Gotweb

Blob

Date:: Thu Dec 29 14:59:25 2022 UTC
Message:: fork gotd repo_read/repo_write children on demand ok op, jamsek
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/queue.h>
18 #include <sys/tree.h>
19 #include <sys/time.h>
20 #include <sys/types.h>
21 #include <sys/stat.h>
22 #include <sys/socket.h>
23 #include <sys/un.h>
24 #include <sys/wait.h>
25 
26 #include <fcntl.h>
27 #include <err.h>
28 #include <errno.h>
29 #include <event.h>
30 #include <limits.h>
31 #include <pwd.h>
32 #include <grp.h>
33 #include <imsg.h>
34 #include <sha1.h>
35 #include <signal.h>
36 #include <siphash.h>
37 #include <stdarg.h>
38 #include <stdio.h>
39 #include <stdlib.h>
40 #include <string.h>
41 #include <syslog.h>
42 #include <unistd.h>
43 
44 #include "got_error.h"
45 #include "got_opentemp.h"
46 #include "got_path.h"
47 #include "got_repository.h"
48 #include "got_object.h"
49 #include "got_reference.h"
50 
51 #include "got_lib_delta.h"
52 #include "got_lib_object.h"
53 #include "got_lib_object_cache.h"
54 #include "got_lib_sha1.h"
55 #include "got_lib_gitproto.h"
56 #include "got_lib_pack.h"
57 #include "got_lib_repository.h"
58 
59 #include "gotd.h"
60 #include "log.h"
61 #include "listen.h"
62 #include "auth.h"
63 #include "repo_read.h"
64 #include "repo_write.h"
65 
66 #ifndef nitems
67 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
68 #endif
69 
70 struct gotd_client {
71 	STAILQ_ENTRY(gotd_client)	 entry;
72 	enum gotd_client_state		 state;
73 	struct gotd_client_capability	*capabilities;
74 	size_t				 ncapa_alloc;
75 	size_t				 ncapabilities;
76 	uint32_t			 id;
77 	int				 fd;
78 	int				 delta_cache_fd;
79 	struct gotd_imsgev		 iev;
80 	struct event			 tmo;
81 	uid_t				 euid;
82 	gid_t				 egid;
83 	struct gotd_child_proc		*repo_read;
84 	struct gotd_child_proc		*repo_write;
85 	char				*packfile_path;
86 	char				*packidx_path;
87 	int				 nref_updates;
88 };
89 STAILQ_HEAD(gotd_clients, gotd_client);
90 
91 static struct gotd_clients gotd_clients[GOTD_CLIENT_TABLE_SIZE];
92 static SIPHASH_KEY clients_hash_key;
93 volatile int client_cnt;
94 static struct timeval timeout = { 3600, 0 };
95 static struct gotd gotd;
96 
97 void gotd_sighdlr(int sig, short event, void *arg);
98 static void gotd_shutdown(void);
99 static const struct got_error *start_repo_child(struct gotd_client *,
100     enum gotd_procid, struct gotd_repo *, char *, const char *, int, int);
101 static void kill_proc(struct gotd_child_proc *, int);
102 
103 __dead static void
104 usage()
105 {
106 	fprintf(stderr, "usage: %s [-dv] [-f config-file]\n", getprogname());
107 	exit(1);
108 }
109 
110 static int
111 unix_socket_listen(const char *unix_socket_path, uid_t uid, gid_t gid)
112 {
113 	struct sockaddr_un sun;
114 	int fd = -1;
115 	mode_t old_umask, mode;
116 
117 	fd = socket(AF_UNIX, SOCK_STREAM | SOCK_NONBLOCK| SOCK_CLOEXEC, 0);
118 	if (fd == -1) {
119 		log_warn("socket");
120 		return -1;
121 	}
122 
123 	sun.sun_family = AF_UNIX;
124 	if (strlcpy(sun.sun_path, unix_socket_path,
125 	    sizeof(sun.sun_path)) >= sizeof(sun.sun_path)) {
126 		log_warnx("%s: name too long", unix_socket_path);
127 		close(fd);
128 		return -1;
129 	}
130 
131 	if (unlink(unix_socket_path) == -1) {
132 		if (errno != ENOENT) {
133 			log_warn("unlink %s", unix_socket_path);
134 			close(fd);
135 			return -1;
136 		}
137 	}
138 
139 	old_umask = umask(S_IXUSR|S_IXGRP|S_IWOTH|S_IROTH|S_IXOTH);
140 	mode = S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP;
141 
142 	if (bind(fd, (struct sockaddr *)&sun, sizeof(sun)) == -1) {
143 		log_warn("bind: %s", unix_socket_path);
144 		close(fd);
145 		umask(old_umask);
146 		return -1;
147 	}
148 
149 	umask(old_umask);
150 
151 	if (chmod(unix_socket_path, mode) == -1) {
152 		log_warn("chmod %o %s", mode, unix_socket_path);
153 		close(fd);
154 		unlink(unix_socket_path);
155 		return -1;
156 	}
157 
158 	if (chown(unix_socket_path, uid, gid) == -1) {
159 		log_warn("chown %s uid=%d gid=%d", unix_socket_path, uid, gid);
160 		close(fd);
161 		unlink(unix_socket_path);
162 		return -1;
163 	}
164 
165 	if (listen(fd, GOTD_UNIX_SOCKET_BACKLOG) == -1) {
166 		log_warn("listen");
167 		close(fd);
168 		unlink(unix_socket_path);
169 		return -1;
170 	}
171 
172 	return fd;
173 }
174 
175 static struct group *
176 match_group(gid_t *groups, int ngroups, const char *unix_group_name)
177 {
178 	struct group *gr;
179 	int i;
180 
181 	for (i = 0; i < ngroups; i++) {
182 		gr = getgrgid(groups[i]);
183 		if (gr == NULL) {
184 			log_warn("getgrgid %d", groups[i]);
185 			continue;
186 		}
187 		if (strcmp(gr->gr_name, unix_group_name) == 0)
188 			return gr;
189 	}
190 
191 	return NULL;
192 }
193 
194 static uint64_t
195 client_hash(uint32_t client_id)
196 {
197 	return SipHash24(&clients_hash_key, &client_id, sizeof(client_id));
198 }
199 
200 static void
201 add_client(struct gotd_client *client)
202 {
203 	uint64_t slot = client_hash(client->id) % nitems(gotd_clients);
204 	STAILQ_INSERT_HEAD(&gotd_clients[slot], client, entry);
205 	client_cnt++;
206 }
207 
208 static struct gotd_client *
209 find_client(uint32_t client_id)
210 {
211 	uint64_t slot;
212 	struct gotd_client *c;
213 
214 	slot = client_hash(client_id) % nitems(gotd_clients);
215 	STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
216 		if (c->id == client_id)
217 			return c;
218 	}
219 
220 	return NULL;
221 }
222 
223 static struct gotd_child_proc *
224 get_client_proc(struct gotd_client *client)
225 {
226 	if (client->repo_read && client->repo_write) {
227 		fatalx("uid %d is reading and writing in the same session",
228 		    client->euid);
229 		/* NOTREACHED */
230 	}
231 
232 	if (client->repo_read)
233 		return client->repo_read;
234 	else if (client->repo_write)
235 		return client->repo_write;
236 
237 	return NULL;
238 }
239 
240 static struct gotd_client *
241 find_client_by_proc_fd(int fd)
242 {
243 	uint64_t slot;
244 
245 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
246 		struct gotd_client *c;
247 
248 		STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
249 			struct gotd_child_proc *proc = get_client_proc(c);
250 			if (proc && proc->iev.ibuf.fd == fd)
251 				return c;
252 		}
253 	}
254 
255 	return NULL;
256 }
257 
258 static int
259 client_is_reading(struct gotd_client *client)
260 {
261 	return client->repo_read != NULL;
262 }
263 
264 static int
265 client_is_writing(struct gotd_client *client)
266 {
267 	return client->repo_write != NULL;
268 }
269 
270 static const struct got_error *
271 ensure_client_is_reading(struct gotd_client *client)
272 {
273 	if (!client_is_reading(client)) {
274 		return got_error_fmt(GOT_ERR_BAD_PACKET,
275 		    "uid %d made a read-request but is not reading from "
276 		    "a repository", client->euid);
277 	}
278 
279 	return NULL;
280 }
281 
282 static const struct got_error *
283 ensure_client_is_writing(struct gotd_client *client)
284 {
285 	if (!client_is_writing(client)) {
286 		return got_error_fmt(GOT_ERR_BAD_PACKET,
287 		    "uid %d made a write-request but is not writing to "
288 		    "a repository", client->euid);
289 	}
290 
291 	return NULL;
292 }
293 
294 static const struct got_error *
295 ensure_client_is_not_writing(struct gotd_client *client)
296 {
297 	if (client_is_writing(client)) {
298 		return got_error_fmt(GOT_ERR_BAD_PACKET,
299 		    "uid %d made a read-request but is writing to "
300 		    "a repository", client->euid);
301 	}
302 
303 	return NULL;
304 }
305 
306 static const struct got_error *
307 ensure_client_is_not_reading(struct gotd_client *client)
308 {
309 	if (client_is_reading(client)) {
310 		return got_error_fmt(GOT_ERR_BAD_PACKET,
311 		    "uid %d made a write-request but is reading from "
312 		    "a repository", client->euid);
313 	}
314 
315 	return NULL;
316 }
317 
318 static void
319 wait_for_children(pid_t child_pid)
320 {
321 	pid_t pid;
322 	int status;
323 
324 	if (child_pid == 0)
325 		log_debug("waiting for children to terminate");
326 	else
327 		log_debug("waiting for child PID %ld to terminate",
328 		    (long)child_pid);
329 
330 	do {
331 		pid = wait(&status);
332 		if (pid == -1) {
333 			if (errno != EINTR && errno != ECHILD)
334 				fatal("wait");
335 		} else if (WIFSIGNALED(status)) {
336 			log_warnx("child PID %ld terminated; signal %d",
337 			    (long)pid, WTERMSIG(status));
338 		}	
339 	} while (pid != -1 || (pid == -1 && errno == EINTR));
340 }
341 
342 static void
343 disconnect(struct gotd_client *client)
344 {
345 	struct gotd_imsg_disconnect idisconnect;
346 	struct gotd_child_proc *proc = get_client_proc(client);
347 	struct gotd_child_proc *listen_proc = &gotd.listen_proc;
348 	uint64_t slot;
349 
350 	log_debug("uid %d: disconnecting", client->euid);
351 
352 	idisconnect.client_id = client->id;
353 	if (proc) {
354 		if (gotd_imsg_compose_event(&proc->iev,
355 		    GOTD_IMSG_DISCONNECT, PROC_GOTD, -1,
356 		    &idisconnect, sizeof(idisconnect)) == -1)
357 			log_warn("imsg compose DISCONNECT");
358 
359 		msgbuf_clear(&proc->iev.ibuf.w);
360 		close(proc->iev.ibuf.fd);
361 		kill_proc(proc, 0);
362 		wait_for_children(proc->pid);
363 		free(proc);
364 		proc = NULL;
365 	}
366 
367 	if (gotd_imsg_compose_event(&listen_proc->iev,
368 	    GOTD_IMSG_DISCONNECT, PROC_GOTD, -1,
369 	    &idisconnect, sizeof(idisconnect)) == -1)
370 		log_warn("imsg compose DISCONNECT");
371 
372 	slot = client_hash(client->id) % nitems(gotd_clients);
