1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/queue.h>
18 #include <sys/stat.h>
19 #include <sys/tree.h>
20 #include <sys/types.h>
21 
22 #include <event.h>
23 #include <errno.h>
24 #include <imsg.h>
25 #include <signal.h>
26 #include <siphash.h>
27 #include <stdio.h>
28 #include <stdlib.h>
29 #include <string.h>
30 #include <limits.h>
31 #include <poll.h>
32 #include <sha1.h>
33 #include <unistd.h>
34 #include <zlib.h>
35 
36 #include "buf.h"
37 
38 #include "got_error.h"
39 #include "got_repository.h"
40 #include "got_object.h"
41 #include "got_reference.h"
42 #include "got_path.h"
43 
44 #include "got_lib_delta.h"
45 #include "got_lib_delta_cache.h"
46 #include "got_lib_object.h"
47 #include "got_lib_object_cache.h"
48 #include "got_lib_ratelimit.h"
49 #include "got_lib_pack.h"
50 #include "got_lib_pack_index.h"
51 #include "got_lib_repository.h"
52 #include "got_lib_poll.h"
53 
54 #include "got_lib_sha1.h" /* XXX temp include for debugging */
55 
56 #include "log.h"
57 #include "gotd.h"
58 #include "repo_write.h"
59 
60 #ifndef nitems
61 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
62 #endif
63 
64 static struct repo_write {
65 	pid_t pid;
66 	const char *title;
67 	struct got_repository *repo;
68 	int *pack_fds;
69 	int *temp_fds;
70 	int session_fd;
71 	struct gotd_imsgev session_iev;
72 } repo_write;
73 
74 struct gotd_ref_update {
75 	STAILQ_ENTRY(gotd_ref_update) entry;
76 	struct got_reference *ref;
77 	int ref_is_new;
78 	int delete_ref;
79 	struct got_object_id old_id;
80 	struct got_object_id new_id;
81 };
82 STAILQ_HEAD(gotd_ref_updates, gotd_ref_update);
83 
84 static struct repo_write_client {
85 	uint32_t			 id;
86 	int				 fd;
87 	int				 pack_pipe[2];
88 	struct got_pack			 pack;
89 	uint8_t				 pack_sha1[SHA1_DIGEST_LENGTH];
90 	int				 packidx_fd;
91 	struct gotd_ref_updates		 ref_updates;
92 	int				 nref_updates;
93 	int				 nref_del;
94 	int				 nref_new;
95 } repo_write_client;
96 
97 static volatile sig_atomic_t sigint_received;
98 static volatile sig_atomic_t sigterm_received;
99 
100 static void
101 catch_sigint(int signo)
102 {
103 	sigint_received = 1;
104 }
105 
106 static void
107 catch_sigterm(int signo)
108 {
109 	sigterm_received = 1;
110 }
111 
112 static const struct got_error *
113 check_cancelled(void *arg)
114 {
115 	if (sigint_received || sigterm_received)
116 		return got_error(GOT_ERR_CANCELLED);
117 
118 	return NULL;
119 }
120 
121 static const struct got_error *
122 send_peeled_tag_ref(struct got_reference *ref, struct got_object *obj,
123     struct imsgbuf *ibuf)
124 {
125 	const struct got_error *err = NULL;
126 	struct got_tag_object *tag;
127 	size_t namelen, len;
128 	char *peeled_refname = NULL;
129 	struct got_object_id *id;
130 	struct ibuf *wbuf;
131 
132 	err = got_object_tag_open(&tag, repo_write.repo, obj);
133 	if (err)
134 		return err;
135 
136 	if (asprintf(&peeled_refname, "%s^{}", got_ref_get_name(ref)) == -1) {
137 		err = got_error_from_errno("asprintf");
138 		goto done;
139 	}
140 
141 	id = got_object_tag_get_object_id(tag);
142 	namelen = strlen(peeled_refname);
143 
144 	len = sizeof(struct gotd_imsg_ref) + namelen;
145 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
146 		err = got_error(GOT_ERR_NO_SPACE);
147 		goto done;
148 	}
149 
150 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
151 	    repo_write.pid, len);
152 	if (wbuf == NULL) {
153 		err = got_error_from_errno("imsg_create REF");
154 		goto done;
155 	}
156 
157 	/* Keep in sync with struct gotd_imsg_ref definition. */
158 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
159 		err = got_error_from_errno("imsg_add REF");
160 		goto done;
161 	}
162 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1) {
163 		err = got_error_from_errno("imsg_add REF");
164 		goto done;
165 	}
166 	if (imsg_add(wbuf, peeled_refname, namelen) == -1) {
167 		err = got_error_from_errno("imsg_add REF");
168 		goto done;
169 	}
170 
171 	wbuf->fd = -1;
172 	imsg_close(ibuf, wbuf);
173 done:
174 	got_object_tag_close(tag);
175 	return err;
176 }
177 
178 static const struct got_error *
179 send_ref(struct got_reference *ref, struct imsgbuf *ibuf)
180 {
181 	const struct got_error *err;
182 	const char *refname = got_ref_get_name(ref);
183 	size_t namelen;
184 	struct got_object_id *id = NULL;
