Gotweb

Blob

Date:: Thu Jun 22 15:30:28 2023 UTC
Message:: add kill_repo_proc() similarly to the other kill_*_proc() ok stsp@
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/queue.h>
18 #include <sys/tree.h>
19 #include <sys/time.h>
20 #include <sys/types.h>
21 #include <sys/stat.h>
22 #include <sys/socket.h>
23 #include <sys/un.h>
24 #include <sys/wait.h>
25 
26 #include <fcntl.h>
27 #include <err.h>
28 #include <errno.h>
29 #include <event.h>
30 #include <limits.h>
31 #include <pwd.h>
32 #include <imsg.h>
33 #include <sha1.h>
34 #include <sha2.h>
35 #include <signal.h>
36 #include <siphash.h>
37 #include <stdarg.h>
38 #include <stdio.h>
39 #include <stdlib.h>
40 #include <string.h>
41 #include <syslog.h>
42 #include <unistd.h>
43 
44 #include "got_error.h"
45 #include "got_opentemp.h"
46 #include "got_path.h"
47 #include "got_repository.h"
48 #include "got_object.h"
49 #include "got_reference.h"
50 
51 #include "got_lib_delta.h"
52 #include "got_lib_object.h"
53 #include "got_lib_object_cache.h"
54 #include "got_lib_hash.h"
55 #include "got_lib_gitproto.h"
56 #include "got_lib_pack.h"
57 #include "got_lib_repository.h"
58 
59 #include "gotd.h"
60 #include "log.h"
61 #include "listen.h"
62 #include "auth.h"
63 #include "session.h"
64 #include "repo_read.h"
65 #include "repo_write.h"
66 
67 #ifndef nitems
68 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
69 #endif
70 
71 enum gotd_client_state {
72 	GOTD_CLIENT_STATE_NEW,
73 	GOTD_CLIENT_STATE_ACCESS_GRANTED,
74 };
75 
76 struct gotd_child_proc {
77 	pid_t				 pid;
78 	enum gotd_procid		 type;
79 	char				 repo_name[NAME_MAX];
80 	char				 repo_path[PATH_MAX];
81 	int				 pipe[2];
82 	struct gotd_imsgev		 iev;
83 };
84 
85 struct gotd_client {
86 	STAILQ_ENTRY(gotd_client)	 entry;
87 	enum gotd_client_state		 state;
88 	uint32_t			 id;
89 	int				 fd;
90 	struct gotd_imsgev		 iev;
91 	struct event			 tmo;
92 	uid_t				 euid;
93 	gid_t				 egid;
94 	struct gotd_child_proc		*repo;
95 	struct gotd_child_proc		*auth;
96 	struct gotd_child_proc		*session;
97 	int				 required_auth;
98 };
99 STAILQ_HEAD(gotd_clients, gotd_client);
100 
101 static struct gotd_clients gotd_clients[GOTD_CLIENT_TABLE_SIZE];
102 static SIPHASH_KEY clients_hash_key;
103 volatile int client_cnt;
104 static struct timeval auth_timeout = { 5, 0 };
105 static struct gotd gotd;
106 
107 void gotd_sighdlr(int sig, short event, void *arg);
108 static void gotd_shutdown(void);
109 static const struct got_error *start_session_child(struct gotd_client *,
110     struct gotd_repo *, char *, const char *, int, int);
111 static const struct got_error *start_repo_child(struct gotd_client *,
112     enum gotd_procid, struct gotd_repo *, char *, const char *, int, int);
113 static const struct got_error *start_auth_child(struct gotd_client *, int,
114     struct gotd_repo *, char *, const char *, int, int);
115 static void kill_proc(struct gotd_child_proc *, int);
116 
117 __dead static void
118 usage(void)
119 {
120 	fprintf(stderr, "usage: %s [-dnv] [-f config-file]\n", getprogname());
121 	exit(1);
122 }
123 
124 static int
125 unix_socket_listen(const char *unix_socket_path, uid_t uid, gid_t gid)
126 {
127 	struct sockaddr_un sun;
128 	int fd = -1;
129 	mode_t old_umask, mode;
130 
131 	fd = socket(AF_UNIX, SOCK_STREAM | SOCK_NONBLOCK| SOCK_CLOEXEC, 0);
132 	if (fd == -1) {
133 		log_warn("socket");
134 		return -1;
135 	}
136 
137 	sun.sun_family = AF_UNIX;
138 	if (strlcpy(sun.sun_path, unix_socket_path,
139 	    sizeof(sun.sun_path)) >= sizeof(sun.sun_path)) {
140 		log_warnx("%s: name too long", unix_socket_path);
141 		close(fd);
142 		return -1;
143 	}
144 
145 	if (unlink(unix_socket_path) == -1) {
146 		if (errno != ENOENT) {
147 			log_warn("unlink %s", unix_socket_path);
148 			close(fd);
149 			return -1;
150 		}
151 	}
152 
153 	old_umask = umask(S_IXUSR|S_IXGRP|S_IWOTH|S_IROTH|S_IXOTH);
154 	mode = S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH;
155 
156 	if (bind(fd, (struct sockaddr *)&sun, sizeof(sun)) == -1) {
157 		log_warn("bind: %s", unix_socket_path);
158 		close(fd);
159 		umask(old_umask);
160 		return -1;
161 	}
162 
163 	umask(old_umask);
164 
165 	if (chmod(unix_socket_path, mode) == -1) {
166 		log_warn("chmod %o %s", mode, unix_socket_path);
167 		close(fd);
168 		unlink(unix_socket_path);
169 		return -1;
170 	}
171 
172 	if (chown(unix_socket_path, uid, gid) == -1) {
173 		log_warn("chown %s uid=%d gid=%d", unix_socket_path, uid, gid);
174 		close(fd);
175 		unlink(unix_socket_path);
176 		return -1;
177 	}
178 
179 	if (listen(fd, GOTD_UNIX_SOCKET_BACKLOG) == -1) {
180 		log_warn("listen");
181 		close(fd);
182 		unlink(unix_socket_path);
183 		return -1;
184 	}
185 
186 	return fd;
187 }
188 
189 static uint64_t
190 client_hash(uint32_t client_id)
191 {
192 	return SipHash24(&clients_hash_key, &client_id, sizeof(client_id));
193 }
194 
195 static void
196 add_client(struct gotd_client *client)
197 {
198 	uint64_t slot = client_hash(client->id) % nitems(gotd_clients);
199 	STAILQ_INSERT_HEAD(&gotd_clients[slot], client, entry);
200 	client_cnt++;
201 }
202 
203 static struct gotd_client *
204 find_client(uint32_t client_id)
205 {
206 	uint64_t slot;
207 	struct gotd_client *c;
208 
209 	slot = client_hash(client_id) % nitems(gotd_clients);
210 	STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
211 		if (c->id == client_id)
212 			return c;
213 	}
214 
215 	return NULL;
216 }
217 
218 static struct gotd_client *
219 find_client_by_proc_fd(int fd)
220 {
221 	uint64_t slot;
222 
223 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
224 		struct gotd_client *c;
225 
226 		STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
227 			if (c->repo && c->repo->iev.ibuf.fd == fd)
228 				return c;
229 			if (c->auth && c->auth->iev.ibuf.fd == fd)
230 				return c;
231 			if (c->session && c->session->iev.ibuf.fd == fd)
232 				return c;
233 		}
234 	}
235 
236 	return NULL;
237 }
238 
239 static int
240 client_is_reading(struct gotd_client *client)
241 {
242 	return (client->required_auth &
243 	    (GOTD_AUTH_READ | GOTD_AUTH_WRITE)) == GOTD_AUTH_READ;
244 }
245 
246 static int
247 client_is_writing(struct gotd_client *client)
248 {
249 	return (client->required_auth &
250 	    (GOTD_AUTH_READ | GOTD_AUTH_WRITE)) ==
251 	    (GOTD_AUTH_READ | GOTD_AUTH_WRITE);
252 }
253 
254 static const struct got_error *
255 ensure_client_is_not_writing(struct gotd_client *client)
256 {
257 	if (client_is_writing(client)) {
258 		return got_error_fmt(GOT_ERR_BAD_PACKET,
259 		    "uid %d made a read-request but is writing to "
260 		    "a repository", client->euid);
261 	}
262 
263 	return NULL;
264 }
265 
266 static const struct got_error *
267 ensure_client_is_not_reading(struct gotd_client *client)
268 {
269 	if (client_is_reading(client)) {
270 		return got_error_fmt(GOT_ERR_BAD_PACKET,
271 		    "uid %d made a write-request but is reading from "
272 		    "a repository", client->euid);
273 	}
274 
275 	return NULL;
276 }
277 
278 static void
279 wait_for_child(pid_t child_pid)
280 {
281 	pid_t pid;
282 	int status;
283 
284 	log_debug("waiting for child PID %ld to terminate",
285 	    (long)child_pid);
286 
287 	do {
288 		pid = waitpid(child_pid, &status, WNOHANG);
289 		if (pid == -1) {
290 			if (errno != EINTR && errno != ECHILD)
291 				fatal("wait");
292 		} else if (WIFSIGNALED(status)) {
293 			log_warnx("child PID %ld terminated; signal %d",
294 			    (long)pid, WTERMSIG(status));
295 		}
296 	} while (pid != -1 || (pid == -1 && errno == EINTR));
297 }
298 
299 static void
300 proc_done(struct gotd_child_proc *proc)
301 {
302 	event_del(&proc->iev.ev);
303 	msgbuf_clear(&proc->iev.ibuf.w);
304 	close(proc->iev.ibuf.fd);
