ncapabilities;
70 	uint32_t			 id;
71 	int				 fd;
72 	int				 delta_cache_fd;
73 	struct gotd_imsgev		 iev;
74 	struct gotd_imsgev		 repo_child_iev;
75 	struct event			 tmo;
76 	uid_t				 euid;
77 	gid_t				 egid;
78 	char				*packfile_path;
79 	char				*packidx_path;
80 	int				 nref_updates;
81 	int				 accept_flush_pkt;
82 } gotd_session_client;
83 
84 void gotd_session_sighdlr(int sig, short event, void *arg);
85 static void gotd_session_shutdown(void);
86 
87 static void
88 disconnect(struct gotd_session_client *client)
89 {
90 	log_debug("uid %d: disconnecting", client->euid);
91 
92 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
93 	    GOTD_IMSG_DISCONNECT, PROC_SESSION, -1, NULL, 0) == -1)
94 		log_warn("imsg compose DISCONNECT");
95 
96 	imsg_clear(&client->repo_child_iev.ibuf);
97 	event_del(&client->repo_child_iev.ev);
98 	evtimer_del(&client->tmo);
99 	close(client->fd);
100 	if (client->delta_cache_fd != -1)
101 		close(client->delta_cache_fd);
102 	if (client->packfile_path) {
103 		if (unlink(client->packfile_path) == -1 && errno != ENOENT)
104 			log_warn("unlink %s: ", client->packfile_path);
105 		free(client->packfile_path);
106 	}
107 	if (client->packidx_path) {
108 		if (unlink(client->packidx_path) == -1 && errno != ENOENT)
109 			log_warn("unlink %s: ", client->packidx_path);
110 		free(client->packidx_path);
111 	}
112 	free(client->capabilities);
113 
114 	gotd_session_shutdown();
115 }
116 
117 static void
118 disconnect_on_error(struct gotd_session_client *client,
119     const struct got_error *err)
120 {
121 	struct imsgbuf ibuf;
122 
123 	log_warnx("uid %d: %s", client->euid, err->msg);
124 	if (err->code != GOT_ERR_EOF) {
125 		imsg_init(&ibuf, client->fd);
126 		gotd_imsg_send_error(&ibuf, 0, PROC_SESSION, err);
127 		imsg_clear(&ibuf);
128 	}
129 
130 	disconnect(client);
131 }
132 
133 static void
134 gotd_request_timeout(int fd, short events, void *arg)
135 {
136 	struct gotd_session_client *client = arg;
137 
138 	log_debug("disconnecting uid %d due to timeout", client->euid);
139 	disconnect(client);
140 }
141 
142 void
143 gotd_session_sighdlr(int sig, short event, void *arg)
144 {
145 	/*
146 	 * Normal signal handler rules don't apply because libevent
147 	 * decouples for us.
148 	 */
149 
150 	switch (sig) {
151 	case SIGHUP:
152 		log_info("%s: ignoring SIGHUP", __func__);
153 		break;
154 	case SIGUSR1:
155 		log_info("%s: ignoring SIGUSR1", __func__);
156 		break;
157 	case SIGTERM:
158 	case SIGINT:
159 		gotd_session_shutdown();
160 		/* NOTREACHED */
161 		break;
162 	default:
163 		fatalx("unexpected signal");
164 	}
165 }
166 
167 static const struct got_error *
168 recv_packfile_done(uint32_t *client_id, struct imsg *imsg)
169 {
170 	struct gotd_imsg_packfile_done idone;
171 	size_t datalen;
172 
173 	log_debug("packfile-done received");
174 
175 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
176 	if (datalen != sizeof(idone))
177 		return got_error(GOT_ERR_PRIVSEP_LEN);
178 	memcpy(&idone, imsg->data, sizeof(idone));
179 
180 	*client_id = idone.client_id;
181 	return NULL;
182 }
183 
184 static const struct got_error *
185 recv_packfile_install(uint32_t *client_id, struct imsg *imsg)
186 {
187 	struct gotd_imsg_packfile_install inst;
188 	size_t datalen;
189 
190 	log_debug("packfile-install received");
191 
192 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
193 	if (datalen != sizeof(inst))
194 		return got_error(GOT_ERR_PRIVSEP_LEN);
195 	memcpy(&inst, imsg->data, sizeof(inst));
196 
197 	*client_id = inst.client_id;
198 	return NULL;
199 }
200 
201 static const struct got_error *
202 recv_ref_updates_start(uint32_t *client_id, struct imsg *imsg)
203 {
204 	struct gotd_imsg_ref_updates_start istart;
205 	size_t datalen;
206 
207 	log_debug("ref-updates-start received");
208 
209 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
210 	if (datalen != sizeof(istart))
211 		return got_error(GOT_ERR_PRIVSEP_LEN);
212 	memcpy(&istart, imsg->data, sizeof(istart));
213 
214 	*client_id = istart.client_id;
215 	return NULL;
216 }
217 
218 static const struct got_error *
219 recv_ref_update(uint32_t *client_id, struct imsg *imsg)
220 {
221 	struct gotd_imsg_ref_update iref;
222 	size_t datalen;
223 
224 	log_debug("ref-update received");
225 
226 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
227 	if (datalen < sizeof(iref))
228 		return got_error(GOT_ERR_PRIVSEP_LEN);
229 	memcpy(&iref, imsg->data, sizeof(iref));
230 
231 	*client_id = iref.client_id;
232 	return NULL;
233 }
234 
235 static const struct got_error *
236 send_ref_update_ok(struct gotd_session_client *client,
237     struct gotd_imsg_ref_update *iref, const char *refname)
238 {
239 	struct gotd_imsg_ref_update_ok iok;
240 	struct gotd_imsgev *iev = &client->iev;
241 	struct ibuf *wbuf;
242 	size_t len;
243 
244 	memset(&iok, 0, sizeof(iok));
245 	iok.client_id = client->id;
246 	memcpy(iok.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
247 	memcpy(iok.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
248 	iok.name_len = strlen(refname);
249 
250 	len = sizeof(iok) + iok.name_len;
251 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE_OK,
252 	    PROC_SESSION, gotd_session.pid, len);
253 	if (wbuf == NULL)
254 		return got_error_from_errno("imsg_create REF_UPDATE_OK");
255 
256 	if (imsg_add(wbuf, &iok, sizeof(iok)) == -1)
257 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
258 	if (imsg_add(wbuf, refname, iok.name_len) == -1)
259 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
260 
261 	wbuf->fd = -1;
262 	imsg_close(&iev->ibuf, wbuf);
263 	gotd_imsg_event_add(iev);
264 	return NULL;
265 }
266 
267 static void
268 send_refs_updated(struct gotd_session_client *client)
