Gotweb

Blob

Date:: Fri Jan 6 09:33:00 2023 UTC
Message:: introduce connection options to gotd.conf Allow administrators to tweak the default authentication and request timeouts if needed, and to tweak the limit of concurrent connections for specific user accounts. with several tweaks from and ok op@
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/queue.h>
18 #include <sys/tree.h>
19 #include <sys/time.h>
20 #include <sys/types.h>
21 #include <sys/stat.h>
22 #include <sys/socket.h>
23 #include <sys/un.h>
24 #include <sys/wait.h>
25 
26 #include <fcntl.h>
27 #include <err.h>
28 #include <errno.h>
29 #include <event.h>
30 #include <limits.h>
31 #include <pwd.h>
32 #include <grp.h>
33 #include <imsg.h>
34 #include <sha1.h>
35 #include <signal.h>
36 #include <siphash.h>
37 #include <stdarg.h>
38 #include <stdio.h>
39 #include <stdlib.h>
40 #include <string.h>
41 #include <syslog.h>
42 #include <unistd.h>
43 
44 #include "got_error.h"
45 #include "got_opentemp.h"
46 #include "got_path.h"
47 #include "got_repository.h"
48 #include "got_object.h"
49 #include "got_reference.h"
50 
51 #include "got_lib_delta.h"
52 #include "got_lib_object.h"
53 #include "got_lib_object_cache.h"
54 #include "got_lib_sha1.h"
55 #include "got_lib_gitproto.h"
56 #include "got_lib_pack.h"
57 #include "got_lib_repository.h"
58 
59 #include "gotd.h"
60 #include "log.h"
61 #include "listen.h"
62 #include "auth.h"
63 #include "repo_read.h"
64 #include "repo_write.h"
65 
66 #ifndef nitems
67 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
68 #endif
69 
70 struct gotd_client {
71 	STAILQ_ENTRY(gotd_client)	 entry;
72 	enum gotd_client_state		 state;
73 	struct gotd_client_capability	*capabilities;
74 	size_t				 ncapa_alloc;
75 	size_t				 ncapabilities;
76 	uint32_t			 id;
77 	int				 fd;
78 	int				 delta_cache_fd;
79 	struct gotd_imsgev		 iev;
80 	struct event			 tmo;
81 	uid_t				 euid;
82 	gid_t				 egid;
83 	struct gotd_child_proc		*repo_read;
84 	struct gotd_child_proc		*repo_write;
85 	struct gotd_child_proc		*auth;
86 	int				 required_auth;
87 	char				*packfile_path;
88 	char				*packidx_path;
89 	int				 nref_updates;
90 };
91 STAILQ_HEAD(gotd_clients, gotd_client);
92 
93 static struct gotd_clients gotd_clients[GOTD_CLIENT_TABLE_SIZE];
94 static SIPHASH_KEY clients_hash_key;
95 volatile int client_cnt;
96 static struct timeval auth_timeout = { 5, 0 };
97 static struct gotd gotd;
98 
99 void gotd_sighdlr(int sig, short event, void *arg);
100 static void gotd_shutdown(void);
101 static const struct got_error *start_repo_child(struct gotd_client *,
102     enum gotd_procid, struct gotd_repo *, char *, const char *, int, int);
103 static const struct got_error *start_auth_child(struct gotd_client *, int,
104     struct gotd_repo *, char *, const char *, int, int);
105 static void kill_proc(struct gotd_child_proc *, int);
106 
107 __dead static void
108 usage()
109 {
110 	fprintf(stderr, "usage: %s [-dv] [-f config-file]\n", getprogname());
111 	exit(1);
112 }
113 
114 static int
115 unix_socket_listen(const char *unix_socket_path, uid_t uid, gid_t gid)
116 {
117 	struct sockaddr_un sun;
118 	int fd = -1;
119 	mode_t old_umask, mode;
120 
121 	fd = socket(AF_UNIX, SOCK_STREAM | SOCK_NONBLOCK| SOCK_CLOEXEC, 0);
122 	if (fd == -1) {
123 		log_warn("socket");
124 		return -1;
125 	}
126 
127 	sun.sun_family = AF_UNIX;
128 	if (strlcpy(sun.sun_path, unix_socket_path,
129 	    sizeof(sun.sun_path)) >= sizeof(sun.sun_path)) {
130 		log_warnx("%s: name too long", unix_socket_path);
131 		close(fd);
132 		return -1;
133 	}
134 
135 	if (unlink(unix_socket_path) == -1) {
136 		if (errno != ENOENT) {
137 			log_warn("unlink %s", unix_socket_path);
138 			close(fd);
139 			return -1;
140 		}
141 	}
142 
143 	old_umask = umask(S_IXUSR|S_IXGRP|S_IWOTH|S_IROTH|S_IXOTH);
144 	mode = S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP;
145 
146 	if (bind(fd, (struct sockaddr *)&sun, sizeof(sun)) == -1) {
147 		log_warn("bind: %s", unix_socket_path);
148 		close(fd);
149 		umask(old_umask);
150 		return -1;
151 	}
152 
153 	umask(old_umask);
154 
155 	if (chmod(unix_socket_path, mode) == -1) {
156 		log_warn("chmod %o %s", mode, unix_socket_path);
157 		close(fd);
158 		unlink(unix_socket_path);
159 		return -1;
160 	}
161 
162 	if (chown(unix_socket_path, uid, gid) == -1) {
163 		log_warn("chown %s uid=%d gid=%d", unix_socket_path, uid, gid);
164 		close(fd);
165 		unlink(unix_socket_path);
166 		return -1;
167 	}
168 
169 	if (listen(fd, GOTD_UNIX_SOCKET_BACKLOG) == -1) {
170 		log_warn("listen");
171 		close(fd);
172 		unlink(unix_socket_path);
173 		return -1;
174 	}
175 
176 	return fd;
177 }
178 
179 static struct group *
180 match_group(gid_t *groups, int ngroups, const char *unix_group_name)
181 {
182 	struct group *gr;
183 	int i;
184 
185 	for (i = 0; i < ngroups; i++) {
186 		gr = getgrgid(groups[i]);
187 		if (gr == NULL) {
188 			log_warn("getgrgid %d", groups[i]);
189 			continue;
190 		}
191 		if (strcmp(gr->gr_name, unix_group_name) == 0)
192 			return gr;
193 	}
194 
195 	return NULL;
196 }
197 
198 static uint64_t
199 client_hash(uint32_t client_id)
200 {
201 	return SipHash24(&clients_hash_key, &client_id, sizeof(client_id));
202 }
203 
204 static void
205 add_client(struct gotd_client *client)
206 {
207 	uint64_t slot = client_hash(client->id) % nitems(gotd_clients);
208 	STAILQ_INSERT_HEAD(&gotd_clients[slot], client, entry);
209 	client_cnt++;
210 }
211 
212 static struct gotd_client *
213 find_client(uint32_t client_id)
214 {
215 	uint64_t slot;
216 	struct gotd_client *c;
217 
218 	slot = client_hash(client_id) % nitems(gotd_clients);
219 	STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
220 		if (c->id == client_id)
221 			return c;
222 	}
223 
224 	return NULL;
225 }
226 
227 static struct gotd_child_proc *
228 get_client_proc(struct gotd_client *client)
229 {
230 	if (client->repo_read && client->repo_write) {
231 		fatalx("uid %d is reading and writing in the same session",
232 		    client->euid);
233 		/* NOTREACHED */
234 	}
235 
236 	if (client->repo_read)
237 		return client->repo_read;
238 	else if (client->repo_write)
239 		return client->repo_write;
240 
241 	return NULL;
242 }
243 
244 static struct gotd_client *
245 find_client_by_proc_fd(int fd)
246 {
247 	uint64_t slot;
248 
249 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
250 		struct gotd_client *c;
251 
252 		STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
253 			struct gotd_child_proc *proc = get_client_proc(c);
254 			if (proc && proc->iev.ibuf.fd == fd)
255 				return c;
256 			if (c->auth && c->auth->iev.ibuf.fd == fd)
257 				return c;
258 		}
259 	}
260 
261 	return NULL;
262 }
263 
264 static int
265 client_is_reading(struct gotd_client *client)
266 {
267 	return client->repo_read != NULL;
268 }
269 
270 static int
271 client_is_writing(struct gotd_client *client)
272 {
273 	return client->repo_write != NULL;
274 }
275 
276 static const struct got_error *
277 ensure_client_is_reading(struct gotd_client *client)
278 {
279 	if (!client_is_reading(client)) {
280 		return got_error_fmt(GOT_ERR_BAD_PACKET,
281 		    "uid %d made a read-request but is not reading from "
282 		    "a repository", client->euid);
283 	}
284 
285 	return NULL;
286 }
287 
288 static const struct got_error *
289 ensure_client_is_writing(struct gotd_client *client)
290 {
291 	if (!client_is_writing(client)) {
292 		return got_error_fmt(GOT_ERR_BAD_PACKET,
293 		    "uid %d made a write-request but is not writing to "
294 		    "a repository", client->euid);
295 	}
296 
297 	return NULL;
298 }
299 
300 static const struct got_error *
301 ensure_client_is_not_writing(struct gotd_client *client)
302 {
303 	if (client_is_writing(client)) {
304 		return got_error_fmt(GOT_ERR_BAD_PACKET,
305 		    "uid %d made a read-request but is writing to "
306 		    "a repository", client->euid);
307 	}
308 
309 	return NULL;
310 }
311 
312 static const struct got_error *
313 ensure_client_is_not_reading(struct gotd_client *client)
314 {
315 	if (client_is_reading(client)) {
316 		return got_error_fmt(GOT_ERR_BAD_PACKET,
317 		    "uid %d made a write-request but is reading from "
318 		    "a repository", client->euid);
319 	}
320 
321 	return NULL;
322 }
323 
324 static void
325 wait_for_child(pid_t child_pid)
326 {
327 	pid_t pid;
328 	int status;
329 
330 	log_debug("waiting for child PID %ld to terminate",
331 	    (long)child_pid);
332 
333 	do {
334 		pid = waitpid(child_pid, &status, WNOHANG);
335 		if (pid == -1) {
336 			if (errno != EINTR && errno != ECHILD)
337 				fatal("wait");
338 		} else if (WIFSIGNALED(status)) {
339 			log_warnx("child PID %ld terminated; signal %d",
340 			    (long)pid, WTERMSIG(status));
341 		}
342 	} while (pid != -1 || (pid == -1 && errno == EINTR));
343 }
344 
345 static void
346 kill_auth_proc(struct gotd_client *client)
347 {
348 	struct gotd_child_proc *proc;
349 
350 	if (client->auth == NULL)
351 		return;
352 
353 	proc = client->auth;
354 	client->auth = NULL;
355 
356 	event_del(&proc->iev.ev);
357 	msgbuf_clear(&proc->iev.ibuf.w);
358 	close(proc->iev.ibuf.fd);
359 	kill_proc(proc, 0);
360 	wait_for_child(proc->pid);
361 	free(proc);
362 }
363 
364 static void
365 disconnect(struct gotd_client *client)
366 {
367 	struct gotd_imsg_disconnect idisconnect;
368 	struct gotd_child_proc *proc = get_client_proc(client);
369 	struct gotd_child_proc *listen_proc = &gotd.listen_proc;
370 	uint64_t slot;
371 
372 	log_debug("uid %d: disconnecting", client->euid);
373 
374 	kill_auth_proc(client);
375 
376 	idisconnect.client_id = client->id;
377 	if (proc) {
