Gotweb

Blob

Date:: Tue Jan 10 12:44:02 2023 UTC
Message:: add a gotd session process, split off from the parent process The new session process is able to manipulate files in the repository and keeps track of the read/write client session state. The parent process now restricts its view of the filesystem to the absolute path stored in argv[0], and combines this with unveil "x" on this path. As a result the parent process can only re-exec itself. small tweaks + ok op@
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2022, 2023 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/queue.h>
19 #include <sys/tree.h>
20 #include <sys/socket.h>
21 #include <sys/uio.h>
22 
23 #include <errno.h>
24 #include <event.h>
25 #include <limits.h>
26 #include <sha1.h>
27 #include <signal.h>
28 #include <stdint.h>
29 #include <stdio.h>
30 #include <stdlib.h>
31 #include <string.h>
32 #include <imsg.h>
33 #include <unistd.h>
34 
35 #include "got_error.h"
36 #include "got_repository.h"
37 #include "got_object.h"
38 #include "got_path.h"
39 #include "got_reference.h"
40 #include "got_opentemp.h"
41 
42 #include "got_lib_sha1.h"
43 #include "got_lib_delta.h"
44 #include "got_lib_object.h"
45 #include "got_lib_object_cache.h"
46 #include "got_lib_pack.h"
47 #include "got_lib_repository.h"
48 #include "got_lib_gitproto.h"
49 
50 #include "gotd.h"
51 #include "log.h"
52 #include "session.h"
53 
54 
55 static struct gotd_session {
56 	pid_t pid;
57 	const char *title;
58 	struct got_repository *repo;
59 	int *pack_fds;
60 	int *temp_fds;
61 	struct gotd_imsgev parent_iev;
62 	struct timeval request_timeout;
63 } gotd_session;
64 
65 static struct gotd_session_client {
66 	enum gotd_client_state		 state;
67 	int				 is_writing;
68 	struct gotd_client_capability	*capabilities;
69 	size_t				 ncapa_alloc;
70 	size_t				 ncapabilities;
71 	uint32_t			 id;
72 	int				 fd;
73 	int				 delta_cache_fd;
74 	struct gotd_imsgev		 iev;
75 	struct gotd_imsgev		 repo_child_iev;
76 	struct event			 tmo;
77 	uid_t				 euid;
78 	gid_t				 egid;
79 	char				*packfile_path;
80 	char				*packidx_path;
81 	int				 nref_updates;
82 } gotd_session_client;
83 
84 void gotd_session_sighdlr(int sig, short event, void *arg);
85 static void gotd_session_shutdown(void);
86 
87 static void
88 disconnect(struct gotd_session_client *client)
89 {
90 	log_debug("uid %d: disconnecting", client->euid);
91 
92 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
93 	    GOTD_IMSG_DISCONNECT, PROC_SESSION, -1, NULL, 0) == -1)
94 		log_warn("imsg compose DISCONNECT");
95 
96 	imsg_clear(&client->repo_child_iev.ibuf);
97 	event_del(&client->repo_child_iev.ev);
98 	evtimer_del(&client->tmo);
99 	close(client->fd);
100 	if (client->delta_cache_fd != -1)
101 		close(client->delta_cache_fd);
102 	if (client->packfile_path) {
103 		if (unlink(client->packfile_path) == -1 && errno != ENOENT)
104 			log_warn("unlink %s: ", client->packfile_path);
105 		free(client->packfile_path);
106 	}
107 	if (client->packidx_path) {
108 		if (unlink(client->packidx_path) == -1 && errno != ENOENT)
109 			log_warn("unlink %s: ", client->packidx_path);
110 		free(client->packidx_path);
111 	}
112 	free(client->capabilities);
113 
114 	gotd_session_shutdown();
115 }
116 
117 static void
118 disconnect_on_error(struct gotd_session_client *client,
119     const struct got_error *err)
120 {
121 	struct imsgbuf ibuf;
122 
123 	log_warnx("uid %d: %s", client->euid, err->msg);
124 	if (err->code != GOT_ERR_EOF) {
125 		imsg_init(&ibuf, client->fd);
126 		gotd_imsg_send_error(&ibuf, 0, PROC_SESSION, err);
127 		imsg_clear(&ibuf);
128 	}
129 
130 	disconnect(client);
131 }
132 
133 static void
134 gotd_request_timeout(int fd, short events, void *arg)
135 {
136 	struct gotd_session_client *client = arg;
137 
138 	log_debug("disconnecting uid %d due to timeout", client->euid);
139 	disconnect(client);
140 }
141 
142 void
143 gotd_session_sighdlr(int sig, short event, void *arg)
144 {
145 	/*
146 	 * Normal signal handler rules don't apply because libevent
147 	 * decouples for us.