185 	struct got_object *obj = NULL;
186 	size_t len;
187 	struct ibuf *wbuf;
188 
189 	namelen = strlen(refname);
190 
191 	len = sizeof(struct gotd_imsg_ref) + namelen;
192 	if (len > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
193 		return got_error(GOT_ERR_NO_SPACE);
194 
195 	err = got_ref_resolve(&id, repo_write.repo, ref);
196 	if (err)
197 		return err;
198 
199 	wbuf = imsg_create(ibuf, GOTD_IMSG_REF, PROC_REPO_WRITE,
200 	    repo_write.pid, len);
201 	if (wbuf == NULL) {
202 		err = got_error_from_errno("imsg_create REF");
203 		goto done;
204 	}
205 
206 	/* Keep in sync with struct gotd_imsg_ref definition. */
207 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1)
208 		return got_error_from_errno("imsg_add REF");
209 	if (imsg_add(wbuf, &namelen, sizeof(namelen)) == -1)
210 		return got_error_from_errno("imsg_add REF");
211 	if (imsg_add(wbuf, refname, namelen) == -1)
212 		return got_error_from_errno("imsg_add REF");
213 
214 	wbuf->fd = -1;
215 	imsg_close(ibuf, wbuf);
216 
217 	err = got_object_open(&obj, repo_write.repo, id);
218 	if (err)
219 		goto done;
220 	if (obj->type == GOT_OBJ_TYPE_TAG)
221 		err = send_peeled_tag_ref(ref, obj, ibuf);
222 done:
223 	if (obj)
224 		got_object_close(obj);
225 	free(id);
226 	return err;
227 }
228 
229 static const struct got_error *
230 list_refs(struct imsg *imsg)
231 {
232 	const struct got_error *err;
233 	struct repo_write_client *client = &repo_write_client;
234 	struct got_reflist_head refs;
235 	struct got_reflist_entry *re;
236 	struct gotd_imsg_list_refs_internal ireq;
237 	size_t datalen;
238 	struct gotd_imsg_reflist irefs;
239 	struct imsgbuf ibuf;
240 	int client_fd = imsg->fd;
241 
242 	TAILQ_INIT(&refs);
243 
244 	if (client_fd == -1)
245 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
246 
247 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
248 	if (datalen != sizeof(ireq))
249 		return got_error(GOT_ERR_PRIVSEP_LEN);
250 	memcpy(&ireq, imsg->data, sizeof(ireq));
251 
252 	if (ireq.client_id == 0)
253 		return got_error(GOT_ERR_CLIENT_ID);
254 	if (client->id != 0) {
255 		return got_error_msg(GOT_ERR_CLIENT_ID,
256 		    "duplicate list-refs request");
257 	}
258 	client->id = ireq.client_id;
259 	client->fd = client_fd;
260 	client->pack_pipe = -1;
261 	client->packidx_fd = -1;
262 	client->nref_updates = 0;
263 	client->nref_del = 0;
264 	client->nref_new = 0;
265 
266 	imsg_init(&ibuf, client_fd);
267 
268 	err = got_ref_list(&refs, repo_write.repo, "",
269 	    got_ref_cmp_by_name, NULL);
270 	if (err)
271 		return err;
272 
273 	memset(&irefs, 0, sizeof(irefs));
274 	TAILQ_FOREACH(re, &refs, entry) {
275 		struct got_object_id *id;
276 		int obj_type;
277 
278 		if (got_ref_is_symbolic(re->ref))
279 			continue;
280 
281 		irefs.nrefs++;
282 
283 		/* Account for a peeled tag refs. */
284 		err = got_ref_resolve(&id, repo_write.repo, re->ref);
285 		if (err)
286 			goto done;
287 		err = got_object_get_type(&obj_type, repo_write.repo, id);
288 		free(id);
289 		if (err)
290 			goto done;
291 		if (obj_type == GOT_OBJ_TYPE_TAG)
292 			irefs.nrefs++;
293 	}
294 
295 	if (imsg_compose(&ibuf, GOTD_IMSG_REFLIST, PROC_REPO_WRITE,
296 	    repo_write.pid, -1, &irefs, sizeof(irefs)) == -1) {
297 		err = got_error_from_errno("imsg_compose REFLIST");
298 		goto done;
299 	}
300 
301 	TAILQ_FOREACH(re, &refs, entry) {
302 		if (got_ref_is_symbolic(re->ref))
303 			continue;
304 		err = send_ref(re->ref, &ibuf);
305 		if (err)
306 			goto done;
307 	}
308 
309 	err = gotd_imsg_flush(&ibuf);
310 done:
311 	got_ref_list_free(&refs);
312 	imsg_clear(&ibuf);
313 	return err;
314 }
315 
316 static const struct got_error *
317 protect_ref_namespace(struct got_reference *ref, const char *namespace)
318 {
319 	size_t len = strlen(namespace);
320 
321 	if (len < 5 || strncmp("refs/", namespace, 5) != 0 ||
322 	    namespace[len -1] != '/') {
323 		return got_error_fmt(GOT_ERR_BAD_REF_NAME,
324 		    "reference namespace '%s'", namespace);
325 	}
326 
327 	if (strncmp(namespace, got_ref_get_name(ref), len) == 0)
328 		return got_error_fmt(GOT_ERR_REFS_PROTECTED, "%s", namespace);
329 
330 	return NULL;
331 }
332 
333 static const struct got_error *
334 recv_ref_update(struct imsg *imsg)
335 {
336 	static const char zero_id[SHA1_DIGEST_LENGTH];
337 	const struct got_error *err = NULL;