378 		if (gotd_imsg_compose_event(&proc->iev,
379 		    GOTD_IMSG_DISCONNECT, PROC_GOTD, -1,
380 		    &idisconnect, sizeof(idisconnect)) == -1)
381 			log_warn("imsg compose DISCONNECT");
382 
383 		msgbuf_clear(&proc->iev.ibuf.w);
384 		close(proc->iev.ibuf.fd);
385 		kill_proc(proc, 0);
386 		wait_for_child(proc->pid);
387 		free(proc);
388 		proc = NULL;
389 	}
390 
391 	if (gotd_imsg_compose_event(&listen_proc->iev,
392 	    GOTD_IMSG_DISCONNECT, PROC_GOTD, -1,
393 	    &idisconnect, sizeof(idisconnect)) == -1)
394 		log_warn("imsg compose DISCONNECT");
395 
396 	slot = client_hash(client->id) % nitems(gotd_clients);
397 	STAILQ_REMOVE(&gotd_clients[slot], client, gotd_client, entry);
398 	imsg_clear(&client->iev.ibuf);
399 	event_del(&client->iev.ev);
400 	evtimer_del(&client->tmo);
401 	close(client->fd);
402 	if (client->delta_cache_fd != -1)
403 		close(client->delta_cache_fd);
404 	if (client->packfile_path) {
405 		if (unlink(client->packfile_path) == -1 && errno != ENOENT)
406 			log_warn("unlink %s: ", client->packfile_path);
407 		free(client->packfile_path);
408 	}
409 	if (client->packidx_path) {
410 		if (unlink(client->packidx_path) == -1 && errno != ENOENT)
411 			log_warn("unlink %s: ", client->packidx_path);
412 		free(client->packidx_path);
413 	}
414 	free(client->capabilities);
415 	free(client);
416 	client_cnt--;
417 }
418 
419 static void
420 disconnect_on_error(struct gotd_client *client, const struct got_error *err)
421 {
422 	struct imsgbuf ibuf;
423 
424 	log_warnx("uid %d: %s", client->euid, err->msg);
425 	if (err->code != GOT_ERR_EOF) {
426 		imsg_init(&ibuf, client->fd);
427 		gotd_imsg_send_error(&ibuf, 0, PROC_GOTD, err);
428 		imsg_clear(&ibuf);
429 	}
430 	disconnect(client);
431 }
432 
433 static const struct got_error *
434 send_repo_info(struct gotd_imsgev *iev, struct gotd_repo *repo)
435 {
436 	const struct got_error *err = NULL;
437 	struct gotd_imsg_info_repo irepo;
438 
439 	memset(&irepo, 0, sizeof(irepo));
440 
441 	if (strlcpy(irepo.repo_name, repo->name, sizeof(irepo.repo_name))
442 	    >= sizeof(irepo.repo_name))
443 		return got_error_msg(GOT_ERR_NO_SPACE, "repo name too long");
444 	if (strlcpy(irepo.repo_path, repo->path, sizeof(irepo.repo_path))
445 	    >= sizeof(irepo.repo_path))
446 		return got_error_msg(GOT_ERR_NO_SPACE, "repo path too long");
447 
448 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_INFO_REPO, PROC_GOTD, -1,
449 	    &irepo, sizeof(irepo)) == -1) {
450 		err = got_error_from_errno("imsg compose INFO_REPO");
451 		if (err)
452 			return err;
453 	}
454 
455 	return NULL;
456 }
457 
458 static const struct got_error *
459 send_capability(struct gotd_client_capability *capa, struct gotd_imsgev* iev)
460 {
461 	const struct got_error *err = NULL;
462 	struct gotd_imsg_capability icapa;
463 	size_t len;
464 	struct ibuf *wbuf;
465 
466 	memset(&icapa, 0, sizeof(icapa));
467 
468 	icapa.key_len = strlen(capa->key);
469 	len = sizeof(icapa) + icapa.key_len;
470 	if (capa->value) {
471 		icapa.value_len = strlen(capa->value);
472 		len += icapa.value_len;
473 	}
474 
475 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_CAPABILITY, 0, 0, len);
476 	if (wbuf == NULL) {
477 		err = got_error_from_errno("imsg_create CAPABILITY");
478 		return err;
479 	}
480 
481 	if (imsg_add(wbuf, &icapa, sizeof(icapa)) == -1)
482 		return got_error_from_errno("imsg_add CAPABILITY");
483 	if (imsg_add(wbuf, capa->key, icapa.key_len) == -1)
484 		return got_error_from_errno("imsg_add CAPABILITY");
485 	if (capa->value) {
486 		if (imsg_add(wbuf, capa->value, icapa.value_len) == -1)
487 			return got_error_from_errno("imsg_add CAPABILITY");
488 	}
489 
490 	wbuf->fd = -1;
491 	imsg_close(&iev->ibuf, wbuf);
492 
493 	gotd_imsg_event_add(iev);
494 
495 	return NULL;
496 }
497 
498 static const struct got_error *
499 send_client_info(struct gotd_imsgev *iev, struct gotd_client *client)
500 {
501 	const struct got_error *err = NULL;
502 	struct gotd_imsg_info_client iclient;
503 	struct gotd_child_proc *proc;
504 	size_t i;
505 
506 	memset(&iclient, 0, sizeof(iclient));
507 	iclient.euid = client->euid;
508 	iclient.egid = client->egid;
509 
510 	proc = get_client_proc(client);
511 	if (proc) {
512 		if (strlcpy(iclient.repo_name, proc->repo_path,
513 		    sizeof(iclient.repo_name)) >= sizeof(iclient.repo_name)) {
514 			return got_error_msg(GOT_ERR_NO_SPACE,
515 			    "repo name too long");
516 		}
517 		if (client_is_writing(client))
518 			iclient.is_writing = 1;
519 	}
520 
521 	iclient.state = client->state;
522 	iclient.ncapabilities = client->ncapabilities;
523 
524 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_INFO_CLIENT, PROC_GOTD, -1,
525 	    &iclient, sizeof(iclient)) == -1) {
526 		err = got_error_from_errno("imsg compose INFO_CLIENT");
527 		if (err)
528 			return err;
529 	}
530 
531 	for (i = 0; i < client->ncapabilities; i++) {
532 		struct gotd_client_capability *capa;
533 		capa = &client->capabilities[i];
534 		err = send_capability(capa, iev);
535 		if (err)
536 			return err;
537 	}
538 
539 	return NULL;
540 }
541 
542 static const struct got_error *
543 send_info(struct gotd_client *client)
544 {
545 	const struct got_error *err = NULL;
546 	struct gotd_imsg_info info;
547 	uint64_t slot;
548 	struct gotd_repo *repo;
549 
550 	info.pid = gotd.pid;
551 	info.verbosity = gotd.verbosity;
552 	info.nrepos = gotd.nrepos;
553 	info.nclients = client_cnt - 1;
554 
555 	if (gotd_imsg_compose_event(&client->iev, GOTD_IMSG_INFO, PROC_GOTD, -1,
556 	    &info, sizeof(info)) == -1) {
557 		err = got_error_from_errno("imsg compose INFO");
558 		if (err)
559 			return err;
560 	}
561 
562 	TAILQ_FOREACH(repo, &gotd.repos, entry) {
563 		err = send_repo_info(&client->iev, repo);
564 		if (err)
565 			return err;
566 	}
567 
568 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
569 		struct gotd_client *c;
570 		STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
571 			if (c->id == client->id)
572 				continue;
573 			err = send_client_info(&client->iev, c);
574 			if (err)
575 				return err;
576 		}
577 	}
578 
579 	return NULL;
580 }
581 
582 static const struct got_error *
583 stop_gotd(struct gotd_client *client)
584 {
585 
586 	if (client->euid != 0)
587 		return got_error_set_errno(EPERM, "stop");
588 
589 	gotd_shutdown();
590 	/* NOTREACHED */
591 	return NULL;
592 }
593 
594 static struct gotd_repo *
595 find_repo_by_name(const char *repo_name)
596 {
597 	struct gotd_repo *repo;
598 	size_t namelen;
599 
600 	TAILQ_FOREACH(repo, &gotd.repos, entry) {
601 		namelen = strlen(repo->name);
602 		if (strncmp(repo->name, repo_name, namelen) != 0)
603 			continue;
604 		if (repo_name[namelen] == '\0' ||
605 		    strcmp(&repo_name[namelen], ".git") == 0)
606 			return repo;
607 	}
608 
609 	return NULL;
610 }
611 
612 static const struct got_error *
613 start_client_session(struct gotd_client *client, struct imsg *imsg)
614 {
615 	const struct got_error *err;
616 	struct gotd_imsg_list_refs ireq;
617 	struct gotd_repo *repo = NULL;
618 	size_t datalen;
619 
620 	log_debug("list-refs request from uid %d", client->euid);
621 
622 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
623 	if (datalen != sizeof(ireq))
624 		return got_error(GOT_ERR_PRIVSEP_LEN);
625 
626 	memcpy(&ireq, imsg->data, datalen);
627 
628 	if (ireq.client_is_reading) {
629 		err = ensure_client_is_not_writing(client);
630 		if (err)
631 			return err;
632 		repo = find_repo_by_name(ireq.repo_name);
633 		if (repo == NULL)
634 			return got_error(GOT_ERR_NOT_GIT_REPO);
635 		err = start_auth_child(client, GOTD_AUTH_READ, repo,
636 		    gotd.argv0, gotd.confpath, gotd.daemonize,
637 		    gotd.verbosity);
638 		if (err)
639 			return err;
640 	} else {
641 		err = ensure_client_is_not_reading(client);
642 		if (err)
643 			return err;
644 		repo = find_repo_by_name(ireq.repo_name);
645 		if (repo == NULL)
646 			return got_error(GOT_ERR_NOT_GIT_REPO);
647 		err = start_auth_child(client,
648 		    GOTD_AUTH_READ | GOTD_AUTH_WRITE,
649 		    repo, gotd.argv0, gotd.confpath, gotd.daemonize,
650 		    gotd.verbosity);
651 		if (err)
652 			return err;
653 	}
654 
655 	/* Flow continues upon authentication successs/failure or timeout. */
656 	return NULL;
657 }
658 
659 static const struct got_error *
660 forward_want(struct gotd_client *client, struct imsg *imsg)
661 {
662 	struct gotd_imsg_want ireq;
663 	struct gotd_imsg_want iwant;
664 	size_t datalen;
665 
666 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
667 	if (datalen != sizeof(ireq))
668 		return got_error(GOT_ERR_PRIVSEP_LEN);
669 
670 	memcpy(&ireq, imsg->data, datalen);
671 
672 	memset(&iwant, 0, sizeof(iwant));
673 	memcpy(iwant.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
674 	iwant.client_id = client->id;
675 
676 	if (gotd_imsg_compose_event(&client->repo_read->iev, GOTD_IMSG_WANT,
677 	    PROC_GOTD, -1, &iwant, sizeof(iwant)) == -1)
678 		return got_error_from_errno("imsg compose WANT");
679 
680 	return NULL;
681 }
682 
683 static const struct got_error *
684 forward_ref_update(struct gotd_client *client, struct imsg *imsg)
685 {
686 	const struct got_error *err = NULL;
687 	struct gotd_imsg_ref_update ireq;
688 	struct gotd_imsg_ref_update *iref = NULL;
689 	size_t datalen;
690 
691 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
692 	if (datalen < sizeof(ireq))
693 		return got_error(GOT_ERR_PRIVSEP_LEN);
694 	memcpy(&ireq, imsg->data, sizeof(ireq));
695 	if (datalen != sizeof(ireq) + ireq.name_len)
696 		return got_error(GOT_ERR_PRIVSEP_LEN);
697 
698 	iref = malloc(datalen);
699 	if (iref == NULL)