305 	kill_proc(proc, 0);
306 	wait_for_child(proc->pid);
307 	free(proc);
308 }
309 
310 static void
311 kill_repo_proc(struct gotd_client *client)
312 {
313 	struct gotd_child_proc *proc;
314 
315 	if (client->repo == NULL)
316 		return;
317 
318 	proc = client->repo;
319 	client->repo = NULL;
320 
321 	proc_done(proc);
322 }
323 
324 static void
325 kill_auth_proc(struct gotd_client *client)
326 {
327 	struct gotd_child_proc *proc;
328 
329 	if (client->auth == NULL)
330 		return;
331 
332 	proc = client->auth;
333 	client->auth = NULL;
334 
335 	proc_done(proc);
336 }
337 
338 static void
339 kill_session_proc(struct gotd_client *client)
340 {
341 	struct gotd_child_proc *proc;
342 
343 	if (client->session == NULL)
344 		return;
345 
346 	proc = client->session;
347 	client->session = NULL;
348 
349 	proc_done(proc);
350 }
351 
352 static void
353 disconnect(struct gotd_client *client)
354 {
355 	struct gotd_imsg_disconnect idisconnect;
356 	struct gotd_child_proc *listen_proc = gotd.listen_proc;
357 	uint64_t slot;
358 
359 	log_debug("uid %d: disconnecting", client->euid);
360 
361 	kill_auth_proc(client);
362 	kill_session_proc(client);
363 	kill_repo_proc(client);
364 
365 	idisconnect.client_id = client->id;
366 	if (gotd_imsg_compose_event(&listen_proc->iev,
367 	    GOTD_IMSG_DISCONNECT, PROC_GOTD, -1,
368 	    &idisconnect, sizeof(idisconnect)) == -1)
369 		log_warn("imsg compose DISCONNECT");
370 
371 	slot = client_hash(client->id) % nitems(gotd_clients);
372 	STAILQ_REMOVE(&gotd_clients[slot], client, gotd_client, entry);
373 	imsg_clear(&client->iev.ibuf);
374 	event_del(&client->iev.ev);
375 	evtimer_del(&client->tmo);
376 	if (client->fd != -1)
377 		close(client->fd);
378 	else if (client->iev.ibuf.fd != -1)
379 		close(client->iev.ibuf.fd);
380 	free(client);
381 	client_cnt--;
382 }
383 
384 static void
385 disconnect_on_error(struct gotd_client *client, const struct got_error *err)
386 {
387 	struct imsgbuf ibuf;
388 
389 	log_warnx("uid %d: %s", client->euid, err->msg);
390 	if (err->code != GOT_ERR_EOF && client->fd != -1) {
391 		imsg_init(&ibuf, client->fd);
392 		gotd_imsg_send_error(&ibuf, 0, PROC_GOTD, err);
393 		imsg_clear(&ibuf);
394 	}
395 	disconnect(client);
396 }
397 
398 static const struct got_error *
399 send_repo_info(struct gotd_imsgev *iev, struct gotd_repo *repo)
400 {
401 	const struct got_error *err = NULL;
402 	struct gotd_imsg_info_repo irepo;
403 
404 	memset(&irepo, 0, sizeof(irepo));
405 
406 	if (strlcpy(irepo.repo_name, repo->name, sizeof(irepo.repo_name))
407 	    >= sizeof(irepo.repo_name))
408 		return got_error_msg(GOT_ERR_NO_SPACE, "repo name too long");
409 	if (strlcpy(irepo.repo_path, repo->path, sizeof(irepo.repo_path))
410 	    >= sizeof(irepo.repo_path))
411 		return got_error_msg(GOT_ERR_NO_SPACE, "repo path too long");
412 
413 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_INFO_REPO, PROC_GOTD, -1,
414 	    &irepo, sizeof(irepo)) == -1) {
415 		err = got_error_from_errno("imsg compose INFO_REPO");
416 		if (err)
417 			return err;
418 	}
419 
420 	return NULL;
421 }
422 
423 static const struct got_error *
424 send_client_info(struct gotd_imsgev *iev, struct gotd_client *client)
425 {
426 	const struct got_error *err = NULL;
427 	struct gotd_imsg_info_client iclient;
428 	struct gotd_child_proc *proc;
429 
430 	memset(&iclient, 0, sizeof(iclient));
431 	iclient.euid = client->euid;
432 	iclient.egid = client->egid;
433 
434 	proc = client->repo;
435 	if (proc) {
436 		if (strlcpy(iclient.repo_name, proc->repo_path,
437 		    sizeof(iclient.repo_name)) >= sizeof(iclient.repo_name)) {
438 			return got_error_msg(GOT_ERR_NO_SPACE,
439 			    "repo name too long");
440 		}
441 		if (client_is_writing(client))
442 			iclient.is_writing = 1;
443 
444 		iclient.repo_child_pid = proc->pid;
445 	}
446 
447 	if (client->session)
448 		iclient.session_child_pid = client->session->pid;
449 
450 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_INFO_CLIENT, PROC_GOTD, -1,
451 	    &iclient, sizeof(iclient)) == -1) {
452 		err = got_error_from_errno("imsg compose INFO_CLIENT");
453 		if (err)
454 			return err;
455 	}
456 
457 	return NULL;
458 }
459 
460 static const struct got_error *
461 send_info(struct gotd_client *client)
462 {
463 	const struct got_error *err = NULL;
464 	struct gotd_imsg_info info;
465 	uint64_t slot;
466 	struct gotd_repo *repo;
467 
468 	if (client->euid != 0)
469 		return got_error_set_errno(EPERM, "info");
470 
471 	info.pid = gotd.pid;
472 	info.verbosity = gotd.verbosity;
473 	info.nrepos = gotd.nrepos;
474 	info.nclients = client_cnt - 1;
475 
476 	if (gotd_imsg_compose_event(&client->iev, GOTD_IMSG_INFO, PROC_GOTD, -1,
477 	    &info, sizeof(info)) == -1) {
478 		err = got_error_from_errno("imsg compose INFO");
479 		if (err)
480 			return err;
481 	}
482 
483 	TAILQ_FOREACH(repo, &gotd.repos, entry) {
484 		err = send_repo_info(&client->iev, repo);
485 		if (err)
486 			return err;
487 	}
488 
489 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
490 		struct gotd_client *c;
491 		STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
492 			if (c->id == client->id)
493 				continue;
494 			err = send_client_info(&client->iev, c);
495 			if (err)
496 				return err;
497 		}
498 	}
499 
500 	return NULL;
501 }
502 
503 static const struct got_error *
504 stop_gotd(struct gotd_client *client)
505 {
506 
507 	if (client->euid != 0)
508 		return got_error_set_errno(EPERM, "stop");
509 
510 	gotd_shutdown();
511 	/* NOTREACHED */
512 	return NULL;
513 }
514 
515 static const struct got_error *
516 start_client_authentication(struct gotd_client *client, struct imsg *imsg)
517 {
518 	const struct got_error *err;
519 	struct gotd_imsg_list_refs ireq;
520 	struct gotd_repo *repo = NULL;
521 	size_t datalen;
522 
523 	log_debug("list-refs request from uid %d", client->euid);
524 
525 	if (client->state != GOTD_CLIENT_STATE_NEW)
526 		return got_error_msg(GOT_ERR_BAD_REQUEST,
527 		    "unexpected list-refs request received");
528 
529 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
530 	if (datalen != sizeof(ireq))
531 		return got_error(GOT_ERR_PRIVSEP_LEN);
532 
533 	memcpy(&ireq, imsg->data, datalen);
534 
535 	if (ireq.client_is_reading) {
536 		err = ensure_client_is_not_writing(client);
537 		if (err)
538 			return err;
539 		repo = gotd_find_repo_by_name(ireq.repo_name, &gotd);
540 		if (repo == NULL)
541 			return got_error(GOT_ERR_NOT_GIT_REPO);
542 		err = start_auth_child(client, GOTD_AUTH_READ, repo,
543 		    gotd.argv0, gotd.confpath, gotd.daemonize,
544 		    gotd.verbosity);
545 		if (err)
546 			return err;
547 	} else {
548 		err = ensure_client_is_not_reading(client);
549 		if (err)
550 			return err;
551 		repo = gotd_find_repo_by_name(ireq.repo_name, &gotd);
552 		if (repo == NULL)
553 			return got_error(GOT_ERR_NOT_GIT_REPO);
554 		err = start_auth_child(client,
555 		    GOTD_AUTH_READ | GOTD_AUTH_WRITE,
556 		    repo, gotd.argv0, gotd.confpath, gotd.daemonize,
557 		    gotd.verbosity);
558 		if (err)
559 			return err;
560 	}
561 
562 	evtimer_add(&client->tmo, &auth_timeout);
563 
564 	/* Flow continues upon authentication successs/failure or timeout. */
565 	return NULL;
566 }
567 
568 static void
569 gotd_request(int fd, short events, void *arg)
570 {
571 	struct gotd_imsgev *iev = arg;
572 	struct imsgbuf *ibuf = &iev->ibuf;
573 	struct gotd_client *client = iev->handler_arg;
574 	const struct got_error *err = NULL;
575 	struct imsg imsg;
576 	ssize_t n;
577 
578 	if (events & EV_WRITE) {
579 		while (ibuf->w.queued) {
580 			n = msgbuf_write(&ibuf->w);
581 			if (n == -1 && errno == EPIPE) {
582 				/*
583 				 * The client has closed its socket.