269 {
270 	if (gotd_imsg_compose_event(&client->iev, GOTD_IMSG_REFS_UPDATED,
271 	    PROC_SESSION, -1, NULL, 0) == -1)
272 		log_warn("imsg compose REFS_UPDATED");
273 }
274 
275 static const struct got_error *
276 send_ref_update_ng(struct gotd_session_client *client,
277     struct gotd_imsg_ref_update *iref, const char *refname,
278     const char *reason)
279 {
280 	const struct got_error *ng_err;
281 	struct gotd_imsg_ref_update_ng ing;
282 	struct gotd_imsgev *iev = &client->iev;
283 	struct ibuf *wbuf;
284 	size_t len;
285 
286 	memset(&ing, 0, sizeof(ing));
287 	ing.client_id = client->id;
288 	memcpy(ing.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
289 	memcpy(ing.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
290 	ing.name_len = strlen(refname);
291 
292 	ng_err = got_error_fmt(GOT_ERR_REF_BUSY, "%s", reason);
293 	ing.reason_len = strlen(ng_err->msg);
294 
295 	len = sizeof(ing) + ing.name_len + ing.reason_len;
296 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE_NG,
297 	    PROC_SESSION, gotd_session.pid, len);
298 	if (wbuf == NULL)
299 		return got_error_from_errno("imsg_create REF_UPDATE_NG");
300 
301 	if (imsg_add(wbuf, &ing, sizeof(ing)) == -1)
302 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
303 	if (imsg_add(wbuf, refname, ing.name_len) == -1)
304 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
305 	if (imsg_add(wbuf, ng_err->msg, ing.reason_len) == -1)
306 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
307 
308 	wbuf->fd = -1;
309 	imsg_close(&iev->ibuf, wbuf);
310 	gotd_imsg_event_add(iev);
311 	return NULL;
312 }
313 
314 static const struct got_error *
315 install_pack(struct gotd_session_client *client, const char *repo_path,
316     struct imsg *imsg)
317 {
318 	const struct got_error *err = NULL;
319 	struct gotd_imsg_packfile_install inst;
320 	char hex[SHA1_DIGEST_STRING_LENGTH];
321 	size_t datalen;
322 	char *packfile_path = NULL, *packidx_path = NULL;
323 
324 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
325 	if (datalen != sizeof(inst))
326 		return got_error(GOT_ERR_PRIVSEP_LEN);
327 	memcpy(&inst, imsg->data, sizeof(inst));
328 
329 	if (client->packfile_path == NULL)
330 		return got_error_msg(GOT_ERR_BAD_REQUEST,
331 		    "client has no pack file");
332 	if (client->packidx_path == NULL)
333 		return got_error_msg(GOT_ERR_BAD_REQUEST,
334 		    "client has no pack file index");
335 
336 	if (got_sha1_digest_to_str(inst.pack_sha1, hex, sizeof(hex)) == NULL)
337 		return got_error_msg(GOT_ERR_NO_SPACE,
338 		    "could not convert pack file SHA1 to hex");
339 
340 	if (asprintf(&packfile_path, "/%s/%s/pack-%s.pack",
341 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
342 		err = got_error_from_errno("asprintf");
343 		goto done;
344 	}
345 
346 	if (asprintf(&packidx_path, "/%s/%s/pack-%s.idx",
347 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
348 		err = got_error_from_errno("asprintf");
349 		goto done;
350 	}
351 
352 	if (rename(client->packfile_path, packfile_path) == -1) {
353 		err = got_error_from_errno3("rename", client->packfile_path,
354 		    packfile_path);
355 		goto done;
356 	}
357 
358 	free(client->packfile_path);
359 	client->packfile_path = NULL;
360 
361 	if (rename(client->packidx_path, packidx_path) == -1) {
362 		err = got_error_from_errno3("rename", client->packidx_path,
363 		    packidx_path);
364 		goto done;
365 	}
366 
367 	free(client->packidx_path);
368 	client->packidx_path = NULL;
369 done:
370 	free(packfile_path);
371 	free(packidx_path);
372 	return err;
373 }
374 
375 static const struct got_error *
376 begin_ref_updates(struct gotd_session_client *client, struct imsg *imsg)
377 {
378 	struct gotd_imsg_ref_updates_start istart;
379 	size_t datalen;
380 
381 	if (client->nref_updates != -1)
382 		return got_error(GOT_ERR_PRIVSEP_MSG);
383 
384 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
385 	if (datalen != sizeof(istart))
386 		return got_error(GOT_ERR_PRIVSEP_LEN);
387 	memcpy(&istart, imsg->data, sizeof(istart));
388 
389 	if (istart.nref_updates <= 0)
390 		return got_error(GOT_ERR_PRIVSEP_MSG);
391 
392 	client->nref_updates = istart.nref_updates;
393 	return NULL;
394 }
395 
396 static const struct got_error *
397 update_ref(int *shut, struct gotd_session_client *client,
398     const char *repo_path, struct imsg *imsg)
399 {
400 	const struct got_error *err = NULL;
401 	struct got_repository *repo = NULL;
402 	struct got_reference *ref = NULL;
403 	struct gotd_imsg_ref_update iref;
404 	struct got_object_id old_id, new_id;
405 	struct got_object_id *id = NULL;
406 	struct got_object *obj = NULL;
407 	char *refname = NULL;
408 	size_t datalen;
409 	int locked = 0;
410 
411 	log_debug("update-ref from uid %d", client->euid);
412 
413 	if (client->nref_updates <= 0)
414 		return got_error(GOT_ERR_PRIVSEP_MSG);
415 
416 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
417 	if (datalen < sizeof(iref))
418 		return got_error(GOT_ERR_PRIVSEP_LEN);
419 	memcpy(&iref, imsg->data, sizeof(iref));
420 	if (datalen != sizeof(iref) + iref.name_len)
421 		return got_error(GOT_ERR_PRIVSEP_LEN);
422 	refname = strndup(imsg->data + sizeof(iref), iref.name_len);
423 	if (refname == NULL)
424 		return got_error_from_errno("strndup");
425 
426 	log_debug("updating ref %s for uid %d", refname, client->euid);
427 
428 	err = got_repo_open(&repo, repo_path, NULL, NULL);
429 	if (err)
430 		goto done;
431 
432 	memcpy(old_id.sha1, iref.old_id, SHA1_DIGEST_LENGTH);
433 	memcpy(new_id.sha1, iref.new_id, SHA1_DIGEST_LENGTH);
434 	err = got_object_open(&obj, repo,
435 	    iref.delete_ref ? &old_id : &new_id);
436 	if (err)
437 		goto done;
438 
439 	if (iref.ref_is_new) {
440 		err = got_ref_open(&ref, repo, refname, 0);