373 	STAILQ_REMOVE(&gotd_clients[slot], client, gotd_client, entry);
374 	imsg_clear(&client->iev.ibuf);
375 	event_del(&client->iev.ev);
376 	evtimer_del(&client->tmo);
377 	close(client->fd);
378 	if (client->delta_cache_fd != -1)
379 		close(client->delta_cache_fd);
380 	if (client->packfile_path) {
381 		if (unlink(client->packfile_path) == -1 && errno != ENOENT)
382 			log_warn("unlink %s: ", client->packfile_path);
383 		free(client->packfile_path);
384 	}
385 	if (client->packidx_path) {
386 		if (unlink(client->packidx_path) == -1 && errno != ENOENT)
387 			log_warn("unlink %s: ", client->packidx_path);
388 		free(client->packidx_path);
389 	}
390 	free(client->capabilities);
391 	free(client);
392 	client_cnt--;
393 }
394 
395 static void
396 disconnect_on_error(struct gotd_client *client, const struct got_error *err)
397 {
398 	struct imsgbuf ibuf;
399 
400 	log_warnx("uid %d: %s", client->euid, err->msg);
401 	if (err->code != GOT_ERR_EOF) {
402 		imsg_init(&ibuf, client->fd);
403 		gotd_imsg_send_error(&ibuf, 0, PROC_GOTD, err);
404 		imsg_clear(&ibuf);
405 	}
406 	disconnect(client);
407 }
408 
409 static const struct got_error *
410 send_repo_info(struct gotd_imsgev *iev, struct gotd_repo *repo)
411 {
412 	const struct got_error *err = NULL;
413 	struct gotd_imsg_info_repo irepo;
414 
415 	memset(&irepo, 0, sizeof(irepo));
416 
417 	if (strlcpy(irepo.repo_name, repo->name, sizeof(irepo.repo_name))
418 	    >= sizeof(irepo.repo_name))
419 		return got_error_msg(GOT_ERR_NO_SPACE, "repo name too long");
420 	if (strlcpy(irepo.repo_path, repo->path, sizeof(irepo.repo_path))
421 	    >= sizeof(irepo.repo_path))
422 		return got_error_msg(GOT_ERR_NO_SPACE, "repo path too long");
423 
424 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_INFO_REPO, PROC_GOTD, -1,
425 	    &irepo, sizeof(irepo)) == -1) {
426 		err = got_error_from_errno("imsg compose INFO_REPO");
427 		if (err)
428 			return err;
429 	}
430 
431 	return NULL;
432 }
433 
434 static const struct got_error *
435 send_capability(struct gotd_client_capability *capa, struct gotd_imsgev* iev)
436 {
437 	const struct got_error *err = NULL;
438 	struct gotd_imsg_capability icapa;
439 	size_t len;
440 	struct ibuf *wbuf;
441 
442 	memset(&icapa, 0, sizeof(icapa));
443 
444 	icapa.key_len = strlen(capa->key);
445 	len = sizeof(icapa) + icapa.key_len;
446 	if (capa->value) {
447 		icapa.value_len = strlen(capa->value);
448 		len += icapa.value_len;
449 	}
450 
451 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_CAPABILITY, 0, 0, len);
452 	if (wbuf == NULL) {
453 		err = got_error_from_errno("imsg_create CAPABILITY");
454 		return err;
455 	}
456 
457 	if (imsg_add(wbuf, &icapa, sizeof(icapa)) == -1)
458 		return got_error_from_errno("imsg_add CAPABILITY");
459 	if (imsg_add(wbuf, capa->key, icapa.key_len) == -1)
460 		return got_error_from_errno("imsg_add CAPABILITY");
461 	if (capa->value) {
462 		if (imsg_add(wbuf, capa->value, icapa.value_len) == -1)
463 			return got_error_from_errno("imsg_add CAPABILITY");
464 	}
465 
466 	wbuf->fd = -1;
467 	imsg_close(&iev->ibuf, wbuf);
468 
469 	gotd_imsg_event_add(iev);
470 
471 	return NULL;
472 }
473 
474 static const struct got_error *
475 send_client_info(struct gotd_imsgev *iev, struct gotd_client *client)
476 {
477 	const struct got_error *err = NULL;
478 	struct gotd_imsg_info_client iclient;
479 	struct gotd_child_proc *proc;
480 	size_t i;
481 
482 	memset(&iclient, 0, sizeof(iclient));
483 	iclient.euid = client->euid;
484 	iclient.egid = client->egid;
485 
486 	proc = get_client_proc(client);
487 	if (proc) {
488 		if (strlcpy(iclient.repo_name, proc->repo_path,
489 		    sizeof(iclient.repo_name)) >= sizeof(iclient.repo_name)) {
490 			return got_error_msg(GOT_ERR_NO_SPACE,
491 			    "repo name too long");
492 		}
493 		if (client_is_writing(client))
494 			iclient.is_writing = 1;
495 	}
496 
497 	iclient.state = client->state;
498 	iclient.ncapabilities = client->ncapabilities;
499 
500 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_INFO_CLIENT, PROC_GOTD, -1,
501 	    &iclient, sizeof(iclient)) == -1) {
502 		err = got_error_from_errno("imsg compose INFO_CLIENT");
503 		if (err)
504 			return err;
505 	}
506 
507 	for (i = 0; i < client->ncapabilities; i++) {
508 		struct gotd_client_capability *capa;
509 		capa = &client->capabilities[i];
510 		err = send_capability(capa, iev);
511 		if (err)
512 			return err;
513 	}
514 
515 	return NULL;
516 }
517 
518 static const struct got_error *
519 send_info(struct gotd_client *client)
520 {
521 	const struct got_error *err = NULL;
522 	struct gotd_imsg_info info;
523 	uint64_t slot;
524 	struct gotd_repo *repo;
525 
526 	info.pid = gotd.pid;
527 	info.verbosity = gotd.verbosity;
528 	info.nrepos = gotd.nrepos;
529 	info.nclients = client_cnt - 1;
530 
531 	if (gotd_imsg_compose_event(&client->iev, GOTD_IMSG_INFO, PROC_GOTD, -1,
532 	    &info, sizeof(info)) == -1) {
533 		err = got_error_from_errno("imsg compose INFO");
534 		if (err)
535 			return err;
536 	}
537 
538 	TAILQ_FOREACH(repo, &gotd.repos, entry) {
539 		err = send_repo_info(&client->iev, repo);
540 		if (err)
541 			return err;
542 	}
543 
544 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
545 		struct gotd_client *c;
546 		STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
547 			if (c->id == client->id)
548 				continue;
549 			err = send_client_info(&client->iev, c);
550 			if (err)
551 				return err;
552 		}
553 	}
554 
555 	return NULL;
556 }
557 
558 static const struct got_error *
559 stop_gotd(struct gotd_client *client)
560 {
561 
562 	if (client->euid != 0)
563 		return got_error_set_errno(EPERM, "stop");
564 
565 	gotd_shutdown();
566 	/* NOTREACHED */
567 	return NULL;
568 }
569 
570 static struct gotd_repo *
571 find_repo_by_name(const char *repo_name)
572 {
573 	struct gotd_repo *repo;
574 	size_t namelen;
575 
576 	TAILQ_FOREACH(repo, &gotd.repos, entry) {
577 		namelen = strlen(repo->name);
578 		if (strncmp(repo->name, repo_name, namelen) != 0)
579 			continue;
580 		if (repo_name[namelen] == '\0' ||
581 		    strcmp(&repo_name[namelen], ".git") == 0)
582 			return repo;
583 	}
584 
585 	return NULL;
586 }
587 
588 static const struct got_error *
589 start_client_session(struct gotd_client *client, struct imsg *imsg)
590 {
591 	const struct got_error *err;
592 	struct gotd_imsg_list_refs ireq;
593 	struct gotd_repo *repo = NULL;
594 	size_t datalen;
595 
596 	log_debug("list-refs request from uid %d", client->euid);
597 
598 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
599 	if (datalen != sizeof(ireq))
600 		return got_error(GOT_ERR_PRIVSEP_LEN);
601 
602 	memcpy(&ireq, imsg->data, datalen);
603 
604 	if (ireq.client_is_reading) {
605 		err = ensure_client_is_not_writing(client);
606 		if (err)
607 			return err;
608 		repo = find_repo_by_name(ireq.repo_name);
609 		if (repo == NULL)
610 			return got_error(GOT_ERR_NOT_GIT_REPO);
611 		err = gotd_auth_check(&repo->rules, repo->name,
612 		    client->euid, client->egid, GOTD_AUTH_READ);
613 		if (err)
614 			return err;
615 		err = start_repo_child(client, PROC_REPO_READ, repo,
616 		    gotd.argv0, gotd.confpath, gotd.daemonize,
617 		    gotd.verbosity);
618 		if (err)
619 			return err;
620 	} else {
621 		err = ensure_client_is_not_reading(client);
622 		if (err)
623 			return err;
624 		repo = find_repo_by_name(ireq.repo_name);
625 		if (repo == NULL)
626 			return got_error(GOT_ERR_NOT_GIT_REPO);
627 		err = gotd_auth_check(&repo->rules, repo->name, client->euid,
628 		    client->egid, GOTD_AUTH_READ | GOTD_AUTH_WRITE);
629 		if (err)
630 			return err;
631 		err = start_repo_child(client, PROC_REPO_WRITE, repo,
632 		    gotd.argv0, gotd.confpath, gotd.daemonize,
633 		    gotd.verbosity);
634 		if (err)
635 			return err;
636 	}
637 
638 	/* List-refs request will be forwarded once the child is ready. */
639 	return NULL;
640 }
641 
642 static const struct got_error *
643 forward_want(struct gotd_client *client, struct imsg *imsg)
644 {
645 	struct gotd_imsg_want ireq;
646 	struct gotd_imsg_want iwant;
647 	size_t datalen;
648 
649 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
650 	if (datalen != sizeof(ireq))
651 		return got_error(GOT_ERR_PRIVSEP_LEN);
652 
653 	memcpy(&ireq, imsg->data, datalen);
654 
655 	memset(&iwant, 0, sizeof(iwant));
656 	memcpy(iwant.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
657 	iwant.client_id = client->id;
658 
659 	if (gotd_imsg_compose_event(&client->repo_read->iev, GOTD_IMSG_WANT,
660 	    PROC_GOTD, -1, &iwant, sizeof(iwant)) == -1)
661 		return got_error_from_errno("imsg compose WANT");
662 
663 	return NULL;
664 }
665 
666 static const struct got_error *
667 forward_ref_update(struct gotd_client *client, struct imsg *imsg)
668 {
669 	const struct got_error *err = NULL;
670 	struct gotd_imsg_ref_update ireq;
671 	struct gotd_imsg_ref_update *iref = NULL;
672 	size_t datalen;
673 
674 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
675 	if (datalen < sizeof(ireq))
676 		return got_error(GOT_ERR_PRIVSEP_LEN);
677 	memcpy(&ireq, imsg->data, sizeof(ireq));
678 	if (datalen != sizeof(ireq) + ireq.name_len)
679 		return got_error(GOT_ERR_PRIVSEP_LEN);
680 
681 	iref = malloc(datalen);
682 	if (iref == NULL)
683 		return got_error_from_errno("malloc");
684 	memcpy(iref, imsg->data, datalen);
685 
686 	iref->client_id = client->id;
687 	if (gotd_imsg_compose_event(&client->repo_write->iev,