700 		return got_error_from_errno("malloc");
701 	memcpy(iref, imsg->data, datalen);
702 
703 	iref->client_id = client->id;
704 	if (gotd_imsg_compose_event(&client->repo_write->iev,
705 	    GOTD_IMSG_REF_UPDATE, PROC_GOTD, -1, iref, datalen) == -1)
706 		err = got_error_from_errno("imsg compose REF_UPDATE");
707 	free(iref);
708 	return err;
709 }
710 
711 static const struct got_error *
712 forward_have(struct gotd_client *client, struct imsg *imsg)
713 {
714 	struct gotd_imsg_have ireq;
715 	struct gotd_imsg_have ihave;
716 	size_t datalen;
717 
718 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
719 	if (datalen != sizeof(ireq))
720 		return got_error(GOT_ERR_PRIVSEP_LEN);
721 
722 	memcpy(&ireq, imsg->data, datalen);
723 
724 	memset(&ihave, 0, sizeof(ihave));
725 	memcpy(ihave.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
726 	ihave.client_id = client->id;
727 
728 	if (gotd_imsg_compose_event(&client->repo_read->iev, GOTD_IMSG_HAVE,
729 	    PROC_GOTD, -1, &ihave, sizeof(ihave)) == -1)
730 		return got_error_from_errno("imsg compose HAVE");
731 
732 	return NULL;
733 }
734 
735 static int
736 client_has_capability(struct gotd_client *client, const char *capastr)
737 {
738 	struct gotd_client_capability *capa;
739 	size_t i;
740 
741 	if (client->ncapabilities == 0)
742 		return 0;
743 
744 	for (i = 0; i < client->ncapabilities; i++) {
745 		capa = &client->capabilities[i];
746 		if (strcmp(capa->key, capastr) == 0)
747 			return 1;
748 	}
749 
750 	return 0;
751 }
752 
753 static const struct got_error *
754 recv_capabilities(struct gotd_client *client, struct imsg *imsg)
755 {
756 	struct gotd_imsg_capabilities icapas;
757 	size_t datalen;
758 
759 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
760 	if (datalen != sizeof(icapas))
761 		return got_error(GOT_ERR_PRIVSEP_LEN);
762 	memcpy(&icapas, imsg->data, sizeof(icapas));
763 
764 	client->ncapa_alloc = icapas.ncapabilities;
765 	client->capabilities = calloc(client->ncapa_alloc,
766 	    sizeof(*client->capabilities));
767 	if (client->capabilities == NULL) {
768 		client->ncapa_alloc = 0;
769 		return got_error_from_errno("calloc");
770 	}
771 
772 	log_debug("expecting %zu capabilities from uid %d",
773 	    client->ncapa_alloc, client->euid);
774 	return NULL;
775 }
776 
777 static const struct got_error *
778 recv_capability(struct gotd_client *client, struct imsg *imsg)
779 {
780 	struct gotd_imsg_capability icapa;
781 	struct gotd_client_capability *capa;
782 	size_t datalen;
783 	char *key, *value = NULL;
784 
785 	if (client->capabilities == NULL ||
786 	    client->ncapabilities >= client->ncapa_alloc) {
787 		return got_error_msg(GOT_ERR_BAD_REQUEST,
788 		    "unexpected capability received");
789 	}
790 
791 	memset(&icapa, 0, sizeof(icapa));
792 
793 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
794 	if (datalen < sizeof(icapa))
795 		return got_error(GOT_ERR_PRIVSEP_LEN);
796 	memcpy(&icapa, imsg->data, sizeof(icapa));
797 
798 	if (datalen != sizeof(icapa) + icapa.key_len + icapa.value_len)
799 		return got_error(GOT_ERR_PRIVSEP_LEN);
800 
801 	key = malloc(icapa.key_len + 1);
802 	if (key == NULL)
803 		return got_error_from_errno("malloc");
804 	if (icapa.value_len > 0) {
805 		value = malloc(icapa.value_len + 1);
806 		if (value == NULL) {
807 			free(key);
808 			return got_error_from_errno("malloc");
809 		}
810 	}
811 
812 	memcpy(key, imsg->data + sizeof(icapa), icapa.key_len);
813 	key[icapa.key_len] = '\0';
814 	if (value) {
815 		memcpy(value, imsg->data + sizeof(icapa) + icapa.key_len,
816 		    icapa.value_len);
817 		value[icapa.value_len] = '\0';
818 	}
819 
820 	capa = &client->capabilities[client->ncapabilities++];
821 	capa->key = key;
822 	capa->value = value;
823 
824 	if (value)
825 		log_debug("uid %d: capability %s=%s", client->euid, key, value);
826 	else
827 		log_debug("uid %d: capability %s", client->euid, key);
828 
829 	return NULL;
830 }
831 
832 static const struct got_error *
833 send_packfile(struct gotd_client *client)
834 {
835 	const struct got_error *err = NULL;
836 	struct gotd_imsg_send_packfile ipack;
837 	struct gotd_imsg_packfile_pipe ipipe;
838 	int pipe[2];
839 
840 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
841 		return got_error_from_errno("socketpair");
842 
843 	memset(&ipack, 0, sizeof(ipack));
844 	memset(&ipipe, 0, sizeof(ipipe));
845 
846 	ipack.client_id = client->id;
847 	if (client_has_capability(client, GOT_CAPA_SIDE_BAND_64K))
848 		ipack.report_progress = 1;
849 
850 	client->delta_cache_fd = got_opentempfd();
851 	if (client->delta_cache_fd == -1)
852 		return got_error_from_errno("got_opentempfd");
853 
854 	if (gotd_imsg_compose_event(&client->repo_read->iev,
855 	    GOTD_IMSG_SEND_PACKFILE, PROC_GOTD, client->delta_cache_fd,
856 	    &ipack, sizeof(ipack)) == -1) {
857 		err = got_error_from_errno("imsg compose SEND_PACKFILE");
858 		close(pipe[0]);
859 		close(pipe[1]);
860 		return err;
861 	}
862 
863 	ipipe.client_id = client->id;
864 
865 	/* Send pack pipe end 0 to repo_read. */
866 	if (gotd_imsg_compose_event(&client->repo_read->iev,
867 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD, pipe[0],
868 	        &ipipe, sizeof(ipipe)) == -1) {
869 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
870 		close(pipe[1]);
871 		return err;
872 	}
873 
874 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
875 	if (gotd_imsg_compose_event(&client->iev,
876 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD, pipe[1], NULL, 0) == -1)
877 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
878 
879 	return err;
880 }
881 
882 static const struct got_error *
883 recv_packfile(struct gotd_client *client)
884 {
885 	const struct got_error *err = NULL;
886 	struct gotd_imsg_recv_packfile ipack;
887 	struct gotd_imsg_packfile_pipe ipipe;
888 	struct gotd_imsg_packidx_file ifile;
889 	char *basepath = NULL, *pack_path = NULL, *idx_path = NULL;
890 	int packfd = -1, idxfd = -1;
891 	int pipe[2] = { -1, -1 };
892 
893 	if (client->packfile_path) {
894 		return got_error_fmt(GOT_ERR_PRIVSEP_MSG,
895 		    "uid %d already has a pack file", client->euid);
896 	}
897 
898 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
899 		return got_error_from_errno("socketpair");
900 
901 	memset(&ipipe, 0, sizeof(ipipe));
902 	ipipe.client_id = client->id;
903 
904 	if (gotd_imsg_compose_event(&client->repo_write->iev,
905 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD, pipe[0],
906 	        &ipipe, sizeof(ipipe)) == -1) {
907 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
908 		pipe[0] = -1;
909 		goto done;
910 	}
911 	pipe[0] = -1;
912 
913 	if (gotd_imsg_compose_event(&client->repo_write->iev,
914 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD, pipe[1],
915 	        &ipipe, sizeof(ipipe)) == -1)
916 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
917 	pipe[1] = -1;
918 
919 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.pack",
920 	    client->repo_write->repo_path, GOT_OBJECTS_PACK_DIR,
921 	    client->euid) == -1) {
922 		err = got_error_from_errno("asprintf");
923 		goto done;
924 	}
925 
926 	err = got_opentemp_named_fd(&pack_path, &packfd, basepath, "");
927 	if (err)
928 		goto done;
929 
930 	free(basepath);
931 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.idx",
932 	    client->repo_write->repo_path, GOT_OBJECTS_PACK_DIR,
933 	    client->euid) == -1) {
934 		err = got_error_from_errno("asprintf");
935 		basepath = NULL;
936 		goto done;
937 	}
938 	err = got_opentemp_named_fd(&idx_path, &idxfd, basepath, "");
939 	if (err)
940 		goto done;
941 
942 	memset(&ifile, 0, sizeof(ifile));
943 	ifile.client_id = client->id;
944 	if (gotd_imsg_compose_event(&client->repo_write->iev,
945 	    GOTD_IMSG_PACKIDX_FILE, PROC_GOTD, idxfd,
946 	    &ifile, sizeof(ifile)) == -1) {
947 		err = got_error_from_errno("imsg compose PACKIDX_FILE");
948 		idxfd = -1;
949 		goto done;
950 	}
951 	idxfd = -1;
952 
953 	memset(&ipack, 0, sizeof(ipack));
954 	ipack.client_id = client->id;
955 	if (client_has_capability(client, GOT_CAPA_REPORT_STATUS))
956 		ipack.report_status = 1;
957 
958 	if (gotd_imsg_compose_event(&client->repo_write->iev,
959 	    GOTD_IMSG_RECV_PACKFILE, PROC_GOTD, packfd,
960 	    &ipack, sizeof(ipack)) == -1) {
961 		err = got_error_from_errno("imsg compose RECV_PACKFILE");
962 		packfd = -1;
963 		goto done;
964 	}
965 	packfd = -1;
966 
967 done:
968 	free(basepath);
969 	if (pipe[0] != -1 && close(pipe[0]) == -1 && err == NULL)
970 		err = got_error_from_errno("close");
971 	if (pipe[1] != -1 && close(pipe[1]) == -1 && err == NULL)
972 		err = got_error_from_errno("close");
973 	if (packfd != -1 && close(packfd) == -1 && err == NULL)
974 		err = got_error_from_errno("close");
975 	if (idxfd != -1 && close(idxfd) == -1 && err == NULL)
976 		err = got_error_from_errno("close");
977 	if (err) {
978 		free(pack_path);
979 		free(idx_path);
980 	} else {
981 		client->packfile_path = pack_path;
982 		client->packidx_path = idx_path;
983 	}
984 	return err;
985 }
986 
987 static void
988 gotd_request(int fd, short events, void *arg)
989 {
990 	struct gotd_imsgev *iev = arg;
991 	struct imsgbuf *ibuf = &iev->ibuf;
992 	struct gotd_client *client = iev->handler_arg;
993 	const struct got_error *err = NULL;
994 	struct imsg imsg;
995 	ssize_t n;
996 
997 	if (events & EV_WRITE) {
998 		while (ibuf->w.queued) {
999 			n = msgbuf_write(&ibuf->w);
1000 			if (n == -1 && errno == EPIPE) {
1001 				/*
1002 				 * The client has closed its socket.
1003 				 * This can happen when Git clients are
1004 				 * done sending pack file data.