148 	 */
149 
150 	switch (sig) {
151 	case SIGHUP:
152 		log_info("%s: ignoring SIGHUP", __func__);
153 		break;
154 	case SIGUSR1:
155 		log_info("%s: ignoring SIGUSR1", __func__);
156 		break;
157 	case SIGTERM:
158 	case SIGINT:
159 		gotd_session_shutdown();
160 		/* NOTREACHED */
161 		break;
162 	default:
163 		fatalx("unexpected signal");
164 	}
165 }
166 
167 static const struct got_error *
168 recv_packfile_done(uint32_t *client_id, struct imsg *imsg)
169 {
170 	struct gotd_imsg_packfile_done idone;
171 	size_t datalen;
172 
173 	log_debug("packfile-done received");
174 
175 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
176 	if (datalen != sizeof(idone))
177 		return got_error(GOT_ERR_PRIVSEP_LEN);
178 	memcpy(&idone, imsg->data, sizeof(idone));
179 
180 	*client_id = idone.client_id;
181 	return NULL;
182 }
183 
184 static const struct got_error *
185 recv_packfile_install(uint32_t *client_id, struct imsg *imsg)
186 {
187 	struct gotd_imsg_packfile_install inst;
188 	size_t datalen;
189 
190 	log_debug("packfile-install received");
191 
192 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
193 	if (datalen != sizeof(inst))
194 		return got_error(GOT_ERR_PRIVSEP_LEN);
195 	memcpy(&inst, imsg->data, sizeof(inst));
196 
197 	*client_id = inst.client_id;
198 	return NULL;
199 }
200 
201 static const struct got_error *
202 recv_ref_updates_start(uint32_t *client_id, struct imsg *imsg)
203 {
204 	struct gotd_imsg_ref_updates_start istart;
205 	size_t datalen;
206 
207 	log_debug("ref-updates-start received");
208 
209 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
210 	if (datalen != sizeof(istart))
211 		return got_error(GOT_ERR_PRIVSEP_LEN);
212 	memcpy(&istart, imsg->data, sizeof(istart));
213 
214 	*client_id = istart.client_id;
215 	return NULL;
216 }
217 
218 static const struct got_error *
219 recv_ref_update(uint32_t *client_id, struct imsg *imsg)
220 {
221 	struct gotd_imsg_ref_update iref;
222 	size_t datalen;
223 
224 	log_debug("ref-update received");
225 
226 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
227 	if (datalen < sizeof(iref))
228 		return got_error(GOT_ERR_PRIVSEP_LEN);
229 	memcpy(&iref, imsg->data, sizeof(iref));
230 
231 	*client_id = iref.client_id;
232 	return NULL;
233 }
234 
235 static const struct got_error *
236 send_ref_update_ok(struct gotd_session_client *client,
237     struct gotd_imsg_ref_update *iref, const char *refname)
238 {
239 	struct gotd_imsg_ref_update_ok iok;
240 	struct gotd_imsgev *iev = &client->iev;
241 	struct ibuf *wbuf;
242 	size_t len;
243 
244 	memset(&iok, 0, sizeof(iok));
245 	iok.client_id = client->id;
246 	memcpy(iok.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
247 	memcpy(iok.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
248 	iok.name_len = strlen(refname);
249 
250 	len = sizeof(iok) + iok.name_len;
251 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE_OK,
252 	    PROC_SESSION, gotd_session.pid, len);
253 	if (wbuf == NULL)
254 		return got_error_from_errno("imsg_create REF_UPDATE_OK");
255 
256 	if (imsg_add(wbuf, &iok, sizeof(iok)) == -1)
257 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
258 	if (imsg_add(wbuf, refname, iok.name_len) == -1)
259 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
260 
261 	wbuf->fd = -1;
262 	imsg_close(&iev->ibuf, wbuf);
263 	gotd_imsg_event_add(iev);
264 	return NULL;
265 }
266 
267 static void
268 send_refs_updated(struct gotd_session_client *client)
269 {
270 	if (gotd_imsg_compose_event(&client->iev, GOTD_IMSG_REFS_UPDATED,
271 	    PROC_SESSION, -1, NULL, 0) == -1)
272 		log_warn("imsg compose REFS_UPDATED");
273 }
274 
275 static const struct got_error *
276 send_ref_update_ng(struct gotd_session_client *client,
277     struct gotd_imsg_ref_update *iref, const char *refname,
278     const char *reason)
279 {
280 	const struct got_error *ng_err;
281 	struct gotd_imsg_ref_update_ng ing;
282 	struct gotd_imsgev *iev = &client->iev;
283 	struct ibuf *wbuf;
284 	size_t len;
285 
286 	memset(&ing, 0, sizeof(ing));
287 	ing.client_id = client->id;
288 	memcpy(ing.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
289 	memcpy(ing.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
290 	ing.name_len = strlen(refname);
291 
292 	ng_err = got_error_fmt(GOT_ERR_REF_BUSY, "%s", reason);
293 	ing.reason_len = strlen(ng_err->msg);
294 
295 	len = sizeof(ing) + ing.name_len + ing.reason_len;
296 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE_NG,
297 	    PROC_SESSION, gotd_session.pid, len);
298 	if (wbuf == NULL)
299 		return got_error_from_errno("imsg_create REF_UPDATE_NG");
300 
301 	if (imsg_add(wbuf, &ing, sizeof(ing)) == -1)
302 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
303 	if (imsg_add(wbuf, refname, ing.name_len) == -1)
304 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
305 	if (imsg_add(wbuf, ng_err->msg, ing.reason_len) == -1)
306 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
307 
308 	wbuf->fd = -1;
309 	imsg_close(&iev->ibuf, wbuf);
310 	gotd_imsg_event_add(iev);
311 	return NULL;
312 }
313 
314 static const struct got_error *
315 install_pack(struct gotd_session_client *client, const char *repo_path,
316     struct imsg *imsg)
317 {
318 	const struct got_error *err = NULL;
319 	struct gotd_imsg_packfile_install inst;
320 	char hex[SHA1_DIGEST_STRING_LENGTH];
321 	size_t datalen;
322 	char *packfile_path = NULL, *packidx_path = NULL;
323 
324 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
325 	if (datalen != sizeof(inst))
326 		return got_error(GOT_ERR_PRIVSEP_LEN);
327 	memcpy(&inst, imsg->data, sizeof(inst));
328 
329 	if (client->packfile_path == NULL)
330 		return got_error_msg(GOT_ERR_BAD_REQUEST,
331 		    "client has no pack file");