688 	    GOTD_IMSG_REF_UPDATE, PROC_GOTD, -1, iref, datalen) == -1)
689 		err = got_error_from_errno("imsg compose REF_UPDATE");
690 	free(iref);
691 	return err;
692 }
693 
694 static const struct got_error *
695 forward_have(struct gotd_client *client, struct imsg *imsg)
696 {
697 	struct gotd_imsg_have ireq;
698 	struct gotd_imsg_have ihave;
699 	size_t datalen;
700 
701 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
702 	if (datalen != sizeof(ireq))
703 		return got_error(GOT_ERR_PRIVSEP_LEN);
704 
705 	memcpy(&ireq, imsg->data, datalen);
706 
707 	memset(&ihave, 0, sizeof(ihave));
708 	memcpy(ihave.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
709 	ihave.client_id = client->id;
710 
711 	if (gotd_imsg_compose_event(&client->repo_read->iev, GOTD_IMSG_HAVE,
712 	    PROC_GOTD, -1, &ihave, sizeof(ihave)) == -1)
713 		return got_error_from_errno("imsg compose HAVE");
714 
715 	return NULL;
716 }
717 
718 static int
719 client_has_capability(struct gotd_client *client, const char *capastr)
720 {
721 	struct gotd_client_capability *capa;
722 	size_t i;
723 
724 	if (client->ncapabilities == 0)
725 		return 0;
726 
727 	for (i = 0; i < client->ncapabilities; i++) {
728 		capa = &client->capabilities[i];
729 		if (strcmp(capa->key, capastr) == 0)
730 			return 1;
731 	}
732 
733 	return 0;
734 }
735 
736 static const struct got_error *
737 recv_capabilities(struct gotd_client *client, struct imsg *imsg)
738 {
739 	struct gotd_imsg_capabilities icapas;
740 	size_t datalen;
741 
742 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
743 	if (datalen != sizeof(icapas))
744 		return got_error(GOT_ERR_PRIVSEP_LEN);
745 	memcpy(&icapas, imsg->data, sizeof(icapas));
746 
747 	client->ncapa_alloc = icapas.ncapabilities;
748 	client->capabilities = calloc(client->ncapa_alloc,
749 	    sizeof(*client->capabilities));
750 	if (client->capabilities == NULL) {
751 		client->ncapa_alloc = 0;
752 		return got_error_from_errno("calloc");
753 	}
754 
755 	log_debug("expecting %zu capabilities from uid %d",
756 	    client->ncapa_alloc, client->euid);
757 	return NULL;
758 }
759 
760 static const struct got_error *
761 recv_capability(struct gotd_client *client, struct imsg *imsg)
762 {
763 	struct gotd_imsg_capability icapa;
764 	struct gotd_client_capability *capa;
765 	size_t datalen;
766 	char *key, *value = NULL;
767 
768 	if (client->capabilities == NULL ||
769 	    client->ncapabilities >= client->ncapa_alloc) {
770 		return got_error_msg(GOT_ERR_BAD_REQUEST,
771 		    "unexpected capability received");
772 	}
773 
774 	memset(&icapa, 0, sizeof(icapa));
775 
776 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
777 	if (datalen < sizeof(icapa))
778 		return got_error(GOT_ERR_PRIVSEP_LEN);
779 	memcpy(&icapa, imsg->data, sizeof(icapa));
780 
781 	if (datalen != sizeof(icapa) + icapa.key_len + icapa.value_len)
782 		return got_error(GOT_ERR_PRIVSEP_LEN);
783 
784 	key = malloc(icapa.key_len + 1);
785 	if (key == NULL)
786 		return got_error_from_errno("malloc");
787 	if (icapa.value_len > 0) {
788 		value = malloc(icapa.value_len + 1);
789 		if (value == NULL) {
790 			free(key);
791 			return got_error_from_errno("malloc");
792 		}
793 	}
794 
795 	memcpy(key, imsg->data + sizeof(icapa), icapa.key_len);
796 	key[icapa.key_len] = '\0';
797 	if (value) {
798 		memcpy(value, imsg->data + sizeof(icapa) + icapa.key_len,
799 		    icapa.value_len);
800 		value[icapa.value_len] = '\0';
801 	}
802 
803 	capa = &client->capabilities[client->ncapabilities++];
804 	capa->key = key;
805 	capa->value = value;
806 
807 	if (value)
808 		log_debug("uid %d: capability %s=%s", client->euid, key, value);
809 	else
810 		log_debug("uid %d: capability %s", client->euid, key);
811 
812 	return NULL;
813 }
814 
815 static const struct got_error *
816 send_packfile(struct gotd_client *client)
817 {
818 	const struct got_error *err = NULL;
819 	struct gotd_imsg_send_packfile ipack;
820 	struct gotd_imsg_packfile_pipe ipipe;
821 	int pipe[2];
822 
823 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
824 		return got_error_from_errno("socketpair");
825 
826 	memset(&ipack, 0, sizeof(ipack));
827 	memset(&ipipe, 0, sizeof(ipipe));
828 
829 	ipack.client_id = client->id;
830 	if (client_has_capability(client, GOT_CAPA_SIDE_BAND_64K))
831 		ipack.report_progress = 1;
832 
833 	client->delta_cache_fd = got_opentempfd();
834 	if (client->delta_cache_fd == -1)
835 		return got_error_from_errno("got_opentempfd");
836 
837 	if (gotd_imsg_compose_event(&client->repo_read->iev,
838 	    GOTD_IMSG_SEND_PACKFILE, PROC_GOTD, client->delta_cache_fd,
839 	    &ipack, sizeof(ipack)) == -1) {
840 		err = got_error_from_errno("imsg compose SEND_PACKFILE");
841 		close(pipe[0]);
842 		close(pipe[1]);
843 		return err;
844 	}
845 
846 	ipipe.client_id = client->id;
847 
848 	/* Send pack pipe end 0 to repo_read. */
849 	if (gotd_imsg_compose_event(&client->repo_read->iev,
850 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD, pipe[0],
851 	        &ipipe, sizeof(ipipe)) == -1) {
852 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
853 		close(pipe[1]);
854 		return err;
855 	}
856 
857 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
858 	if (gotd_imsg_compose_event(&client->iev,
859 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD, pipe[1], NULL, 0) == -1)
860 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
861 
862 	return err;
863 }
864 
865 static const struct got_error *
866 recv_packfile(struct gotd_client *client)
867 {
868 	const struct got_error *err = NULL;
869 	struct gotd_imsg_recv_packfile ipack;
870 	struct gotd_imsg_packfile_pipe ipipe;
871 	struct gotd_imsg_packidx_file ifile;
872 	char *basepath = NULL, *pack_path = NULL, *idx_path = NULL;
873 	int packfd = -1, idxfd = -1;
874 	int pipe[2] = { -1, -1 };
875 
876 	if (client->packfile_path) {
877 		return got_error_fmt(GOT_ERR_PRIVSEP_MSG,
878 		    "uid %d already has a pack file", client->euid);
879 	}
880 
881 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
882 		return got_error_from_errno("socketpair");
883 
884 	memset(&ipipe, 0, sizeof(ipipe));
885 	ipipe.client_id = client->id;
886 
887 	/* Send pack pipe end 0 to repo_write. */
888 	if (gotd_imsg_compose_event(&client->repo_write->iev,
889 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD, pipe[0],
890 	        &ipipe, sizeof(ipipe)) == -1) {
891 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
892 		pipe[0] = -1;
893 		goto done;
894 	}
895 	pipe[0] = -1;
896 
897 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
898 	if (gotd_imsg_compose_event(&client->iev,
899 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD, pipe[1], NULL, 0) == -1)
900 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
901 	pipe[1] = -1;
902 
903 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.pack",
904 	    client->repo_write->repo_path, GOT_OBJECTS_PACK_DIR,
905 	    client->euid) == -1) {
906 		err = got_error_from_errno("asprintf");
907 		goto done;
908 	}
909 
910 	err = got_opentemp_named_fd(&pack_path, &packfd, basepath, "");
911 	if (err)
912 		goto done;
913 
914 	free(basepath);
915 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.idx",
916 	    client->repo_write->repo_path, GOT_OBJECTS_PACK_DIR,
917 	    client->euid) == -1) {
918 		err = got_error_from_errno("asprintf");
919 		basepath = NULL;
920 		goto done;
921 	}
922 	err = got_opentemp_named_fd(&idx_path, &idxfd, basepath, "");
923 	if (err)
924 		goto done;
925 
926 	memset(&ifile, 0, sizeof(ifile));
927 	ifile.client_id = client->id;
928 	if (gotd_imsg_compose_event(&client->repo_write->iev,
929 	    GOTD_IMSG_PACKIDX_FILE, PROC_GOTD, idxfd,
930 	    &ifile, sizeof(ifile)) == -1) {
931 		err = got_error_from_errno("imsg compose PACKIDX_FILE");
932 		idxfd = -1;
933 		goto done;
934 	}
935 	idxfd = -1;
936 
937 	memset(&ipack, 0, sizeof(ipack));
938 	ipack.client_id = client->id;
939 	if (client_has_capability(client, GOT_CAPA_REPORT_STATUS))
940 		ipack.report_status = 1;
941 
942 	if (gotd_imsg_compose_event(&client->repo_write->iev,
943 	    GOTD_IMSG_RECV_PACKFILE, PROC_GOTD, packfd,
944 	    &ipack, sizeof(ipack)) == -1) {
945 		err = got_error_from_errno("imsg compose RECV_PACKFILE");
946 		packfd = -1;
947 		goto done;
948 	}
949 	packfd = -1;
950 
951 done:
952 	free(basepath);
953 	if (pipe[0] != -1 && close(pipe[0]) == -1 && err == NULL)
954 		err = got_error_from_errno("close");
955 	if (pipe[1] != -1 && close(pipe[1]) == -1 && err == NULL)
956 		err = got_error_from_errno("close");
957 	if (packfd != -1 && close(packfd) == -1 && err == NULL)
958 		err = got_error_from_errno("close");
959 	if (idxfd != -1 && close(idxfd) == -1 && err == NULL)
960 		err = got_error_from_errno("close");
961 	if (err) {
962 		free(pack_path);
963 		free(idx_path);
964 	} else {
965 		client->packfile_path = pack_path;
966 		client->packidx_path = idx_path;
967 	}
968 	return err;
969 }
970 
971 static void
972 gotd_request(int fd, short events, void *arg)
973 {
974 	struct gotd_imsgev *iev = arg;
975 	struct imsgbuf *ibuf = &iev->ibuf;
976 	struct gotd_client *client = iev->handler_arg;
977 	const struct got_error *err = NULL;
978 	struct imsg imsg;
979 	ssize_t n;
980 
981 	if (events & EV_WRITE) {
982 		while (ibuf->w.queued) {
983 			n = msgbuf_write(&ibuf->w);
984 			if (n == -1 && errno == EPIPE) {
985 				/*
986 				 * The client has closed its socket.