338 	struct repo_write_client *client = &repo_write_client;
339 	struct gotd_imsg_ref_update iref;
340 	size_t datalen;
341 	char *refname = NULL;
342 	struct got_reference *ref = NULL;
343 	struct got_object_id *id = NULL;
344 	struct imsgbuf ibuf;
345 	struct gotd_ref_update *ref_update = NULL;
346 
347 	log_debug("ref-update received");
348 
349 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
350 	if (datalen < sizeof(iref))
351 		return got_error(GOT_ERR_PRIVSEP_LEN);
352 	memcpy(&iref, imsg->data, sizeof(iref));
353 	if (datalen != sizeof(iref) + iref.name_len)
354 		return got_error(GOT_ERR_PRIVSEP_LEN);
355 
356 	imsg_init(&ibuf, client->fd);
357 
358 	refname = strndup(imsg->data + sizeof(iref), iref.name_len);
359 	if (refname == NULL)
360 		return got_error_from_errno("strndup");
361 
362 	ref_update = calloc(1, sizeof(*ref_update));
363 	if (ref_update == NULL) {
364 		err = got_error_from_errno("malloc");
365 		goto done;
366 	}
367 
368 	memcpy(ref_update->old_id.sha1, iref.old_id, SHA1_DIGEST_LENGTH);
369 	memcpy(ref_update->new_id.sha1, iref.new_id, SHA1_DIGEST_LENGTH);
370 
371 	err = got_ref_open(&ref, repo_write.repo, refname, 0);
372 	if (err) {
373 		if (err->code != GOT_ERR_NOT_REF)
374 			goto done;
375 		err = got_ref_alloc(&ref, refname, &ref_update->new_id);
376 		if (err)
377 			goto done;
378 		ref_update->ref_is_new = 1;
379 		client->nref_new++;
380 	}
381 	if (got_ref_is_symbolic(ref)) {
382 		err = got_error_fmt(GOT_ERR_BAD_REF_TYPE,
383 		    "'%s' is a symbolic reference and cannot "
384 		    "be updated", got_ref_get_name(ref));
385 		goto done;
386 	}
387 	if (strncmp("refs/", got_ref_get_name(ref), 5) != 0) {
388 		err = got_error_fmt(GOT_ERR_BAD_REF_NAME,
389 		    "%s: does not begin with 'refs/'",
390 		    got_ref_get_name(ref));
391 		goto done;
392 	}
393 
394 	err = protect_ref_namespace(ref, "refs/got/");
395 	if (err)
396 		goto done;
397 	err = protect_ref_namespace(ref, "refs/remotes/");
398 	if (err)
399 		goto done;
400 
401 	if (!ref_update->ref_is_new) {
402 		/*
403 		 * Ensure the client's idea of this update is still valid.
404 		 * At this point we can only return an error, to prevent
405 		 * the client from uploading a pack file which will likely
406 		 * have to be discarded.
407 		 */
408 		err = got_ref_resolve(&id, repo_write.repo, ref);
409 		if (err)
410 			goto done;
411 
412 		if (got_object_id_cmp(id, &ref_update->old_id) != 0) {
413 			err = got_error_fmt(GOT_ERR_REF_BUSY,
414 			    "%s has been modified by someone else "
415 			    "while transaction was in progress",
416 			    got_ref_get_name(ref));
417 			goto done;
418 		}
419 	}
420 
421 	gotd_imsg_send_ack(&ref_update->new_id, &ibuf, PROC_REPO_WRITE,
422 	    repo_write.pid);
423 
424 	ref_update->ref = ref;
425 	if (memcmp(ref_update->new_id.sha1, zero_id, sizeof(zero_id)) == 0) {
426 		ref_update->delete_ref = 1;
427 		client->nref_del++;
428 	}
429 	STAILQ_INSERT_HEAD(&client->ref_updates, ref_update, entry);
430 	client->nref_updates++;
431 	ref = NULL;
432 	ref_update = NULL;
433 done:
434 	if (ref)
435 		got_ref_close(ref);
436 	free(ref_update);
437 	free(refname);
438 	free(id);
439 	return err;
440 }
441 
442 static const struct got_error *
443 pack_index_progress(void *arg, uint32_t nobj_total, uint32_t nobj_indexed,
444     uint32_t nobj_loose, uint32_t nobj_resolved)
445 {
446 	int p_indexed = 0, p_resolved = 0;
447 	int nobj_delta = nobj_total - nobj_loose;
448 
449 	if (nobj_total > 0)
450 		p_indexed = (nobj_indexed * 100) / nobj_total;
451 
452 	if (nobj_delta > 0)
453 		p_resolved = (nobj_resolved * 100) / nobj_delta;
454 
455 	if (p_resolved > 0) {
456 		log_debug("indexing %d objects %d%%; resolving %d deltas %d%%",
457 		    nobj_total, p_indexed, nobj_delta, p_resolved);
458 	} else
459 		log_debug("indexing %d objects %d%%", nobj_total, p_indexed);
460 
461 	return NULL;
462 }
463 
464 static const struct got_error *
465 read_more_pack_stream(int infd, BUF *buf, size_t minsize)
466 {
467 	const struct got_error *err = NULL;
468 	uint8_t readahead[65536];
469 	size_t have, newlen;
470 
471 	err = got_poll_read_full(infd, &have,
472 	    readahead, sizeof(readahead), minsize);
473 	if (err)
474 		return err;
475 
476 	err = buf_append(&newlen, buf, readahead, have);
477 	if (err)
478 		return err;
479 	return NULL;