1005 				 */
1006 				msgbuf_clear(&ibuf->w);
1007 				continue;
1008 			} else if (n == -1 && errno != EAGAIN) {
1009 				err = got_error_from_errno("imsg_flush");
1010 				disconnect_on_error(client, err);
1011 				return;
1012 			}
1013 			if (n == 0) {
1014 				/* Connection closed. */
1015 				err = got_error(GOT_ERR_EOF);
1016 				disconnect_on_error(client, err);
1017 				return;
1018 			}
1019 		}
1020 
1021 		/* Disconnect gotctl(8) now that messages have been sent. */
1022 		if (!client_is_reading(client) && !client_is_writing(client)) {
1023 			disconnect(client);
1024 			return;
1025 		}
1026 	}
1027 
1028 	if ((events & EV_READ) == 0)
1029 		return;
1030 
1031 	memset(&imsg, 0, sizeof(imsg));
1032 
1033 	while (err == NULL) {
1034 		err = gotd_imsg_recv(&imsg, ibuf, 0);
1035 		if (err) {
1036 			if (err->code == GOT_ERR_PRIVSEP_READ)
1037 				err = NULL;
1038 			break;
1039 		}
1040 
1041 		evtimer_del(&client->tmo);
1042 
1043 		switch (imsg.hdr.type) {
1044 		case GOTD_IMSG_INFO:
1045 			err = send_info(client);
1046 			break;
1047 		case GOTD_IMSG_STOP:
1048 			err = stop_gotd(client);
1049 			break;
1050 		case GOTD_IMSG_LIST_REFS:
1051 			if (client->state != GOTD_STATE_EXPECT_LIST_REFS) {
1052 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1053 				    "unexpected list-refs request received");
1054 				break;
1055 			}
1056 			err = start_client_session(client, &imsg);
1057 			if (err)
1058 				break;
1059 			break;
1060 		case GOTD_IMSG_CAPABILITIES:
1061 			if (client->state != GOTD_STATE_EXPECT_CAPABILITIES) {
1062 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1063 				    "unexpected capabilities received");
1064 				break;
1065 			}
1066 			log_debug("receiving capabilities from uid %d",
1067 			    client->euid);
1068 			err = recv_capabilities(client, &imsg);
1069 			break;
1070 		case GOTD_IMSG_CAPABILITY:
1071 			if (client->state != GOTD_STATE_EXPECT_CAPABILITIES) {
1072 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1073 				    "unexpected capability received");
1074 				break;
1075 			}
1076 			err = recv_capability(client, &imsg);
1077 			if (err || client->ncapabilities < client->ncapa_alloc)
1078 				break;
1079 			if (client_is_reading(client)) {
1080 				client->state = GOTD_STATE_EXPECT_WANT;
1081 				log_debug("uid %d: expecting want-lines",
1082 				    client->euid);
1083 			} else if (client_is_writing(client)) {
1084 				client->state = GOTD_STATE_EXPECT_REF_UPDATE;
1085 				log_debug("uid %d: expecting ref-update-lines",
1086 				    client->euid);
1087 			} else
1088 				fatalx("client %d is both reading and writing",
1089 				    client->euid);
1090 			break;
1091 		case GOTD_IMSG_WANT:
1092 			if (client->state != GOTD_STATE_EXPECT_WANT) {
1093 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1094 				    "unexpected want-line received");
1095 				break;
1096 			}
1097 			log_debug("received want-line from uid %d",
1098 			    client->euid);
1099 			err = ensure_client_is_reading(client);
1100 			if (err)
1101 				break;
1102 			err = forward_want(client, &imsg);
1103 			break;
1104 		case GOTD_IMSG_REF_UPDATE:
1105 			if (client->state != GOTD_STATE_EXPECT_REF_UPDATE) {
1106 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1107 				    "unexpected ref-update-line received");
1108 				break;
1109 			}
1110 			log_debug("received ref-update-line from uid %d",
1111 			    client->euid);
1112 			err = ensure_client_is_writing(client);
1113 			if (err)
1114 				break;
1115 			err = forward_ref_update(client, &imsg);
1116 			if (err)
1117 				break;
1118 			client->state = GOTD_STATE_EXPECT_MORE_REF_UPDATES;
1119 			break;
1120 		case GOTD_IMSG_HAVE:
1121 			if (client->state != GOTD_STATE_EXPECT_HAVE) {
1122 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1123 				    "unexpected have-line received");
1124 				break;
1125 			}
1126 			log_debug("received have-line from uid %d",
1127 			    client->euid);
1128 			err = ensure_client_is_reading(client);
1129 			if (err)
1130 				break;
1131 			err = forward_have(client, &imsg);
1132 			if (err)
1133 				break;
1134 			break;
1135 		case GOTD_IMSG_FLUSH:
1136 			if (client->state == GOTD_STATE_EXPECT_WANT ||
1137 			    client->state == GOTD_STATE_EXPECT_HAVE) {
1138 				err = ensure_client_is_reading(client);
1139 				if (err)
1140 					break;
1141 			} else if (client->state ==
1142 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1143 				err = ensure_client_is_writing(client);
1144 				if (err)
1145 					break;
1146 			} else {
1147 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1148 				    "unexpected flush-pkt received");
1149 				break;
1150 			}
1151 			log_debug("received flush-pkt from uid %d",
1152 			    client->euid);
1153 			if (client->state == GOTD_STATE_EXPECT_WANT) {
1154 				client->state = GOTD_STATE_EXPECT_HAVE;
1155 				log_debug("uid %d: expecting have-lines",
1156 				    client->euid);
1157 			} else if (client->state == GOTD_STATE_EXPECT_HAVE) {
1158 				client->state = GOTD_STATE_EXPECT_DONE;
1159 				log_debug("uid %d: expecting 'done'",
1160 				    client->euid);
1161 			} else if (client->state ==
1162 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1163 				client->state = GOTD_STATE_EXPECT_PACKFILE;
1164 				log_debug("uid %d: expecting packfile",
1165 				    client->euid);
1166 				err = recv_packfile(client);
1167 			} else {
1168 				/* should not happen, see above */
1169 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1170 				    "unexpected client state");
1171 				break;
1172 			}
1173 			break;
1174 		case GOTD_IMSG_DONE:
1175 			if (client->state != GOTD_STATE_EXPECT_HAVE &&
1176 			    client->state != GOTD_STATE_EXPECT_DONE) {
1177 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1178 				    "unexpected flush-pkt received");
1179 				break;
1180 			}
1181 			log_debug("received 'done' from uid %d", client->euid);
1182 			err = ensure_client_is_reading(client);
1183 			if (err)
1184 				break;
1185 			client->state = GOTD_STATE_DONE;
1186 			err = send_packfile(client);
1187 			break;
1188 		default:
1189 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1190 			break;
1191 		}
1192 
1193 		imsg_free(&imsg);
1194 	}
1195 
1196 	if (err) {
1197 		if (err->code != GOT_ERR_EOF ||
1198 		    client->state != GOTD_STATE_EXPECT_PACKFILE)
1199 			disconnect_on_error(client, err);
1200 	} else {
1201 		gotd_imsg_event_add(&client->iev);
1202 		if (client->state == GOTD_STATE_EXPECT_LIST_REFS)
1203 			evtimer_add(&client->tmo, &auth_timeout);
1204 		else
1205 			evtimer_add(&client->tmo, &gotd.request_timeout);
1206 	}
1207 }
1208 
1209 static void
1210 gotd_request_timeout(int fd, short events, void *arg)
1211 {
1212 	struct gotd_client *client = arg;
1213 
1214 	log_debug("disconnecting uid %d due to timeout", client->euid);
1215 	disconnect(client);
1216 }
1217 
1218 static const struct got_error *
1219 recv_connect(uint32_t *client_id, struct imsg *imsg)
1220 {
1221 	const struct got_error *err = NULL;
1222 	struct gotd_imsg_connect iconnect;
1223 	size_t datalen;
1224 	int s = -1;
1225 	struct gotd_client *client = NULL;
1226 
1227 	*client_id = 0;
1228 
1229 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1230 	if (datalen != sizeof(iconnect))
1231 		return got_error(GOT_ERR_PRIVSEP_LEN);
1232 	memcpy(&iconnect, imsg->data, sizeof(iconnect));
1233 
1234 	s = imsg->fd;
1235 	if (s == -1) {
1236 		err = got_error(GOT_ERR_PRIVSEP_NO_FD);
1237 		goto done;
1238 	}
1239 
1240 	if (find_client(iconnect.client_id)) {
1241 		err = got_error_msg(GOT_ERR_CLIENT_ID, "duplicate client ID");
1242 		goto done;
1243 	}
1244 
1245 	client = calloc(1, sizeof(*client));
1246 	if (client == NULL) {
1247 		err = got_error_from_errno("calloc");
1248 		goto done;
1249 	}
1250 
1251 	*client_id = iconnect.client_id;
1252 
1253 	client->state = GOTD_STATE_EXPECT_LIST_REFS;
1254 	client->id = iconnect.client_id;
1255 	client->fd = s;
1256 	s = -1;
1257 	client->delta_cache_fd = -1;
1258 	/* The auth process will verify UID/GID for us. */
1259 	client->euid = iconnect.euid;
1260 	client->egid = iconnect.egid;
1261 	client->nref_updates = -1;
1262 
1263 	imsg_init(&client->iev.ibuf, client->fd);
1264 	client->iev.handler = gotd_request;
1265 	client->iev.events = EV_READ;
1266 	client->iev.handler_arg = client;
1267 
1268 	event_set(&client->iev.ev, client->fd, EV_READ, gotd_request,
1269 	    &client->iev);
1270 	gotd_imsg_event_add(&client->iev);
1271 
1272 	evtimer_set(&client->tmo, gotd_request_timeout, client);
1273 
1274 	add_client(client);
1275 	log_debug("%s: new client uid %d connected on fd %d", __func__,
1276 	    client->euid, client->fd);
1277 done:
1278 	if (err) {
1279 		struct gotd_child_proc *listen_proc = &gotd.listen_proc;
1280 		struct gotd_imsg_disconnect idisconnect;
1281 
1282 		idisconnect.client_id = client->id;
1283 		if (gotd_imsg_compose_event(&listen_proc->iev,
1284 		    GOTD_IMSG_DISCONNECT, PROC_GOTD, -1,
1285 		    &idisconnect, sizeof(idisconnect)) == -1)
1286 			log_warn("imsg compose DISCONNECT");
1287 
1288 		if (s != -1)
1289 			close(s);
1290 	}
1291 
1292 	return err;
1293 }
1294 
1295 static const char *gotd_proc_names[PROC_MAX] = {
1296 	"parent",
1297 	"listen",
1298 	"auth",
1299 	"repo_read",
1300 	"repo_write"
1301 };
1302 
1303 static void
1304 kill_proc(struct gotd_child_proc *proc, int fatal)
1305 {
1306 	if (fatal) {
1307 		log_warnx("sending SIGKILL to PID %d", proc->pid);
1308 		kill(proc->pid, SIGKILL);
1309 	} else
1310 		kill(proc->pid, SIGTERM);
1311 }
1312 
1313 static void
1314 gotd_shutdown(void)
1315 {
1316 	struct gotd_child_proc *proc;
1317 	uint64_t slot;
1318 
1319 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
1320 		struct gotd_client *c, *tmp;
1321 
1322 		STAILQ_FOREACH_SAFE(c, &gotd_clients[slot], entry, tmp)
1323 			disconnect(c);
1324 	}
1325 
1326 	proc = &gotd.listen_proc;
1327 	msgbuf_clear(&proc->iev.ibuf.w);
1328 	close(proc->iev.ibuf.fd);
1329 	kill_proc(proc, 0);
1330 	wait_for_child(proc->pid);
1331 
1332 	log_info("terminating");
1333 	exit(0);
1334 }
1335 
1336 void
1337 gotd_sighdlr(int sig, short event, void *arg)
1338 {
1339 	/*
1340 	 * Normal signal handler rules don't apply because libevent
1341 	 * decouples for us.