332 	if (client->packidx_path == NULL)
333 		return got_error_msg(GOT_ERR_BAD_REQUEST,
334 		    "client has no pack file index");
335 
336 	if (got_sha1_digest_to_str(inst.pack_sha1, hex, sizeof(hex)) == NULL)
337 		return got_error_msg(GOT_ERR_NO_SPACE,
338 		    "could not convert pack file SHA1 to hex");
339 
340 	if (asprintf(&packfile_path, "/%s/%s/pack-%s.pack",
341 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
342 		err = got_error_from_errno("asprintf");
343 		goto done;
344 	}
345 
346 	if (asprintf(&packidx_path, "/%s/%s/pack-%s.idx",
347 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
348 		err = got_error_from_errno("asprintf");
349 		goto done;
350 	}
351 
352 	if (rename(client->packfile_path, packfile_path) == -1) {
353 		err = got_error_from_errno3("rename", client->packfile_path,
354 		    packfile_path);
355 		goto done;
356 	}
357 
358 	free(client->packfile_path);
359 	client->packfile_path = NULL;
360 
361 	if (rename(client->packidx_path, packidx_path) == -1) {
362 		err = got_error_from_errno3("rename", client->packidx_path,
363 		    packidx_path);
364 		goto done;
365 	}
366 
367 	free(client->packidx_path);
368 	client->packidx_path = NULL;
369 done:
370 	free(packfile_path);
371 	free(packidx_path);
372 	return err;
373 }
374 
375 static const struct got_error *
376 begin_ref_updates(struct gotd_session_client *client, struct imsg *imsg)
377 {
378 	struct gotd_imsg_ref_updates_start istart;
379 	size_t datalen;
380 
381 	if (client->nref_updates != -1)
382 		return got_error(GOT_ERR_PRIVSEP_MSG);
383 
384 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
385 	if (datalen != sizeof(istart))
386 		return got_error(GOT_ERR_PRIVSEP_LEN);
387 	memcpy(&istart, imsg->data, sizeof(istart));
388 
389 	if (istart.nref_updates <= 0)
390 		return got_error(GOT_ERR_PRIVSEP_MSG);
391 
392 	client->nref_updates = istart.nref_updates;
393 	return NULL;
394 }
395 
396 static const struct got_error *
397 update_ref(struct gotd_session_client *client, const char *repo_path,
398     struct imsg *imsg)
399 {
400 	const struct got_error *err = NULL;
401 	struct got_repository *repo = NULL;
402 	struct got_reference *ref = NULL;
403 	struct gotd_imsg_ref_update iref;
404 	struct got_object_id old_id, new_id;
405 	struct got_object_id *id = NULL;
406 	struct got_object *obj = NULL;
407 	char *refname = NULL;
408 	size_t datalen;
409 	int locked = 0;
410 
411 	log_debug("update-ref from uid %d", client->euid);
412 
413 	if (client->nref_updates <= 0)
414 		return got_error(GOT_ERR_PRIVSEP_MSG);
415 
416 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
417 	if (datalen < sizeof(iref))
418 		return got_error(GOT_ERR_PRIVSEP_LEN);
419 	memcpy(&iref, imsg->data, sizeof(iref));
420 	if (datalen != sizeof(iref) + iref.name_len)
421 		return got_error(GOT_ERR_PRIVSEP_LEN);
422 	refname = malloc(iref.name_len + 1);
423 	if (refname == NULL)
424 		return got_error_from_errno("malloc");
425 	memcpy(refname, imsg->data + sizeof(iref), iref.name_len);
426 	refname[iref.name_len] = '\0';
427 
428 	log_debug("updating ref %s for uid %d", refname, client->euid);
429 
430 	err = got_repo_open(&repo, repo_path, NULL, NULL);
431 	if (err)
432 		goto done;
433 
434 	memcpy(old_id.sha1, iref.old_id, SHA1_DIGEST_LENGTH);
435 	memcpy(new_id.sha1, iref.new_id, SHA1_DIGEST_LENGTH);
436 	err = got_object_open(&obj, repo, &new_id);
437 	if (err)
438 		goto done;
439 
440 	if (iref.ref_is_new) {
441 		err = got_ref_open(&ref, repo, refname, 0);
442 		if (err) {
443 			if (err->code != GOT_ERR_NOT_REF)
444 				goto done;
445 			err = got_ref_alloc(&ref, refname, &new_id);
446 			if (err)
447 				goto done;
448 			err = got_ref_write(ref, repo); /* will lock/unlock */
449 			if (err)
450 				goto done;
451 		} else {
452 			err = got_error_fmt(GOT_ERR_REF_BUSY,
453 			    "%s has been created by someone else "
454 			    "while transaction was in progress",
455 			    got_ref_get_name(ref));
456 			goto done;
457 		}
458 	} else {
459 		err = got_ref_open(&ref, repo, refname, 1 /* lock */);
460 		if (err)
461 			goto done;
462 		locked = 1;
463 
464 		err = got_ref_resolve(&id, repo, ref);
465 		if (err)
466 			goto done;
467 
468 		if (got_object_id_cmp(id, &old_id) != 0) {
469 			err = got_error_fmt(GOT_ERR_REF_BUSY,
470 			    "%s has been modified by someone else "
471 			    "while transaction was in progress",
472 			    got_ref_get_name(ref));
473 			goto done;
474 		}
475 
476 		err = got_ref_change_ref(ref, &new_id);
477 		if (err)
478 			goto done;
479 
480 		err = got_ref_write(ref, repo);
481 		if (err)
482 			goto done;
483 
484 		free(id);
485 		id = NULL;
486 	}
487 done:
488 	if (err) {
489 		if (err->code == GOT_ERR_LOCKFILE_TIMEOUT) {
490 			err = got_error_fmt(GOT_ERR_LOCKFILE_TIMEOUT,
491 			    "could not acquire exclusive file lock for %s",
492 			    refname);
493 		}
494 		send_ref_update_ng(client, &iref, refname, err->msg);
495 	} else
496 		send_ref_update_ok(client, &iref, refname);
497 
498 	if (client->nref_updates > 0) {
499 		client->nref_updates--;
500 		if (client->nref_updates == 0)
501 			send_refs_updated(client);
502 
503 	}
504 	if (locked) {
505 		const struct got_error *unlock_err;
506 		unlock_err = got_ref_unlock(ref);
507 		if (unlock_err && err == NULL)
508 			err = unlock_err;
509 	}
510 	if (ref)
511 		got_ref_close(ref);
512 	if (obj)
513 		got_object_close(obj);
514 	if (repo)
515 		got_repo_close(repo);
516 	free(refname);
517 	free(id);
518 	return err;
519 }
520 
521 static void
522 session_dispatch_repo_child(int fd, short event, void *arg)
523 {
524 	struct gotd_imsgev *iev = arg;
525 	struct imsgbuf *ibuf = &iev->ibuf;
526 	struct gotd_session_client *client = &gotd_session_client;