987 				 * This can happen when Git clients are
988 				 * done sending pack file data.
989 				*/
990 				msgbuf_clear(&ibuf->w);
991 				continue;
992 			} else if (n == -1 && errno != EAGAIN) {
993 				err = got_error_from_errno("imsg_flush");
994 				disconnect_on_error(client, err);
995 				return;
996 			}
997 			if (n == 0) {
998 				/* Connection closed. */
999 				err = got_error(GOT_ERR_EOF);
1000 				disconnect_on_error(client, err);
1001 				return;
1002 			}
1003 		}
1004 
1005 		/* Disconnect gotctl(8) now that messages have been sent. */
1006 		if (!client_is_reading(client) && !client_is_writing(client)) {
1007 			disconnect(client);
1008 			return;
1009 		}
1010 	}
1011 
1012 	if ((events & EV_READ) == 0)
1013 		return;
1014 
1015 	memset(&imsg, 0, sizeof(imsg));
1016 
1017 	while (err == NULL) {
1018 		err = gotd_imsg_recv(&imsg, ibuf, 0);
1019 		if (err) {
1020 			if (err->code == GOT_ERR_PRIVSEP_READ)
1021 				err = NULL;
1022 			break;
1023 		}
1024 
1025 		evtimer_del(&client->tmo);
1026 
1027 		switch (imsg.hdr.type) {
1028 		case GOTD_IMSG_INFO:
1029 			err = send_info(client);
1030 			break;
1031 		case GOTD_IMSG_STOP:
1032 			err = stop_gotd(client);
1033 			break;
1034 		case GOTD_IMSG_LIST_REFS:
1035 			if (client->state != GOTD_STATE_EXPECT_LIST_REFS) {
1036 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1037 				    "unexpected list-refs request received");
1038 				break;
1039 			}
1040 			err = start_client_session(client, &imsg);
1041 			if (err)
1042 				break;
1043 			break;
1044 		case GOTD_IMSG_CAPABILITIES:
1045 			if (client->state != GOTD_STATE_EXPECT_CAPABILITIES) {
1046 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1047 				    "unexpected capabilities received");
1048 				break;
1049 			}
1050 			log_debug("receiving capabilities from uid %d",
1051 			    client->euid);
1052 			err = recv_capabilities(client, &imsg);
1053 			break;
1054 		case GOTD_IMSG_CAPABILITY:
1055 			if (client->state != GOTD_STATE_EXPECT_CAPABILITIES) {
1056 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1057 				    "unexpected capability received");
1058 				break;
1059 			}
1060 			err = recv_capability(client, &imsg);
1061 			if (err || client->ncapabilities < client->ncapa_alloc)
1062 				break;
1063 			if (client_is_reading(client)) {
1064 				client->state = GOTD_STATE_EXPECT_WANT;
1065 				log_debug("uid %d: expecting want-lines",
1066 				    client->euid);
1067 			} else if (client_is_writing(client)) {
1068 				client->state = GOTD_STATE_EXPECT_REF_UPDATE;
1069 				log_debug("uid %d: expecting ref-update-lines",
1070 				    client->euid);
1071 			} else
1072 				fatalx("client %d is both reading and writing",
1073 				    client->euid);
1074 			break;
1075 		case GOTD_IMSG_WANT:
1076 			if (client->state != GOTD_STATE_EXPECT_WANT) {
1077 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1078 				    "unexpected want-line received");
1079 				break;
1080 			}
1081 			log_debug("received want-line from uid %d",
1082 			    client->euid);
1083 			err = ensure_client_is_reading(client);
1084 			if (err)
1085 				break;
1086 			err = forward_want(client, &imsg);
1087 			break;
1088 		case GOTD_IMSG_REF_UPDATE:
1089 			if (client->state != GOTD_STATE_EXPECT_REF_UPDATE) {
1090 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1091 				    "unexpected ref-update-line received");
1092 				break;
1093 			}
1094 			log_debug("received ref-update-line from uid %d",
1095 			    client->euid);
1096 			err = ensure_client_is_writing(client);
1097 			if (err)
1098 				break;
1099 			err = forward_ref_update(client, &imsg);
1100 			if (err)
1101 				break;
1102 			client->state = GOTD_STATE_EXPECT_MORE_REF_UPDATES;
1103 			break;
1104 		case GOTD_IMSG_HAVE:
1105 			if (client->state != GOTD_STATE_EXPECT_HAVE) {
1106 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1107 				    "unexpected have-line received");
1108 				break;
1109 			}
1110 			log_debug("received have-line from uid %d",
1111 			    client->euid);
1112 			err = ensure_client_is_reading(client);
1113 			if (err)
1114 				break;
1115 			err = forward_have(client, &imsg);
1116 			if (err)
1117 				break;
1118 			break;
1119 		case GOTD_IMSG_FLUSH:
1120 			if (client->state == GOTD_STATE_EXPECT_WANT ||
1121 			    client->state == GOTD_STATE_EXPECT_HAVE) {
1122 				err = ensure_client_is_reading(client);
1123 				if (err)
1124 					break;
1125 			} else if (client->state ==
1126 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1127 				err = ensure_client_is_writing(client);
1128 				if (err)
1129 					break;
1130 			} else {
1131 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1132 				    "unexpected flush-pkt received");
1133 				break;
1134 			}
1135 			log_debug("received flush-pkt from uid %d",
1136 			    client->euid);
1137 			if (client->state == GOTD_STATE_EXPECT_WANT) {
1138 				client->state = GOTD_STATE_EXPECT_HAVE;
1139 				log_debug("uid %d: expecting have-lines",
1140 				    client->euid);
1141 			} else if (client->state == GOTD_STATE_EXPECT_HAVE) {
1142 				client->state = GOTD_STATE_EXPECT_DONE;
1143 				log_debug("uid %d: expecting 'done'",
1144 				    client->euid);
1145 			} else if (client->state ==
1146 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1147 				client->state = GOTD_STATE_EXPECT_PACKFILE;
1148 				log_debug("uid %d: expecting packfile",
1149 				    client->euid);
1150 				err = recv_packfile(client);
1151 			} else {
1152 				/* should not happen, see above */
1153 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1154 				    "unexpected client state");
1155 				break;
1156 			}
1157 			break;
1158 		case GOTD_IMSG_DONE:
1159 			if (client->state != GOTD_STATE_EXPECT_HAVE &&
1160 			    client->state != GOTD_STATE_EXPECT_DONE) {
1161 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1162 				    "unexpected flush-pkt received");
1163 				break;
1164 			}
1165 			log_debug("received 'done' from uid %d", client->euid);
1166 			err = ensure_client_is_reading(client);
1167 			if (err)
1168 				break;
1169 			client->state = GOTD_STATE_DONE;
1170 			err = send_packfile(client);
1171 			break;
1172 		default:
1173 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1174 			break;
1175 		}
1176 
1177 		imsg_free(&imsg);
1178 	}
1179 
1180 	if (err) {
1181 		if (err->code != GOT_ERR_EOF ||
1182 		    client->state != GOTD_STATE_EXPECT_PACKFILE)
1183 			disconnect_on_error(client, err);
1184 	} else {
1185 		gotd_imsg_event_add(&client->iev);
1186 		evtimer_add(&client->tmo, &timeout);
1187 	}
1188 }
1189 
1190 static void
1191 gotd_request_timeout(int fd, short events, void *arg)
1192 {
1193 	struct gotd_client *client = arg;
1194 
1195 	log_debug("disconnecting uid %d due to timeout", client->euid);
1196 	disconnect(client);
1197 }
1198 
1199 static const struct got_error *
1200 recv_connect(uint32_t *client_id, struct imsg *imsg)
1201 {
1202 	const struct got_error *err = NULL;
1203 	struct gotd_imsg_connect iconnect;
1204 	size_t datalen;
1205 	int s = -1;
1206 	struct gotd_client *client = NULL;
1207 	uid_t euid;
1208 	gid_t egid;
1209 
1210 	*client_id = 0;
1211 
1212 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1213 	if (datalen != sizeof(iconnect))
1214 		return got_error(GOT_ERR_PRIVSEP_LEN);
1215 	memcpy(&iconnect, imsg->data, sizeof(iconnect));
1216 
1217 	s = imsg->fd;
1218 	if (s == -1) {
1219 		err = got_error(GOT_ERR_PRIVSEP_NO_FD);
1220 		goto done;
1221 	}
1222 
1223 	if (find_client(iconnect.client_id)) {
1224 		err = got_error_msg(GOT_ERR_CLIENT_ID, "duplicate client ID");
1225 		goto done;
1226 	}
1227 
1228 	if (getpeereid(s, &euid, &egid) == -1) {
1229 		err = got_error_from_errno("getpeerid");
1230 		goto done;
1231 	}
1232 
1233 	client = calloc(1, sizeof(*client));
1234 	if (client == NULL) {
1235 		err = got_error_from_errno("calloc");
1236 		goto done;
1237 	}
1238 
1239 	*client_id = iconnect.client_id;
1240 
1241 	client->state = GOTD_STATE_EXPECT_LIST_REFS;
1242 	client->id = iconnect.client_id;
1243 	client->fd = s;
1244 	s = -1;
1245 	client->delta_cache_fd = -1;
1246 	client->euid = euid;
1247 	client->egid = egid;
1248 	client->nref_updates = -1;
1249 
1250 	imsg_init(&client->iev.ibuf, client->fd);
1251 	client->iev.handler = gotd_request;
1252 	client->iev.events = EV_READ;
1253 	client->iev.handler_arg = client;
1254 
1255 	event_set(&client->iev.ev, client->fd, EV_READ, gotd_request,
1256 	    &client->iev);
1257 	gotd_imsg_event_add(&client->iev);
1258 
1259 	evtimer_set(&client->tmo, gotd_request_timeout, client);
1260 
1261 	add_client(client);
1262 	log_debug("%s: new client uid %d connected on fd %d", __func__,
1263 	    client->euid, client->fd);
1264 done:
1265 	if (err) {
1266 		struct gotd_child_proc *listen_proc = &gotd.listen_proc;
1267 		struct gotd_imsg_disconnect idisconnect;
1268 
1269 		idisconnect.client_id = client->id;
1270 		if (gotd_imsg_compose_event(&listen_proc->iev,
1271 		    GOTD_IMSG_DISCONNECT, PROC_GOTD, -1,
1272 		    &idisconnect, sizeof(idisconnect)) == -1)
1273 			log_warn("imsg compose DISCONNECT");
1274 
1275 		if (s != -1)
1276 			close(s);
1277 	}
1278 
1279 	return err;
1280 }
1281 
1282 static const char *gotd_proc_names[PROC_MAX] = {
1283 	"parent",
1284 	"listen",
1285 	"repo_read",
1286 	"repo_write"
1287 };
1288 
1289 static void
1290 kill_proc(struct gotd_child_proc *proc, int fatal)
1291 {
1292 	if (fatal) {
1293 		log_warnx("sending SIGKILL to PID %d", proc->pid);
1294 		kill(proc->pid, SIGKILL);
1295 	} else
1296 		kill(proc->pid, SIGTERM);
1297 }
1298 
1299 static void
1300 gotd_shutdown(void)
1301 {
1302 	struct gotd_child_proc *proc;
1303 	uint64_t slot;
1304 
1305 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
1306 		struct gotd_client *c, *tmp;
1307 
1308 		STAILQ_FOREACH_SAFE(c, &gotd_clients[slot], entry, tmp)
1309 			disconnect(c);
1310 	}
1311 
1312 	proc = &gotd.listen_proc;
1313 	msgbuf_clear(&proc->iev.ibuf.w);
1314 	close(proc->iev.ibuf.fd);
1315 	kill_proc(proc, 0);
1316 	wait_for_children(proc->pid);
1317 
1318 	log_info("terminating");
1319 	exit(0);
1320 }
1321 
1322 void
1323 gotd_sighdlr(int sig, short event, void *arg)
1324 {
1325 	/*
1326 	 * Normal signal handler rules don't apply because libevent
1327 	 * decouples for us.