1342 	 */
1343 
1344 	switch (sig) {
1345 	case SIGHUP:
1346 		log_info("%s: ignoring SIGHUP", __func__);
1347 		break;
1348 	case SIGUSR1:
1349 		log_info("%s: ignoring SIGUSR1", __func__);
1350 		break;
1351 	case SIGTERM:
1352 	case SIGINT:
1353 		gotd_shutdown();
1354 		log_warnx("gotd terminating");
1355 		exit(0);
1356 		break;
1357 	default:
1358 		fatalx("unexpected signal");
1359 	}
1360 }
1361 
1362 static const struct got_error *
1363 ensure_proc_is_reading(struct gotd_client *client,
1364     struct gotd_child_proc *proc)
1365 {
1366 	if (!client_is_reading(client)) {
1367 		kill_proc(proc, 1);
1368 		return got_error_fmt(GOT_ERR_BAD_PACKET,
1369 		    "PID %d handled a read-request for uid %d but this "
1370 		    "user is not reading from a repository", proc->pid,
1371 		    client->euid);
1372 	}
1373 
1374 	return NULL;
1375 }
1376 
1377 static const struct got_error *
1378 ensure_proc_is_writing(struct gotd_client *client,
1379     struct gotd_child_proc *proc)
1380 {
1381 	if (!client_is_writing(client)) {
1382 		kill_proc(proc, 1);
1383 		return got_error_fmt(GOT_ERR_BAD_PACKET,
1384 		    "PID %d handled a write-request for uid %d but this "
1385 		    "user is not writing to a repository", proc->pid,
1386 		    client->euid);
1387 	}
1388 
1389 	return NULL;
1390 }
1391 
1392 static int
1393 verify_imsg_src(struct gotd_client *client, struct gotd_child_proc *proc,
1394     struct imsg *imsg)
1395 {
1396 	const struct got_error *err;
1397 	struct gotd_child_proc *client_proc;
1398 	int ret = 0;
1399 
1400 	if (proc->type == PROC_REPO_READ || proc->type == PROC_REPO_WRITE) {
1401 		client_proc = get_client_proc(client);
1402 		if (client_proc == NULL)
1403 			fatalx("no process found for uid %d", client->euid);
1404 		if (proc->pid != client_proc->pid) {
1405 			kill_proc(proc, 1);
1406 			log_warnx("received message from PID %d for uid %d, "
1407 			    "while PID %d is the process serving this user",
1408 			    proc->pid, client->euid, client_proc->pid);
1409 			return 0;
1410 		}
1411 	}
1412 
1413 	switch (imsg->hdr.type) {
1414 	case GOTD_IMSG_ERROR:
1415 		ret = 1;
1416 		break;
1417 	case GOTD_IMSG_CONNECT:
1418 		if (proc->type != PROC_LISTEN) {
1419 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
1420 			    "new connection for uid %d from PID %d "
1421 			    "which is not the listen process",
1422 			    proc->pid, client->euid);
1423 		} else
1424 			ret = 1;
1425 		break;
1426 	case GOTD_IMSG_ACCESS_GRANTED:
1427 		if (proc->type != PROC_AUTH) {
1428 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
1429 			    "authentication of uid %d from PID %d "
1430 			    "which is not the auth process",
1431 			    proc->pid, client->euid);
1432 		} else
1433 			ret = 1;
1434 		break;
1435 	case GOTD_IMSG_REPO_CHILD_READY:
1436 		if (proc->type != PROC_REPO_READ &&
1437 		    proc->type != PROC_REPO_WRITE) {
1438 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
1439 			    "unexpected \"ready\" signal from PID %d",
1440 			    proc->pid);
1441 		} else
1442 			ret = 1;
1443 		break;
1444 	case GOTD_IMSG_PACKFILE_DONE:
1445 		err = ensure_proc_is_reading(client, proc);
1446 		if (err)
1447 			log_warnx("uid %d: %s", client->euid, err->msg);
1448 		else
1449 			ret = 1;
1450 		break;
1451 	case GOTD_IMSG_PACKFILE_INSTALL:
1452 	case GOTD_IMSG_REF_UPDATES_START:
1453 	case GOTD_IMSG_REF_UPDATE:
1454 		err = ensure_proc_is_writing(client, proc);
1455 		if (err)
1456 			log_warnx("uid %d: %s", client->euid, err->msg);
1457 		else
1458 			ret = 1;
1459 		break;
1460 	default:
1461 		log_debug("%s: unexpected imsg %d", __func__, imsg->hdr.type);
1462 		break;
1463 	}
1464 
1465 	return ret;
1466 }
1467 
1468 static const struct got_error *
1469 list_refs_request(struct gotd_client *client, struct gotd_imsgev *iev)
1470 {
1471 	static const struct got_error *err;
1472 	struct gotd_imsg_list_refs_internal ilref;
1473 	int fd;
1474 
1475 	memset(&ilref, 0, sizeof(ilref));
1476 	ilref.client_id = client->id;
1477 
1478 	fd = dup(client->fd);
1479 	if (fd == -1)
1480 		return got_error_from_errno("dup");
1481 
1482 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_LIST_REFS_INTERNAL,
1483 	    PROC_GOTD, fd, &ilref, sizeof(ilref)) == -1) {
1484 		err = got_error_from_errno("imsg compose WANT");
1485 		close(fd);
1486 		return err;
1487 	}
1488 
1489 	client->state = GOTD_STATE_EXPECT_CAPABILITIES;
1490 	log_debug("uid %d: expecting capabilities", client->euid);
1491 	return NULL;
1492 }
1493 
1494 static const struct got_error *
1495 recv_packfile_done(uint32_t *client_id, struct imsg *imsg)
1496 {
1497 	struct gotd_imsg_packfile_done idone;
1498 	size_t datalen;
1499 
1500 	log_debug("packfile-done received");
1501 
1502 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1503 	if (datalen != sizeof(idone))
1504 		return got_error(GOT_ERR_PRIVSEP_LEN);
1505 	memcpy(&idone, imsg->data, sizeof(idone));
1506 
1507 	*client_id = idone.client_id;
1508 	return NULL;
1509 }
1510 
1511 static const struct got_error *
1512 recv_packfile_install(uint32_t *client_id, struct imsg *imsg)
1513 {
1514 	struct gotd_imsg_packfile_install inst;
1515 	size_t datalen;
1516 
1517 	log_debug("packfile-install received");
1518 
1519 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1520 	if (datalen != sizeof(inst))
1521 		return got_error(GOT_ERR_PRIVSEP_LEN);
1522 	memcpy(&inst, imsg->data, sizeof(inst));
1523 
1524 	*client_id = inst.client_id;
1525 	return NULL;
1526 }
1527 
1528 static const struct got_error *
1529 recv_ref_updates_start(uint32_t *client_id, struct imsg *imsg)
1530 {
1531 	struct gotd_imsg_ref_updates_start istart;
1532 	size_t datalen;
1533 
1534 	log_debug("ref-updates-start received");
1535 
1536 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1537 	if (datalen != sizeof(istart))
1538 		return got_error(GOT_ERR_PRIVSEP_LEN);
1539 	memcpy(&istart, imsg->data, sizeof(istart));
1540 
1541 	*client_id = istart.client_id;
1542 	return NULL;
1543 }
1544 
1545 static const struct got_error *
1546 recv_ref_update(uint32_t *client_id, struct imsg *imsg)
1547 {
1548 	struct gotd_imsg_ref_update iref;
1549 	size_t datalen;
1550 
1551 	log_debug("ref-update received");
1552 
1553 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1554 	if (datalen < sizeof(iref))
1555 		return got_error(GOT_ERR_PRIVSEP_LEN);
1556 	memcpy(&iref, imsg->data, sizeof(iref));
1557 
1558 	*client_id = iref.client_id;
1559 	return NULL;
1560 }
1561 
1562 static const struct got_error *
1563 send_ref_update_ok(struct gotd_client *client,
1564     struct gotd_imsg_ref_update *iref, const char *refname)
1565 {
1566 	struct gotd_imsg_ref_update_ok iok;
1567 	struct ibuf *wbuf;
1568 	size_t len;
1569 
1570 	memset(&iok, 0, sizeof(iok));
1571 	iok.client_id = client->id;
1572 	memcpy(iok.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
1573 	memcpy(iok.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
1574 	iok.name_len = strlen(refname);
1575 
1576 	len = sizeof(iok) + iok.name_len;
1577 	wbuf = imsg_create(&client->iev.ibuf, GOTD_IMSG_REF_UPDATE_OK,
1578 	    PROC_GOTD, gotd.pid, len);
1579 	if (wbuf == NULL)
1580 		return got_error_from_errno("imsg_create REF_UPDATE_OK");
1581 
1582 	if (imsg_add(wbuf, &iok, sizeof(iok)) == -1)
1583 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
1584 	if (imsg_add(wbuf, refname, iok.name_len) == -1)
1585 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
1586 
1587 	wbuf->fd = -1;
1588 	imsg_close(&client->iev.ibuf, wbuf);
1589 	gotd_imsg_event_add(&client->iev);
1590 	return NULL;
1591 }
1592 
1593 static void
1594 send_refs_updated(struct gotd_client *client)
1595 {
1596 	if (gotd_imsg_compose_event(&client->iev,
1597 	    GOTD_IMSG_REFS_UPDATED, PROC_GOTD, -1, NULL, 0) == -1)
1598 		log_warn("imsg compose REFS_UPDATED");
1599 }
1600 
1601 static const struct got_error *
1602 send_ref_update_ng(struct gotd_client *client,
1603     struct gotd_imsg_ref_update *iref, const char *refname,
1604     const char *reason)
1605 {
1606 	const struct got_error *ng_err;
1607 	struct gotd_imsg_ref_update_ng ing;
1608 	struct ibuf *wbuf;
1609 	size_t len;
1610 
1611 	memset(&ing, 0, sizeof(ing));
1612 	ing.client_id = client->id;
1613 	memcpy(ing.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
1614 	memcpy(ing.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
1615 	ing.name_len = strlen(refname);
1616 
1617 	ng_err = got_error_fmt(GOT_ERR_REF_BUSY, "%s", reason);
1618 	ing.reason_len = strlen(ng_err->msg);
1619 
1620 	len = sizeof(ing) + ing.name_len + ing.reason_len;
1621 	wbuf = imsg_create(&client->iev.ibuf, GOTD_IMSG_REF_UPDATE_NG,
1622 	    PROC_GOTD, gotd.pid, len);
1623 	if (wbuf == NULL)
1624 		return got_error_from_errno("imsg_create REF_UPDATE_NG");
1625 
1626 	if (imsg_add(wbuf, &ing, sizeof(ing)) == -1)
1627 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
1628 	if (imsg_add(wbuf, refname, ing.name_len) == -1)
1629 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
1630 	if (imsg_add(wbuf, ng_err->msg, ing.reason_len) == -1)
1631 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
1632 
1633 	wbuf->fd = -1;
1634 	imsg_close(&client->iev.ibuf, wbuf);
1635 	gotd_imsg_event_add(&client->iev);
1636 	return NULL;
1637 }
1638 
1639 static const struct got_error *
1640 install_pack(struct gotd_client *client, const char *repo_path,
1641     struct imsg *imsg)
1642 {
1643 	const struct got_error *err = NULL;
1644 	struct gotd_imsg_packfile_install inst;
1645 	char hex[SHA1_DIGEST_STRING_LENGTH];
1646 	size_t datalen;
1647 	char *packfile_path = NULL, *packidx_path = NULL;
1648 
1649 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1650 	if (datalen != sizeof(inst))
1651 		return got_error(GOT_ERR_PRIVSEP_LEN);
1652 	memcpy(&inst, imsg->data, sizeof(inst));
1653 
1654 	if (client->packfile_path == NULL)
1655 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1656 		    "client has no pack file");