527 	ssize_t n;
528 	int shut = 0;
529 	struct imsg imsg;
530 
531 	if (event & EV_READ) {
532 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
533 			fatal("imsg_read error");
534 		if (n == 0) {
535 			/* Connection closed. */
536 			shut = 1;
537 			goto done;
538 		}
539 	}
540 
541 	if (event & EV_WRITE) {
542 		n = msgbuf_write(&ibuf->w);
543 		if (n == -1 && errno != EAGAIN)
544 			fatal("msgbuf_write");
545 		if (n == 0) {
546 			/* Connection closed. */
547 			shut = 1;
548 			goto done;
549 		}
550 	}
551 
552 	for (;;) {
553 		const struct got_error *err = NULL;
554 		uint32_t client_id = 0;
555 		int do_disconnect = 0;
556 		int do_ref_updates = 0, do_ref_update = 0;
557 		int do_packfile_install = 0;
558 
559 		if ((n = imsg_get(ibuf, &imsg)) == -1)
560 			fatal("%s: imsg_get error", __func__);
561 		if (n == 0)	/* No more messages. */
562 			break;
563 
564 		switch (imsg.hdr.type) {
565 		case GOTD_IMSG_ERROR:
566 			do_disconnect = 1;
567 			err = gotd_imsg_recv_error(&client_id, &imsg);
568 			break;
569 		case GOTD_IMSG_PACKFILE_DONE:
570 			do_disconnect = 1;
571 			err = recv_packfile_done(&client_id, &imsg);
572 			break;
573 		case GOTD_IMSG_PACKFILE_INSTALL:
574 			err = recv_packfile_install(&client_id, &imsg);
575 			if (err == NULL)
576 				do_packfile_install = 1;
577 			break;
578 		case GOTD_IMSG_REF_UPDATES_START:
579 			err = recv_ref_updates_start(&client_id, &imsg);
580 			if (err == NULL)
581 				do_ref_updates = 1;
582 			break;
583 		case GOTD_IMSG_REF_UPDATE:
584 			err = recv_ref_update(&client_id, &imsg);
585 			if (err == NULL)
586 				do_ref_update = 1;
587 			break;
588 		default:
589 			log_debug("unexpected imsg %d", imsg.hdr.type);
590 			break;
591 		}
592 
593 		if (do_disconnect) {
594 			if (err)
595 				disconnect_on_error(client, err);
596 			else
597 				disconnect(client);
598 		} else {
599 			if (do_packfile_install)
600 				err = install_pack(client,
601 				    gotd_session.repo->path, &imsg);
602 			else if (do_ref_updates)
603 				err = begin_ref_updates(client, &imsg);
604 			else if (do_ref_update)
605 				err = update_ref(client,
606 				    gotd_session.repo->path, &imsg);
607 			if (err)
608 				log_warnx("uid %d: %s", client->euid, err->msg);
609 		}
610 		imsg_free(&imsg);
611 	}
612 done:
613 	if (!shut) {
614 		gotd_imsg_event_add(iev);
615 	} else {
616 		/* This pipe is dead. Remove its event handler */
617 		event_del(&iev->ev);
618 		event_loopexit(NULL);
619 	}
620 }
621 
622 static const struct got_error *
623 recv_capabilities(struct gotd_session_client *client, struct imsg *imsg)
624 {
625 	struct gotd_imsg_capabilities icapas;
626 	size_t datalen;
627 
628 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
629 	if (datalen != sizeof(icapas))
630 		return got_error(GOT_ERR_PRIVSEP_LEN);
631 	memcpy(&icapas, imsg->data, sizeof(icapas));
632 
633 	client->ncapa_alloc = icapas.ncapabilities;
634 	client->capabilities = calloc(client->ncapa_alloc,
635 	    sizeof(*client->capabilities));
636 	if (client->capabilities == NULL) {
637 		client->ncapa_alloc = 0;
638 		return got_error_from_errno("calloc");
639 	}
640 
641 	log_debug("expecting %zu capabilities from uid %d",
642 	    client->ncapa_alloc, client->euid);
643 	return NULL;
644 }
645 
646 static const struct got_error *
647 recv_capability(struct gotd_session_client *client, struct imsg *imsg)
648 {
649 	struct gotd_imsg_capability icapa;
650 	struct gotd_client_capability *capa;
651 	size_t datalen;
652 	char *key, *value = NULL;
653 
654 	if (client->capabilities == NULL ||
655 	    client->ncapabilities >= client->ncapa_alloc) {
656 		return got_error_msg(GOT_ERR_BAD_REQUEST,
657 		    "unexpected capability received");
658 	}
659 
660 	memset(&icapa, 0, sizeof(icapa));
661 
662 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
663 	if (datalen < sizeof(icapa))
664 		return got_error(GOT_ERR_PRIVSEP_LEN);
665 	memcpy(&icapa, imsg->data, sizeof(icapa));
666 
667 	if (datalen != sizeof(icapa) + icapa.key_len + icapa.value_len)
668 		return got_error(GOT_ERR_PRIVSEP_LEN);
669 
670 	key = malloc(icapa.key_len + 1);
671 	if (key == NULL)
672 		return got_error_from_errno("malloc");
673 	if (icapa.value_len > 0) {
674 		value = malloc(icapa.value_len + 1);
675 		if (value == NULL) {
676 			free(key);
677 			return got_error_from_errno("malloc");
678 		}
679 	}
680 
681 	memcpy(key, imsg->data + sizeof(icapa), icapa.key_len);
682 	key[icapa.key_len] = '\0';
683 	if (value) {
684 		memcpy(value, imsg->data + sizeof(icapa) + icapa.key_len,
685 		    icapa.value_len);
686 		value[icapa.value_len] = '\0';
687 	}
688 
689 	capa = &client->capabilities[client->ncapabilities++];
690 	capa->key = key;
691 	capa->value = value;
692 
693 	if (value)
694 		log_debug("uid %d: capability %s=%s", client->euid, key, value);
695 	else
696 		log_debug("uid %d: capability %s", client->euid, key);
697 
698 	return NULL;
699 }
700 
701 static const struct got_error *
702 ensure_client_is_reading(struct gotd_session_client *client)
703 {
704 	if (client->is_writing) {
705 		return got_error_fmt(GOT_ERR_BAD_PACKET,
706 		    "uid %d made a read-request but is not reading from "
707 		    "a repository", client->euid);
708 	}
709 
710 	return NULL;
711 }
712 
713 static const struct got_error *
714 ensure_client_is_writing(struct gotd_session_client *client)
715 {
716 	if (!client->is_writing) {
717 		return got_error_fmt(GOT_ERR_BAD_PACKET,
718 		    "uid %d made a write-request but is not writing to "
719 		    "a repository", client->euid);
720 	}
721 
722 	return NULL;
723 }
724 
725 static const struct got_error *
726 forward_want(struct gotd_session_client *client, struct imsg *imsg)
727 {
728 	struct gotd_imsg_want ireq;