1328 	 */
1329 
1330 	switch (sig) {
1331 	case SIGHUP:
1332 		log_info("%s: ignoring SIGHUP", __func__);
1333 		break;
1334 	case SIGUSR1:
1335 		log_info("%s: ignoring SIGUSR1", __func__);
1336 		break;
1337 	case SIGTERM:
1338 	case SIGINT:
1339 		gotd_shutdown();
1340 		log_warnx("gotd terminating");
1341 		exit(0);
1342 		break;
1343 	default:
1344 		fatalx("unexpected signal");
1345 	}
1346 }
1347 
1348 static const struct got_error *
1349 ensure_proc_is_reading(struct gotd_client *client,
1350     struct gotd_child_proc *proc)
1351 {
1352 	if (!client_is_reading(client)) {
1353 		kill_proc(proc, 1);
1354 		return got_error_fmt(GOT_ERR_BAD_PACKET,
1355 		    "PID %d handled a read-request for uid %d but this "
1356 		    "user is not reading from a repository", proc->pid,
1357 		    client->euid);
1358 	}
1359 
1360 	return NULL;
1361 }
1362 
1363 static const struct got_error *
1364 ensure_proc_is_writing(struct gotd_client *client,
1365     struct gotd_child_proc *proc)
1366 {
1367 	if (!client_is_writing(client)) {
1368 		kill_proc(proc, 1);
1369 		return got_error_fmt(GOT_ERR_BAD_PACKET,
1370 		    "PID %d handled a write-request for uid %d but this "
1371 		    "user is not writing to a repository", proc->pid,
1372 		    client->euid);
1373 	}
1374 
1375 	return NULL;
1376 }
1377 
1378 static int
1379 verify_imsg_src(struct gotd_client *client, struct gotd_child_proc *proc,
1380     struct imsg *imsg)
1381 {
1382 	const struct got_error *err;
1383 	struct gotd_child_proc *client_proc;
1384 	int ret = 0;
1385 
1386 	if (proc->type == PROC_REPO_READ || proc->type == PROC_REPO_WRITE) {
1387 		client_proc = get_client_proc(client);
1388 		if (client_proc == NULL)
1389 			fatalx("no process found for uid %d", client->euid);
1390 		if (proc->pid != client_proc->pid) {
1391 			kill_proc(proc, 1);
1392 			log_warnx("received message from PID %d for uid %d, "
1393 			    "while PID %d is the process serving this user",
1394 			    proc->pid, client->euid, client_proc->pid);
1395 			return 0;
1396 		}
1397 	}
1398 
1399 	switch (imsg->hdr.type) {
1400 	case GOTD_IMSG_ERROR:
1401 		ret = 1;
1402 		break;
1403 	case GOTD_IMSG_CONNECT:
1404 		if (proc->type != PROC_LISTEN) {
1405 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
1406 			    "new connection for uid %d from PID %d "
1407 			    "which is not the listen process",
1408 			    proc->pid, client->euid);
1409 		} else
1410 			ret = 1;
1411 		break;
1412 	case GOTD_IMSG_REPO_CHILD_READY:
1413 		if (proc->type != PROC_REPO_READ &&
1414 		    proc->type != PROC_REPO_WRITE) {
1415 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
1416 			    "unexpected \"ready\" signal from PID %d",
1417 			    proc->pid);
1418 		} else
1419 			ret = 1;
1420 		break;
1421 	case GOTD_IMSG_PACKFILE_DONE:
1422 		err = ensure_proc_is_reading(client, proc);
1423 		if (err)
1424 			log_warnx("uid %d: %s", client->euid, err->msg);
1425 		else
1426 			ret = 1;
1427 		break;
1428 	case GOTD_IMSG_PACKFILE_INSTALL:
1429 	case GOTD_IMSG_REF_UPDATES_START:
1430 	case GOTD_IMSG_REF_UPDATE:
1431 		err = ensure_proc_is_writing(client, proc);
1432 		if (err)
1433 			log_warnx("uid %d: %s", client->euid, err->msg);
1434 		else
1435 			ret = 1;
1436 		break;
1437 	default:
1438 		log_debug("%s: unexpected imsg %d", __func__, imsg->hdr.type);
1439 		break;
1440 	}
1441 
1442 	return ret;
1443 }
1444 
1445 static const struct got_error *
1446 list_refs_request(struct gotd_client *client, struct gotd_imsgev *iev)
1447 {
1448 	static const struct got_error *err;
1449 	struct gotd_imsg_list_refs_internal ilref;
1450 	int fd;
1451 
1452 	memset(&ilref, 0, sizeof(ilref));
1453 	ilref.client_id = client->id;
1454 
1455 	fd = dup(client->fd);
1456 	if (fd == -1)
1457 		return got_error_from_errno("dup");
1458 
1459 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_LIST_REFS_INTERNAL,
1460 	    PROC_GOTD, fd, &ilref, sizeof(ilref)) == -1) {
1461 		err = got_error_from_errno("imsg compose WANT");
1462 		close(fd);
1463 		return err;
1464 	}
1465 
1466 	client->state = GOTD_STATE_EXPECT_CAPABILITIES;
1467 	log_debug("uid %d: expecting capabilities", client->euid);
1468 	return NULL;
1469 }
1470 
1471 static const struct got_error *
1472 recv_packfile_done(uint32_t *client_id, struct imsg *imsg)
1473 {
1474 	struct gotd_imsg_packfile_done idone;
1475 	size_t datalen;
1476 
1477 	log_debug("packfile-done received");
1478 
1479 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1480 	if (datalen != sizeof(idone))
1481 		return got_error(GOT_ERR_PRIVSEP_LEN);
1482 	memcpy(&idone, imsg->data, sizeof(idone));
1483 
1484 	*client_id = idone.client_id;
1485 	return NULL;
1486 }
1487 
1488 static const struct got_error *
1489 recv_packfile_install(uint32_t *client_id, struct imsg *imsg)
1490 {
1491 	struct gotd_imsg_packfile_install inst;
1492 	size_t datalen;
1493 
1494 	log_debug("packfile-install received");
1495 
1496 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1497 	if (datalen != sizeof(inst))
1498 		return got_error(GOT_ERR_PRIVSEP_LEN);
1499 	memcpy(&inst, imsg->data, sizeof(inst));
1500 
1501 	*client_id = inst.client_id;
1502 	return NULL;
1503 }
1504 
1505 static const struct got_error *
1506 recv_ref_updates_start(uint32_t *client_id, struct imsg *imsg)
1507 {
1508 	struct gotd_imsg_ref_updates_start istart;
1509 	size_t datalen;
1510 
1511 	log_debug("ref-updates-start received");
1512 
1513 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1514 	if (datalen != sizeof(istart))
1515 		return got_error(GOT_ERR_PRIVSEP_LEN);
1516 	memcpy(&istart, imsg->data, sizeof(istart));
1517 
1518 	*client_id = istart.client_id;
1519 	return NULL;
1520 }
1521 
1522 static const struct got_error *
1523 recv_ref_update(uint32_t *client_id, struct imsg *imsg)
1524 {
1525 	struct gotd_imsg_ref_update iref;
1526 	size_t datalen;
1527 
1528 	log_debug("ref-update received");
1529 
1530 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1531 	if (datalen < sizeof(iref))
1532 		return got_error(GOT_ERR_PRIVSEP_LEN);
1533 	memcpy(&iref, imsg->data, sizeof(iref));
1534 
1535 	*client_id = iref.client_id;
1536 	return NULL;
1537 }
1538 
1539 static const struct got_error *
1540 send_ref_update_ok(struct gotd_client *client,
1541     struct gotd_imsg_ref_update *iref, const char *refname)
1542 {
1543 	struct gotd_imsg_ref_update_ok iok;
1544 	struct ibuf *wbuf;
1545 	size_t len;
1546 
1547 	memset(&iok, 0, sizeof(iok));
1548 	iok.client_id = client->id;
1549 	memcpy(iok.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
1550 	memcpy(iok.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
1551 	iok.name_len = strlen(refname);
1552 
1553 	len = sizeof(iok) + iok.name_len;
1554 	wbuf = imsg_create(&client->iev.ibuf, GOTD_IMSG_REF_UPDATE_OK,
1555 	    PROC_GOTD, gotd.pid, len);
1556 	if (wbuf == NULL)
1557 		return got_error_from_errno("imsg_create REF_UPDATE_OK");
1558 
1559 	if (imsg_add(wbuf, &iok, sizeof(iok)) == -1)
1560 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
1561 	if (imsg_add(wbuf, refname, iok.name_len) == -1)
1562 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
1563 
1564 	wbuf->fd = -1;
1565 	imsg_close(&client->iev.ibuf, wbuf);
1566 	gotd_imsg_event_add(&client->iev);
1567 	return NULL;
1568 }
1569 
1570 static void
1571 send_refs_updated(struct gotd_client *client)
1572 {
1573 	if (gotd_imsg_compose_event(&client->iev,
1574 	    GOTD_IMSG_REFS_UPDATED, PROC_GOTD, -1, NULL, 0) == -1)
1575 		log_warn("imsg compose REFS_UPDATED");
1576 }
1577 
1578 static const struct got_error *
1579 send_ref_update_ng(struct gotd_client *client,
1580     struct gotd_imsg_ref_update *iref, const char *refname,
1581     const char *reason)
1582 {
1583 	const struct got_error *ng_err;
1584 	struct gotd_imsg_ref_update_ng ing;
1585 	struct ibuf *wbuf;
1586 	size_t len;
1587 
1588 	memset(&ing, 0, sizeof(ing));
1589 	ing.client_id = client->id;
1590 	memcpy(ing.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
1591 	memcpy(ing.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
1592 	ing.name_len = strlen(refname);
1593 
1594 	ng_err = got_error_fmt(GOT_ERR_REF_BUSY, "%s", reason);
1595 	ing.reason_len = strlen(ng_err->msg);
1596 