584 				 * This can happen when Git clients are
585 				 * done sending pack file data.
586 				 */
587 				msgbuf_clear(&ibuf->w);
588 				continue;
589 			} else if (n == -1 && errno != EAGAIN) {
590 				err = got_error_from_errno("imsg_flush");
591 				disconnect_on_error(client, err);
592 				return;
593 			}
594 			if (n == 0) {
595 				/* Connection closed. */
596 				err = got_error(GOT_ERR_EOF);
597 				disconnect_on_error(client, err);
598 				return;
599 			}
600 		}
601 
602 		/* Disconnect gotctl(8) now that messages have been sent. */
603 		if (!client_is_reading(client) && !client_is_writing(client)) {
604 			disconnect(client);
605 			return;
606 		}
607 	}
608 
609 	if ((events & EV_READ) == 0)
610 		return;
611 
612 	memset(&imsg, 0, sizeof(imsg));
613 
614 	while (err == NULL) {
615 		err = gotd_imsg_recv(&imsg, ibuf, 0);
616 		if (err) {
617 			if (err->code == GOT_ERR_PRIVSEP_READ)
618 				err = NULL;
619 			break;
620 		}
621 
622 		evtimer_del(&client->tmo);
623 
624 		switch (imsg.hdr.type) {
625 		case GOTD_IMSG_INFO:
626 			err = send_info(client);
627 			break;
628 		case GOTD_IMSG_STOP:
629 			err = stop_gotd(client);
630 			break;
631 		case GOTD_IMSG_LIST_REFS:
632 			err = start_client_authentication(client, &imsg);
633 			break;
634 		default:
635 			log_debug("unexpected imsg %d", imsg.hdr.type);
636 			err = got_error(GOT_ERR_PRIVSEP_MSG);
637 			break;
638 		}
639 
640 		imsg_free(&imsg);
641 	}
642 
643 	if (err) {
644 		disconnect_on_error(client, err);
645 	} else {
646 		gotd_imsg_event_add(&client->iev);
647 	}
648 }
649 
650 static void
651 gotd_auth_timeout(int fd, short events, void *arg)
652 {
653 	struct gotd_client *client = arg;
654 
655 	log_debug("disconnecting uid %d due to authentication timeout",
656 	    client->euid);
657 	disconnect(client);
658 }
659 
660 static const struct got_error *
661 recv_connect(uint32_t *client_id, struct imsg *imsg)
662 {
663 	const struct got_error *err = NULL;
664 	struct gotd_imsg_connect iconnect;
665 	size_t datalen;
666 	int s = -1;
667 	struct gotd_client *client = NULL;
668 
669 	*client_id = 0;
670 
671 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
672 	if (datalen != sizeof(iconnect))
673 		return got_error(GOT_ERR_PRIVSEP_LEN);
674 	memcpy(&iconnect, imsg->data, sizeof(iconnect));
675 
676 	s = imsg->fd;
677 	if (s == -1) {
678 		err = got_error(GOT_ERR_PRIVSEP_NO_FD);
679 		goto done;
680 	}
681 
682 	if (find_client(iconnect.client_id)) {
683 		err = got_error_msg(GOT_ERR_CLIENT_ID, "duplicate client ID");
684 		goto done;
685 	}
686 
687 	client = calloc(1, sizeof(*client));
688 	if (client == NULL) {
689 		err = got_error_from_errno("calloc");
690 		goto done;
691 	}
692 
693 	*client_id = iconnect.client_id;
694 
695 	client->state = GOTD_CLIENT_STATE_NEW;
696 	client->id = iconnect.client_id;
697 	client->fd = s;
698 	s = -1;
699 	/* The auth process will verify UID/GID for us. */
700 	client->euid = iconnect.euid;
701 	client->egid = iconnect.egid;
702 
703 	imsg_init(&client->iev.ibuf, client->fd);
704 	client->iev.handler = gotd_request;
705 	client->iev.events = EV_READ;
706 	client->iev.handler_arg = client;
707 
708 	event_set(&client->iev.ev, client->fd, EV_READ, gotd_request,
709 	    &client->iev);
710 	gotd_imsg_event_add(&client->iev);
711 
712 	evtimer_set(&client->tmo, gotd_auth_timeout, client);
713 
714 	add_client(client);
715 	log_debug("%s: new client uid %d connected on fd %d", __func__,
716 	    client->euid, client->fd);
717 done:
718 	if (err) {
719 		struct gotd_child_proc *listen_proc = gotd.listen_proc;
720 		struct gotd_imsg_disconnect idisconnect;
721 
722 		idisconnect.client_id = client->id;
723 		if (gotd_imsg_compose_event(&listen_proc->iev,
724 		    GOTD_IMSG_DISCONNECT, PROC_GOTD, -1,
725 		    &idisconnect, sizeof(idisconnect)) == -1)
726 			log_warn("imsg compose DISCONNECT");
727 
728 		if (s != -1)
729 			close(s);
730 	}
731 
732 	return err;
733 }
734 
735 static const char *gotd_proc_names[PROC_MAX] = {
736 	"parent",
737 	"listen",
738 	"auth",
739 	"session_read",
740 	"session_write",
741 	"repo_read",
742 	"repo_write"
743 };
744 
745 static void
746 kill_proc(struct gotd_child_proc *proc, int fatal)
747 {
748 	if (fatal) {
749 		log_warnx("sending SIGKILL to PID %d", proc->pid);
750 		kill(proc->pid, SIGKILL);
751 	} else
752 		kill(proc->pid, SIGTERM);
753 }
754 
755 static void
756 gotd_shutdown(void)
757 {
758 	struct gotd_child_proc *proc;
759 	uint64_t slot;
760 
761 	log_debug("shutting down");
762 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
763 		struct gotd_client *c, *tmp;
764 
765 		STAILQ_FOREACH_SAFE(c, &gotd_clients[slot], entry, tmp)
766 			disconnect(c);
767 	}
768 
769 	proc = gotd.listen_proc;
770 	msgbuf_clear(&proc->iev.ibuf.w);
771 	close(proc->iev.ibuf.fd);
772 	kill_proc(proc, 0);
773 	wait_for_child(proc->pid);
774 	free(proc);
775 
776 	log_info("terminating");
777 	exit(0);
778 }
779 
780 void
781 gotd_sighdlr(int sig, short event, void *arg)
782 {
783 	/*
784 	 * Normal signal handler rules don't apply because libevent
785 	 * decouples for us.