729 	struct gotd_imsg_want iwant;
730 	size_t datalen;
731 
732 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
733 	if (datalen != sizeof(ireq))
734 		return got_error(GOT_ERR_PRIVSEP_LEN);
735 
736 	memcpy(&ireq, imsg->data, datalen);
737 
738 	memset(&iwant, 0, sizeof(iwant));
739 	memcpy(iwant.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
740 	iwant.client_id = client->id;
741 
742 	if (gotd_imsg_compose_event(&client->repo_child_iev, GOTD_IMSG_WANT,
743 	    PROC_SESSION, -1, &iwant, sizeof(iwant)) == -1)
744 		return got_error_from_errno("imsg compose WANT");
745 
746 	return NULL;
747 }
748 
749 static const struct got_error *
750 forward_ref_update(struct gotd_session_client *client, struct imsg *imsg)
751 {
752 	const struct got_error *err = NULL;
753 	struct gotd_imsg_ref_update ireq;
754 	struct gotd_imsg_ref_update *iref = NULL;
755 	size_t datalen;
756 
757 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
758 	if (datalen < sizeof(ireq))
759 		return got_error(GOT_ERR_PRIVSEP_LEN);
760 	memcpy(&ireq, imsg->data, sizeof(ireq));
761 	if (datalen != sizeof(ireq) + ireq.name_len)
762 		return got_error(GOT_ERR_PRIVSEP_LEN);
763 
764 	iref = malloc(datalen);
765 	if (iref == NULL)
766 		return got_error_from_errno("malloc");
767 	memcpy(iref, imsg->data, datalen);
768 
769 	iref->client_id = client->id;
770 	if (gotd_imsg_compose_event(&client->repo_child_iev,
771 	    GOTD_IMSG_REF_UPDATE, PROC_SESSION, -1, iref, datalen) == -1)
772 		err = got_error_from_errno("imsg compose REF_UPDATE");
773 	free(iref);
774 	return err;
775 }
776 
777 static const struct got_error *
778 forward_have(struct gotd_session_client *client, struct imsg *imsg)
779 {
780 	struct gotd_imsg_have ireq;
781 	struct gotd_imsg_have ihave;
782 	size_t datalen;
783 
784 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
785 	if (datalen != sizeof(ireq))
786 		return got_error(GOT_ERR_PRIVSEP_LEN);
787 
788 	memcpy(&ireq, imsg->data, datalen);
789 
790 	memset(&ihave, 0, sizeof(ihave));
791 	memcpy(ihave.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
792 	ihave.client_id = client->id;
793 
794 	if (gotd_imsg_compose_event(&client->repo_child_iev, GOTD_IMSG_HAVE,
795 	    PROC_SESSION, -1, &ihave, sizeof(ihave)) == -1)
796 		return got_error_from_errno("imsg compose HAVE");
797 
798 	return NULL;
799 }
800 
801 static int
802 client_has_capability(struct gotd_session_client *client, const char *capastr)
803 {
804 	struct gotd_client_capability *capa;
805 	size_t i;
806 
807 	if (client->ncapabilities == 0)
808 		return 0;
809 
810 	for (i = 0; i < client->ncapabilities; i++) {
811 		capa = &client->capabilities[i];
812 		if (strcmp(capa->key, capastr) == 0)
813 			return 1;
814 	}
815 
816 	return 0;
817 }
818 
819 static const struct got_error *
820 recv_packfile(struct gotd_session_client *client)
821 {
822 	const struct got_error *err = NULL;
823 	struct gotd_imsg_recv_packfile ipack;
824 	struct gotd_imsg_packfile_pipe ipipe;
825 	struct gotd_imsg_packidx_file ifile;
826 	char *basepath = NULL, *pack_path = NULL, *idx_path = NULL;
827 	int packfd = -1, idxfd = -1;
828 	int pipe[2] = { -1, -1 };
829 
830 	if (client->packfile_path) {
831 		return got_error_fmt(GOT_ERR_PRIVSEP_MSG,
832 		    "uid %d already has a pack file", client->euid);
833 	}
834 
835 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
836 		return got_error_from_errno("socketpair");
837 
838 	memset(&ipipe, 0, sizeof(ipipe));
839 	ipipe.client_id = client->id;
840 
841 	/* Send pack pipe end 0 to repo child process. */
842 	if (gotd_imsg_compose_event(&client->repo_child_iev,
843 	    GOTD_IMSG_PACKFILE_PIPE, PROC_SESSION, pipe[0],
844 	        &ipipe, sizeof(ipipe)) == -1) {
845 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
846 		pipe[0] = -1;
847 		goto done;
848 	}
849 	pipe[0] = -1;
850 
851 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
852 	if (gotd_imsg_compose_event(&client->iev,
853 	    GOTD_IMSG_PACKFILE_PIPE, PROC_SESSION, pipe[1], NULL, 0) == -1)
854 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
855 	pipe[1] = -1;
856 
857 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.pack",
858 	    got_repo_get_path(gotd_session.repo), GOT_OBJECTS_PACK_DIR,
859 	    client->euid) == -1) {
860 		err = got_error_from_errno("asprintf");
861 		goto done;
862 	}
863 
864 	err = got_opentemp_named_fd(&pack_path, &packfd, basepath, "");
865 	if (err)
866 		goto done;
867 
868 	free(basepath);
869 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.idx",
870 	    got_repo_get_path(gotd_session.repo), GOT_OBJECTS_PACK_DIR,
871 	    client->euid) == -1) {
872 		err = got_error_from_errno("asprintf");
873 		basepath = NULL;
874 		goto done;
875 	}
876 	err = got_opentemp_named_fd(&idx_path, &idxfd, basepath, "");
877 	if (err)
878 		goto done;
879 
880 	memset(&ifile, 0, sizeof(ifile));
881 	ifile.client_id = client->id;
882 	if (gotd_imsg_compose_event(&client->repo_child_iev,
883 	    GOTD_IMSG_PACKIDX_FILE, PROC_SESSION,
884 	    idxfd, &ifile, sizeof(ifile)) == -1) {
885 		err = got_error_from_errno("imsg compose PACKIDX_FILE");
886 		idxfd = -1;
887 		goto done;
888 	}
889 	idxfd = -1;
890 
891 	memset(&ipack, 0, sizeof(ipack));
892 	ipack.client_id = client->id;
893 	if (client_has_capability(client, GOT_CAPA_REPORT_STATUS))
894 		ipack.report_status = 1;
895 
896 	if (gotd_imsg_compose_event(&client->repo_child_iev,
897 	    GOTD_IMSG_RECV_PACKFILE, PROC_SESSION, packfd,
898 	    &ipack, sizeof(ipack)) == -1) {
899 		err = got_error_from_errno("imsg compose RECV_PACKFILE");
900 		packfd = -1;
901 		goto done;
902 	}
903 	packfd = -1;
904 
905 done:
906 	free(basepath);
907 	if (pipe[0] != -1 && close(pipe[0]) == -1 && err == NULL)