1597 	len = sizeof(ing) + ing.name_len + ing.reason_len;
1598 	wbuf = imsg_create(&client->iev.ibuf, GOTD_IMSG_REF_UPDATE_NG,
1599 	    PROC_GOTD, gotd.pid, len);
1600 	if (wbuf == NULL)
1601 		return got_error_from_errno("imsg_create REF_UPDATE_NG");
1602 
1603 	if (imsg_add(wbuf, &ing, sizeof(ing)) == -1)
1604 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
1605 	if (imsg_add(wbuf, refname, ing.name_len) == -1)
1606 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
1607 	if (imsg_add(wbuf, ng_err->msg, ing.reason_len) == -1)
1608 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
1609 
1610 	wbuf->fd = -1;
1611 	imsg_close(&client->iev.ibuf, wbuf);
1612 	gotd_imsg_event_add(&client->iev);
1613 	return NULL;
1614 }
1615 
1616 static const struct got_error *
1617 install_pack(struct gotd_client *client, const char *repo_path,
1618     struct imsg *imsg)
1619 {
1620 	const struct got_error *err = NULL;
1621 	struct gotd_imsg_packfile_install inst;
1622 	char hex[SHA1_DIGEST_STRING_LENGTH];
1623 	size_t datalen;
1624 	char *packfile_path = NULL, *packidx_path = NULL;
1625 
1626 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1627 	if (datalen != sizeof(inst))
1628 		return got_error(GOT_ERR_PRIVSEP_LEN);
1629 	memcpy(&inst, imsg->data, sizeof(inst));
1630 
1631 	if (client->packfile_path == NULL)
1632 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1633 		    "client has no pack file");
1634 	if (client->packidx_path == NULL)
1635 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1636 		    "client has no pack file index");
1637 
1638 	if (got_sha1_digest_to_str(inst.pack_sha1, hex, sizeof(hex)) == NULL)
1639 		return got_error_msg(GOT_ERR_NO_SPACE,
1640 		    "could not convert pack file SHA1 to hex");
1641 
1642 	if (asprintf(&packfile_path, "/%s/%s/pack-%s.pack",
1643 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
1644 		err = got_error_from_errno("asprintf");
1645 		goto done;
1646 	}
1647 
1648 	if (asprintf(&packidx_path, "/%s/%s/pack-%s.idx",
1649 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
1650 		err = got_error_from_errno("asprintf");
1651 		goto done;
1652 	}
1653 
1654 	if (rename(client->packfile_path, packfile_path) == -1) {
1655 		err = got_error_from_errno3("rename", client->packfile_path,
1656 		    packfile_path);
1657 		goto done;
1658 	}
1659 
1660 	free(client->packfile_path);
1661 	client->packfile_path = NULL;
1662 
1663 	if (rename(client->packidx_path, packidx_path) == -1) {
1664 		err = got_error_from_errno3("rename", client->packidx_path,
1665 		    packidx_path);
1666 		goto done;
1667 	}
1668 
1669 	free(client->packidx_path);
1670 	client->packidx_path = NULL;
1671 done:
1672 	free(packfile_path);
1673 	free(packidx_path);
1674 	return err;
1675 }
1676 
1677 static const struct got_error *
1678 begin_ref_updates(struct gotd_client *client, struct imsg *imsg)
1679 {
1680 	struct gotd_imsg_ref_updates_start istart;
1681 	size_t datalen;
1682 
1683 	if (client->nref_updates != -1)
1684 		return got_error(GOT_ERR_PRIVSEP_MSG);
1685 
1686 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1687 	if (datalen != sizeof(istart))
1688 		return got_error(GOT_ERR_PRIVSEP_LEN);
1689 	memcpy(&istart, imsg->data, sizeof(istart));
1690 
1691 	if (istart.nref_updates <= 0)
1692 		return got_error(GOT_ERR_PRIVSEP_MSG);
1693 
1694 	client->nref_updates = istart.nref_updates;
1695 	return NULL;
1696 }
1697 
1698 static const struct got_error *
1699 update_ref(struct gotd_client *client, const char *repo_path,
1700     struct imsg *imsg)
1701 {
1702 	const struct got_error *err = NULL;
1703 	struct got_repository *repo = NULL;
1704 	struct got_reference *ref = NULL;
1705 	struct gotd_imsg_ref_update iref;
1706 	struct got_object_id old_id, new_id;
1707 	struct got_object_id *id = NULL;
1708 	struct got_object *obj = NULL;
1709 	char *refname = NULL;
1710 	size_t datalen;
1711 	int locked = 0;
1712 
1713 	log_debug("update-ref from uid %d", client->euid);
1714 
1715 	if (client->nref_updates <= 0)
1716 		return got_error(GOT_ERR_PRIVSEP_MSG);
1717 
1718 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1719 	if (datalen < sizeof(iref))
1720 		return got_error(GOT_ERR_PRIVSEP_LEN);
1721 	memcpy(&iref, imsg->data, sizeof(iref));
1722 	if (datalen != sizeof(iref) + iref.name_len)
1723 		return got_error(GOT_ERR_PRIVSEP_LEN);
1724 	refname = malloc(iref.name_len + 1);
1725 	if (refname == NULL)
1726 		return got_error_from_errno("malloc");
1727 	memcpy(refname, imsg->data + sizeof(iref), iref.name_len);
1728 	refname[iref.name_len] = '\0';
1729 
1730 	log_debug("updating ref %s for uid %d", refname, client->euid);
1731 
1732 	err = got_repo_open(&repo, repo_path, NULL, NULL);
1733 	if (err)
1734 		goto done;
1735 
1736 	memcpy(old_id.sha1, iref.old_id, SHA1_DIGEST_LENGTH);
1737 	memcpy(new_id.sha1, iref.new_id, SHA1_DIGEST_LENGTH);
1738 	err = got_object_open(&obj, repo, &new_id);
1739 	if (err)
1740 		goto done;
1741 
1742 	if (iref.ref_is_new) {
1743 		err = got_ref_open(&ref, repo, refname, 0);
1744 		if (err) {
1745 			if (err->code != GOT_ERR_NOT_REF)
1746 				goto done;
1747 			err = got_ref_alloc(&ref, refname, &new_id);
1748 			if (err)
1749 				goto done;
1750 			err = got_ref_write(ref, repo); /* will lock/unlock */
1751 			if (err)
1752 				goto done;
1753 		} else {
1754 			err = got_error_fmt(GOT_ERR_REF_BUSY,
1755 			    "%s has been created by someone else "
1756 			    "while transaction was in progress",
1757 			    got_ref_get_name(ref));
1758 			goto done;
1759 		}
1760 	} else {
1761 		err = got_ref_open(&ref, repo, refname, 1 /* lock */);
1762 		if (err)
1763 			goto done;
1764 		locked = 1;
1765 
1766 		err = got_ref_resolve(&id, repo, ref);
1767 		if (err)
1768 			goto done;
1769 
1770 		if (got_object_id_cmp(id, &old_id) != 0) {
1771 			err = got_error_fmt(GOT_ERR_REF_BUSY,
1772 			    "%s has been modified by someone else "
1773 			    "while transaction was in progress",
1774 			    got_ref_get_name(ref));
1775 			goto done;
1776 		}
1777 
1778 		err = got_ref_change_ref(ref, &new_id);
1779 		if (err)
1780 			goto done;
1781 
1782 		err = got_ref_write(ref, repo);
1783 		if (err)
1784 			goto done;
1785 
1786 		free(id);
1787 		id = NULL;
1788 	}
1789 done:
1790 	if (err) {
1791 		if (err->code == GOT_ERR_LOCKFILE_TIMEOUT) {
1792 			err = got_error_fmt(GOT_ERR_LOCKFILE_TIMEOUT,
1793 			    "could not acquire exclusive file lock for %s",
1794 			    refname);
1795 		}
1796 		send_ref_update_ng(client, &iref, refname, err->msg);
1797 	} else
1798 		send_ref_update_ok(client, &iref, refname);
1799 
1800 	if (client->nref_updates > 0) {
1801 		client->nref_updates--;
1802 		if (client->nref_updates == 0)
1803 			send_refs_updated(client);
1804 
1805 	}
1806 	if (locked) {
1807 		const struct got_error *unlock_err;
1808 		unlock_err = got_ref_unlock(ref);
1809 		if (unlock_err && err == NULL)
1810 			err = unlock_err;
1811 	}
1812 	if (ref)
1813 		got_ref_close(ref);
1814 	if (obj)
1815 		got_object_close(obj);
1816 	if (repo)
1817 		got_repo_close(repo);
1818 	free(refname);
1819 	free(id);
1820 	return err;
1821 }
1822 
1823 static void
1824 gotd_dispatch_listener(int fd, short event, void *arg)
1825 {
1826 	struct gotd_imsgev *iev = arg;
1827 	struct imsgbuf *ibuf = &iev->ibuf;
1828 	struct gotd_child_proc *proc = &gotd.listen_proc;
1829 	ssize_t n;
1830 	int shut = 0;
1831 	struct imsg imsg;
1832 
1833 	if (proc->iev.ibuf.fd != fd)
1834 		fatalx("%s: unexpected fd %d", __func__, fd);
1835 
1836 	if (event & EV_READ) {
1837 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1838 			fatal("imsg_read error");
1839 		if (n == 0) {
1840 			/* Connection closed. */
1841 			shut = 1;
1842 			goto done;
1843 		}
1844 	}
1845 
1846 	if (event & EV_WRITE) {
1847 		n = msgbuf_write(&ibuf->w);
1848 		if (n == -1 && errno != EAGAIN)
1849 			fatal("msgbuf_write");
1850 		if (n == 0) {
1851 			/* Connection closed. */
1852 			shut = 1;
1853 			goto done;
1854 		}
1855 	}
1856 
1857 	for (;;) {
1858 		const struct got_error *err = NULL;
1859 		struct gotd_client *client = NULL;
1860 		uint32_t client_id = 0;
1861 		int do_disconnect = 0;
1862 
1863 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1864 			fatal("%s: imsg_get error", __func__);