786 	 */
787 
788 	switch (sig) {
789 	case SIGHUP:
790 		log_info("%s: ignoring SIGHUP", __func__);
791 		break;
792 	case SIGUSR1:
793 		log_info("%s: ignoring SIGUSR1", __func__);
794 		break;
795 	case SIGTERM:
796 	case SIGINT:
797 		gotd_shutdown();
798 		break;
799 	default:
800 		fatalx("unexpected signal");
801 	}
802 }
803 
804 static const struct got_error *
805 ensure_proc_is_reading(struct gotd_client *client,
806     struct gotd_child_proc *proc)
807 {
808 	if (!client_is_reading(client)) {
809 		kill_proc(proc, 1);
810 		return got_error_fmt(GOT_ERR_BAD_PACKET,
811 		    "PID %d handled a read-request for uid %d but this "
812 		    "user is not reading from a repository", proc->pid,
813 		    client->euid);
814 	}
815 
816 	return NULL;
817 }
818 
819 static const struct got_error *
820 ensure_proc_is_writing(struct gotd_client *client,
821     struct gotd_child_proc *proc)
822 {
823 	if (!client_is_writing(client)) {
824 		kill_proc(proc, 1);
825 		return got_error_fmt(GOT_ERR_BAD_PACKET,
826 		    "PID %d handled a write-request for uid %d but this "
827 		    "user is not writing to a repository", proc->pid,
828 		    client->euid);
829 	}
830 
831 	return NULL;
832 }
833 
834 static int
835 verify_imsg_src(struct gotd_client *client, struct gotd_child_proc *proc,
836     struct imsg *imsg)
837 {
838 	const struct got_error *err;
839 	int ret = 0;
840 
841 	if (proc->type == PROC_REPO_READ || proc->type == PROC_REPO_WRITE) {
842 		if (client->repo == NULL)
843 			fatalx("no process found for uid %d", client->euid);
844 		if (proc->pid != client->repo->pid) {
845 			kill_proc(proc, 1);
846 			log_warnx("received message from PID %d for uid %d, "
847 			    "while PID %d is the process serving this user",
848 			    proc->pid, client->euid, client->repo->pid);
849 			return 0;
850 		}
851 	}
852 	if (proc->type == PROC_SESSION_READ ||
853 	    proc->type == PROC_SESSION_WRITE) {
854 		if (client->session == NULL) {
855 			log_warnx("no session found for uid %d", client->euid);
856 			return 0;
857 		}
858 		if (proc->pid != client->session->pid) {
859 			kill_proc(proc, 1);
860 			log_warnx("received message from PID %d for uid %d, "
861 			    "while PID %d is the process serving this user",
862 			    proc->pid, client->euid, client->session->pid);
863 			return 0;
864 		}
865 	}
866 
867 	switch (imsg->hdr.type) {
868 	case GOTD_IMSG_ERROR:
869 		ret = 1;
870 		break;
871 	case GOTD_IMSG_CONNECT:
872 		if (proc->type != PROC_LISTEN) {
873 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
874 			    "new connection for uid %d from PID %d "
875 			    "which is not the listen process",
876 			    proc->pid, client->euid);
877 		} else
878 			ret = 1;
879 		break;
880 	case GOTD_IMSG_ACCESS_GRANTED:
881 		if (proc->type != PROC_AUTH) {
882 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
883 			    "authentication of uid %d from PID %d "
884 			    "which is not the auth process",
885 			    proc->pid, client->euid);
886 		} else
887 			ret = 1;
888 		break;
889 	case GOTD_IMSG_CLIENT_SESSION_READY:
890 		if (proc->type != PROC_SESSION_READ &&
891 		    proc->type != PROC_SESSION_WRITE) {
892 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
893 			    "unexpected \"ready\" signal from PID %d",
894 			    proc->pid);
895 		} else
896 			ret = 1;
897 		break;
898 	case GOTD_IMSG_REPO_CHILD_READY:
899 		if (proc->type != PROC_REPO_READ &&
900 		    proc->type != PROC_REPO_WRITE) {
901 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
902 			    "unexpected \"ready\" signal from PID %d",
903 			    proc->pid);
904 		} else
905 			ret = 1;
906 		break;
907 	case GOTD_IMSG_PACKFILE_DONE:
908 		err = ensure_proc_is_reading(client, proc);
909 		if (err)
910 			log_warnx("uid %d: %s", client->euid, err->msg);
911 		else
912 			ret = 1;
913 		break;
914 	case GOTD_IMSG_PACKFILE_INSTALL:
915 	case GOTD_IMSG_REF_UPDATES_START:
916 	case GOTD_IMSG_REF_UPDATE:
917 		err = ensure_proc_is_writing(client, proc);
918 		if (err)
919 			log_warnx("uid %d: %s", client->euid, err->msg);
920 		else
921 			ret = 1;
922 		break;
923 	default:
924 		log_debug("%s: unexpected imsg %d", __func__, imsg->hdr.type);
925 		break;
926 	}
927 
928 	return ret;
929 }
930 
931 static const struct got_error *
932 connect_repo_child(struct gotd_client *client,
933     struct gotd_child_proc *repo_proc)
934 {
935 	static const struct got_error *err;
936 	struct gotd_imsgev *session_iev = &client->session->iev;
937 	struct gotd_imsg_connect_repo_child ireq;
938 	int pipe[2];
939 
940 	if (client->state != GOTD_CLIENT_STATE_ACCESS_GRANTED)
941 		return got_error_msg(GOT_ERR_BAD_REQUEST,
942 		    "unexpected repo child ready signal received");
943 
944 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
945 	    PF_UNSPEC, pipe) == -1)
946 		fatal("socketpair");
947 
948 	memset(&ireq, 0, sizeof(ireq));
949 	ireq.client_id = client->id;
950 	ireq.proc_id = repo_proc->type;
951 
952 	/* Pass repo child pipe to session child process. */
953 	if (gotd_imsg_compose_event(session_iev, GOTD_IMSG_CONNECT_REPO_CHILD,
954 	    PROC_GOTD, pipe[0], &ireq, sizeof(ireq)) == -1) {
955 		err = got_error_from_errno("imsg compose CONNECT_REPO_CHILD");
956 		close(pipe[0]);
957 		close(pipe[1]);
958 		return err;
959 	}
960 
961 	/* Pass session child pipe to repo child process. */
962 	if (gotd_imsg_compose_event(&repo_proc->iev,
963 	    GOTD_IMSG_CONNECT_REPO_CHILD, PROC_GOTD, pipe[1], NULL, 0) == -1) {
964 		err = got_error_from_errno("imsg compose CONNECT_REPO_CHILD");
965 		close(pipe[1]);
966 		return err;
967 	}
968 
969 	return NULL;
970 }
971 
972 static void
973 gotd_dispatch_listener(int fd, short event, void *arg)
974 {
975 	struct gotd_imsgev *iev = arg;
976 	struct imsgbuf *ibuf = &iev->ibuf;
977 	struct gotd_child_proc *proc = gotd.listen_proc;
978 	ssize_t n;
979 	int shut = 0;
980 	struct imsg imsg;
981 
982 	if (proc->iev.ibuf.fd != fd)
983 		fatalx("%s: unexpected fd %d", __func__, fd);
984 
985 	if (event & EV_READ) {
986 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
987 			fatal("imsg_read error");
988 		if (n == 0) {
989 			/* Connection closed. */
990 			shut = 1;
991 			goto done;
992 		}
993 	}
994 
995 	if (event & EV_WRITE) {
996 		n = msgbuf_write(&ibuf->w);
997 		if (n == -1 && errno != EAGAIN)
998 			fatal("msgbuf_write");
999 		if (n == 0) {
1000 			/* Connection closed. */
1001 			shut = 1;
1002 			goto done;
1003 		}
1004 	}
1005 
1006 	for (;;) {
1007 		const struct got_error *err = NULL;
1008 		struct gotd_client *client = NULL;
1009 		uint32_t client_id = 0;
1010 		int do_disconnect = 0;
1011 
1012 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1013 			fatal("%s: imsg_get error", __func__);
1014 		if (n == 0)	/* No more messages. */
1015 			break;
1016 
1017 		switch (imsg.hdr.type) {
1018 		case GOTD_IMSG_ERROR:
1019 			do_disconnect = 1;
1020 			err = gotd_imsg_recv_error(&client_id, &imsg);
1021 			break;
1022 		case GOTD_IMSG_CONNECT:
1023 			err = recv_connect(&client_id, &imsg);
1024 			break;
1025 		default:
1026 			log_debug("unexpected imsg %d", imsg.hdr.type);
1027 			break;
1028 		}
1029 
1030 		client = find_client(client_id);
1031 		if (client == NULL) {
1032 			log_warnx("%s: client not found", __func__);
1033 			imsg_free(&imsg);
1034 			continue;
1035 		}
1036 
1037 		if (err)
1038 			log_warnx("uid %d: %s", client->euid, err->msg);
1039 
1040 		if (do_disconnect) {
1041 			if (err)
1042 				disconnect_on_error(client, err);
1043 			else
1044 				disconnect(client);
1045 		}
1046 
1047 		imsg_free(&imsg);
1048 	}
1049 done:
1050 	if (!shut) {
1051 		gotd_imsg_event_add(iev);
1052 	} else {
1053 		/* This pipe is dead. Remove its event handler */
1054 		event_del(&iev->ev);
1055 		event_loopexit(NULL);
1056 	}
1057 }
1058 
1059 static void
1060 gotd_dispatch_auth_child(int fd, short event, void *arg)
1061 {
1062 	const struct got_error *err = NULL;
1063 	struct gotd_imsgev *iev = arg;
1064 	struct imsgbuf *ibuf = &iev->ibuf;
1065 	struct gotd_client *client;
1066 	struct gotd_repo *repo = NULL;
1067 	ssize_t n;
1068 	int shut = 0;
1069 	struct imsg imsg;
1070 	uint32_t client_id = 0;
1071 	int do_disconnect = 0;
1072 
1073 	client = find_client_by_proc_fd(fd);
1074 	if (client == NULL) {
1075 		/* Can happen during process teardown. */
1076 		warnx("cannot find client for fd %d", fd);
1077 		shut = 1;
1078 		goto done;
1079 	}
1080 
1081 	if (client->auth == NULL)
1082 		fatalx("cannot find auth child process for fd %d", fd);
1083 
1084 	if (event & EV_READ) {
1085 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1086 			fatal("imsg_read error");
1087 		if (n == 0) {
1088 			/* Connection closed. */
1089 			shut = 1;
1090 			goto done;
1091 		}
1092 	}
1093 
1094 	if (event & EV_WRITE) {
1095 		n = msgbuf_write(&ibuf->w);
1096 		if (n == -1 && errno != EAGAIN)
1097 			fatal("msgbuf_write");
1098 		if (n == 0) {
1099 			/* Connection closed. */
1100 			shut = 1;
1101 		}
1102 		goto done;
1103 	}
1104 
1105 	if (client->auth->iev.ibuf.fd != fd)
1106 		fatalx("%s: unexpected fd %d", __func__, fd);
1107 
1108 	if ((n = imsg_get(ibuf, &imsg)) == -1)
1109 		fatal("%s: imsg_get error", __func__);
1110 	if (n == 0)	/* No more messages. */
1111 		return;
1112 
1113 	evtimer_del(&client->tmo);
1114 
1115 	switch (imsg.hdr.type) {
1116 	case GOTD_IMSG_ERROR:
1117 		do_disconnect = 1;
1118 		err = gotd_imsg_recv_error(&client_id, &imsg);
1119 		break;
1120 	case GOTD_IMSG_ACCESS_GRANTED:
1121 		client->state = GOTD_CLIENT_STATE_ACCESS_GRANTED;
1122 		break;
1123 	default:
1124 		do_disconnect = 1;
1125 		log_debug("unexpected imsg %d", imsg.hdr.type);
1126 		break;
1127 	}
1128 
1129 	if (!verify_imsg_src(client, client->auth, &imsg)) {
1130 		do_disconnect = 1;
1131 		log_debug("dropping imsg type %d from PID %d",
1132 		    imsg.hdr.type, client->auth->pid);
1133 	}
1134 	imsg_free(&imsg);
1135 
1136 	if (do_disconnect) {
1137 		if (err)
1138 			disconnect_on_error(client, err);
1139 		else
1140 			disconnect(client);
1141 		return;
1142 	}
1143 
1144 	repo = gotd_find_repo_by_name(client->auth->repo_name, &gotd);
1145 	if (repo == NULL) {
1146 		err = got_error(GOT_ERR_NOT_GIT_REPO);
1147 		goto done;
1148 	}
1149 	kill_auth_proc(client);
1150 
1151 	log_info("authenticated uid %d for repository %s",
1152 	    client->euid, repo->name);
1153 
1154 	err = start_session_child(client, repo, gotd.argv0,
1155 	    gotd.confpath, gotd.daemonize, gotd.verbosity);
1156 	if (err)
1157 		goto done;
1158 done:
1159 	if (err)
1160 		log_warnx("uid %d: %s", client->euid, err->msg);
1161 
1162 	/* We might have killed the auth process by now. */
1163 	if (client->auth != NULL) {
1164 		if (!shut) {
1165 			gotd_imsg_event_add(iev);
1166 		} else {
1167 			/* This pipe is dead. Remove its event handler */
1168 			event_del(&iev->ev);
1169 		}
1170 	}
1171 }
1172 
1173 static const struct got_error *
1174 connect_session(struct gotd_client *client)
1175 {
1176 	const struct got_error *err = NULL;
1177 	struct gotd_imsg_connect iconnect;
1178 	int s;
1179 
1180 	memset(&iconnect, 0, sizeof(iconnect));
1181 
1182 	s = dup(client->fd);
1183 	if (s == -1)
1184 		return got_error_from_errno("dup");
1185 
1186 	iconnect.client_id = client->id;
1187 	iconnect.euid = client->euid;
1188 	iconnect.egid = client->egid;
1189 
1190 	if (gotd_imsg_compose_event(&client->session->iev, GOTD_IMSG_CONNECT,
1191 	    PROC_GOTD, s, &iconnect, sizeof(iconnect)) == -1) {
1192 		err = got_error_from_errno("imsg compose CONNECT");
1193 		close(s);
1194 		return err;
1195 	}
1196 
1197 	/*
1198 	 * We are no longer interested in messages from this client.
1199 	 * Further client requests will be handled by the session process.
1200 	 */
1201 	msgbuf_clear(&client->iev.ibuf.w);
1202 	imsg_clear(&client->iev.ibuf);
1203 	event_del(&client->iev.ev);
1204 	client->fd = -1; /* will be closed via copy in client->iev.ibuf.fd */
1205 
1206 	return NULL;
1207 }
1208 
1209 static void
1210 gotd_dispatch_client_session(int fd, short event, void *arg)
1211 {
1212 	struct gotd_imsgev *iev = arg;
1213 	struct imsgbuf *ibuf = &iev->ibuf;
1214 	struct gotd_child_proc *proc = NULL;
1215 	struct gotd_client *client = NULL;
1216 	ssize_t n;
1217 	int shut = 0;
1218 	struct imsg imsg;
1219 
1220 	client = find_client_by_proc_fd(fd);
1221 	if (client == NULL) {
1222 		/* Can happen during process teardown. */
1223 		warnx("cannot find client for fd %d", fd);
1224 		shut = 1;
1225 		goto done;
1226 	}
1227 
1228 	if (event & EV_READ) {
1229 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1230 			fatal("imsg_read error");
1231 		if (n == 0) {
1232 			/* Connection closed. */
1233 			shut = 1;
1234 			goto done;
1235 		}
1236 	}
1237 
1238 	if (event & EV_WRITE) {
1239 		n = msgbuf_write(&ibuf->w);
1240 		if (n == -1 && errno != EAGAIN)
1241 			fatal("msgbuf_write");
1242 		if (n == 0) {
1243 			/* Connection closed. */
1244 			shut = 1;
1245 			goto done;
1246 		}
1247 	}
1248 
1249 	proc = client->session;
1250 	if (proc == NULL)
1251 		fatalx("cannot find session child process for fd %d", fd);
1252 
1253 	for (;;) {
1254 		const struct got_error *err = NULL;
1255 		uint32_t client_id = 0;
1256 		int do_disconnect = 0, do_start_repo_child = 0;
1257 
1258 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1259 			fatal("%s: imsg_get error", __func__);
1260 		if (n == 0)	/* No more messages. */
1261 			break;
1262 
1263 		switch (imsg.hdr.type) {
1264 		case GOTD_IMSG_ERROR:
1265 			do_disconnect = 1;
1266 			err = gotd_imsg_recv_error(&client_id, &imsg);
1267 			break;
1268 		case GOTD_IMSG_CLIENT_SESSION_READY:
1269 			if (client->state != GOTD_CLIENT_STATE_ACCESS_GRANTED) {
1270 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1271 				break;
1272 			}
1273 			do_start_repo_child = 1;
1274 			break;
1275 		case GOTD_IMSG_DISCONNECT:
1276 			do_disconnect = 1;
1277 			break;
1278 		default:
1279 			log_debug("unexpected imsg %d", imsg.hdr.type);
1280 			break;
1281 		}
1282 
1283 		if (!verify_imsg_src(client, proc, &imsg)) {
1284 			log_debug("dropping imsg type %d from PID %d",