441 		if (err) {
442 			if (err->code != GOT_ERR_NOT_REF)
443 				goto done;
444 			err = got_ref_alloc(&ref, refname, &new_id);
445 			if (err)
446 				goto done;
447 			err = got_ref_write(ref, repo); /* will lock/unlock */
448 			if (err)
449 				goto done;
450 		} else {
451 			err = got_error_fmt(GOT_ERR_REF_BUSY,
452 			    "%s has been created by someone else "
453 			    "while transaction was in progress",
454 			    got_ref_get_name(ref));
455 			goto done;
456 		}
457 	} else if (iref.delete_ref) {
458 		err = got_ref_open(&ref, repo, refname, 1 /* lock */);
459 		if (err)
460 			goto done;
461 		locked = 1;
462 
463 		err = got_ref_resolve(&id, repo, ref);
464 		if (err)
465 			goto done;
466 
467 		if (got_object_id_cmp(id, &old_id) != 0) {
468 			err = got_error_fmt(GOT_ERR_REF_BUSY,
469 			    "%s has been modified by someone else "
470 			    "while transaction was in progress",
471 			    got_ref_get_name(ref));
472 			goto done;
473 		}
474 
475 		err = got_ref_delete(ref, repo);
476 		if (err)
477 			goto done;
478 
479 		free(id);
480 		id = NULL;
481 	} else {
482 		err = got_ref_open(&ref, repo, refname, 1 /* lock */);
483 		if (err)
484 			goto done;
485 		locked = 1;
486 
487 		err = got_ref_resolve(&id, repo, ref);
488 		if (err)
489 			goto done;
490 
491 		if (got_object_id_cmp(id, &old_id) != 0) {
492 			err = got_error_fmt(GOT_ERR_REF_BUSY,
493 			    "%s has been modified by someone else "
494 			    "while transaction was in progress",
495 			    got_ref_get_name(ref));
496 			goto done;
497 		}
498 
499 		err = got_ref_change_ref(ref, &new_id);
500 		if (err)
501 			goto done;
502 
503 		err = got_ref_write(ref, repo);
504 		if (err)
505 			goto done;
506 
507 		free(id);
508 		id = NULL;
509 	}
510 done:
511 	if (err) {
512 		if (err->code == GOT_ERR_LOCKFILE_TIMEOUT) {
513 			err = got_error_fmt(GOT_ERR_LOCKFILE_TIMEOUT,
514 			    "could not acquire exclusive file lock for %s",
515 			    refname);
516 		}
517 		send_ref_update_ng(client, &iref, refname, err->msg);
518 	} else
519 		send_ref_update_ok(client, &iref, refname);
520 
521 	if (client->nref_updates > 0) {
522 		client->nref_updates--;
523 		if (client->nref_updates == 0) {
524 			send_refs_updated(client);
525 			*shut = 1;
526 		}
527 
528 	}
529 	if (locked) {
530 		const struct got_error *unlock_err;
531 		unlock_err = got_ref_unlock(ref);
532 		if (unlock_err && err == NULL)
533 			err = unlock_err;
534 	}
535 	if (ref)
536 		got_ref_close(ref);
537 	if (obj)
538 		got_object_close(obj);
539 	if (repo)
540 		got_repo_close(repo);
541 	free(refname);
542 	free(id);
543 	return err;
544 }
545 
546 static void
547 session_dispatch_repo_child(int fd, short event, void *arg)
548 {
549 	struct gotd_imsgev *iev = arg;
550 	struct imsgbuf *ibuf = &iev->ibuf;
551 	struct gotd_session_client *client = &gotd_session_client;
552 	ssize_t n;
553 	int shut = 0;
554 	struct imsg imsg;
555 
556 	if (event & EV_READ) {
557 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
558 			fatal("imsg_read error");
559 		if (n == 0) {
560 			/* Connection closed. */
561 			shut = 1;
562 			goto done;
563 		}
564 	}
565 
566 	if (event & EV_WRITE) {
567 		n = msgbuf_write(&ibuf->w);
568 		if (n == -1 && errno != EAGAIN)
569 			fatal("msgbuf_write");
570 		if (n == 0) {
571 			/* Connection closed. */
572 			shut = 1;
573 			goto done;
574 		}
575 	}
576 
577 	for (;;) {
578 		const struct got_error *err = NULL;
579 		uint32_t client_id = 0;
580 		int do_disconnect = 0;
581 		int do_ref_updates = 0, do_ref_update = 0;
582 		int do_packfile_install = 0;
583 
584 		if ((n = imsg_get(ibuf, &imsg)) == -1)
585 			fatal("%s: imsg_get error", __func__);
586 		if (n == 0)	/* No more messages. */
587 			break;
588 
589 		switch (imsg.hdr.type) {
590 		case GOTD_IMSG_ERROR:
591 			do_disconnect = 1;
592 			err = gotd_imsg_recv_error(&client_id, &imsg);
593 			break;
594 		case GOTD_IMSG_PACKFILE_DONE:
595 			do_disconnect = 1;
596 			err = recv_packfile_done(&client_id, &imsg);
597 			break;
598 		case GOTD_IMSG_PACKFILE_INSTALL:
599 			err = recv_packfile_install(&client_id, &imsg);
600 			if (err == NULL)
601 				do_packfile_install = 1;
602 			break;
603 		case GOTD_IMSG_REF_UPDATES_START:
604 			err = recv_ref_updates_start(&client_id, &imsg);
605 			if (err == NULL)
606 				do_ref_updates = 1;
607 			break;
608 		case GOTD_IMSG_REF_UPDATE:
609 			err = recv_ref_update(&client_id, &imsg);
610 			if (err == NULL)
611 				do_ref_update = 1;
612 			break;
613 		default:
614 			log_debug("unexpected imsg %d", imsg.hdr.type);
615 			break;
616 		}
617 
618 		if (do_disconnect) {
619 			if (err)
620 				disconnect_on_error(client, err);
621 			else
622 				disconnect(client);
623 		} else {
624 			if (do_packfile_install)
625 				err = install_pack(client,
626 				    gotd_session.repo->path, &imsg);
627 			else if (do_ref_updates)
628 				err = begin_ref_updates(client, &imsg);
629 			else if (do_ref_update)
630 				err = update_ref(&shut, client,
631 				    gotd_session.repo->path, &imsg);
632 			if (err)
633 				log_warnx("uid %d: %s", client->euid, err->msg);
634 		}
635 		imsg_free(&imsg);
636 	}
637 done:
638 	if (!shut) {
639 		gotd_imsg_event_add(iev);
640 	} else {
641 		/* This pipe is dead. Remove its event handler */
642 		event_del(&iev->ev);
643 		event_loopexit(NULL);
644 	}
645 }
646 
647 static const struct got_error *
648 recv_capabilities(struct gotd_session_client *client, struct imsg *imsg)
649 {
650 	struct gotd_imsg_capabilities icapas;
651 	size_t datalen;
652 
653 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
654 	if (datalen != sizeof(icapas))
655 		return got_error(GOT_ERR_PRIVSEP_LEN);
656 	memcpy(&icapas, imsg->data, sizeof(icapas));