1657 	if (client->packidx_path == NULL)
1658 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1659 		    "client has no pack file index");
1660 
1661 	if (got_sha1_digest_to_str(inst.pack_sha1, hex, sizeof(hex)) == NULL)
1662 		return got_error_msg(GOT_ERR_NO_SPACE,
1663 		    "could not convert pack file SHA1 to hex");
1664 
1665 	if (asprintf(&packfile_path, "/%s/%s/pack-%s.pack",
1666 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
1667 		err = got_error_from_errno("asprintf");
1668 		goto done;
1669 	}
1670 
1671 	if (asprintf(&packidx_path, "/%s/%s/pack-%s.idx",
1672 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
1673 		err = got_error_from_errno("asprintf");
1674 		goto done;
1675 	}
1676 
1677 	if (rename(client->packfile_path, packfile_path) == -1) {
1678 		err = got_error_from_errno3("rename", client->packfile_path,
1679 		    packfile_path);
1680 		goto done;
1681 	}
1682 
1683 	free(client->packfile_path);
1684 	client->packfile_path = NULL;
1685 
1686 	if (rename(client->packidx_path, packidx_path) == -1) {
1687 		err = got_error_from_errno3("rename", client->packidx_path,
1688 		    packidx_path);
1689 		goto done;
1690 	}
1691 
1692 	free(client->packidx_path);
1693 	client->packidx_path = NULL;
1694 done:
1695 	free(packfile_path);
1696 	free(packidx_path);
1697 	return err;
1698 }
1699 
1700 static const struct got_error *
1701 begin_ref_updates(struct gotd_client *client, struct imsg *imsg)
1702 {
1703 	struct gotd_imsg_ref_updates_start istart;
1704 	size_t datalen;
1705 
1706 	if (client->nref_updates != -1)
1707 		return got_error(GOT_ERR_PRIVSEP_MSG);
1708 
1709 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1710 	if (datalen != sizeof(istart))
1711 		return got_error(GOT_ERR_PRIVSEP_LEN);
1712 	memcpy(&istart, imsg->data, sizeof(istart));
1713 
1714 	if (istart.nref_updates <= 0)
1715 		return got_error(GOT_ERR_PRIVSEP_MSG);
1716 
1717 	client->nref_updates = istart.nref_updates;
1718 	return NULL;
1719 }
1720 
1721 static const struct got_error *
1722 update_ref(struct gotd_client *client, const char *repo_path,
1723     struct imsg *imsg)
1724 {
1725 	const struct got_error *err = NULL;
1726 	struct got_repository *repo = NULL;
1727 	struct got_reference *ref = NULL;
1728 	struct gotd_imsg_ref_update iref;
1729 	struct got_object_id old_id, new_id;
1730 	struct got_object_id *id = NULL;
1731 	struct got_object *obj = NULL;
1732 	char *refname = NULL;
1733 	size_t datalen;
1734 	int locked = 0;
1735 
1736 	log_debug("update-ref from uid %d", client->euid);
1737 
1738 	if (client->nref_updates <= 0)
1739 		return got_error(GOT_ERR_PRIVSEP_MSG);
1740 
1741 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1742 	if (datalen < sizeof(iref))
1743 		return got_error(GOT_ERR_PRIVSEP_LEN);
1744 	memcpy(&iref, imsg->data, sizeof(iref));
1745 	if (datalen != sizeof(iref) + iref.name_len)
1746 		return got_error(GOT_ERR_PRIVSEP_LEN);
1747 	refname = malloc(iref.name_len + 1);
1748 	if (refname == NULL)
1749 		return got_error_from_errno("malloc");
1750 	memcpy(refname, imsg->data + sizeof(iref), iref.name_len);
1751 	refname[iref.name_len] = '\0';
1752 
1753 	log_debug("updating ref %s for uid %d", refname, client->euid);
1754 
1755 	err = got_repo_open(&repo, repo_path, NULL, NULL);
1756 	if (err)
1757 		goto done;
1758 
1759 	memcpy(old_id.sha1, iref.old_id, SHA1_DIGEST_LENGTH);
1760 	memcpy(new_id.sha1, iref.new_id, SHA1_DIGEST_LENGTH);
1761 	err = got_object_open(&obj, repo, &new_id);
1762 	if (err)
1763 		goto done;
1764 
1765 	if (iref.ref_is_new) {
1766 		err = got_ref_open(&ref, repo, refname, 0);
1767 		if (err) {
1768 			if (err->code != GOT_ERR_NOT_REF)
1769 				goto done;
1770 			err = got_ref_alloc(&ref, refname, &new_id);
1771 			if (err)
1772 				goto done;
1773 			err = got_ref_write(ref, repo); /* will lock/unlock */
1774 			if (err)
1775 				goto done;
1776 		} else {
1777 			err = got_error_fmt(GOT_ERR_REF_BUSY,
1778 			    "%s has been created by someone else "
1779 			    "while transaction was in progress",
1780 			    got_ref_get_name(ref));
1781 			goto done;
1782 		}
1783 	} else {
1784 		err = got_ref_open(&ref, repo, refname, 1 /* lock */);
1785 		if (err)
1786 			goto done;
1787 		locked = 1;
1788 
1789 		err = got_ref_resolve(&id, repo, ref);
1790 		if (err)
1791 			goto done;
1792 
1793 		if (got_object_id_cmp(id, &old_id) != 0) {
1794 			err = got_error_fmt(GOT_ERR_REF_BUSY,
1795 			    "%s has been modified by someone else "
1796 			    "while transaction was in progress",
1797 			    got_ref_get_name(ref));
1798 			goto done;
1799 		}
1800 
1801 		err = got_ref_change_ref(ref, &new_id);
1802 		if (err)
1803 			goto done;
1804 
1805 		err = got_ref_write(ref, repo);
1806 		if (err)
1807 			goto done;
1808 
1809 		free(id);
1810 		id = NULL;
1811 	}
1812 done:
1813 	if (err) {
1814 		if (err->code == GOT_ERR_LOCKFILE_TIMEOUT) {
1815 			err = got_error_fmt(GOT_ERR_LOCKFILE_TIMEOUT,
1816 			    "could not acquire exclusive file lock for %s",
1817 			    refname);
1818 		}
1819 		send_ref_update_ng(client, &iref, refname, err->msg);
1820 	} else
1821 		send_ref_update_ok(client, &iref, refname);
1822 
1823 	if (client->nref_updates > 0) {
1824 		client->nref_updates--;
1825 		if (client->nref_updates == 0)
1826 			send_refs_updated(client);
1827 
1828 	}
1829 	if (locked) {
1830 		const struct got_error *unlock_err;
1831 		unlock_err = got_ref_unlock(ref);
1832 		if (unlock_err && err == NULL)
1833 			err = unlock_err;
1834 	}
1835 	if (ref)
1836 		got_ref_close(ref);
1837 	if (obj)
1838 		got_object_close(obj);
1839 	if (repo)
1840 		got_repo_close(repo);
1841 	free(refname);
1842 	free(id);
1843 	return err;
1844 }
1845 
1846 static void
1847 gotd_dispatch_listener(int fd, short event, void *arg)
1848 {
1849 	struct gotd_imsgev *iev = arg;
1850 	struct imsgbuf *ibuf = &iev->ibuf;
1851 	struct gotd_child_proc *proc = &gotd.listen_proc;
1852 	ssize_t n;
1853 	int shut = 0;
1854 	struct imsg imsg;
1855 
1856 	if (proc->iev.ibuf.fd != fd)
1857 		fatalx("%s: unexpected fd %d", __func__, fd);
1858 
1859 	if (event & EV_READ) {
1860 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1861 			fatal("imsg_read error");
1862 		if (n == 0) {
1863 			/* Connection closed. */
1864 			shut = 1;
1865 			goto done;
1866 		}
1867 	}
1868 
1869 	if (event & EV_WRITE) {
1870 		n = msgbuf_write(&ibuf->w);
1871 		if (n == -1 && errno != EAGAIN)
1872 			fatal("msgbuf_write");
1873 		if (n == 0) {
1874 			/* Connection closed. */
1875 			shut = 1;
1876 			goto done;
1877 		}
1878 	}
1879 
1880 	for (;;) {
1881 		const struct got_error *err = NULL;
1882 		struct gotd_client *client = NULL;
1883 		uint32_t client_id = 0;
1884 		int do_disconnect = 0;
1885 
1886 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1887 			fatal("%s: imsg_get error", __func__);
1888 		if (n == 0)	/* No more messages. */
1889 			break;
1890 
1891 		switch (imsg.hdr.type) {
1892 		case GOTD_IMSG_ERROR:
1893 			do_disconnect = 1;
1894 			err = gotd_imsg_recv_error(&client_id, &imsg);
1895 			break;
1896 		case GOTD_IMSG_CONNECT:
1897 			err = recv_connect(&client_id, &imsg);
1898 			break;
1899 		default:
1900 			log_debug("unexpected imsg %d", imsg.hdr.type);
1901 			break;
1902 		}
1903 
1904 		client = find_client(client_id);
1905 		if (client == NULL) {
1906 			log_warnx("%s: client not found", __func__);
1907 			imsg_free(&imsg);
1908 			continue;
1909 		}
1910 
1911 		if (err)
1912 			log_warnx("uid %d: %s", client->euid, err->msg);
1913 
1914 		if (do_disconnect) {
1915 			if (err)
1916 				disconnect_on_error(client, err);
1917 			else
1918 				disconnect(client);
1919 		}
1920 
1921 		imsg_free(&imsg);
1922 	}
1923 done:
1924 	if (!shut) {
1925 		gotd_imsg_event_add(iev);
1926 	} else {
1927 		/* This pipe is dead. Remove its event handler */
1928 		event_del(&iev->ev);
1929 		event_loopexit(NULL);
1930 	}
1931 }
1932 
1933 static void
1934 gotd_dispatch_auth_child(int fd, short event, void *arg)
1935 {
1936 	const struct got_error *err = NULL;
1937 	struct gotd_imsgev *iev = arg;
1938 	struct imsgbuf *ibuf = &iev->ibuf;
1939 	struct gotd_client *client;
1940 	struct gotd_repo *repo = NULL;
1941 	ssize_t n;
1942 	int shut = 0;
1943 	struct imsg imsg;
1944 	uint32_t client_id = 0;
1945 	int do_disconnect = 0;
1946 	enum gotd_procid proc_type;
1947 
1948 	client = find_client_by_proc_fd(fd);
1949 	if (client == NULL)
1950 		fatalx("cannot find client for fd %d", fd);
1951 
1952 	if (client->auth == NULL)
1953 		fatalx("cannot find auth child process for fd %d", fd);
1954 
1955 	if (event & EV_READ) {
1956 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1957 			fatal("imsg_read error");
1958 		if (n == 0) {
1959 			/* Connection closed. */
1960 			shut = 1;
1961 			goto done;
1962 		}
1963 	}
1964 
1965 	if (event & EV_WRITE) {
1966 		n = msgbuf_write(&ibuf->w);
1967 		if (n == -1 && errno != EAGAIN)
1968 			fatal("msgbuf_write");
1969 		if (n == 0) {
1970 			/* Connection closed. */
1971 			shut = 1;
1972 		}
1973 		goto done;
1974 	}
1975 
1976 	if (client->auth->iev.ibuf.fd != fd)
1977 		fatalx("%s: unexpected fd %d", __func__, fd);
1978 
1979 	if ((n = imsg_get(ibuf, &imsg)) == -1)
1980 		fatal("%s: imsg_get error", __func__);
1981 	if (n == 0)	/* No more messages. */
1982 		return;
1983 
1984 	evtimer_del(&client->tmo);
1985 
1986 	switch (imsg.hdr.type) {
1987 	case GOTD_IMSG_ERROR:
1988 		do_disconnect = 1;
1989 		err = gotd_imsg_recv_error(&client_id, &imsg);
1990 		break;
1991 	case GOTD_IMSG_ACCESS_GRANTED:
1992 		break;
1993 	default:
1994 		do_disconnect = 1;
1995 		log_debug("unexpected imsg %d", imsg.hdr.type);
1996 		break;
1997 	}
1998 
1999 	if (!verify_imsg_src(client, client->auth, &imsg)) {
2000 		do_disconnect = 1;
2001 		log_debug("dropping imsg type %d from PID %d",
2002 		    imsg.hdr.type, client->auth->pid);
2003 	}
2004 	imsg_free(&imsg);
2005 