1285 			    imsg.hdr.type, proc->pid);
1286 			imsg_free(&imsg);
1287 			continue;
1288 		}
1289 		if (err)
1290 			log_warnx("uid %d: %s", client->euid, err->msg);
1291 
1292 		if (do_start_repo_child) {
1293 			struct gotd_repo *repo;
1294 			const char *name = client->session->repo_name;
1295 
1296 			repo = gotd_find_repo_by_name(name, &gotd);
1297 			if (repo != NULL) {
1298 				enum gotd_procid proc_type;
1299 
1300 				if (client->required_auth & GOTD_AUTH_WRITE)
1301 					proc_type = PROC_REPO_WRITE;
1302 				else
1303 					proc_type = PROC_REPO_READ;
1304 
1305 				err = start_repo_child(client, proc_type, repo,
1306 				    gotd.argv0, gotd.confpath, gotd.daemonize,
1307 				    gotd.verbosity);
1308 			} else
1309 				err = got_error(GOT_ERR_NOT_GIT_REPO);
1310 
1311 			if (err) {
1312 				log_warnx("uid %d: %s", client->euid, err->msg);
1313 				do_disconnect = 1;
1314 			}
1315 		}
1316 
1317 		if (do_disconnect) {
1318 			if (err)
1319 				disconnect_on_error(client, err);
1320 			else
1321 				disconnect(client);
1322 		}
1323 
1324 		imsg_free(&imsg);
1325 	}
1326 done:
1327 	if (!shut) {
1328 		gotd_imsg_event_add(iev);
1329 	} else {
1330 		/* This pipe is dead. Remove its event handler */
1331 		event_del(&iev->ev);
1332 		disconnect(client);
1333 	}
1334 }
1335 
1336 static void
1337 gotd_dispatch_repo_child(int fd, short event, void *arg)
1338 {
1339 	struct gotd_imsgev *iev = arg;
1340 	struct imsgbuf *ibuf = &iev->ibuf;
1341 	struct gotd_child_proc *proc = NULL;
1342 	struct gotd_client *client;
1343 	ssize_t n;
1344 	int shut = 0;
1345 	struct imsg imsg;
1346 
1347 	client = find_client_by_proc_fd(fd);
1348 	if (client == NULL) {
1349 		/* Can happen during process teardown. */
1350 		warnx("cannot find client for fd %d", fd);
1351 		shut = 1;
1352 		goto done;
1353 	}
1354 
1355 	if (event & EV_READ) {
1356 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1357 			fatal("imsg_read error");
1358 		if (n == 0) {
1359 			/* Connection closed. */
1360 			shut = 1;
1361 			goto done;
1362 		}
1363 	}
1364 
1365 	if (event & EV_WRITE) {
1366 		n = msgbuf_write(&ibuf->w);
1367 		if (n == -1 && errno != EAGAIN)
1368 			fatal("msgbuf_write");
1369 		if (n == 0) {
1370 			/* Connection closed. */
1371 			shut = 1;
1372 			goto done;
1373 		}
1374 	}
1375 
1376 	proc = client->repo;
1377 	if (proc == NULL)
1378 		fatalx("cannot find child process for fd %d", fd);
1379 
1380 	for (;;) {
1381 		const struct got_error *err = NULL;
1382 		uint32_t client_id = 0;
1383 		int do_disconnect = 0;
1384 
1385 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1386 			fatal("%s: imsg_get error", __func__);
1387 		if (n == 0)	/* No more messages. */
1388 			break;
1389 
1390 		switch (imsg.hdr.type) {
1391 		case GOTD_IMSG_ERROR:
1392 			do_disconnect = 1;
1393 			err = gotd_imsg_recv_error(&client_id, &imsg);
1394 			break;
1395 		case GOTD_IMSG_REPO_CHILD_READY:
1396 			err = connect_session(client);
1397 			if (err)
1398 				break;
1399 			err = connect_repo_child(client, proc);
1400 			break;
1401 		default:
1402 			log_debug("unexpected imsg %d", imsg.hdr.type);
1403 			break;
1404 		}
1405 
1406 		if (!verify_imsg_src(client, proc, &imsg)) {
1407 			log_debug("dropping imsg type %d from PID %d",
1408 			    imsg.hdr.type, proc->pid);
1409 			imsg_free(&imsg);
1410 			continue;
1411 		}
1412 		if (err)
1413 			log_warnx("uid %d: %s", client->euid, err->msg);
1414 
1415 		if (do_disconnect) {
1416 			if (err)
1417 				disconnect_on_error(client, err);
1418 			else
1419 				disconnect(client);
1420 		}
1421 
1422 		imsg_free(&imsg);
1423 	}
1424 done:
1425 	if (!shut) {
1426 		gotd_imsg_event_add(iev);
1427 	} else {
1428 		/* This pipe is dead. Remove its event handler */
1429 		event_del(&iev->ev);
1430 		disconnect(client);
1431 	}
1432 }
1433 
1434 static pid_t
1435 start_child(enum gotd_procid proc_id, const char *repo_path,
1436     char *argv0, const char *confpath, int fd, int daemonize, int verbosity)
1437 {
1438 	char	*argv[11];
1439 	int	 argc = 0;
1440 	pid_t	 pid;
1441 
1442 	switch (pid = fork()) {
1443 	case -1:
1444 		fatal("cannot fork");
1445 	case 0:
1446 		break;
1447 	default:
1448 		close(fd);
1449 		return pid;
1450 	}
1451 
1452 	if (fd != GOTD_FILENO_MSG_PIPE) {
1453 		if (dup2(fd, GOTD_FILENO_MSG_PIPE) == -1)
1454 			fatal("cannot setup imsg fd");
1455 	} else if (fcntl(fd, F_SETFD, 0) == -1)
1456 		fatal("cannot setup imsg fd");
1457 
1458 	argv[argc++] = argv0;
1459 	switch (proc_id) {
1460 	case PROC_LISTEN:
1461 		argv[argc++] = (char *)"-L";
1462 		break;
1463 	case PROC_AUTH:
1464 		argv[argc++] = (char *)"-A";
1465 		break;
1466 	case PROC_SESSION_READ:
1467 		argv[argc++] = (char *)"-s";
1468 		break;
1469 	case PROC_SESSION_WRITE:
1470 		argv[argc++] = (char *)"-S";
1471 		break;
1472 	case PROC_REPO_READ:
1473 		argv[argc++] = (char *)"-R";
1474 		break;
1475 	case PROC_REPO_WRITE:
1476 		argv[argc++] = (char *)"-W";
1477 		break;
1478 	default:
1479 		fatalx("invalid process id %d", proc_id);
1480 	}
1481 
1482 	argv[argc++] = (char *)"-f";
1483 	argv[argc++] = (char *)confpath;
1484 
1485 	if (repo_path) {
1486 		argv[argc++] = (char *)"-P";
1487 		argv[argc++] = (char *)repo_path;
1488 	}
1489 
1490 	if (!daemonize)
1491 		argv[argc++] = (char *)"-d";
1492 	if (verbosity > 0)
1493 		argv[argc++] = (char *)"-v";
1494 	if (verbosity > 1)
1495 		argv[argc++] = (char *)"-v";
1496 	argv[argc++] = NULL;
1497 
1498 	execvp(argv0, argv);
1499 	fatal("execvp");
1500 }
1501 
1502 static void
1503 start_listener(char *argv0, const char *confpath, int daemonize, int verbosity)
1504 {
1505 	struct gotd_child_proc *proc;
1506 
1507 	proc = calloc(1, sizeof(*proc));
1508 	if (proc == NULL)
1509 		fatal("calloc");
1510 
1511 	proc->type = PROC_LISTEN;
1512 
1513 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1514 	    PF_UNSPEC, proc->pipe) == -1)
1515 		fatal("socketpair");
1516 
1517 	proc->pid = start_child(proc->type, NULL, argv0, confpath,
1518 	    proc->pipe[1], daemonize, verbosity);
1519 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1520 	proc->iev.handler = gotd_dispatch_listener;
1521 	proc->iev.events = EV_READ;
1522 	proc->iev.handler_arg = NULL;
1523 
1524 	gotd.listen_proc = proc;
1525 }
1526 
1527 static const struct got_error *
1528 start_session_child(struct gotd_client *client, struct gotd_repo *repo,
1529     char *argv0, const char *confpath, int daemonize, int verbosity)
1530 {
1531 	struct gotd_child_proc *proc;
1532 
1533 	proc = calloc(1, sizeof(*proc));
1534 	if (proc == NULL)
1535 		return got_error_from_errno("calloc");
1536 
1537 	if (client_is_reading(client))
1538 		proc->type = PROC_SESSION_READ;
1539 	else
1540 		proc->type = PROC_SESSION_WRITE;
1541 	if (strlcpy(proc->repo_name, repo->name,
1542 	    sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
1543 		fatalx("repository name too long: %s", repo->name);
1544 	log_debug("starting client uid %d session for repository %s",
1545 	    client->euid, repo->name);
1546 	if (strlcpy(proc->repo_path, repo->path, sizeof(proc->repo_path)) >=