657 
658 	client->ncapa_alloc = icapas.ncapabilities;
659 	client->capabilities = calloc(client->ncapa_alloc,
660 	    sizeof(*client->capabilities));
661 	if (client->capabilities == NULL) {
662 		client->ncapa_alloc = 0;
663 		return got_error_from_errno("calloc");
664 	}
665 
666 	log_debug("expecting %zu capabilities from uid %d",
667 	    client->ncapa_alloc, client->euid);
668 	return NULL;
669 }
670 
671 static const struct got_error *
672 recv_capability(struct gotd_session_client *client, struct imsg *imsg)
673 {
674 	struct gotd_imsg_capability icapa;
675 	struct gotd_client_capability *capa;
676 	size_t datalen;
677 	char *key, *value = NULL;
678 
679 	if (client->capabilities == NULL ||
680 	    client->ncapabilities >= client->ncapa_alloc) {
681 		return got_error_msg(GOT_ERR_BAD_REQUEST,
682 		    "unexpected capability received");
683 	}
684 
685 	memset(&icapa, 0, sizeof(icapa));
686 
687 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
688 	if (datalen < sizeof(icapa))
689 		return got_error(GOT_ERR_PRIVSEP_LEN);
690 	memcpy(&icapa, imsg->data, sizeof(icapa));
691 
692 	if (datalen != sizeof(icapa) + icapa.key_len + icapa.value_len)
693 		return got_error(GOT_ERR_PRIVSEP_LEN);
694 
695 	key = strndup(imsg->data + sizeof(icapa), icapa.key_len);
696 	if (key == NULL)
697 		return got_error_from_errno("strndup");
698 	if (icapa.value_len > 0) {
699 		value = strndup(imsg->data + sizeof(icapa) + icapa.key_len,
700 		    icapa.value_len);
701 		if (value == NULL) {
702 			free(key);
703 			return got_error_from_errno("strndup");
704 		}
705 	}
706 
707 	capa = &client->capabilities[client->ncapabilities++];
708 	capa->key = key;
709 	capa->value = value;
710 
711 	if (value)
712 		log_debug("uid %d: capability %s=%s", client->euid, key, value);
713 	else
714 		log_debug("uid %d: capability %s", client->euid, key);
715 
716 	return NULL;
717 }
718 
719 static const struct got_error *
720 ensure_client_is_reading(struct gotd_session_client *client)
721 {
722 	if (client->is_writing) {
723 		return got_error_fmt(GOT_ERR_BAD_PACKET,
724 		    "uid %d made a read-request but is not reading from "
725 		    "a repository", client->euid);
726 	}
727 
728 	return NULL;
729 }
730 
731 static const struct got_error *
732 ensure_client_is_writing(struct gotd_session_client *client)
733 {
734 	if (!client->is_writing) {
735 		return got_error_fmt(GOT_ERR_BAD_PACKET,
736 		    "uid %d made a write-request but is not writing to "
737 		    "a repository", client->euid);
738 	}
739 
740 	return NULL;
741 }
742 
743 static const struct got_error *
744 forward_want(struct gotd_session_client *client, struct imsg *imsg)
745 {
746 	struct gotd_imsg_want ireq;
747 	struct gotd_imsg_want iwant;
748 	size_t datalen;
749 
750 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
751 	if (datalen != sizeof(ireq))
752 		return got_error(GOT_ERR_PRIVSEP_LEN);
753 
754 	memcpy(&ireq, imsg->data, datalen);
755 
756 	memset(&iwant, 0, sizeof(iwant));
757 	memcpy(iwant.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
758 	iwant.client_id = client->id;
759 
760 	if (gotd_imsg_compose_event(&client->repo_child_iev, GOTD_IMSG_WANT,
761 	    PROC_SESSION, -1, &iwant, sizeof(iwant)) == -1)
762 		return got_error_from_errno("imsg compose WANT");
763 
764 	return NULL;
765 }
766 
767 static const struct got_error *
768 forward_ref_update(struct gotd_session_client *client, struct imsg *imsg)
769 {
770 	const struct got_error *err = NULL;
771 	struct gotd_imsg_ref_update ireq;
772 	struct gotd_imsg_ref_update *iref = NULL;
773 	size_t datalen;
774 
775 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
776 	if (datalen < sizeof(ireq))
777 		return got_error(GOT_ERR_PRIVSEP_LEN);
778 	memcpy(&ireq, imsg->data, sizeof(ireq));
779 	if (datalen != sizeof(ireq) + ireq.name_len)
780 		return got_error(GOT_ERR_PRIVSEP_LEN);
781 
782 	iref = malloc(datalen);
783 	if (iref == NULL)
784 		return got_error_from_errno("malloc");
785 	memcpy(iref, imsg->data, datalen);
786 
787 	iref->client_id = client->id;
788 	if (gotd_imsg_compose_event(&client->repo_child_iev,
789 	    GOTD_IMSG_REF_UPDATE, PROC_SESSION, -1, iref, datalen) == -1)
790 		err = got_error_from_errno("imsg compose REF_UPDATE");
791 	free(iref);
792 	return err;
793 }
794 
795 static const struct got_error *
796 forward_have(struct gotd_session_client *client, struct imsg *imsg)
797 {
798 	struct gotd_imsg_have ireq;
799 	struct gotd_imsg_have ihave;
800 	size_t datalen;
801 
802 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
803 	if (datalen != sizeof(ireq))
804 		return got_error(GOT_ERR_PRIVSEP_LEN);
805 
806 	memcpy(&ireq, imsg->data, datalen);
807 
808 	memset(&ihave, 0, sizeof(ihave));
809 	memcpy(ihave.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
810 	ihave.client_id = client->id;
811 
812 	if (gotd_imsg_compose_event(&client->repo_child_iev, GOTD_IMSG_HAVE,
813 	    PROC_SESSION, -1, &ihave, sizeof(ihave)) == -1)
814 		return got_error_from_errno("imsg compose HAVE");
815 
816 	return NULL;
817 }
818 
819 static int
820 client_has_capability(struct gotd_session_client *client, const char *capastr)
821 {
822 	struct gotd_client_capability *capa;
823 	size_t i;
824 
825 	if (client->ncapabilities == 0)
826 		return 0;
827 
828 	for (i = 0; i < client->ncapabilities; i++) {
829 		capa = &client->capabilities[i];
830 		if (strcmp(capa->key, capastr) == 0)
831 			return 1;
832 	}
833 
834 	return 0;
835 }
836 
837 static const struct got_error *
838 recv_packfile(struct gotd_session_client *client)
839 {
840 	const struct got_error *err = NULL;
841 	struct gotd_imsg_recv_packfile ipack;
842 	struct gotd_imsg_packfile_pipe ipipe;
843 	struct gotd_imsg_packidx_file ifile;