1865 		if (n == 0)	/* No more messages. */
1866 			break;
1867 
1868 		switch (imsg.hdr.type) {
1869 		case GOTD_IMSG_ERROR:
1870 			do_disconnect = 1;
1871 			err = gotd_imsg_recv_error(&client_id, &imsg);
1872 			break;
1873 		case GOTD_IMSG_CONNECT:
1874 			err = recv_connect(&client_id, &imsg);
1875 			break;
1876 		default:
1877 			log_debug("unexpected imsg %d", imsg.hdr.type);
1878 			break;
1879 		}
1880 
1881 		client = find_client(client_id);
1882 		if (client == NULL) {
1883 			log_warnx("%s: client not found", __func__);
1884 			imsg_free(&imsg);
1885 			continue;
1886 		}
1887 
1888 		if (err)
1889 			log_warnx("uid %d: %s", client->euid, err->msg);
1890 
1891 		if (do_disconnect) {
1892 			if (err)
1893 				disconnect_on_error(client, err);
1894 			else
1895 				disconnect(client);
1896 		}
1897 
1898 		imsg_free(&imsg);
1899 	}
1900 done:
1901 	if (!shut) {
1902 		gotd_imsg_event_add(iev);
1903 	} else {
1904 		/* This pipe is dead. Remove its event handler */
1905 		event_del(&iev->ev);
1906 		event_loopexit(NULL);
1907 	}
1908 }
1909 
1910 static void
1911 gotd_dispatch_repo_child(int fd, short event, void *arg)
1912 {
1913 	struct gotd_imsgev *iev = arg;
1914 	struct imsgbuf *ibuf = &iev->ibuf;
1915 	struct gotd_child_proc *proc = NULL;
1916 	struct gotd_client *client = NULL;
1917 	ssize_t n;
1918 	int shut = 0;
1919 	struct imsg imsg;
1920 
1921 	if (event & EV_READ) {
1922 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1923 			fatal("imsg_read error");
1924 		if (n == 0) {
1925 			/* Connection closed. */
1926 			shut = 1;
1927 			goto done;
1928 		}
1929 	}
1930 
1931 	if (event & EV_WRITE) {
1932 		n = msgbuf_write(&ibuf->w);
1933 		if (n == -1 && errno != EAGAIN)
1934 			fatal("msgbuf_write");
1935 		if (n == 0) {
1936 			/* Connection closed. */
1937 			shut = 1;
1938 			goto done;
1939 		}
1940 	}
1941 
1942 	client = find_client_by_proc_fd(fd);
1943 	if (client == NULL)
1944 		fatalx("cannot find client for fd %d", fd);
1945 
1946 	proc = get_client_proc(client);
1947 	if (proc == NULL)
1948 		fatalx("cannot find child process for fd %d", fd);
1949 
1950 	for (;;) {
1951 		const struct got_error *err = NULL;
1952 		uint32_t client_id = 0;
1953 		int do_disconnect = 0;
1954 		int do_list_refs = 0, do_ref_updates = 0, do_ref_update = 0;
1955 		int do_packfile_install = 0;
1956 
1957 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1958 			fatal("%s: imsg_get error", __func__);
1959 		if (n == 0)	/* No more messages. */
1960 			break;
1961 
1962 		switch (imsg.hdr.type) {
1963 		case GOTD_IMSG_ERROR:
1964 			do_disconnect = 1;
1965 			err = gotd_imsg_recv_error(&client_id, &imsg);
1966 			break;
1967 		case GOTD_IMSG_REPO_CHILD_READY:
1968 			do_list_refs = 1;
1969 			break;
1970 		case GOTD_IMSG_PACKFILE_DONE:
1971 			do_disconnect = 1;
1972 			err = recv_packfile_done(&client_id, &imsg);
1973 			break;
1974 		case GOTD_IMSG_PACKFILE_INSTALL:
1975 			err = recv_packfile_install(&client_id, &imsg);
1976 			if (err == NULL)
1977 				do_packfile_install = 1;
1978 			break;
1979 		case GOTD_IMSG_REF_UPDATES_START:
1980 			err = recv_ref_updates_start(&client_id, &imsg);
1981 			if (err == NULL)
1982 				do_ref_updates = 1;
1983 			break;
1984 		case GOTD_IMSG_REF_UPDATE:
1985 			err = recv_ref_update(&client_id, &imsg);
1986 			if (err == NULL)
1987 				do_ref_update = 1;
1988 			break;
1989 		default:
1990 			log_debug("unexpected imsg %d", imsg.hdr.type);
1991 			break;
1992 		}
1993 
1994 		if (!verify_imsg_src(client, proc, &imsg)) {
1995 			log_debug("dropping imsg type %d from PID %d",
1996 			    imsg.hdr.type, proc->pid);
1997 			imsg_free(&imsg);
1998 			continue;
1999 		}
2000 		if (err)
2001 			log_warnx("uid %d: %s", client->euid, err->msg);
2002 
2003 		if (do_disconnect) {
2004 			if (err)
2005 				disconnect_on_error(client, err);
2006 			else
2007 				disconnect(client);
2008 		} else {
2009 			if (do_list_refs)
2010 				err = list_refs_request(client, iev);
2011 			else if (do_packfile_install)
2012 				err = install_pack(client, proc->repo_path,
2013 				    &imsg);
2014 			else if (do_ref_updates)
2015 				err = begin_ref_updates(client, &imsg);
2016 			else if (do_ref_update)
2017 				err = update_ref(client, proc->repo_path,
2018 				    &imsg);
2019 			if (err)
2020 				log_warnx("uid %d: %s", client->euid, err->msg);
2021 		}
2022 		imsg_free(&imsg);
2023 	}
2024 done:
2025 	if (!shut) {
2026 		gotd_imsg_event_add(iev);
2027 	} else {
2028 		/* This pipe is dead. Remove its event handler */
2029 		event_del(&iev->ev);
2030 		event_loopexit(NULL);
2031 	}
2032 }
2033 
2034 static pid_t
2035 start_child(enum gotd_procid proc_id, const char *repo_path,
2036     char *argv0, const char *confpath, int fd, int daemonize, int verbosity)
2037 {
2038 	char	*argv[11];
2039 	int	 argc = 0;
2040 	pid_t	 pid;
2041 
2042 	switch (pid = fork()) {
2043 	case -1:
2044 		fatal("cannot fork");
2045 	case 0:
2046 		break;
2047 	default:
2048 		close(fd);
2049 		return pid;
2050 	}
2051 
2052 	if (fd != GOTD_FILENO_MSG_PIPE) {
2053 		if (dup2(fd, GOTD_FILENO_MSG_PIPE) == -1)
2054 			fatal("cannot setup imsg fd");
2055 	} else if (fcntl(fd, F_SETFD, 0) == -1)
2056 		fatal("cannot setup imsg fd");
2057 
2058 	argv[argc++] = argv0;
2059 	switch (proc_id) {
2060 	case PROC_LISTEN:
2061 		argv[argc++] = (char *)"-L";
2062 		break;
2063 	case PROC_REPO_READ:
2064 		argv[argc++] = (char *)"-R";
2065 		break;
2066 	case PROC_REPO_WRITE:
2067 		argv[argc++] = (char *)"-W";
2068 		break;
2069 	default:
2070 		fatalx("invalid process id %d", proc_id);
2071 	}
2072 
2073 	argv[argc++] = (char *)"-f";
2074 	argv[argc++] = (char *)confpath;
2075 
2076 	if (repo_path) {
2077 		argv[argc++] = (char *)"-P";
2078 		argv[argc++] = (char *)repo_path;
2079 	}
2080 
2081 	if (!daemonize)
2082 		argv[argc++] = (char *)"-d";
2083 	if (verbosity > 0)
2084 		argv[argc++] = (char *)"-v";
2085 	if (verbosity > 1)
2086 		argv[argc++] = (char *)"-v";
2087 	argv[argc++] = NULL;
2088 
2089 	execvp(argv0, argv);
2090 	fatal("execvp");
2091 }
2092 
2093 static void
2094 start_listener(char *argv0, const char *confpath, int daemonize, int verbosity)
2095 {
2096 	struct gotd_child_proc *proc = &gotd.listen_proc;
2097 
2098 	proc->type = PROC_LISTEN;
2099 
2100 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
2101 	    PF_UNSPEC, proc->pipe) == -1)
2102 		fatal("socketpair");
2103 
2104 	proc->pid = start_child(proc->type, NULL, argv0, confpath,
2105 	    proc->pipe[1], daemonize, verbosity);
2106 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
2107 	proc->iev.handler = gotd_dispatch_listener;
2108 	proc->iev.events = EV_READ;
2109 	proc->iev.handler_arg = NULL;
2110 }
2111 
2112 static const struct got_error *
2113 start_repo_child(struct gotd_client *client, enum gotd_procid proc_type,
2114     struct gotd_repo *repo, char *argv0, const char *confpath,
2115     int daemonize, int verbosity)
2116 {
2117 	struct gotd_child_proc *proc;
2118 
2119 	if (proc_type != PROC_REPO_READ && proc_type != PROC_REPO_WRITE)
2120 		return got_error_msg(GOT_ERR_NOT_IMPL, "bad process type");
2121 		
2122 	proc = calloc(1, sizeof(*proc));
2123 	if (proc == NULL)
2124 		return got_error_from_errno("calloc");
2125 
2126 	proc->type = proc_type;
2127 	if (strlcpy(proc->repo_name, repo->name,
2128 	    sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
2129 		fatalx("repository name too long: %s", repo->name);
2130 	log_debug("starting %s for repository %s",
2131 	    proc->type == PROC_REPO_READ ? "reader" : "writer", repo->name);
2132 	if (realpath(repo->path, proc->repo_path) == NULL)
2133 		fatal("%s", repo->path);
2134 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
2135 	    PF_UNSPEC, proc->pipe) == -1)
2136 		fatal("socketpair");
2137 	proc->pid = start_child(proc->type, proc->repo_path, argv0,
2138 	    confpath, proc->pipe[1], daemonize, verbosity);
2139 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
2140 	log_debug("proc %s %s is on fd %d",
2141 	    gotd_proc_names[proc->type], proc->repo_path,
2142 	    proc->pipe[0]);
2143 	proc->iev.handler = gotd_dispatch_repo_child;
2144 	proc->iev.events = EV_READ;
2145 	proc->iev.handler_arg = NULL;