480 }
481 
482 static const struct got_error *
483 copy_object_type_and_size(uint8_t *type, uint64_t *size, int infd, int outfd,
484     off_t *outsize, BUF *buf, size_t *buf_pos, SHA1_CTX *ctx)
485 {
486 	const struct got_error *err = NULL;
487 	uint8_t t = 0;
488 	uint64_t s = 0;
489 	uint8_t sizebuf[8];
490 	size_t i = 0;
491 	off_t obj_offset = *outsize;
492 
493 	do {
494 		/* We do not support size values which don't fit in 64 bit. */
495 		if (i > 9)
496 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
497 			    "packfile offset %lld", (long long)obj_offset);
498 
499 		if (buf_len(buf) - *buf_pos < sizeof(sizebuf[0])) {
500 			err = read_more_pack_stream(infd, buf,
501 			    sizeof(sizebuf[0]));
502 			if (err)
503 				return err;
504 		}
505 
506 		sizebuf[i] = buf_getc(buf, *buf_pos);
507 		*buf_pos += sizeof(sizebuf[i]);
508 
509 		if (i == 0) {
510 			t = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_TYPE_MASK) >>
511 			    GOT_PACK_OBJ_SIZE0_TYPE_MASK_SHIFT;
512 			s = (sizebuf[i] & GOT_PACK_OBJ_SIZE0_VAL_MASK);
513 		} else {
514 			size_t shift = 4 + 7 * (i - 1);
515 			s |= ((sizebuf[i] & GOT_PACK_OBJ_SIZE_VAL_MASK) <<
516 			    shift);
517 		}
518 		i++;
519 	} while (sizebuf[i - 1] & GOT_PACK_OBJ_SIZE_MORE);
520 
521 	err = got_pack_hwrite(outfd, sizebuf, i, ctx);
522 	if (err)
523 		return err;
524 	*outsize += i;
525 
526 	*type = t;
527 	*size = s;
528 	return NULL;
529 }
530 
531 static const struct got_error *
532 copy_ref_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
533     SHA1_CTX *ctx)
534 {
535 	const struct got_error *err = NULL;
536 	size_t remain = buf_len(buf) - *buf_pos;
537 
538 	if (remain < SHA1_DIGEST_LENGTH) {
539 		err = read_more_pack_stream(infd, buf,
540 		    SHA1_DIGEST_LENGTH - remain);
541 		if (err)
542 			return err;
543 	}
544 
545 	err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
546 	    SHA1_DIGEST_LENGTH, ctx);
547 	if (err)
548 		return err;
549 
550 	*buf_pos += SHA1_DIGEST_LENGTH;
551 	return NULL;
552 }
553 
554 static const struct got_error *
555 copy_offset_delta(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
556     SHA1_CTX *ctx)
557 {
558 	const struct got_error *err = NULL;
559 	uint64_t o = 0;
560 	uint8_t offbuf[8];
561 	size_t i = 0;
562 	off_t obj_offset = *outsize;
563 
564 	do {
565 		/* We do not support offset values which don't fit in 64 bit. */
566 		if (i > 8)
567 			return got_error_fmt(GOT_ERR_OBJ_TOO_LARGE,
568 			    "packfile offset %lld", (long long)obj_offset);
569 
570 		if (buf_len(buf) - *buf_pos < sizeof(offbuf[0])) {
571 			err = read_more_pack_stream(infd, buf,
572 			    sizeof(offbuf[0]));
573 			if (err)
574 				return err;
575 		}
576 
577 		offbuf[i] = buf_getc(buf, *buf_pos);
578 		*buf_pos += sizeof(offbuf[i]);
579 
580 		if (i == 0)
581 			o = (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
582 		else {
583 			o++;
584 			o <<= 7;
585 			o += (offbuf[i] & GOT_PACK_OBJ_DELTA_OFF_VAL_MASK);
586 		}
587 		i++;
588 	} while (offbuf[i - 1] & GOT_PACK_OBJ_DELTA_OFF_MORE);
589 
590 	if (o < sizeof(struct got_packfile_hdr) || o > *outsize)
591 		return got_error(GOT_ERR_PACK_OFFSET);
592 
593 	err = got_pack_hwrite(outfd, offbuf, i, ctx);
594 	if (err)
595 		return err;
596 
597 	*outsize += i;
598 	return NULL;
599 }
600 
601 static const struct got_error *
602 copy_zstream(int infd, int outfd, off_t *outsize, BUF *buf, size_t *buf_pos,
603     SHA1_CTX *ctx)
604 {
605 	const struct got_error *err = NULL;
606 	z_stream z;
607 	int zret;
608 	char voidbuf[1024];
609 	size_t consumed_total = 0;
610 	off_t zstream_offset = *outsize;
611 
612 	memset(&z, 0, sizeof(z));
613 
614 	z.zalloc = Z_NULL;
615 	z.zfree = Z_NULL;
616 	zret = inflateInit(&z);
617 	if (zret != Z_OK) {
618 		if  (zret == Z_ERRNO)
619 			return got_error_from_errno("inflateInit");
620 		if  (zret == Z_MEM_ERROR) {
621 			errno = ENOMEM;
622 			return got_error_from_errno("inflateInit");
623 		}
624 		return got_error_msg(GOT_ERR_DECOMPRESSION,
625 		    "inflateInit failed");
626 	}
627 
628 	while (zret != Z_STREAM_END) {
629 		size_t last_total_in, consumed;
630 
631 		/*
632 		 * Decompress into the void. Object data will be parsed
633 		 * later, when the pack file is indexed. For now, we just
634 		 * want to locate the end of the compressed stream.