1547 	    sizeof(proc->repo_path))
1548 		fatalx("repository path too long: %s", repo->path);
1549 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1550 	    PF_UNSPEC, proc->pipe) == -1)
1551 		fatal("socketpair");
1552 	proc->pid = start_child(proc->type, proc->repo_path, argv0,
1553 	    confpath, proc->pipe[1], daemonize, verbosity);
1554 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1555 	log_debug("proc %s %s is on fd %d",
1556 	    gotd_proc_names[proc->type], proc->repo_path,
1557 	    proc->pipe[0]);
1558 	proc->iev.handler = gotd_dispatch_client_session;
1559 	proc->iev.events = EV_READ;
1560 	proc->iev.handler_arg = NULL;
1561 	event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
1562 	    gotd_dispatch_client_session, &proc->iev);
1563 	gotd_imsg_event_add(&proc->iev);
1564 
1565 	client->session = proc;
1566 	return NULL;
1567 }
1568 
1569 static const struct got_error *
1570 start_repo_child(struct gotd_client *client, enum gotd_procid proc_type,
1571     struct gotd_repo *repo, char *argv0, const char *confpath,
1572     int daemonize, int verbosity)
1573 {
1574 	struct gotd_child_proc *proc;
1575 
1576 	if (proc_type != PROC_REPO_READ && proc_type != PROC_REPO_WRITE)
1577 		return got_error_msg(GOT_ERR_NOT_IMPL, "bad process type");
1578 
1579 	proc = calloc(1, sizeof(*proc));
1580 	if (proc == NULL)
1581 		return got_error_from_errno("calloc");
1582 
1583 	proc->type = proc_type;
1584 	if (strlcpy(proc->repo_name, repo->name,
1585 	    sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
1586 		fatalx("repository name too long: %s", repo->name);
1587 	log_debug("starting %s for repository %s",
1588 	    proc->type == PROC_REPO_READ ? "reader" : "writer", repo->name);
1589 	if (strlcpy(proc->repo_path, repo->path, sizeof(proc->repo_path)) >=
1590 	    sizeof(proc->repo_path))
1591 		fatalx("repository path too long: %s", repo->path);
1592 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1593 	    PF_UNSPEC, proc->pipe) == -1)
1594 		fatal("socketpair");
1595 	proc->pid = start_child(proc->type, proc->repo_path, argv0,
1596 	    confpath, proc->pipe[1], daemonize, verbosity);
1597 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1598 	log_debug("proc %s %s is on fd %d",
1599 	    gotd_proc_names[proc->type], proc->repo_path,
1600 	    proc->pipe[0]);
1601 	proc->iev.handler = gotd_dispatch_repo_child;
1602 	proc->iev.events = EV_READ;
1603 	proc->iev.handler_arg = NULL;
1604 	event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
1605 	    gotd_dispatch_repo_child, &proc->iev);
1606 	gotd_imsg_event_add(&proc->iev);
1607 
1608 	client->repo = proc;
1609 	return NULL;
1610 }
1611 
1612 static const struct got_error *
1613 start_auth_child(struct gotd_client *client, int required_auth,
1614     struct gotd_repo *repo, char *argv0, const char *confpath,
1615     int daemonize, int verbosity)
1616 {
1617 	const struct got_error *err = NULL;
1618 	struct gotd_child_proc *proc;
1619 	struct gotd_imsg_auth iauth;
1620 	int fd;
1621 
1622 	memset(&iauth, 0, sizeof(iauth));
1623 
1624 	fd = dup(client->fd);
1625 	if (fd == -1)
1626 		return got_error_from_errno("dup");
1627 
1628 	proc = calloc(1, sizeof(*proc));
1629 	if (proc == NULL) {
1630 		err = got_error_from_errno("calloc");
1631 		close(fd);
1632 		return err;
1633 	}
1634 
1635 	proc->type = PROC_AUTH;
1636 	if (strlcpy(proc->repo_name, repo->name,
1637 	    sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
1638 		fatalx("repository name too long: %s", repo->name);
1639 	log_debug("starting auth for uid %d repository %s",
1640 	    client->euid, repo->name);
1641 	if (strlcpy(proc->repo_path, repo->path, sizeof(proc->repo_path)) >=
1642 	    sizeof(proc->repo_path))
1643 		fatalx("repository path too long: %s", repo->path);
1644 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1645 	    PF_UNSPEC, proc->pipe) == -1)
1646 		fatal("socketpair");
1647 	proc->pid = start_child(proc->type, proc->repo_path, argv0,
1648 	    confpath, proc->pipe[1], daemonize, verbosity);
1649 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1650 	log_debug("proc %s %s is on fd %d",
1651 	    gotd_proc_names[proc->type], proc->repo_path,
1652 	    proc->pipe[0]);
1653 	proc->iev.handler = gotd_dispatch_auth_child;
1654 	proc->iev.events = EV_READ;
1655 	proc->iev.handler_arg = NULL;
1656 	event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
1657 	    gotd_dispatch_auth_child, &proc->iev);
1658 	gotd_imsg_event_add(&proc->iev);
1659 
1660 	iauth.euid = client->euid;
1661 	iauth.egid = client->egid;
1662 	iauth.required_auth = required_auth;
1663 	iauth.client_id = client->id;
1664 	if (gotd_imsg_compose_event(&proc->iev, GOTD_IMSG_AUTHENTICATE,
1665 	    PROC_GOTD, fd, &iauth, sizeof(iauth)) == -1) {
1666 		log_warn("imsg compose AUTHENTICATE");
1667 		close(fd);
1668 		/* Let the auth_timeout handler tidy up. */
1669 	}
1670 
1671 	client->auth = proc;
1672 	client->required_auth = required_auth;
1673 	return NULL;
1674 }
1675 
1676 static void
1677 apply_unveil_repo_readonly(const char *repo_path, int need_tmpdir)
1678 {
1679 	if (need_tmpdir) {
1680 		if (unveil(GOT_TMPDIR_STR, "rwc") == -1)
1681 			fatal("unveil %s", GOT_TMPDIR_STR);
1682 	}
1683 
1684 	if (unveil(repo_path, "r") == -1)
1685 		fatal("unveil %s", repo_path);
1686 
1687 	if (unveil(NULL, NULL) == -1)
1688 		fatal("unveil");
1689 }
1690 
1691 static void
1692 apply_unveil_repo_readwrite(const char *repo_path)
1693 {
1694 	if (unveil(repo_path, "rwc") == -1)
1695 		fatal("unveil %s", repo_path);
1696 
1697 	if (unveil(GOT_TMPDIR_STR, "rwc") == -1)
1698 		fatal("unveil %s", GOT_TMPDIR_STR);
1699 
1700 	if (unveil(NULL, NULL) == -1)
1701 		fatal("unveil");
1702 }
1703 
1704 static void
1705 apply_unveil_none(void)
1706 {
1707 	if (unveil("/", "") == -1)
1708 		fatal("unveil");
1709 
1710 	if (unveil(NULL, NULL) == -1)
1711 		fatal("unveil");
1712 }
1713 
1714 static void
1715 apply_unveil_selfexec(void)
1716 {
1717 	if (unveil(gotd.argv0, "x") == -1)
1718 		fatal("unveil %s", gotd.argv0);
1719 
1720 	if (unveil(NULL, NULL) == -1)
1721 		fatal("unveil");
1722 }
1723 
1724 int
1725 main(int argc, char **argv)
1726 {
1727 	const struct got_error *error = NULL;
1728 	int ch, fd = -1, daemonize = 1, verbosity = 0, noaction = 0;
1729 	const char *confpath = GOTD_CONF_PATH;
1730 	char *argv0 = argv[0];
1731 	char title[2048];
1732 	struct passwd *pw = NULL;
1733 	char *repo_path = NULL;
1734 	enum gotd_procid proc_id = PROC_GOTD;
1735 	struct event evsigint, evsigterm, evsighup, evsigusr1;
1736 	int *pack_fds = NULL, *temp_fds = NULL;
1737 	struct gotd_repo *repo = NULL;
1738 
1739 	log_init(1, LOG_DAEMON); /* Log to stderr until daemonized. */
1740 
1741 	while ((ch = getopt(argc, argv, "Adf:LnP:RsSvW")) != -1) {
1742 		switch (ch) {
1743 		case 'A':
1744 			proc_id = PROC_AUTH;
1745 			break;
1746 		case 'd':
1747 			daemonize = 0;
1748 			break;
1749 		case 'f':
1750 			confpath = optarg;
1751 			break;
1752 		case 'L':
1753 			proc_id = PROC_LISTEN;
1754 			break;
1755 		case 'n':