908 		err = got_error_from_errno("close");
909 	if (pipe[1] != -1 && close(pipe[1]) == -1 && err == NULL)
910 		err = got_error_from_errno("close");
911 	if (packfd != -1 && close(packfd) == -1 && err == NULL)
912 		err = got_error_from_errno("close");
913 	if (idxfd != -1 && close(idxfd) == -1 && err == NULL)
914 		err = got_error_from_errno("close");
915 	if (err) {
916 		free(pack_path);
917 		free(idx_path);
918 	} else {
919 		client->packfile_path = pack_path;
920 		client->packidx_path = idx_path;
921 	}
922 	return err;
923 }
924 
925 static const struct got_error *
926 send_packfile(struct gotd_session_client *client)
927 {
928 	const struct got_error *err = NULL;
929 	struct gotd_imsg_send_packfile ipack;
930 	struct gotd_imsg_packfile_pipe ipipe;
931 	int pipe[2];
932 
933 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
934 		return got_error_from_errno("socketpair");
935 
936 	memset(&ipack, 0, sizeof(ipack));
937 	memset(&ipipe, 0, sizeof(ipipe));
938 
939 	ipack.client_id = client->id;
940 	if (client_has_capability(client, GOT_CAPA_SIDE_BAND_64K))
941 		ipack.report_progress = 1;
942 
943 	client->delta_cache_fd = got_opentempfd();
944 	if (client->delta_cache_fd == -1)
945 		return got_error_from_errno("got_opentempfd");
946 
947 	if (gotd_imsg_compose_event(&client->repo_child_iev,
948 	    GOTD_IMSG_SEND_PACKFILE, PROC_GOTD, client->delta_cache_fd,
949 	    &ipack, sizeof(ipack)) == -1) {
950 		err = got_error_from_errno("imsg compose SEND_PACKFILE");
951 		close(pipe[0]);
952 		close(pipe[1]);
953 		return err;
954 	}
955 
956 	ipipe.client_id = client->id;
957 
958 	/* Send pack pipe end 0 to repo child process. */
959 	if (gotd_imsg_compose_event(&client->repo_child_iev,
960 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD,
961 	    pipe[0], &ipipe, sizeof(ipipe)) == -1) {
962 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
963 		close(pipe[1]);
964 		return err;
965 	}
966 
967 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
968 	if (gotd_imsg_compose_event(&client->iev,
969 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD, pipe[1], NULL, 0) == -1)
970 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
971 
972 	return err;
973 }
974 
975 static void
976 session_dispatch_listener(int fd, short events, void *arg)
977 {
978 	struct gotd_imsgev *iev = arg;
979 	struct imsgbuf *ibuf = &iev->ibuf;
980 	struct gotd_session_client *client = &gotd_session_client;
981 	const struct got_error *err = NULL;
982 	struct imsg imsg;
983 	ssize_t n;
984 
985 	if (events & EV_WRITE) {
986 		while (ibuf->w.queued) {
987 			n = msgbuf_write(&ibuf->w);
988 			if (n == -1 && errno == EPIPE) {
989 				/*
990 				 * The client has closed its socket.
991 				 * This can happen when Git clients are
992 				 * done sending pack file data.
993 				 */
994 				msgbuf_clear(&ibuf->w);
995 				continue;
996 			} else if (n == -1 && errno != EAGAIN) {
997 				err = got_error_from_errno("imsg_flush");
998 				disconnect_on_error(client, err);
999 				return;
1000 			}
1001 			if (n == 0) {
1002 				/* Connection closed. */
1003 				err = got_error(GOT_ERR_EOF);
1004 				disconnect_on_error(client, err);
1005 				return;
1006 			}
1007 		}
1008 	}
1009 
1010 	if ((events & EV_READ) == 0)
1011 		return;
1012 
1013 	memset(&imsg, 0, sizeof(imsg));
1014 
1015 	while (err == NULL) {
1016 		err = gotd_imsg_recv(&imsg, ibuf, 0);
1017 		if (err) {
1018 			if (err->code == GOT_ERR_PRIVSEP_READ)
1019 				err = NULL;
1020 			break;
1021 		}
1022 
1023 		evtimer_del(&client->tmo);
1024 
1025 		switch (imsg.hdr.type) {
1026 		case GOTD_IMSG_CAPABILITIES:
1027 			if (client->state != GOTD_STATE_EXPECT_CAPABILITIES) {
1028 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1029 				    "unexpected capabilities received");
1030 				break;
1031 			}
1032 			log_debug("receiving capabilities from uid %d",
1033 			    client->euid);
1034 			err = recv_capabilities(client, &imsg);
1035 			break;
1036 		case GOTD_IMSG_CAPABILITY:
1037 			if (client->state != GOTD_STATE_EXPECT_CAPABILITIES) {
1038 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1039 				    "unexpected capability received");
1040 				break;
1041 			}
1042 			err = recv_capability(client, &imsg);
1043 			if (err || client->ncapabilities < client->ncapa_alloc)
1044 				break;
1045 			if (!client->is_writing) {
1046 				client->state = GOTD_STATE_EXPECT_WANT;
1047 				log_debug("uid %d: expecting want-lines",
1048 				    client->euid);
1049 			} else if (client->is_writing) {
1050 				client->state = GOTD_STATE_EXPECT_REF_UPDATE;
1051 				log_debug("uid %d: expecting ref-update-lines",
1052 				    client->euid);
1053 			} else
1054 				fatalx("client %d is both reading and writing",
1055 				    client->euid);
1056 			break;
1057 		case GOTD_IMSG_WANT:
1058 			if (client->state != GOTD_STATE_EXPECT_WANT) {
1059 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1060 				    "unexpected want-line received");
1061 				break;
1062 			}
1063 			log_debug("received want-line from uid %d",
1064 			    client->euid);
1065 			err = ensure_client_is_reading(client);
1066 			if (err)
1067 				break;
1068 			err = forward_want(client, &imsg);
1069 			break;
1070 		case GOTD_IMSG_REF_UPDATE:
1071 			if (client->state != GOTD_STATE_EXPECT_REF_UPDATE) {
1072 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1073 				    "unexpected ref-update-line received");
1074 				break;
1075 			}
1076 			log_debug("received ref-update-line from uid %d",
1077 			    client->euid);
1078 			err = ensure_client_is_writing(client);
1079 			if (err)
1080 				break;
1081 			err = forward_ref_update(client, &imsg);
1082 			if (err)
1083 				break;
1084 			client->state = GOTD_STATE_EXPECT_MORE_REF_UPDATES;
1085 			break;