844 	char *basepath = NULL, *pack_path = NULL, *idx_path = NULL;
845 	int packfd = -1, idxfd = -1;
846 	int pipe[2] = { -1, -1 };
847 
848 	if (client->packfile_path) {
849 		return got_error_fmt(GOT_ERR_PRIVSEP_MSG,
850 		    "uid %d already has a pack file", client->euid);
851 	}
852 
853 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
854 		return got_error_from_errno("socketpair");
855 
856 	memset(&ipipe, 0, sizeof(ipipe));
857 	ipipe.client_id = client->id;
858 
859 	/* Send pack pipe end 0 to repo child process. */
860 	if (gotd_imsg_compose_event(&client->repo_child_iev,
861 	    GOTD_IMSG_PACKFILE_PIPE, PROC_SESSION, pipe[0],
862 	        &ipipe, sizeof(ipipe)) == -1) {
863 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
864 		pipe[0] = -1;
865 		goto done;
866 	}
867 	pipe[0] = -1;
868 
869 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
870 	if (gotd_imsg_compose_event(&client->iev,
871 	    GOTD_IMSG_PACKFILE_PIPE, PROC_SESSION, pipe[1], NULL, 0) == -1)
872 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
873 	pipe[1] = -1;
874 
875 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.pack",
876 	    got_repo_get_path(gotd_session.repo), GOT_OBJECTS_PACK_DIR,
877 	    client->euid) == -1) {
878 		err = got_error_from_errno("asprintf");
879 		goto done;
880 	}
881 
882 	err = got_opentemp_named_fd(&pack_path, &packfd, basepath, "");
883 	if (err)
884 		goto done;
885 	if (fchmod(packfd, GOT_DEFAULT_PACK_MODE) == -1) {
886 		err = got_error_from_errno2("fchmod", pack_path);
887 		goto done;
888 	}
889 
890 	free(basepath);
891 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.idx",
892 	    got_repo_get_path(gotd_session.repo), GOT_OBJECTS_PACK_DIR,
893 	    client->euid) == -1) {
894 		err = got_error_from_errno("asprintf");
895 		basepath = NULL;
896 		goto done;
897 	}
898 	err = got_opentemp_named_fd(&idx_path, &idxfd, basepath, "");
899 	if (err)
900 		goto done;
901 	if (fchmod(idxfd, GOT_DEFAULT_PACK_MODE) == -1) {
902 		err = got_error_from_errno2("fchmod", idx_path);
903 		goto done;
904 	}
905 
906 	memset(&ifile, 0, sizeof(ifile));
907 	ifile.client_id = client->id;
908 	if (gotd_imsg_compose_event(&client->repo_child_iev,
909 	    GOTD_IMSG_PACKIDX_FILE, PROC_SESSION,
910 	    idxfd, &ifile, sizeof(ifile)) == -1) {
911 		err = got_error_from_errno("imsg compose PACKIDX_FILE");
912 		idxfd = -1;
913 		goto done;
914 	}
915 	idxfd = -1;
916 
917 	memset(&ipack, 0, sizeof(ipack));
918 	ipack.client_id = client->id;
919 	if (client_has_capability(client, GOT_CAPA_REPORT_STATUS))
920 		ipack.report_status = 1;
921 
922 	if (gotd_imsg_compose_event(&client->repo_child_iev,
923 	    GOTD_IMSG_RECV_PACKFILE, PROC_SESSION, packfd,
924 	    &ipack, sizeof(ipack)) == -1) {
925 		err = got_error_from_errno("imsg compose RECV_PACKFILE");
926 		packfd = -1;
927 		goto done;
928 	}
929 	packfd = -1;
930 
931 done:
932 	free(basepath);
933 	if (pipe[0] != -1 && close(pipe[0]) == -1 && err == NULL)
934 		err = got_error_from_errno("close");
935 	if (pipe[1] != -1 && close(pipe[1]) == -1 && err == NULL)
936 		err = got_error_from_errno("close");
937 	if (packfd != -1 && close(packfd) == -1 && err == NULL)
938 		err = got_error_from_errno("close");
939 	if (idxfd != -1 && close(idxfd) == -1 && err == NULL)
940 		err = got_error_from_errno("close");
941 	if (err) {
942 		free(pack_path);
943 		free(idx_path);
944 	} else {
945 		client->packfile_path = pack_path;
946 		client->packidx_path = idx_path;
947 	}
948 	return err;
949 }
950 
951 static const struct got_error *
952 send_packfile(struct gotd_session_client *client)
953 {
954 	const struct got_error *err = NULL;
955 	struct gotd_imsg_send_packfile ipack;
956 	struct gotd_imsg_packfile_pipe ipipe;
957 	int pipe[2];
958 
959 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
960 		return got_error_from_errno("socketpair");
961 
962 	memset(&ipack, 0, sizeof(ipack));
963 	memset(&ipipe, 0, sizeof(ipipe));
964 
965 	ipack.client_id = client->id;
966 	if (client_has_capability(client, GOT_CAPA_SIDE_BAND_64K))
967 		ipack.report_progress = 1;
968 
969 	client->delta_cache_fd = got_opentempfd();
970 	if (client->delta_cache_fd == -1)
971 		return got_error_from_errno("got_opentempfd");
972 
973 	if (gotd_imsg_compose_event(&client->repo_child_iev,
974 	    GOTD_IMSG_SEND_PACKFILE, PROC_GOTD, client->delta_cache_fd,
975 	    &ipack, sizeof(ipack)) == -1) {
976 		err = got_error_from_errno("imsg compose SEND_PACKFILE");
977 		close(pipe[0]);
978 		close(pipe[1]);
979 		return err;
980 	}
981 
982 	ipipe.client_id = client->id;
983 
984 	/* Send pack pipe end 0 to repo child process. */
985 	if (gotd_imsg_compose_event(&client->repo_child_iev,
986 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD,
987 	    pipe[0], &ipipe, sizeof(ipipe)) == -1) {
988 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
989 		close(pipe[1]);
990 		return err;
991 	}
992 
993 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
994 	if (gotd_imsg_compose_event(&client->iev,
995 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD, pipe[1], NULL, 0) == -1)
996 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
997 
998 	return err;
999 }
1000 
1001 static void
1002 session_dispatch_client(int fd, short events, void *arg)
1003 {
1004 	struct gotd_imsgev *iev = arg;
1005 	struct imsgbuf *ibuf = &iev->ibuf;
1006 	struct gotd_session_client *client = &gotd_session_client;
1007 	const struct got_error *err = NULL;
1008 	struct imsg imsg;
1009 	ssize_t n;
1010 
1011 	if (events & EV_WRITE) {
1012 		while (ibuf->w.queued) {
1013 			n = msgbuf_write(&ibuf->w);
1014 			if (n == -1 && errno == EPIPE) {
1015 				/*
1016 				 * The client has closed its socket.