635 		 */
636 		while (zret != Z_STREAM_END && buf_len(buf) - *buf_pos > 0) {
637 			last_total_in = z.total_in;
638 			z.next_in = buf_get(buf) + *buf_pos;
639 			z.avail_in = buf_len(buf) - *buf_pos;
640 			z.next_out = voidbuf;
641 			z.avail_out = sizeof(voidbuf);
642 
643 			zret = inflate(&z, Z_SYNC_FLUSH);
644 			if (zret != Z_OK && zret != Z_BUF_ERROR &&
645 			    zret != Z_STREAM_END) {
646 				err = got_error_fmt(GOT_ERR_DECOMPRESSION,
647 				    "packfile offset %lld",
648 				    (long long)zstream_offset);
649 				goto done;
650 			}
651 			consumed = z.total_in - last_total_in;
652 
653 			err = got_pack_hwrite(outfd, buf_get(buf) + *buf_pos,
654 			    consumed, ctx);
655 			if (err)
656 				goto done;
657 
658 			err = buf_discard(buf, *buf_pos + consumed);
659 			if (err)
660 				goto done;
661 			*buf_pos = 0;
662 
663 			consumed_total += consumed;
664 		}
665 
666 		if (zret != Z_STREAM_END) {
667 			err = read_more_pack_stream(infd, buf, 1);
668 			if (err)
669 				goto done;
670 		}
671 	}
672 
673 	if (err == NULL)
674 		*outsize += consumed_total;
675 done:
676 	inflateEnd(&z);
677 	return err;
678 }
679 
680 static const struct got_error *
681 validate_object_type(int obj_type)
682 {
683 	switch (obj_type) {
684 	case GOT_OBJ_TYPE_BLOB:
685 	case GOT_OBJ_TYPE_COMMIT:
686 	case GOT_OBJ_TYPE_TREE:
687 	case GOT_OBJ_TYPE_TAG:
688 	case GOT_OBJ_TYPE_REF_DELTA:
689 	case GOT_OBJ_TYPE_OFFSET_DELTA:
690 		return NULL;
691 	default:
692 		break;
693 	}
694 
695 	return got_error(GOT_ERR_OBJ_TYPE);
696 }
697 
698 static const struct got_error *
699 recv_packdata(off_t *outsize, uint32_t *nobj, uint8_t *sha1,
700     int infd, int outfd)
701 {
702 	const struct got_error *err;
703 	struct repo_write_client *client = &repo_write_client;
704 	struct got_packfile_hdr hdr;
705 	size_t have;
706 	uint32_t nhave = 0;
707 	SHA1_CTX ctx;
708 	uint8_t expected_sha1[SHA1_DIGEST_LENGTH];
709 	char hex[SHA1_DIGEST_STRING_LENGTH];
710 	BUF *buf = NULL;
711 	size_t buf_pos = 0, remain;
712 	ssize_t w;
713 
714 	*outsize = 0;
715 	*nobj = 0;
716 
717 	/* if only deleting references there's nothing to read */
718 	if (client->nref_updates == client->nref_del)
719 		return NULL;
720 
721 	SHA1Init(&ctx);
722 
723 	err = got_poll_read_full(infd, &have, &hdr, sizeof(hdr), sizeof(hdr));
724 	if (err)
725 		return err;
726 	if (have != sizeof(hdr))
727 		return got_error_msg(GOT_ERR_BAD_PACKFILE, "short pack file");
728 	*outsize += have;
729 
730 	if (hdr.signature != htobe32(GOT_PACKFILE_SIGNATURE))
731 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
732 		    "bad packfile signature");
733 	if (hdr.version != htobe32(GOT_PACKFILE_VERSION))
734 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
735 		    "bad packfile version");
736 
737 	*nobj = be32toh(hdr.nobjects);
738 	if (*nobj == 0) {
739 		/*
740 		 * Clients which are creating new references only
741 		 * will send us an empty pack file.
742 		 */
743 		if (client->nref_updates > 0 &&
744 		    client->nref_updates == client->nref_new)
745 			return NULL;
746 
747 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
748 		    "bad packfile with zero objects");
749 	}
750 
751 	log_debug("expecting %d objects", *nobj);
752 
753 	err = got_pack_hwrite(outfd, &hdr, sizeof(hdr), &ctx);
754 	if (err)
755 		return err;
756 
757 	err = buf_alloc(&buf, 65536);
758 	if (err)
759 		return err;
760 
761 	while (nhave != *nobj) {
762 		uint8_t obj_type;
763 		uint64_t obj_size;
764 
765 		err = copy_object_type_and_size(&obj_type, &obj_size,
766 		    infd, outfd, outsize, buf, &buf_pos, &ctx);
767 		if (err)
768 			goto done;
769 
770 		err = validate_object_type(obj_type);
771 		if (err)
772 			goto done;
773 
774 		if (obj_type == GOT_OBJ_TYPE_REF_DELTA) {
775 			err = copy_ref_delta(infd, outfd, outsize,
776 			    buf, &buf_pos, &ctx);
777 			if (err)
778 				goto done;
779 		} else if (obj_type == GOT_OBJ_TYPE_OFFSET_DELTA) {
780 			err = copy_offset_delta(infd, outfd, outsize,
781 			    buf, &buf_pos, &ctx);
782 			if (err)
783 				goto done;
784 		}
785 
786 		err = copy_zstream(infd, outfd, outsize, buf, &buf_pos, &ctx);
787 		if (err)
788 			goto done;
789 
790 		nhave++;
791 	}
792 
793 	log_debug("received %u objects", *nobj);
794 
795 	SHA1Final(expected_sha1, &ctx);
796 
797 	remain = buf_len(buf) - buf_pos;
798 	if (remain < SHA1_DIGEST_LENGTH) {
799 		err = read_more_pack_stream(infd, buf,
800 		    SHA1_DIGEST_LENGTH - remain);
801 		if (err)
802 			return err;
803 	}
804 
805 	got_sha1_digest_to_str(expected_sha1, hex, sizeof(hex));
806 	log_debug("expect SHA1: %s", hex);
807 	got_sha1_digest_to_str(buf_get(buf) + buf_pos, hex, sizeof(hex));
808 	log_debug("actual SHA1: %s", hex);
809 
810 	if (memcmp(buf_get(buf) + buf_pos, expected_sha1,
811 	    SHA1_DIGEST_LENGTH) != 0) {
812 		err = got_error(GOT_ERR_PACKFILE_CSUM);