1086 		case GOTD_IMSG_HAVE:
1087 			if (client->state != GOTD_STATE_EXPECT_HAVE) {
1088 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1089 				    "unexpected have-line received");
1090 				break;
1091 			}
1092 			log_debug("received have-line from uid %d",
1093 			    client->euid);
1094 			err = ensure_client_is_reading(client);
1095 			if (err)
1096 				break;
1097 			err = forward_have(client, &imsg);
1098 			if (err)
1099 				break;
1100 			break;
1101 		case GOTD_IMSG_FLUSH:
1102 			if (client->state == GOTD_STATE_EXPECT_WANT ||
1103 			    client->state == GOTD_STATE_EXPECT_HAVE) {
1104 				err = ensure_client_is_reading(client);
1105 				if (err)
1106 					break;
1107 			} else if (client->state ==
1108 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1109 				err = ensure_client_is_writing(client);
1110 				if (err)
1111 					break;
1112 			} else {
1113 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1114 				    "unexpected flush-pkt received");
1115 				break;
1116 			}
1117 			log_debug("received flush-pkt from uid %d",
1118 			    client->euid);
1119 			if (client->state == GOTD_STATE_EXPECT_WANT) {
1120 				client->state = GOTD_STATE_EXPECT_HAVE;
1121 				log_debug("uid %d: expecting have-lines",
1122 				    client->euid);
1123 			} else if (client->state == GOTD_STATE_EXPECT_HAVE) {
1124 				client->state = GOTD_STATE_EXPECT_DONE;
1125 				log_debug("uid %d: expecting 'done'",
1126 				    client->euid);
1127 			} else if (client->state ==
1128 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1129 				client->state = GOTD_STATE_EXPECT_PACKFILE;
1130 				log_debug("uid %d: expecting packfile",
1131 				    client->euid);
1132 				err = recv_packfile(client);
1133 			} else {
1134 				/* should not happen, see above */
1135 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1136 				    "unexpected client state");
1137 				break;
1138 			}
1139 			break;
1140 		case GOTD_IMSG_DONE:
1141 			if (client->state != GOTD_STATE_EXPECT_HAVE &&
1142 			    client->state != GOTD_STATE_EXPECT_DONE) {
1143 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1144 				    "unexpected flush-pkt received");
1145 				break;
1146 			}
1147 			log_debug("received 'done' from uid %d", client->euid);
1148 			err = ensure_client_is_reading(client);
1149 			if (err)
1150 				break;
1151 			client->state = GOTD_STATE_DONE;
1152 			err = send_packfile(client);
1153 			break;
1154 		default:
1155 			log_debug("unexpected imsg %d", imsg.hdr.type);
1156 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1157 			break;
1158 		}
1159 
1160 		imsg_free(&imsg);
1161 	}
1162 
1163 	if (err) {
1164 		if (err->code != GOT_ERR_EOF ||
1165 		    client->state != GOTD_STATE_EXPECT_PACKFILE)
1166 			disconnect_on_error(client, err);
1167 	} else {
1168 		gotd_imsg_event_add(iev);
1169 		evtimer_add(&client->tmo, &gotd_session.request_timeout);
1170 	}
1171 }
1172 
1173 static const struct got_error *
1174 list_refs_request(void)
1175 {
1176 	static const struct got_error *err;
1177 	struct gotd_session_client *client = &gotd_session_client;
1178 	struct gotd_imsgev *iev = &client->repo_child_iev;
1179 	struct gotd_imsg_list_refs_internal ilref;
1180 	int fd;
1181 
1182 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1183 		return got_error(GOT_ERR_PRIVSEP_MSG);
1184 
1185 	memset(&ilref, 0, sizeof(ilref));
1186 	ilref.client_id = client->id;
1187 
1188 	fd = dup(client->fd);
1189 	if (fd == -1)
1190 		return got_error_from_errno("dup");
1191 
1192 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_LIST_REFS_INTERNAL,
1193 	    PROC_SESSION, fd, &ilref, sizeof(ilref)) == -1) {
1194 		err = got_error_from_errno("imsg compose LIST_REFS_INTERNAL");
1195 		close(fd);
1196 		return err;
1197 	}
1198 
1199 	client->state = GOTD_STATE_EXPECT_CAPABILITIES;
1200 	log_debug("uid %d: expecting capabilities", client->euid);
1201 	return NULL;
1202 }
1203 
1204 static const struct got_error *
1205 recv_connect(struct imsg *imsg)
1206 {
1207 	struct gotd_session_client *client = &gotd_session_client;
1208 	struct gotd_imsg_connect iconnect;
1209 	size_t datalen;
1210 
1211 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1212 		return got_error(GOT_ERR_PRIVSEP_MSG);
1213 
1214 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1215 	if (datalen != sizeof(iconnect))
1216 		return got_error(GOT_ERR_PRIVSEP_LEN);
1217 	memcpy(&iconnect, imsg->data, sizeof(iconnect));
1218 
1219 	if (imsg->fd == -1)
1220 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1221 
1222 	client->fd = imsg->fd;
1223 	client->euid = iconnect.euid;
1224 	client->egid = iconnect.egid;
1225 
1226 	imsg_init(&client->iev.ibuf, client->fd);
1227 	client->iev.handler = session_dispatch_listener;
1228 	client->iev.events = EV_READ;
1229 	client->iev.handler_arg = NULL;
1230 	event_set(&client->iev.ev, client->iev.ibuf.fd, EV_READ,
1231 	    session_dispatch_listener, &client->iev);
1232 	gotd_imsg_event_add(&client->iev);
1233 	evtimer_set(&client->tmo, gotd_request_timeout, client);
1234 
1235 	return NULL;
1236 }
1237 
1238 static const struct got_error *
1239 recv_repo_child(struct imsg *imsg)
1240 {
1241 	struct gotd_imsg_connect_repo_child ichild;
1242 	struct gotd_session_client *client = &gotd_session_client;
1243 	size_t datalen;
1244 
1245 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1246 		return got_error(GOT_ERR_PRIVSEP_MSG);
1247 
1248 	/* We should already have received a pipe to the listener. */
1249 	if (client->fd == -1)
1250 		return got_error(GOT_ERR_PRIVSEP_MSG);
1251 
1252 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1253 	if (datalen != sizeof(ichild))
1254 		return got_error(GOT_ERR_PRIVSEP_LEN);
1255 
1256 	memcpy(&ichild, imsg->data, sizeof(ichild));