2146 	event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
2147 	    gotd_dispatch_repo_child, &proc->iev);
2148 	gotd_imsg_event_add(&proc->iev);
2149 
2150 	if (proc->type == PROC_REPO_READ)
2151 		client->repo_read = proc;
2152 	else
2153 		client->repo_write = proc;
2154 
2155 	return NULL;
2156 }
2157 
2158 static void
2159 apply_unveil_repo_readonly(const char *repo_path)
2160 {
2161 	if (unveil(repo_path, "r") == -1)
2162 		fatal("unveil %s", repo_path);
2163 
2164 	if (unveil(NULL, NULL) == -1)
2165 		fatal("unveil");
2166 }
2167 
2168 static void
2169 apply_unveil(void)
2170 {
2171 	struct gotd_repo *repo;
2172 
2173 	if (unveil(gotd.argv0, "x") == -1)
2174 		fatal("unveil %s", gotd.argv0);
2175 
2176 	TAILQ_FOREACH(repo, &gotd.repos, entry) {
2177 		if (unveil(repo->path, "rwc") == -1)
2178 			fatal("unveil %s", repo->path);
2179 	}
2180 
2181 	if (unveil(GOT_TMPDIR_STR, "rwc") == -1)
2182 		fatal("unveil %s", GOT_TMPDIR_STR);
2183 
2184 	if (unveil(NULL, NULL) == -1)
2185 		fatal("unveil");
2186 }
2187 
2188 int
2189 main(int argc, char **argv)
2190 {
2191 	const struct got_error *error = NULL;
2192 	int ch, fd = -1, daemonize = 1, verbosity = 0, noaction = 0;
2193 	const char *confpath = GOTD_CONF_PATH;
2194 	char *argv0 = argv[0];
2195 	char title[2048];
2196 	gid_t groups[NGROUPS_MAX];
2197 	int ngroups = NGROUPS_MAX;
2198 	struct passwd *pw = NULL;
2199 	struct group *gr = NULL;
2200 	char *repo_path = NULL;
2201 	enum gotd_procid proc_id = PROC_GOTD;
2202 	struct event evsigint, evsigterm, evsighup, evsigusr1;
2203 	int *pack_fds = NULL, *temp_fds = NULL;
2204 
2205 	log_init(1, LOG_DAEMON); /* Log to stderr until daemonized. */
2206 
2207 	while ((ch = getopt(argc, argv, "df:LnP:RvW")) != -1) {
2208 		switch (ch) {
2209 		case 'd':
2210 			daemonize = 0;
2211 			break;
2212 		case 'f':
2213 			confpath = optarg;
2214 			break;
2215 		case 'L':
2216 			proc_id = PROC_LISTEN;
2217 			break;
2218 		case 'n':
2219 			noaction = 1;
2220 			break;
2221 		case 'P':
2222 			repo_path = realpath(optarg, NULL);
2223 			if (repo_path == NULL)
2224 				fatal("realpath '%s'", optarg);
2225 			break;
2226 		case 'R':
2227 			proc_id = PROC_REPO_READ;
2228 			break;
2229 		case 'v':
2230 			if (verbosity < 3)
2231 				verbosity++;
2232 			break;
2233 		case 'W':
2234 			proc_id = PROC_REPO_WRITE;
2235 			break;
2236 		default:
2237 			usage();
2238 		}
2239 	}
2240 
2241 	argc -= optind;
2242 	argv += optind;
2243 
2244 	if (argc != 0)
2245 		usage();
2246 
2247 	/* Require an absolute path in argv[0] for reliable re-exec. */
2248 	if (!got_path_is_absolute(argv0))
2249 		fatalx("bad path \"%s\": must be an absolute path", argv0);
2250 
2251 	if (geteuid() && (proc_id == PROC_GOTD || proc_id == PROC_LISTEN))
2252 		fatalx("need root privileges");
2253 
2254 	log_init(daemonize ? 0 : 1, LOG_DAEMON);
2255 	log_setverbose(verbosity);
2256 
2257 	if (parse_config(confpath, proc_id, &gotd) != 0)
2258 		return 1;
2259 
2260 	gotd.argv0 = argv0;
2261 	gotd.daemonize = daemonize;
2262 	gotd.verbosity = verbosity;
2263 	gotd.confpath = confpath;
2264 
2265 	if (proc_id == PROC_GOTD &&
2266 	    (gotd.nrepos == 0 || TAILQ_EMPTY(&gotd.repos)))
2267 		fatalx("no repository defined in configuration file");
2268 
2269 	pw = getpwnam(gotd.user_name);
2270 	if (pw == NULL)
2271 		fatalx("user %s not found", gotd.user_name);
2272 
2273 	if (pw->pw_uid == 0) {
2274 		fatalx("cannot run %s as %s: the user running %s "
2275 		    "must not be the superuser",
2276 		    getprogname(), pw->pw_name, getprogname());
2277 	}
2278 
2279 	if (getgrouplist(pw->pw_name, pw->pw_gid, groups, &ngroups) == -1)
2280 		log_warnx("group membership list truncated");
2281 
2282 	gr = match_group(groups, ngroups, gotd.unix_group_name);
2283 	if (gr == NULL) {
2284 		fatalx("cannot start %s: the user running %s "
2285 		    "must be a secondary member of group %s",
2286 		    getprogname(), getprogname(), gotd.unix_group_name);
2287 	}
2288 	if (gr->gr_gid == pw->pw_gid) {
2289 		fatalx("cannot start %s: the user running %s "
2290 		    "must be a secondary member of group %s, but "
2291 		    "%s is the user's primary group",
2292 		    getprogname(), getprogname(), gotd.unix_group_name,
2293 		    gotd.unix_group_name);
2294 	}
2295 
2296 	if (proc_id == PROC_LISTEN &&
2297 	    !got_path_is_absolute(gotd.unix_socket_path))
2298 		fatalx("bad unix socket path \"%s\": must be an absolute path",
2299 		    gotd.unix_socket_path);
2300 
2301 	if (noaction)
2302 		return 0;
2303 
2304 	if (proc_id == PROC_GOTD) {
2305 		gotd.pid = getpid();
2306 		snprintf(title, sizeof(title), "%s", gotd_proc_names[proc_id]);
2307 		start_listener(argv0, confpath, daemonize, verbosity);
2308 		arc4random_buf(&clients_hash_key, sizeof(clients_hash_key));
2309 		if (daemonize && daemon(1, 0) == -1)
2310 			fatal("daemon");
2311 	} else if (proc_id == PROC_LISTEN) {
2312 		snprintf(title, sizeof(title), "%s", gotd_proc_names[proc_id]);
2313 		if (verbosity) {
2314 			log_info("socket: %s", gotd.unix_socket_path);
2315 			log_info("user: %s", pw->pw_name);
2316 			log_info("secondary group: %s", gr->gr_name);
2317 		}
2318 
2319 		fd = unix_socket_listen(gotd.unix_socket_path, pw->pw_uid,
2320 		    gr->gr_gid);
2321 		if (fd == -1) {
2322 			fatal("cannot listen on unix socket %s",
2323 			    gotd.unix_socket_path);
2324 		}
2325 		if (daemonize && daemon(0, 0) == -1)
2326 			fatal("daemon");
2327 	} else if (proc_id == PROC_REPO_READ || proc_id == PROC_REPO_WRITE) {
2328 		error = got_repo_pack_fds_open(&pack_fds);
2329 		if (error != NULL)
2330 			fatalx("cannot open pack tempfiles: %s", error->msg);
2331 		error = got_repo_temp_fds_open(&temp_fds);
2332 		if (error != NULL)
2333 			fatalx("cannot open pack tempfiles: %s", error->msg);
2334 		if (repo_path == NULL)
2335 			fatalx("repository path not specified");
2336 		snprintf(title, sizeof(title), "%s %s",
2337 		    gotd_proc_names[proc_id], repo_path);
2338 		if (daemonize && daemon(0, 0) == -1)
2339 			fatal("daemon");
2340 	} else
2341 		fatal("invalid process id %d", proc_id);
2342 
2343 	setproctitle("%s", title);
2344 	log_procinit(title);
2345 
2346 	/* Drop root privileges. */
2347 	if (setgid(pw->pw_gid) == -1)
2348 		fatal("setgid %d failed", pw->pw_gid);
2349 	if (setuid(pw->pw_uid) == -1)
2350 		fatal("setuid %d failed", pw->pw_uid);
2351 
2352 	event_init();
2353 
2354 	switch (proc_id) {
2355 	case PROC_GOTD:
2356 #ifndef PROFILE
2357 		if (pledge("stdio rpath wpath cpath proc exec getpw "
2358 		    "sendfd recvfd fattr flock unix unveil", NULL) == -1)
2359 			err(1, "pledge");
2360 #endif
2361 		break;
2362 	case PROC_LISTEN:
2363 #ifndef PROFILE
2364 		if (pledge("stdio sendfd unix", NULL) == -1)
2365 			err(1, "pledge");
2366 #endif
2367 		listen_main(title, fd);
2368 		/* NOTREACHED */
2369 		break;
2370 	case PROC_REPO_READ:
2371 #ifndef PROFILE
2372 		if (pledge("stdio rpath recvfd unveil", NULL) == -1)
2373 			err(1, "pledge");
2374 #endif
2375 		apply_unveil_repo_readonly(repo_path);
2376 		repo_read_main(title, repo_path, pack_fds, temp_fds);
2377 		/* NOTREACHED */
2378 		exit(0);
2379 	case PROC_REPO_WRITE:
2380 #ifndef PROFILE
2381 		if (pledge("stdio rpath recvfd unveil", NULL) == -1)
2382 			err(1, "pledge");
2383 #endif
2384 		apply_unveil_repo_readonly(repo_path);
2385 		repo_write_main(title, repo_path, pack_fds, temp_fds);
2386 		/* NOTREACHED */
2387 		exit(0);
2388 	default:
2389 		fatal("invalid process id %d", proc_id);
2390 	}
2391 
2392 	if (proc_id != PROC_GOTD)
2393 		fatal("invalid process id %d", proc_id);
2394 
2395 	apply_unveil();
2396 
2397 	signal_set(&evsigint, SIGINT, gotd_sighdlr, NULL);
2398 	signal_set(&evsigterm, SIGTERM, gotd_sighdlr, NULL);
2399 	signal_set(&evsighup, SIGHUP, gotd_sighdlr, NULL);
2400 	signal_set(&evsigusr1, SIGUSR1, gotd_sighdlr, NULL);
2401 	signal(SIGPIPE, SIG_IGN);
2402 
2403 	signal_add(&evsigint, NULL);
2404 	signal_add(&evsigterm, NULL);
2405 	signal_add(&evsighup, NULL);
2406 	signal_add(&evsigusr1, NULL);
2407 
2408 	gotd_imsg_event_add(&gotd.listen_proc.iev);
2409 
2410 	event_dispatch();
2411 
2412 	if (pack_fds)
2413 		got_repo_pack_fds_close(pack_fds);
2414 	free(repo_path);
2415 	return 0;
2416 }