1756 			noaction = 1;
1757 			break;
1758 		case 'P':
1759 			repo_path = realpath(optarg, NULL);
1760 			if (repo_path == NULL)
1761 				fatal("realpath '%s'", optarg);
1762 			break;
1763 		case 'R':
1764 			proc_id = PROC_REPO_READ;
1765 			break;
1766 		case 's':
1767 			proc_id = PROC_SESSION_READ;
1768 			break;
1769 		case 'S':
1770 			proc_id = PROC_SESSION_WRITE;
1771 			break;
1772 		case 'v':
1773 			if (verbosity < 3)
1774 				verbosity++;
1775 			break;
1776 		case 'W':
1777 			proc_id = PROC_REPO_WRITE;
1778 			break;
1779 		default:
1780 			usage();
1781 		}
1782 	}
1783 
1784 	argc -= optind;
1785 	argv += optind;
1786 
1787 	if (argc != 0)
1788 		usage();
1789 
1790 	if (geteuid() && (proc_id == PROC_GOTD || proc_id == PROC_LISTEN))
1791 		fatalx("need root privileges");
1792 
1793 	if (parse_config(confpath, proc_id, &gotd, 1) != 0)
1794 		return 1;
1795 
1796 	pw = getpwnam(gotd.user_name);
1797 	if (pw == NULL)
1798 		fatalx("user %s not found", gotd.user_name);
1799 
1800 	if (pw->pw_uid == 0)
1801 		fatalx("cannot run %s as the superuser", getprogname());
1802 
1803 	if (noaction) {
1804 		fprintf(stderr, "configuration OK\n");
1805 		return 0;
1806 	}
1807 
1808 	gotd.argv0 = argv0;
1809 	gotd.daemonize = daemonize;
1810 	gotd.verbosity = verbosity;
1811 	gotd.confpath = confpath;
1812 
1813 	/* Require an absolute path in argv[0] for reliable re-exec. */
1814 	if (!got_path_is_absolute(argv0))
1815 		fatalx("bad path \"%s\": must be an absolute path", argv0);
1816 
1817 	log_init(daemonize ? 0 : 1, LOG_DAEMON);
1818 	log_setverbose(verbosity);
1819 
1820 	if (proc_id == PROC_GOTD) {
1821 		snprintf(title, sizeof(title), "%s", gotd_proc_names[proc_id]);
1822 		arc4random_buf(&clients_hash_key, sizeof(clients_hash_key));
1823 		if (daemonize && daemon(1, 0) == -1)
1824 			fatal("daemon");
1825 		gotd.pid = getpid();
1826 		start_listener(argv0, confpath, daemonize, verbosity);
1827 	} else if (proc_id == PROC_LISTEN) {
1828 		snprintf(title, sizeof(title), "%s", gotd_proc_names[proc_id]);
1829 		if (verbosity) {
1830 			log_info("socket: %s", gotd.unix_socket_path);
1831 			log_info("user: %s", pw->pw_name);
1832 		}
1833 
1834 		fd = unix_socket_listen(gotd.unix_socket_path, pw->pw_uid,
1835 		    pw->pw_gid);
1836 		if (fd == -1) {
1837 			fatal("cannot listen on unix socket %s",
1838 			    gotd.unix_socket_path);
1839 		}
1840 	} else if (proc_id == PROC_AUTH) {
1841 		snprintf(title, sizeof(title), "%s %s",
1842 		    gotd_proc_names[proc_id], repo_path);
1843 	} else if (proc_id == PROC_REPO_READ || proc_id == PROC_REPO_WRITE ||
1844 	    proc_id == PROC_SESSION_READ || proc_id == PROC_SESSION_WRITE) {
1845 		error = got_repo_pack_fds_open(&pack_fds);
1846 		if (error != NULL)
1847 			fatalx("cannot open pack tempfiles: %s", error->msg);
1848 		error = got_repo_temp_fds_open(&temp_fds);
1849 		if (error != NULL)
1850 			fatalx("cannot open pack tempfiles: %s", error->msg);
1851 		if (repo_path == NULL)
1852 			fatalx("repository path not specified");
1853 		snprintf(title, sizeof(title), "%s %s",
1854 		    gotd_proc_names[proc_id], repo_path);
1855 	} else
1856 		fatal("invalid process id %d", proc_id);
1857 
1858 	setproctitle("%s", title);
1859 	log_procinit(title);
1860 
1861 	/* Drop root privileges. */
1862 	if (setgid(pw->pw_gid) == -1)
1863 		fatal("setgid %d failed", pw->pw_gid);
1864 	if (setuid(pw->pw_uid) == -1)
1865 		fatal("setuid %d failed", pw->pw_uid);
1866 
1867 	event_init();
1868 
1869 	switch (proc_id) {
1870 	case PROC_GOTD:
1871 #ifndef PROFILE
1872 		/* "exec" promise will be limited to argv[0] via unveil(2). */
1873 		if (pledge("stdio proc exec sendfd recvfd unveil", NULL) == -1)
1874 			err(1, "pledge");
1875 #endif
1876 		break;
1877 	case PROC_LISTEN:
1878 #ifndef PROFILE
1879 		if (pledge("stdio sendfd unix unveil", NULL) == -1)
1880 			err(1, "pledge");
1881 #endif
1882 		/*
1883 		 * Ensure that AF_UNIX bind(2) cannot be used with any other
1884 		 * sockets by revoking all filesystem access via unveil(2).
1885 		 */
1886 		apply_unveil_none();
1887 
1888 		listen_main(title, fd, gotd.connection_limits,
1889 		    gotd.nconnection_limits);
1890 		/* NOTREACHED */
1891 		break;
1892 	case PROC_AUTH:
1893 #ifndef PROFILE
1894 		if (pledge("stdio getpw recvfd unix unveil", NULL) == -1)
1895 			err(1, "pledge");
1896 #endif
1897 		/*
1898 		 * We need the "unix" pledge promise for getpeername(2) only.
1899 		 * Ensure that AF_UNIX bind(2) cannot be used by revoking all
1900 		 * filesystem access via unveil(2). Access to password database
1901 		 * files will still work since "getpw" bypasses unveil(2).
1902 		 */
1903 		apply_unveil_none();
1904 
1905 		auth_main(title, &gotd.repos, repo_path);
1906 		/* NOTREACHED */
1907 		break;
1908 	case PROC_SESSION_READ:
1909 	case PROC_SESSION_WRITE:
1910 #ifndef PROFILE
1911 		/*
1912 		 * The "recvfd" promise is only needed during setup and
1913 		 * will be removed in a later pledge(2) call.
1914 		 */
1915 		if (pledge("stdio rpath wpath cpath recvfd sendfd fattr flock "
1916 		    "unveil", NULL) == -1)
1917 			err(1, "pledge");
1918 #endif
1919 		if (proc_id == PROC_SESSION_READ)
1920 			apply_unveil_repo_readonly(repo_path, 1);
1921 		else
1922 			apply_unveil_repo_readwrite(repo_path);
1923 		session_main(title, repo_path, pack_fds, temp_fds,
1924 		    &gotd.request_timeout, proc_id);
1925 		/* NOTREACHED */
1926 		break;
1927 	case PROC_REPO_READ:
1928 #ifndef PROFILE
1929 		if (pledge("stdio rpath recvfd unveil", NULL) == -1)
1930 			err(1, "pledge");
1931 #endif
1932 		apply_unveil_repo_readonly(repo_path, 0);
1933 		repo_read_main(title, repo_path, pack_fds, temp_fds);
1934 		/* NOTREACHED */
1935 		exit(0);
1936 	case PROC_REPO_WRITE:
1937 #ifndef PROFILE
1938 		if (pledge("stdio rpath recvfd unveil", NULL) == -1)
1939 			err(1, "pledge");
1940 #endif
1941 		apply_unveil_repo_readonly(repo_path, 0);
1942 		repo = gotd_find_repo_by_path(repo_path, &gotd);
1943 		if (repo == NULL)
1944 			fatalx("no repository for path %s", repo_path);
1945 		repo_write_main(title, repo_path, pack_fds, temp_fds,
1946 		    &repo->protected_tag_namespaces,
1947 		    &repo->protected_branch_namespaces,
1948 		    &repo->protected_branches);
1949 		/* NOTREACHED */
1950 		exit(0);
1951 	default:
1952 		fatal("invalid process id %d", proc_id);
1953 	}
1954 
1955 	if (proc_id != PROC_GOTD)
1956 		fatal("invalid process id %d", proc_id);
1957 
1958 	apply_unveil_selfexec();
1959 
1960 	signal_set(&evsigint, SIGINT, gotd_sighdlr, NULL);
1961 	signal_set(&evsigterm, SIGTERM, gotd_sighdlr, NULL);
1962 	signal_set(&evsighup, SIGHUP, gotd_sighdlr, NULL);
1963 	signal_set(&evsigusr1, SIGUSR1, gotd_sighdlr, NULL);
1964 	signal(SIGPIPE, SIG_IGN);
1965 
1966 	signal_add(&evsigint, NULL);
1967 	signal_add(&evsigterm, NULL);
1968 	signal_add(&evsighup, NULL);
1969 	signal_add(&evsigusr1, NULL);
1970 
1971 	gotd_imsg_event_add(&gotd.listen_proc->iev);
1972 
1973 	event_dispatch();
1974 
1975 	free(repo_path);
1976 	gotd_shutdown();
1977 
1978 	return 0;
1979 }