813 		goto done;
814 	}
815 
816 	memcpy(sha1, expected_sha1, SHA1_DIGEST_LENGTH);
817 
818 	w = write(outfd, expected_sha1, SHA1_DIGEST_LENGTH);
819 	if (w == -1) {
820 		err = got_error_from_errno("write");
821 		goto done;
822 	}
823 	if (w != SHA1_DIGEST_LENGTH) {
824 		err = got_error(GOT_ERR_IO);
825 		goto done;
826 	}
827 
828 	*outsize += SHA1_DIGEST_LENGTH;
829 
830 	if (fsync(outfd) == -1) {
831 		err = got_error_from_errno("fsync");
832 		goto done;
833 	}
834 	if (lseek(outfd, 0L, SEEK_SET) == -1) {
835 		err = got_error_from_errno("lseek");
836 		goto done;
837 	}
838 done:
839 	buf_free(buf);
840 	return err;
841 }
842 
843 static const struct got_error *
844 report_pack_status(const struct got_error *unpack_err)
845 {
846 	const struct got_error *err = NULL;
847 	struct repo_write_client *client = &repo_write_client;
848 	struct gotd_imsg_packfile_status istatus;
849 	struct ibuf *wbuf;
850 	struct imsgbuf ibuf;
851 	const char *unpack_ok = "unpack ok\n";
852 	size_t len;
853 
854 	imsg_init(&ibuf, client->fd);
855 
856 	if (unpack_err)
857 		istatus.reason_len = strlen(unpack_err->msg);
858 	else
859 		istatus.reason_len = strlen(unpack_ok);
860 
861 	len = sizeof(istatus) + istatus.reason_len;
862 	wbuf = imsg_create(&ibuf, GOTD_IMSG_PACKFILE_STATUS, PROC_REPO_WRITE,
863 	    repo_write.pid, len);
864 	if (wbuf == NULL) {
865 		err = got_error_from_errno("imsg_create PACKFILE_STATUS");
866 		goto done;
867 	}
868 
869 	if (imsg_add(wbuf, &istatus, sizeof(istatus)) == -1) {
870 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
871 		goto done;
872 	}
873 
874 	if (imsg_add(wbuf, err ? err->msg : unpack_ok,
875 	    istatus.reason_len) == -1) {
876 		err = got_error_from_errno("imsg_add PACKFILE_STATUS");
877 		goto done;
878 	}
879 
880 	wbuf->fd = -1;
881 	imsg_close(&ibuf, wbuf);
882 
883 	err = gotd_imsg_flush(&ibuf);
884 done:
885 	imsg_clear(&ibuf);
886 	return err;
887 }
888 
889 static const struct got_error *
890 recv_packfile(int *have_packfile, struct imsg *imsg)
891 {
892 	const struct got_error *err = NULL, *unpack_err;
893 	struct repo_write_client *client = &repo_write_client;
894 	struct gotd_imsg_recv_packfile ireq;
895 	FILE *tempfiles[3] = { NULL, NULL, NULL };
896 	struct repo_tempfile {
897 		int fd;
898 		int idx;
899 	} repo_tempfiles[3] = { { - 1, - 1 }, { - 1, - 1 }, { - 1, - 1 }, };
900 	int i;
901 	size_t datalen;
902 	struct imsgbuf ibuf;
903 	struct got_ratelimit rl;
904 	struct got_pack *pack = NULL;
905 	off_t pack_filesize = 0;
906 	uint32_t nobj = 0;
907 
908 	log_debug("packfile request received");
909 
910 	*have_packfile = 0;
911 	got_ratelimit_init(&rl, 2, 0);
912 
913 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
914 	if (datalen != sizeof(ireq))
915 		return got_error(GOT_ERR_PRIVSEP_LEN);
916 	memcpy(&ireq, imsg->data, sizeof(ireq));
917 
918 	if (client->pack_pipe == -1 || client->packidx_fd == -1)
919 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
920 
921 	imsg_init(&ibuf, client->fd);
922 
923 	if (imsg->fd == -1)
924 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
925 
926 	pack = &client->pack;
927 	memset(pack, 0, sizeof(*pack));
928 	pack->fd = imsg->fd;
929 	err = got_delta_cache_alloc(&pack->delta_cache);
930 	if (err)
931 		return err;
932 
933 	for (i = 0; i < nitems(repo_tempfiles); i++) {
934 		struct repo_tempfile *t = &repo_tempfiles[i];
935 		err = got_repo_temp_fds_get(&t->fd, &t->idx, repo_write.repo);
936 		if (err)
937 			goto done;
938 	}
939 
940 	for (i = 0; i < nitems(tempfiles); i++) {
941 		int fd = dup(repo_tempfiles[i].fd);
942 		FILE *f;
943 		if (fd == -1) {
944 			err = got_error_from_errno("dup");
945 			goto done;
946 		}
947 		f = fdopen(fd, "w+");
948 		if (f == NULL) {
949 			err = got_error_from_errno("dup");
950 			close(fd);
951 			goto done;
952 		}
953 		tempfiles[i] = f;
954 	}
955 
956 	/* Send pack file pipe to gotsh(1). */
957 	if (imsg_compose(&ibuf, GOTD_IMSG_RECV_PACKFILE, PROC_REPO_WRITE,
958 	    repo_write.pid, (*client)->pack_pipe[1], NULL, 0) == -1) {
959 		(*client)->pack_pipe[1] = -1;
960 		err = got_error_from_errno("imsg_compose ACK");
961 		if (err)	
962 			goto done;
963 	}
964 	(*client)->pack_pipe[1] = -1;
965 	err = gotd_imsg_flush(&ibuf);
966 	if (err)
967 		goto done;
968 
969 	log_debug("receiving pack data");
970 	unpack_err = recv_packdata(&pack_filesize, &nobj,
971 	    client->pack_sha1, client->pack_pipe, pack->fd);
972 	if (ireq.report_status) {
973 		err = report_pack_status(unpack_err);
974 		if (err) {
975 			/* Git clients hang up after sending the pack file. */
976 			if (err->code == GOT_ERR_EOF)
977 				err = NULL;
978 		}
979 	}
980 	if (unpack_err)
981 		err = unpack_err;
982 	if (err)
983 		goto done;
984 
985 	log_debug("pack data received");
986 
987 	/*
988 	 * Clients which are creating new references only will
989 	 * send us an empty pack file.