1257 
1258 	client->id = ichild.client_id;
1259 	if (ichild.proc_id == PROC_REPO_WRITE)
1260 		client->is_writing = 1;
1261 	else if (ichild.proc_id == PROC_REPO_READ)
1262 		client->is_writing = 0;
1263 	else
1264 		return got_error_msg(GOT_ERR_PRIVSEP_MSG,
1265 		    "bad child process type");
1266 		
1267 	if (imsg->fd == -1)
1268 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1269 
1270 	imsg_init(&client->repo_child_iev.ibuf, imsg->fd);
1271 	client->repo_child_iev.handler = session_dispatch_repo_child;
1272 	client->repo_child_iev.events = EV_READ;
1273 	client->repo_child_iev.handler_arg = NULL;
1274 	event_set(&client->repo_child_iev.ev, client->repo_child_iev.ibuf.fd,
1275 	    EV_READ, session_dispatch_repo_child, &client->repo_child_iev);
1276 	gotd_imsg_event_add(&client->repo_child_iev);
1277 
1278 	/* The "recvfd" pledge promise is no longer needed. */
1279 	if (pledge("stdio rpath wpath cpath sendfd fattr flock", NULL) == -1)
1280 		fatal("pledge");
1281 
1282 	return NULL;
1283 }
1284 
1285 static void
1286 session_dispatch(int fd, short event, void *arg)
1287 {
1288 	struct gotd_imsgev *iev = arg;
1289 	struct imsgbuf *ibuf = &iev->ibuf;
1290 	struct gotd_session_client *client = &gotd_session_client;
1291 	ssize_t n;
1292 	int shut = 0;
1293 	struct imsg imsg;
1294 
1295 	if (event & EV_READ) {
1296 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1297 			fatal("imsg_read error");
1298 		if (n == 0) {
1299 			/* Connection closed. */
1300 			shut = 1;
1301 			goto done;
1302 		}
1303 	}
1304 
1305 	if (event & EV_WRITE) {
1306 		n = msgbuf_write(&ibuf->w);
1307 		if (n == -1 && errno != EAGAIN)
1308 			fatal("msgbuf_write");
1309 		if (n == 0) {
1310 			/* Connection closed. */
1311 			shut = 1;
1312 			goto done;
1313 		}
1314 	}
1315 
1316 	for (;;) {
1317 		const struct got_error *err = NULL;
1318 		uint32_t client_id = 0;
1319 		int do_disconnect = 0, do_list_refs = 0;
1320 
1321 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1322 			fatal("%s: imsg_get error", __func__);
1323 		if (n == 0)	/* No more messages. */
1324 			break;
1325 
1326 		switch (imsg.hdr.type) {
1327 		case GOTD_IMSG_ERROR:
1328 			do_disconnect = 1;
1329 			err = gotd_imsg_recv_error(&client_id, &imsg);
1330 			break;
1331 		case GOTD_IMSG_CONNECT:
1332 			err = recv_connect(&imsg);
1333 			break;
1334 		case GOTD_IMSG_DISCONNECT:
1335 			do_disconnect = 1;
1336 			break;
1337 		case GOTD_IMSG_CONNECT_REPO_CHILD:
1338 			err = recv_repo_child(&imsg);
1339 			if (err)
1340 				break;
1341 			do_list_refs = 1;
1342 			break;
1343 		default:
1344 			log_debug("unexpected imsg %d", imsg.hdr.type);
1345 			break;
1346 		}
1347 		imsg_free(&imsg);
1348 
1349 		if (do_disconnect) {
1350 			if (err)
1351 				disconnect_on_error(client, err);
1352 			else
1353 				disconnect(client);
1354 		} else if (do_list_refs)
1355 			err = list_refs_request();
1356 
1357 		if (err)
1358 			log_warnx("uid %d: %s", client->euid, err->msg);
1359 	}
1360 done:
1361 	if (!shut) {
1362 		gotd_imsg_event_add(iev);
1363 	} else {
1364 		/* This pipe is dead. Remove its event handler */
1365 		event_del(&iev->ev);
1366 		event_loopexit(NULL);
1367 	}	
1368 }
1369 
1370 void
1371 session_main(const char *title, const char *repo_path,
1372     int *pack_fds, int *temp_fds, struct timeval *request_timeout)
1373 {
1374 	const struct got_error *err = NULL;
1375 	struct event evsigint, evsigterm, evsighup, evsigusr1;
1376 
1377 	gotd_session.title = title;
1378 	gotd_session.pid = getpid();
1379 	gotd_session.pack_fds = pack_fds;
1380 	gotd_session.temp_fds = temp_fds;
1381 	memcpy(&gotd_session.request_timeout, request_timeout,
1382 	    sizeof(gotd_session.request_timeout));
1383 
1384 	err = got_repo_open(&gotd_session.repo, repo_path, NULL, pack_fds);
1385 	if (err)
1386 		goto done;
1387 	if (!got_repo_is_bare(gotd_session.repo)) {
1388 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
1389 		    "bare git repository required");
1390 		goto done;
1391 	}
1392 
1393 	got_repo_temp_fds_set(gotd_session.repo, temp_fds);
1394 
1395 	signal_set(&evsigint, SIGINT, gotd_session_sighdlr, NULL);
1396 	signal_set(&evsigterm, SIGTERM, gotd_session_sighdlr, NULL);
1397 	signal_set(&evsighup, SIGHUP, gotd_session_sighdlr, NULL);
1398 	signal_set(&evsigusr1, SIGUSR1, gotd_session_sighdlr, NULL);
1399 	signal(SIGPIPE, SIG_IGN);
1400 
1401 	signal_add(&evsigint, NULL);
1402 	signal_add(&evsigterm, NULL);
1403 	signal_add(&evsighup, NULL);
1404 	signal_add(&evsigusr1, NULL);
1405 
1406 	gotd_session_client.state = GOTD_STATE_EXPECT_LIST_REFS;
1407 	gotd_session_client.fd = -1;
1408 	gotd_session_client.nref_updates = -1;
1409 
1410 	imsg_init(&gotd_session.parent_iev.ibuf, GOTD_FILENO_MSG_PIPE);
1411 	gotd_session.parent_iev.handler = session_dispatch;
1412 	gotd_session.parent_iev.events = EV_READ;
1413 	gotd_session.parent_iev.handler_arg = NULL;
1414 	event_set(&gotd_session.parent_iev.ev, gotd_session.parent_iev.ibuf.fd,
1415 	    EV_READ, session_dispatch, &gotd_session.parent_iev);
1416 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
1417 	    GOTD_IMSG_CLIENT_SESSION_READY, PROC_SESSION, -1, NULL, 0) == -1) {
1418 		err = got_error_from_errno("imsg compose CLIENT_SESSION_READY");
1419 		goto done;
1420 	}
1421 
1422 	event_dispatch();
1423 done:
1424 	if (err)
1425 		log_warnx("%s: %s", title, err->msg);
1426 	gotd_session_shutdown();
1427 }
1428 
1429 void
1430 gotd_session_shutdown(void)
1431 {
1432 	log_debug("%s: shutting down", gotd_session.title);
1433 	if (gotd_session.repo)
1434 		got_repo_close(gotd_session.repo);
1435 	got_repo_pack_fds_close(gotd_session.pack_fds);
1436 	got_repo_temp_fds_close(gotd_session.temp_fds);
1437 	exit(0);
1438 }