1017 				 * This can happen when Git clients are
1018 				 * done sending pack file data.
1019 				 */
1020 				msgbuf_clear(&ibuf->w);
1021 				continue;
1022 			} else if (n == -1 && errno != EAGAIN) {
1023 				err = got_error_from_errno("imsg_flush");
1024 				disconnect_on_error(client, err);
1025 				return;
1026 			}
1027 			if (n == 0) {
1028 				/* Connection closed. */
1029 				err = got_error(GOT_ERR_EOF);
1030 				disconnect_on_error(client, err);
1031 				return;
1032 			}
1033 		}
1034 	}
1035 
1036 	if ((events & EV_READ) == 0)
1037 		return;
1038 
1039 	memset(&imsg, 0, sizeof(imsg));
1040 
1041 	while (err == NULL) {
1042 		err = gotd_imsg_recv(&imsg, ibuf, 0);
1043 		if (err) {
1044 			if (err->code == GOT_ERR_PRIVSEP_READ)
1045 				err = NULL;
1046 			break;
1047 		}
1048 
1049 		evtimer_del(&client->tmo);
1050 
1051 		switch (imsg.hdr.type) {
1052 		case GOTD_IMSG_CAPABILITIES:
1053 			if (client->state != GOTD_STATE_EXPECT_CAPABILITIES) {
1054 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1055 				    "unexpected capabilities received");
1056 				break;
1057 			}
1058 			log_debug("receiving capabilities from uid %d",
1059 			    client->euid);
1060 			err = recv_capabilities(client, &imsg);
1061 			break;
1062 		case GOTD_IMSG_CAPABILITY:
1063 			if (client->state != GOTD_STATE_EXPECT_CAPABILITIES) {
1064 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1065 				    "unexpected capability received");
1066 				break;
1067 			}
1068 			err = recv_capability(client, &imsg);
1069 			if (err || client->ncapabilities < client->ncapa_alloc)
1070 				break;
1071 			if (!client->is_writing) {
1072 				client->state = GOTD_STATE_EXPECT_WANT;
1073 				client->accept_flush_pkt = 1;
1074 				log_debug("uid %d: expecting want-lines",
1075 				    client->euid);
1076 			} else if (client->is_writing) {
1077 				client->state = GOTD_STATE_EXPECT_REF_UPDATE;
1078 				client->accept_flush_pkt = 1;
1079 				log_debug("uid %d: expecting ref-update-lines",
1080 				    client->euid);
1081 			} else
1082 				fatalx("client %d is both reading and writing",
1083 				    client->euid);
1084 			break;
1085 		case GOTD_IMSG_WANT:
1086 			if (client->state != GOTD_STATE_EXPECT_WANT) {
1087 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1088 				    "unexpected want-line received");
1089 				break;
1090 			}
1091 			log_debug("received want-line from uid %d",
1092 			    client->euid);
1093 			err = ensure_client_is_reading(client);
1094 			if (err)
1095 				break;
1096 			client->accept_flush_pkt = 1;
1097 			err = forward_want(client, &imsg);
1098 			break;
1099 		case GOTD_IMSG_REF_UPDATE:
1100 			if (client->state != GOTD_STATE_EXPECT_REF_UPDATE &&
1101 			    client->state !=
1102 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1103 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1104 				    "unexpected ref-update-line received");
1105 				break;
1106 			}
1107 			log_debug("received ref-update-line from uid %d",
1108 			    client->euid);
1109 			err = ensure_client_is_writing(client);
1110 			if (err)
1111 				break;
1112 			err = forward_ref_update(client, &imsg);
1113 			if (err)
1114 				break;
1115 			client->state = GOTD_STATE_EXPECT_MORE_REF_UPDATES;
1116 			client->accept_flush_pkt = 1;
1117 			break;
1118 		case GOTD_IMSG_HAVE:
1119 			if (client->state != GOTD_STATE_EXPECT_HAVE) {
1120 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1121 				    "unexpected have-line received");
1122 				break;
1123 			}
1124 			log_debug("received have-line from uid %d",
1125 			    client->euid);
1126 			err = ensure_client_is_reading(client);
1127 			if (err)
1128 				break;
1129 			err = forward_have(client, &imsg);
1130 			if (err)
1131 				break;
1132 			client->accept_flush_pkt = 1;
1133 			break;
1134 		case GOTD_IMSG_FLUSH:
1135 			if (client->state == GOTD_STATE_EXPECT_WANT ||
1136 			    client->state == GOTD_STATE_EXPECT_HAVE) {
1137 				err = ensure_client_is_reading(client);
1138 				if (err)
1139 					break;
1140 			} else if (client->state ==
1141 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1142 				err = ensure_client_is_writing(client);
1143 				if (err)
1144 					break;
1145 			} else if (client->state != GOTD_STATE_EXPECT_DONE) {
1146 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1147 				    "unexpected flush-pkt received");
1148 				break;
1149 			}
1150 			if (!client->accept_flush_pkt) {
1151 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1152 				    "unexpected flush-pkt received");
1153 				break;
1154 			}
1155 
1156 			/*
1157 			 * Accept just one flush packet at a time.
1158 			 * Future client state transitions will set this flag
1159 			 * again if another flush packet is expected.