990 	 */
991 	if (nobj == 0 &&
992 	    pack_filesize == sizeof(struct got_packfile_hdr) &&
993 	    client->nref_updates > 0 &&
994 	    client->nref_updates == client->nref_new)
995 		goto done;
996 
997 	/*
998 	 * Clients which are deleting references only will send
999 	 * no pack file.
1000 	 */
1001 	if (nobj == 0 &&
1002 	    client->nref_del > 0 &&
1003 	    client->nref_updates == client->nref_del)
1004 		goto done;
1005 
1006 	pack->filesize = pack_filesize;
1007 	*have_packfile = 1;
1008 
1009 	log_debug("begin indexing pack (%lld bytes in size)",
1010 	    (long long)pack->filesize);
1011 	err = got_pack_index(pack, client->packidx_fd,
1012 	    tempfiles[0], tempfiles[1], tempfiles[2], client->pack_sha1,
1013 	    pack_index_progress, NULL, &rl);
1014 	if (err)
1015 		goto done;
1016 	log_debug("done indexing pack");
1017 
1018 	if (fsync(client->packidx_fd) == -1) {
1019 		err = got_error_from_errno("fsync");
1020 		goto done;
1021 	}
1022 	if (lseek(client->packidx_fd, 0L, SEEK_SET) == -1)
1023 		err = got_error_from_errno("lseek");
1024 done:
1025 	if (close(client->pack_pipe) == -1 && err == NULL)
1026 		err = got_error_from_errno("close");
1027 	client->pack_pipe = -1;
1028 	for (i = 0; i < nitems(repo_tempfiles); i++) {
1029 		struct repo_tempfile *t = &repo_tempfiles[i];
1030 		if (t->idx != -1)
1031 			got_repo_temp_fds_put(t->idx, repo_write.repo);
1032 	}
1033 	for (i = 0; i < nitems(tempfiles); i++) {
1034 		if (tempfiles[i] && fclose(tempfiles[i]) == EOF && err == NULL)
1035 			err = got_error_from_errno("fclose");
1036 	}
1037 	if (err)
1038 		got_pack_close(pack);
1039 	imsg_clear(&ibuf);
1040 	return err;
1041 }
1042 
1043 static const struct got_error *
1044 verify_packfile(void)
1045 {
1046 	const struct got_error *err = NULL, *close_err;
1047 	struct repo_write_client *client = &repo_write_client;
1048 	struct gotd_ref_update *ref_update;
1049 	struct got_packidx *packidx = NULL;
1050 	struct stat sb;
1051 	char *id_str = NULL;
1052 	int idx = -1;
1053 
1054 	if (STAILQ_EMPTY(&client->ref_updates)) {
1055 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1056 		    "cannot verify pack file without any ref-updates");
1057 	}
1058 
1059 	if (client->pack.fd == -1) {
1060 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1061 		    "invalid pack file handle during pack verification");
1062 	}
1063 	if (client->packidx_fd == -1) {
1064 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1065 		    "invalid pack index handle during pack verification");
1066 	}
1067 
1068 	if (fstat(client->packidx_fd, &sb) == -1)
1069 		return got_error_from_errno("pack index fstat");
1070 
1071 	packidx = malloc(sizeof(*packidx));
1072 	memset(packidx, 0, sizeof(*packidx));
1073 	packidx->fd = client->packidx_fd;
1074 	client->packidx_fd = -1;
1075 	packidx->len = sb.st_size;
1076 
1077 	err = got_packidx_init_hdr(packidx, 1, client->pack.filesize);
1078 	if (err)
1079 		return err;
1080 
1081 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1082 		if (ref_update->delete_ref)
1083 			continue;
1084 
1085 		err = got_object_id_str(&id_str, &ref_update->new_id);
1086 		if (err)
1087 			goto done;
1088 
1089 		idx = got_packidx_get_object_idx(packidx, &ref_update->new_id);
1090 		if (idx == -1) {
1091 			err = got_error_fmt(GOT_ERR_BAD_PACKFILE,
1092 			    "advertised object %s is missing from pack file",
1093 			    id_str);
1094 			goto done;
1095 		}
1096 	}
1097 
1098 done:
1099 	close_err = got_packidx_close(packidx);
1100 	if (close_err && err == NULL)
1101 		err = close_err;
1102 	free(id_str);
1103 	return err;
1104 }
1105 
1106 static const struct got_error *
1107 install_packfile(struct gotd_imsgev *iev)
1108 {
1109 	struct repo_write_client *client = &repo_write_client;
1110 	struct gotd_imsg_packfile_install inst;
1111 	int ret;
1112 
1113 	memset(&inst, 0, sizeof(inst));
1114 	inst.client_id = client->id;
1115 	memcpy(inst.pack_sha1, client->pack_sha1, SHA1_DIGEST_LENGTH);
1116 
1117 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_PACKFILE_INSTALL,