2006 	if (do_disconnect) {
2007 		if (err)
2008 			disconnect_on_error(client, err);
2009 		else
2010 			disconnect(client);
2011 		goto done;
2012 	}
2013 
2014 	repo = find_repo_by_name(client->auth->repo_name);
2015 	if (repo == NULL) {
2016 		err = got_error(GOT_ERR_NOT_GIT_REPO);
2017 		goto done;
2018 	}
2019 	kill_auth_proc(client);
2020 
2021 	log_info("authenticated uid %d for repository %s\n",
2022 	    client->euid, repo->name);
2023 
2024 	if (client->required_auth & GOTD_AUTH_WRITE)
2025 		proc_type = PROC_REPO_WRITE;
2026 	else
2027 		proc_type = PROC_REPO_READ;
2028 
2029 	err = start_repo_child(client, proc_type, repo, gotd.argv0,
2030 	    gotd.confpath, gotd.daemonize, gotd.verbosity);
2031 done:
2032 	if (err)
2033 		log_warnx("uid %d: %s", client->euid, err->msg);
2034 
2035 	/* We might have killed the auth process by now. */
2036 	if (client->auth != NULL) {
2037 		if (!shut) {
2038 			gotd_imsg_event_add(iev);
2039 		} else {
2040 			/* This pipe is dead. Remove its event handler */
2041 			event_del(&iev->ev);
2042 		}
2043 	}
2044 }
2045 
2046 static void
2047 gotd_dispatch_repo_child(int fd, short event, void *arg)
2048 {
2049 	struct gotd_imsgev *iev = arg;
2050 	struct imsgbuf *ibuf = &iev->ibuf;
2051 	struct gotd_child_proc *proc = NULL;
2052 	struct gotd_client *client = NULL;
2053 	ssize_t n;
2054 	int shut = 0;
2055 	struct imsg imsg;
2056 
2057 	if (event & EV_READ) {
2058 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
2059 			fatal("imsg_read error");
2060 		if (n == 0) {
2061 			/* Connection closed. */
2062 			shut = 1;
2063 			goto done;
2064 		}
2065 	}
2066 
2067 	if (event & EV_WRITE) {
2068 		n = msgbuf_write(&ibuf->w);
2069 		if (n == -1 && errno != EAGAIN)
2070 			fatal("msgbuf_write");
2071 		if (n == 0) {
2072 			/* Connection closed. */
2073 			shut = 1;
2074 			goto done;
2075 		}
2076 	}
2077 
2078 	client = find_client_by_proc_fd(fd);
2079 	if (client == NULL)
2080 		fatalx("cannot find client for fd %d", fd);
2081 
2082 	proc = get_client_proc(client);
2083 	if (proc == NULL)
2084 		fatalx("cannot find child process for fd %d", fd);
2085 
2086 	for (;;) {
2087 		const struct got_error *err = NULL;
2088 		uint32_t client_id = 0;
2089 		int do_disconnect = 0;
2090 		int do_list_refs = 0, do_ref_updates = 0, do_ref_update = 0;
2091 		int do_packfile_install = 0;
2092 
2093 		if ((n = imsg_get(ibuf, &imsg)) == -1)
2094 			fatal("%s: imsg_get error", __func__);
2095 		if (n == 0)	/* No more messages. */
2096 			break;
2097 
2098 		switch (imsg.hdr.type) {
2099 		case GOTD_IMSG_ERROR:
2100 			do_disconnect = 1;
2101 			err = gotd_imsg_recv_error(&client_id, &imsg);
2102 			break;
2103 		case GOTD_IMSG_REPO_CHILD_READY:
2104 			do_list_refs = 1;
2105 			break;
2106 		case GOTD_IMSG_PACKFILE_DONE:
2107 			do_disconnect = 1;
2108 			err = recv_packfile_done(&client_id, &imsg);
2109 			break;
2110 		case GOTD_IMSG_PACKFILE_INSTALL:
2111 			err = recv_packfile_install(&client_id, &imsg);
2112 			if (err == NULL)
2113 				do_packfile_install = 1;
2114 			break;
2115 		case GOTD_IMSG_REF_UPDATES_START:
2116 			err = recv_ref_updates_start(&client_id, &imsg);
2117 			if (err == NULL)
2118 				do_ref_updates = 1;
2119 			break;
2120 		case GOTD_IMSG_REF_UPDATE:
2121 			err = recv_ref_update(&client_id, &imsg);
2122 			if (err == NULL)
2123 				do_ref_update = 1;
2124 			break;
2125 		default:
2126 			log_debug("unexpected imsg %d", imsg.hdr.type);
2127 			break;
2128 		}
2129 
2130 		if (!verify_imsg_src(client, proc, &imsg)) {
2131 			log_debug("dropping imsg type %d from PID %d",
2132 			    imsg.hdr.type, proc->pid);
2133 			imsg_free(&imsg);
2134 			continue;
2135 		}
2136 		if (err)
2137 			log_warnx("uid %d: %s", client->euid, err->msg);
2138 
2139 		if (do_disconnect) {
2140 			if (err)
2141 				disconnect_on_error(client, err);
2142 			else
2143 				disconnect(client);
2144 		} else {
2145 			if (do_list_refs)
2146 				err = list_refs_request(client, iev);
2147 			else if (do_packfile_install)
2148 				err = install_pack(client, proc->repo_path,
2149 				    &imsg);
2150 			else if (do_ref_updates)
2151 				err = begin_ref_updates(client, &imsg);
2152 			else if (do_ref_update)
2153 				err = update_ref(client, proc->repo_path,
2154 				    &imsg);
2155 			if (err)
2156 				log_warnx("uid %d: %s", client->euid, err->msg);
2157 		}
2158 		imsg_free(&imsg);
2159 	}
2160 done:
2161 	if (!shut) {
2162 		gotd_imsg_event_add(iev);
2163 	} else {
2164 		/* This pipe is dead. Remove its event handler */
2165 		event_del(&iev->ev);
2166 		event_loopexit(NULL);
2167 	}
2168 }
2169 
2170 static pid_t
2171 start_child(enum gotd_procid proc_id, const char *repo_path,
2172     char *argv0, const char *confpath, int fd, int daemonize, int verbosity)
2173 {
2174 	char	*argv[11];
2175 	int	 argc = 0;
2176 	pid_t	 pid;
2177 
2178 	switch (pid = fork()) {
2179 	case -1:
2180 		fatal("cannot fork");
2181 	case 0:
2182 		break;
2183 	default:
2184 		close(fd);
2185 		return pid;
2186 	}
2187 
2188 	if (fd != GOTD_FILENO_MSG_PIPE) {
2189 		if (dup2(fd, GOTD_FILENO_MSG_PIPE) == -1)
2190 			fatal("cannot setup imsg fd");
2191 	} else if (fcntl(fd, F_SETFD, 0) == -1)
2192 		fatal("cannot setup imsg fd");
2193 
2194 	argv[argc++] = argv0;
2195 	switch (proc_id) {
2196 	case PROC_LISTEN:
2197 		argv[argc++] = (char *)"-L";
2198 		break;
2199 	case PROC_AUTH:
2200 		argv[argc++] = (char *)"-A";
2201 		break;
2202 	case PROC_REPO_READ:
2203 		argv[argc++] = (char *)"-R";
2204 		break;
2205 	case PROC_REPO_WRITE:
2206 		argv[argc++] = (char *)"-W";
2207 		break;
2208 	default:
2209 		fatalx("invalid process id %d", proc_id);
2210 	}
2211 
2212 	argv[argc++] = (char *)"-f";
2213 	argv[argc++] = (char *)confpath;
2214 
2215 	if (repo_path) {
2216 		argv[argc++] = (char *)"-P";
2217 		argv[argc++] = (char *)repo_path;
2218 	}
2219 
2220 	if (!daemonize)
2221 		argv[argc++] = (char *)"-d";
2222 	if (verbosity > 0)
2223 		argv[argc++] = (char *)"-v";
2224 	if (verbosity > 1)
2225 		argv[argc++] = (char *)"-v";
2226 	argv[argc++] = NULL;
2227 
2228 	execvp(argv0, argv);
2229 	fatal("execvp");
2230 }
2231 
2232 static void
2233 start_listener(char *argv0, const char *confpath, int daemonize, int verbosity)
2234 {
2235 	struct gotd_child_proc *proc = &gotd.listen_proc;
2236 
2237 	proc->type = PROC_LISTEN;
2238 
2239 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
2240 	    PF_UNSPEC, proc->pipe) == -1)
2241 		fatal("socketpair");
2242 
2243 	proc->pid = start_child(proc->type, NULL, argv0, confpath,
2244 	    proc->pipe[1], daemonize, verbosity);
2245 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
2246 	proc->iev.handler = gotd_dispatch_listener;
2247 	proc->iev.events = EV_READ;
2248 	proc->iev.handler_arg = NULL;
2249 }
2250 
2251 static const struct got_error *
2252 start_repo_child(struct gotd_client *client, enum gotd_procid proc_type,
2253     struct gotd_repo *repo, char *argv0, const char *confpath,
2254     int daemonize, int verbosity)
2255 {
2256 	struct gotd_child_proc *proc;
2257 
2258 	if (proc_type != PROC_REPO_READ && proc_type != PROC_REPO_WRITE)
2259 		return got_error_msg(GOT_ERR_NOT_IMPL, "bad process type");
2260 
2261 	proc = calloc(1, sizeof(*proc));
2262 	if (proc == NULL)
2263 		return got_error_from_errno("calloc");
2264 
2265 	proc->type = proc_type;
2266 	if (strlcpy(proc->repo_name, repo->name,
2267 	    sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
2268 		fatalx("repository name too long: %s", repo->name);
2269 	log_debug("starting %s for repository %s",
2270 	    proc->type == PROC_REPO_READ ? "reader" : "writer", repo->name);
2271 	if (realpath(repo->path, proc->repo_path) == NULL)
2272 		fatal("%s", repo->path);
2273 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
2274 	    PF_UNSPEC, proc->pipe) == -1)
2275 		fatal("socketpair");
2276 	proc->pid = start_child(proc->type, proc->repo_path, argv0,
2277 	    confpath, proc->pipe[1], daemonize, verbosity);
2278 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
2279 	log_debug("proc %s %s is on fd %d",
2280 	    gotd_proc_names[proc->type], proc->repo_path,
2281 	    proc->pipe[0]);
2282 	proc->iev.handler = gotd_dispatch_repo_child;
2283 	proc->iev.events = EV_READ;
2284 	proc->iev.handler_arg = NULL;
2285 	event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
2286 	    gotd_dispatch_repo_child, &proc->iev);
2287 	gotd_imsg_event_add(&proc->iev);
2288 
2289 	if (proc->type == PROC_REPO_READ)
2290 		client->repo_read = proc;
2291 	else
2292 		client->repo_write = proc;
2293 
2294 	return NULL;
2295 }
2296 
2297 static const struct got_error *
2298 start_auth_child(struct gotd_client *client, int required_auth,
2299     struct gotd_repo *repo, char *argv0, const char *confpath,
2300     int daemonize, int verbosity)
2301 {
2302 	const struct got_error *err = NULL;
2303 	struct gotd_child_proc *proc;
2304 	struct gotd_imsg_auth iauth;
2305 	int fd;
2306 
2307 	memset(&iauth, 0, sizeof(iauth));
2308 
2309 	fd = dup(client->fd);
2310 	if (fd == -1)
2311 		return got_error_from_errno("dup");
2312 
2313 	proc = calloc(1, sizeof(*proc));
2314 	if (proc == NULL) {
2315 		err = got_error_from_errno("calloc");
2316 		close(fd);
2317 		return err;
2318 	}
2319 
2320 	proc->type = PROC_AUTH;
2321 	if (strlcpy(proc->repo_name, repo->name,
2322 	    sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
2323 		fatalx("repository name too long: %s", repo->name);
2324 	log_debug("starting auth for uid %d repository %s",
2325 	    client->euid, repo->name);
2326 	if (realpath(repo->path, proc->repo_path) == NULL)
2327 		fatal("%s", repo->path);
2328 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
2329 	    PF_UNSPEC, proc->pipe) == -1)
2330 		fatal("socketpair");
2331 	proc->pid = start_child(proc->type, proc->repo_path, argv0,
2332 	    confpath, proc->pipe[1], daemonize, verbosity);
2333 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