1160 			 */
1161 			client->accept_flush_pkt = 0;
1162 
1163 			log_debug("received flush-pkt from uid %d",
1164 			    client->euid);
1165 			if (client->state == GOTD_STATE_EXPECT_WANT) {
1166 				client->state = GOTD_STATE_EXPECT_HAVE;
1167 				log_debug("uid %d: expecting have-lines",
1168 				    client->euid);
1169 			} else if (client->state == GOTD_STATE_EXPECT_HAVE) {
1170 				client->state = GOTD_STATE_EXPECT_DONE;
1171 				client->accept_flush_pkt = 1;
1172 				log_debug("uid %d: expecting 'done'",
1173 				    client->euid);
1174 			} else if (client->state ==
1175 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1176 				client->state = GOTD_STATE_EXPECT_PACKFILE;
1177 				log_debug("uid %d: expecting packfile",
1178 				    client->euid);
1179 				err = recv_packfile(client);
1180 			} else if (client->state != GOTD_STATE_EXPECT_DONE) {
1181 				/* should not happen, see above */
1182 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1183 				    "unexpected client state");
1184 				break;
1185 			}
1186 			break;
1187 		case GOTD_IMSG_DONE:
1188 			if (client->state != GOTD_STATE_EXPECT_HAVE &&
1189 			    client->state != GOTD_STATE_EXPECT_DONE) {
1190 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1191 				    "unexpected flush-pkt received");
1192 				break;
1193 			}
1194 			log_debug("received 'done' from uid %d", client->euid);
1195 			err = ensure_client_is_reading(client);
1196 			if (err)
1197 				break;
1198 			client->state = GOTD_STATE_DONE;
1199 			client->accept_flush_pkt = 1;
1200 			err = send_packfile(client);
1201 			break;
1202 		default:
1203 			log_debug("unexpected imsg %d", imsg.hdr.type);
1204 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1205 			break;
1206 		}
1207 
1208 		imsg_free(&imsg);
1209 	}
1210 
1211 	if (err) {
1212 		if (err->code != GOT_ERR_EOF ||
1213 		    client->state != GOTD_STATE_EXPECT_PACKFILE)
1214 			disconnect_on_error(client, err);
1215 	} else {
1216 		gotd_imsg_event_add(iev);
1217 		evtimer_add(&client->tmo, &gotd_session.request_timeout);
1218 	}
1219 }
1220 
1221 static const struct got_error *
1222 list_refs_request(void)
1223 {
1224 	static const struct got_error *err;
1225 	struct gotd_session_client *client = &gotd_session_client;
1226 	struct gotd_imsgev *iev = &client->repo_child_iev;
1227 	struct gotd_imsg_list_refs_internal ilref;
1228 	int fd;
1229 
1230 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1231 		return got_error(GOT_ERR_PRIVSEP_MSG);
1232 
1233 	memset(&ilref, 0, sizeof(ilref));
1234 	ilref.client_id = client->id;
1235 
1236 	fd = dup(client->fd);
1237 	if (fd == -1)
1238 		return got_error_from_errno("dup");
1239 
1240 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_LIST_REFS_INTERNAL,
1241 	    PROC_SESSION, fd, &ilref, sizeof(ilref)) == -1) {
1242 		err = got_error_from_errno("imsg compose LIST_REFS_INTERNAL");
1243 		close(fd);
1244 		return err;
1245 	}
1246 
1247 	client->state = GOTD_STATE_EXPECT_CAPABILITIES;
1248 	log_debug("uid %d: expecting capabilities", client->euid);
1249 	return NULL;
1250 }
1251 
1252 static const struct got_error *
1253 recv_connect(struct imsg *imsg)
1254 {
1255 	struct gotd_session_client *client = &gotd_session_client;
1256 	struct gotd_imsg_connect iconnect;
1257 	size_t datalen;
1258 
1259 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1260 		return got_error(GOT_ERR_PRIVSEP_MSG);
1261 
1262 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1263 	if (datalen != sizeof(iconnect))
1264 		return got_error(GOT_ERR_PRIVSEP_LEN);
1265 	memcpy(&iconnect, imsg->data, sizeof(iconnect));
1266 
1267 	if (imsg->fd == -1)
1268 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1269 
1270 	client->fd = imsg->fd;
1271 	client->euid = iconnect.euid;
1272 	client->egid = iconnect.egid;
1273 
1274 	imsg_init(&client->iev.ibuf, client->fd);
1275 	client->iev.handler = session_dispatch_client;
1276 	client->iev.events = EV_READ;
1277 	client->iev.handler_arg = NULL;
1278 	event_set(&client->iev.ev, client->iev.ibuf.fd, EV_READ,
1279 	    session_dispatch_client, &client->iev);
1280 	gotd_imsg_event_add(&client->iev);
1281 	evtimer_set(&client->tmo, gotd_request_timeout, client);
1282 
1283 	return NULL;
1284 }
1285 
1286 static const struct got_error *
1287 recv_repo_child(struct imsg *imsg)
1288 {
1289 	struct gotd_imsg_connect_repo_child ichild;
1290 	struct gotd_session_client *client = &gotd_session_client;
1291 	size_t datalen;
1292 
1293 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1294 		return got_error(GOT_ERR_PRIVSEP_MSG);
1295 
1296 	/* We should already have received a pipe to the listener. */
1297 	if (client->fd == -1)
1298 		return got_error(GOT_ERR_PRIVSEP_MSG);
1299 
1300 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1301 	if (datalen != sizeof(ichild))
1302 		return got_error(GOT_ERR_PRIVSEP_LEN);
1303 
1304 	memcpy(&ichild, imsg->data, sizeof(ichild));
1305 
1306 	client->id = ichild.client_id;
1307 	if (ichild.proc_id == PROC_REPO_WRITE)
1308 		client->is_writing = 1;
1309 	else if (ichild.proc_id == PROC_REPO_READ)
1310 		client->is_writing = 0;
1311 	else
1312 		return got_error_msg(GOT_ERR_PRIVSEP_MSG,
1313 		    "bad child process type");
1314 
1315 	if (imsg->fd == -1)
1316 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1317 
1318 	imsg_init(&client->repo_child_iev.ibuf, imsg->fd);
1319 	client->repo_child_iev.handler = session_dispatch_repo_child;
1320 	client->repo_child_iev.events = EV_READ;
1321 	client->repo_child_iev.handler_arg = NULL;
1322 	event_set(&client->repo_child_iev.ev, client->repo_child_iev.ibuf.fd,
1323 	    EV_READ, session_dispatch_repo_child, &client->repo_child_iev);
1324 	gotd_imsg_event_add(&client->repo_child_iev);
1325 
1326 	/* The "recvfd" pledge promise is no longer needed. */
1327 	if (pledge("stdio rpath wpath cpath sendfd fattr flock", NULL) == -1)
1328 		fatal("pledge");
1329 
1330 	return NULL;
1331 }
1332 
1333 static void
1334 session_dispatch(int fd, short event, void *arg)
1335 {
1336 	struct gotd_imsgev *iev = arg;
1337 	struct imsgbuf *ibuf = &iev->ibuf;
1338 	struct gotd_session_client *client = &gotd_session_client;
1339 	ssize_t n;
1340 	int shut = 0;
1341 	struct imsg imsg;
1342 
1343 	if (event & EV_READ) {
1344 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1345 			fatal("imsg_read error");
1346 		if (n == 0) {
1347 			/* Connection closed. */
1348 			shut = 1;
1349 			goto done;
1350 		}
1351 	}
1352 
1353 	if (event & EV_WRITE) {
1354 		n = msgbuf_write(&ibuf->w);
1355 		if (n == -1 && errno != EAGAIN)
1356 			fatal("msgbuf_write");
1357 		if (n == 0) {
1358 			/* Connection closed. */
1359 			shut = 1;
1360 			goto done;
1361 		}
1362 	}
1363 
1364 	for (;;) {
1365 		const struct got_error *err = NULL;
1366 		uint32_t client_id = 0;
1367 		int do_disconnect = 0, do_list_refs = 0;
1368 
1369 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1370 			fatal("%s: imsg_get error", __func__);
1371 		if (n == 0)	/* No more messages. */
1372 			break;
1373 
1374 		switch (imsg.hdr.type) {
1375 		case GOTD_IMSG_ERROR:
1376 			do_disconnect = 1;
1377 			err = gotd_imsg_recv_error(&client_id, &imsg);
1378 			break;
1379 		case GOTD_IMSG_CONNECT:
1380 			err = recv_connect(&imsg);
1381 			break;
1382 		case GOTD_IMSG_DISCONNECT:
1383 			do_disconnect = 1;
1384 			break;
1385 		case GOTD_IMSG_CONNECT_REPO_CHILD:
1386 			err = recv_repo_child(&imsg);
1387 			if (err)
1388 				break;
1389 			do_list_refs = 1;
1390 			break;
1391 		default:
1392 			log_debug("unexpected imsg %d", imsg.hdr.type);
1393 			break;
1394 		}
1395 		imsg_free(&imsg);
1396 
1397 		if (do_disconnect) {
1398 			if (err)
1399 				disconnect_on_error(client, err);
1400 			else
1401 				disconnect(client);
1402 		} else if (do_list_refs)
1403 			err = list_refs_request();
1404 
1405 		if (err)
1406 			log_warnx("uid %d: %s", client->euid, err->msg);
1407 	}
1408 done:
1409 	if (!shut) {
1410 		gotd_imsg_event_add(iev);
1411 	} else {
1412 		/* This pipe is dead. Remove its event handler */
1413 		event_del(&iev->ev);
1414 		event_loopexit(NULL);
1415 	}
1416 }
1417 
1418 void
1419 session_main(const char *title, const char *repo_path,
1420     int *pack_fds, int *temp_fds, struct timeval *request_timeout)
1421 {
1422 	const struct got_error *err = NULL;
1423 	struct event evsigint, evsigterm, evsighup, evsigusr1;
1424 
1425 	gotd_session.title = title;
1426 	gotd_session.pid = getpid();
1427 	gotd_session.pack_fds = pack_fds;
1428 	gotd_session.temp_fds = temp_fds;
1429 	memcpy(&gotd_session.request_timeout, request_timeout,
1430 	    sizeof(gotd_session.request_timeout));
1431 
1432 	err = got_repo_open(&gotd_session.repo, repo_path, NULL, pack_fds);
1433 	if (err)
1434 		goto done;
1435 	if (!got_repo_is_bare(gotd_session.repo)) {
1436 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
1437 		    "bare git repository required");
1438 		goto done;
1439 	}
1440 
1441 	got_repo_temp_fds_set(gotd_session.repo, temp_fds);
1442 
1443 	signal_set(&evsigint, SIGINT, gotd_session_sighdlr, NULL);
1444 	signal_set(&evsigterm, SIGTERM, gotd_session_sighdlr, NULL);
1445 	signal_set(&evsighup, SIGHUP, gotd_session_sighdlr, NULL);
1446 	signal_set(&evsigusr1, SIGUSR1, gotd_session_sighdlr, NULL);
1447 	signal(SIGPIPE, SIG_IGN);
1448 
1449 	signal_add(&evsigint, NULL);
1450 	signal_add(&evsigterm, NULL);
1451 	signal_add(&evsighup, NULL);
1452 	signal_add(&evsigusr1, NULL);
1453 
1454 	gotd_session_client.state = GOTD_STATE_EXPECT_LIST_REFS;
1455 	gotd_session_client.fd = -1;
1456 	gotd_session_client.nref_updates = -1;
1457 	gotd_session_client.delta_cache_fd = -1;
1458 	gotd_session_client.accept_flush_pkt = 1;
1459 
1460 	imsg_init(&gotd_session.parent_iev.ibuf, GOTD_FILENO_MSG_PIPE);
1461 	gotd_session.parent_iev.handler = session_dispatch;
1462 	gotd_session.parent_iev.events = EV_READ;
1463 	gotd_session.parent_iev.handler_arg = NULL;
1464 	event_set(&gotd_session.parent_iev.ev, gotd_session.parent_iev.ibuf.fd,
1465 	    EV_READ, session_dispatch, &gotd_session.parent_iev);
1466 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
1467 	    GOTD_IMSG_CLIENT_SESSION_READY, PROC_SESSION, -1, NULL, 0) == -1) {
1468 		err = got_error_from_errno("imsg compose CLIENT_SESSION_READY");
1469 		goto done;
1470 	}
1471 
1472 	event_dispatch();
1473 done:
1474 	if (err)
1475 		log_warnx("%s: %s", title, err->msg);
1476 	gotd_session_shutdown();
1477 }
1478 
1479 void
1480 gotd_session_shutdown(void)
1481 {
1482 	log_debug("shutting down");
1483 	if (gotd_session.repo)
1484 		got_repo_close(gotd_session.repo);
1485 	got_repo_pack_fds_close(gotd_session.pack_fds);
1486 	got_repo_temp_fds_close(gotd_session.temp_fds);
1487 	exit(0);
1488 }