2334 	log_debug("proc %s %s is on fd %d",
2335 	    gotd_proc_names[proc->type], proc->repo_path,
2336 	    proc->pipe[0]);
2337 	proc->iev.handler = gotd_dispatch_auth_child;
2338 	proc->iev.events = EV_READ;
2339 	proc->iev.handler_arg = NULL;
2340 	event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
2341 	    gotd_dispatch_auth_child, &proc->iev);
2342 	gotd_imsg_event_add(&proc->iev);
2343 
2344 	iauth.euid = client->euid;
2345 	iauth.egid = client->egid;
2346 	iauth.required_auth = required_auth;
2347 	iauth.client_id = client->id;
2348 	if (gotd_imsg_compose_event(&proc->iev, GOTD_IMSG_AUTHENTICATE,
2349 	    PROC_GOTD, fd, &iauth, sizeof(iauth)) == -1) {
2350 		log_warn("imsg compose AUTHENTICATE");
2351 		close(fd);
2352 		/* Let the auth_timeout handler tidy up. */
2353 	}
2354 
2355 	client->auth = proc;
2356 	client->required_auth = required_auth;
2357 	return NULL;
2358 }
2359 
2360 static void
2361 apply_unveil_repo_readonly(const char *repo_path)
2362 {
2363 	if (unveil(repo_path, "r") == -1)
2364 		fatal("unveil %s", repo_path);
2365 
2366 	if (unveil(NULL, NULL) == -1)
2367 		fatal("unveil");
2368 }
2369 
2370 static void
2371 apply_unveil_none(void)
2372 {
2373 	if (unveil("/", "") == -1)
2374 		fatal("unveil");
2375 
2376 	if (unveil(NULL, NULL) == -1)
2377 		fatal("unveil");
2378 }
2379 
2380 static void
2381 apply_unveil(void)
2382 {
2383 	struct gotd_repo *repo;
2384 
2385 	if (unveil(gotd.argv0, "x") == -1)
2386 		fatal("unveil %s", gotd.argv0);
2387 
2388 	TAILQ_FOREACH(repo, &gotd.repos, entry) {
2389 		if (unveil(repo->path, "rwc") == -1)
2390 			fatal("unveil %s", repo->path);
2391 	}
2392 
2393 	if (unveil(GOT_TMPDIR_STR, "rwc") == -1)
2394 		fatal("unveil %s", GOT_TMPDIR_STR);
2395 
2396 	if (unveil(NULL, NULL) == -1)
2397 		fatal("unveil");
2398 }
2399 
2400 int
2401 main(int argc, char **argv)
2402 {
2403 	const struct got_error *error = NULL;
2404 	int ch, fd = -1, daemonize = 1, verbosity = 0, noaction = 0;
2405 	const char *confpath = GOTD_CONF_PATH;
2406 	char *argv0 = argv[0];
2407 	char title[2048];
2408 	gid_t groups[NGROUPS_MAX];
2409 	int ngroups = NGROUPS_MAX;
2410 	struct passwd *pw = NULL;
2411 	struct group *gr = NULL;
2412 	char *repo_path = NULL;
2413 	enum gotd_procid proc_id = PROC_GOTD;
2414 	struct event evsigint, evsigterm, evsighup, evsigusr1;
2415 	int *pack_fds = NULL, *temp_fds = NULL;
2416 
2417 	log_init(1, LOG_DAEMON); /* Log to stderr until daemonized. */
2418 
2419 	while ((ch = getopt(argc, argv, "Adf:LnP:RvW")) != -1) {
2420 		switch (ch) {
2421 		case 'A':
2422 			proc_id = PROC_AUTH;
2423 			break;
2424 		case 'd':
2425 			daemonize = 0;
2426 			break;
2427 		case 'f':
2428 			confpath = optarg;
2429 			break;
2430 		case 'L':
2431 			proc_id = PROC_LISTEN;
2432 			break;
2433 		case 'n':
2434 			noaction = 1;
2435 			break;
2436 		case 'P':
2437 			repo_path = realpath(optarg, NULL);
2438 			if (repo_path == NULL)
2439 				fatal("realpath '%s'", optarg);
2440 			break;
2441 		case 'R':
2442 			proc_id = PROC_REPO_READ;
2443 			break;
2444 		case 'v':
2445 			if (verbosity < 3)
2446 				verbosity++;
2447 			break;
2448 		case 'W':
2449 			proc_id = PROC_REPO_WRITE;
2450 			break;
2451 		default:
2452 			usage();
2453 		}
2454 	}
2455 
2456 	argc -= optind;
2457 	argv += optind;
2458 
2459 	if (argc != 0)
2460 		usage();
2461 
2462 	/* Require an absolute path in argv[0] for reliable re-exec. */
2463 	if (!got_path_is_absolute(argv0))
2464 		fatalx("bad path \"%s\": must be an absolute path", argv0);
2465 
2466 	if (geteuid() && (proc_id == PROC_GOTD || proc_id == PROC_LISTEN))
2467 		fatalx("need root privileges");
2468 
2469 	log_init(daemonize ? 0 : 1, LOG_DAEMON);
2470 	log_setverbose(verbosity);
2471 
2472 	if (parse_config(confpath, proc_id, &gotd) != 0)
2473 		return 1;
2474 
2475 	gotd.argv0 = argv0;
2476 	gotd.daemonize = daemonize;
2477 	gotd.verbosity = verbosity;
2478 	gotd.confpath = confpath;
2479 
2480 	if (proc_id == PROC_GOTD &&
2481 	    (gotd.nrepos == 0 || TAILQ_EMPTY(&gotd.repos)))
2482 		fatalx("no repository defined in configuration file");
2483 
2484 	pw = getpwnam(gotd.user_name);
2485 	if (pw == NULL)
2486 		fatalx("user %s not found", gotd.user_name);
2487 
2488 	if (pw->pw_uid == 0) {
2489 		fatalx("cannot run %s as %s: the user running %s "
2490 		    "must not be the superuser",
2491 		    getprogname(), pw->pw_name, getprogname());
2492 	}
2493 
2494 	if (getgrouplist(pw->pw_name, pw->pw_gid, groups, &ngroups) == -1)
2495 		log_warnx("group membership list truncated");
2496 
2497 	gr = match_group(groups, ngroups, gotd.unix_group_name);
2498 	if (gr == NULL) {
2499 		fatalx("cannot start %s: the user running %s "
2500 		    "must be a secondary member of group %s",
2501 		    getprogname(), getprogname(), gotd.unix_group_name);
2502 	}
2503 	if (gr->gr_gid == pw->pw_gid) {
2504 		fatalx("cannot start %s: the user running %s "
2505 		    "must be a secondary member of group %s, but "
2506 		    "%s is the user's primary group",
2507 		    getprogname(), getprogname(), gotd.unix_group_name,
2508 		    gotd.unix_group_name);
2509 	}
2510 
2511 	if (proc_id == PROC_LISTEN &&
2512 	    !got_path_is_absolute(gotd.unix_socket_path))
2513 		fatalx("bad unix socket path \"%s\": must be an absolute path",
2514 		    gotd.unix_socket_path);
2515 
2516 	if (noaction)
2517 		return 0;
2518 
2519 	if (proc_id == PROC_GOTD) {
2520 		gotd.pid = getpid();
2521 		snprintf(title, sizeof(title), "%s", gotd_proc_names[proc_id]);
2522 		start_listener(argv0, confpath, daemonize, verbosity);
2523 		arc4random_buf(&clients_hash_key, sizeof(clients_hash_key));
2524 		if (daemonize && daemon(1, 0) == -1)
2525 			fatal("daemon");
2526 	} else if (proc_id == PROC_LISTEN) {
2527 		snprintf(title, sizeof(title), "%s", gotd_proc_names[proc_id]);
2528 		if (verbosity) {
2529 			log_info("socket: %s", gotd.unix_socket_path);
2530 			log_info("user: %s", pw->pw_name);
2531 			log_info("secondary group: %s", gr->gr_name);
2532 		}
2533 
2534 		fd = unix_socket_listen(gotd.unix_socket_path, pw->pw_uid,
2535 		    gr->gr_gid);
2536 		if (fd == -1) {
2537 			fatal("cannot listen on unix socket %s",
2538 			    gotd.unix_socket_path);
2539 		}
2540 		if (daemonize && daemon(0, 0) == -1)
2541 			fatal("daemon");
2542 	} else if (proc_id == PROC_AUTH) {
2543 		snprintf(title, sizeof(title), "%s %s",
2544 		    gotd_proc_names[proc_id], repo_path);
2545 		if (daemonize && daemon(0, 0) == -1)
2546 			fatal("daemon");
2547 	} else if (proc_id == PROC_REPO_READ || proc_id == PROC_REPO_WRITE) {
2548 		error = got_repo_pack_fds_open(&pack_fds);
2549 		if (error != NULL)
2550 			fatalx("cannot open pack tempfiles: %s", error->msg);
2551 		error = got_repo_temp_fds_open(&temp_fds);
2552 		if (error != NULL)
2553 			fatalx("cannot open pack tempfiles: %s", error->msg);
2554 		if (repo_path == NULL)
2555 			fatalx("repository path not specified");
2556 		snprintf(title, sizeof(title), "%s %s",
2557 		    gotd_proc_names[proc_id], repo_path);
2558 		if (daemonize && daemon(0, 0) == -1)
2559 			fatal("daemon");
2560 	} else
2561 		fatal("invalid process id %d", proc_id);
2562 
2563 	setproctitle("%s", title);
2564 	log_procinit(title);
2565 
2566 	/* Drop root privileges. */
2567 	if (setgid(pw->pw_gid) == -1)
2568 		fatal("setgid %d failed", pw->pw_gid);
2569 	if (setuid(pw->pw_uid) == -1)
2570 		fatal("setuid %d failed", pw->pw_uid);
2571 
2572 	event_init();
2573 
2574 	switch (proc_id) {
2575 	case PROC_GOTD:
2576 #ifndef PROFILE
2577 		if (pledge("stdio rpath wpath cpath proc exec "
2578 		    "sendfd recvfd fattr flock unveil", NULL) == -1)
2579 			err(1, "pledge");
2580 #endif
2581 		break;
2582 	case PROC_LISTEN:
2583 #ifndef PROFILE
2584 		if (pledge("stdio sendfd unix", NULL) == -1)
2585 			err(1, "pledge");
2586 #endif
2587 		listen_main(title, fd, gotd.connection_limits,
2588 		    gotd.nconnection_limits);
2589 		/* NOTREACHED */
2590 		break;
2591 	case PROC_AUTH:
2592 #ifndef PROFILE
2593 		if (pledge("stdio getpw recvfd unix unveil", NULL) == -1)
2594 			err(1, "pledge");
2595 #endif
2596 		/*
2597 		 * We need the "unix" pledge promise for getpeername(2) only.
2598 		 * Ensure that AF_UNIX bind(2) cannot be used by revoking all
2599 		 * filesystem access via unveil(2). Access to password database
2600 		 * files will still work since "getpw" bypasses unveil(2).
2601 		 */
2602 		apply_unveil_none();
2603 
2604 		auth_main(title, &gotd.repos, repo_path);
2605 		/* NOTREACHED */
2606 		break;
2607 	case PROC_REPO_READ:
2608 #ifndef PROFILE
2609 		if (pledge("stdio rpath recvfd unveil", NULL) == -1)
2610 			err(1, "pledge");
2611 #endif
2612 		apply_unveil_repo_readonly(repo_path);
2613 		repo_read_main(title, repo_path, pack_fds, temp_fds);
2614 		/* NOTREACHED */
2615 		exit(0);
2616 	case PROC_REPO_WRITE:
2617 #ifndef PROFILE
2618 		if (pledge("stdio rpath recvfd unveil", NULL) == -1)
2619 			err(1, "pledge");
2620 #endif
2621 		apply_unveil_repo_readonly(repo_path);
2622 		repo_write_main(title, repo_path, pack_fds, temp_fds);
2623 		/* NOTREACHED */
2624 		exit(0);
2625 	default:
2626 		fatal("invalid process id %d", proc_id);
2627 	}
2628 
2629 	if (proc_id != PROC_GOTD)
2630 		fatal("invalid process id %d", proc_id);
2631 
2632 	apply_unveil();
2633 
2634 	signal_set(&evsigint, SIGINT, gotd_sighdlr, NULL);
2635 	signal_set(&evsigterm, SIGTERM, gotd_sighdlr, NULL);
2636 	signal_set(&evsighup, SIGHUP, gotd_sighdlr, NULL);
2637 	signal_set(&evsigusr1, SIGUSR1, gotd_sighdlr, NULL);
2638 	signal(SIGPIPE, SIG_IGN);
2639 
2640 	signal_add(&evsigint, NULL);
2641 	signal_add(&evsigterm, NULL);
2642 	signal_add(&evsighup, NULL);
2643 	signal_add(&evsigusr1, NULL);
2644 
2645 	gotd_imsg_event_add(&gotd.listen_proc.iev);
2646 
2647 	event_dispatch();
2648 
2649 	if (pack_fds)
2650 		got_repo_pack_fds_close(pack_fds);
2651 	free(repo_path);
2652 	return 0;
2653 }