1118 	    PROC_REPO_WRITE, -1, &inst, sizeof(inst));
1119 	if (ret == -1)
1120 		return got_error_from_errno("imsg_compose PACKFILE_INSTALL");
1121 
1122 	return NULL;
1123 }
1124 
1125 static const struct got_error *
1126 send_ref_updates_start(int nref_updates, struct gotd_imsgev *iev)
1127 {
1128 	struct repo_write_client *client = &repo_write_client;
1129 	struct gotd_imsg_ref_updates_start istart;
1130 	int ret;
1131 
1132 	memset(&istart, 0, sizeof(istart));
1133 	istart.nref_updates = nref_updates;
1134 	istart.client_id = client->id;
1135 
1136 	ret = gotd_imsg_compose_event(iev, GOTD_IMSG_REF_UPDATES_START,
1137 	    PROC_REPO_WRITE, -1, &istart, sizeof(istart));
1138 	if (ret == -1)
1139 		return got_error_from_errno("imsg_compose REF_UPDATES_START");
1140 
1141 	return NULL;
1142 }
1143 
1144 
1145 static const struct got_error *
1146 send_ref_update(struct gotd_ref_update *ref_update, struct gotd_imsgev *iev)
1147 {
1148 	struct repo_write_client *client = &repo_write_client;
1149 	struct gotd_imsg_ref_update iref;
1150 	const char *refname = got_ref_get_name(ref_update->ref);
1151 	struct ibuf *wbuf;
1152 	size_t len;
1153 
1154 	memset(&iref, 0, sizeof(iref));
1155 	memcpy(iref.old_id, ref_update->old_id.sha1, SHA1_DIGEST_LENGTH);
1156 	memcpy(iref.new_id, ref_update->new_id.sha1, SHA1_DIGEST_LENGTH);
1157 	iref.ref_is_new = ref_update->ref_is_new;
1158 	iref.delete_ref = ref_update->delete_ref;
1159 	iref.client_id = client->id;
1160 	iref.name_len = strlen(refname);
1161 
1162 	len = sizeof(iref) + iref.name_len;
1163 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE, PROC_REPO_WRITE,
1164 	    repo_write.pid, len);
1165 	if (wbuf == NULL)
1166 		return got_error_from_errno("imsg_create REF_UPDATE");
1167 
1168 	if (imsg_add(wbuf, &iref, sizeof(iref)) == -1)
1169 		return got_error_from_errno("imsg_add REF_UPDATE");
1170 	if (imsg_add(wbuf, refname, iref.name_len) == -1)
1171 		return got_error_from_errno("imsg_add REF_UPDATE");
1172 
1173 	wbuf->fd = -1;
1174 	imsg_close(&iev->ibuf, wbuf);
1175 
1176 	gotd_imsg_event_add(iev);
1177 	return NULL;
1178 }
1179 
1180 static const struct got_error *
1181 update_refs(struct gotd_imsgev *iev)
1182 {
1183 	const struct got_error *err = NULL;
1184 	struct repo_write_client *client = &repo_write_client;
1185 	struct gotd_ref_update *ref_update;
1186 
1187 	err = send_ref_updates_start(client->nref_updates, iev);
1188 	if (err)
1189 		return err;
1190 
1191 	STAILQ_FOREACH(ref_update, &client->ref_updates, entry) {
1192 		err = send_ref_update(ref_update, iev);
1193 		if (err)
1194 			goto done;
1195 	}
1196 done:
1197 	return err;
1198 }
1199 
1200 static const struct got_error *
1201 recv_disconnect(struct imsg *imsg)
1202 {
1203 	const struct got_error *err = NULL;
1204 	struct gotd_imsg_disconnect idisconnect;
1205 	size_t datalen;
1206 	int pack_pipe = -1, idxfd = -1;
1207 	struct repo_write_client *client = &repo_write_client;
1208 
1209 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1210 	if (datalen != sizeof(idisconnect))
1211 		return got_error(GOT_ERR_PRIVSEP_LEN);
1212 	memcpy(&idisconnect, imsg->data, sizeof(idisconnect));
1213 
1214 	log_debug("client disconnecting");
1215 
1216 	while (!STAILQ_EMPTY(&client->ref_updates)) {
1217 		struct gotd_ref_update *ref_update;
1218 		ref_update = STAILQ_FIRST(&client->ref_updates);
1219 		STAILQ_REMOVE_HEAD(&client->ref_updates, entry);
1220 		got_ref_close(ref_update->ref);
1221 		free(ref_update);
1222 	}
1223 	err = got_pack_close(&client->pack);
1224 	if (client->fd != -1 && close(client->fd) == -1)
1225 		err = got_error_from_errno("close");
1226 	pack_pipe = client->pack_pipe;
1227 	if (pack_pipe != -1 && close(pack_pipe) == -1 && err == NULL)
1228 		err = got_error_from_errno("close");
1229 	idxfd = client->packidx_fd;
1230 	if (idxfd != -1 && close(idxfd) == -1 && err == NULL)
1231 		err = got_error_from_errno("close");
1232 	return err;
1233 }
1234 
1235 static const struct got_error *
1236 receive_pack_pipe(struct imsg *imsg, struct gotd_imsgev *iev)
1237 {
1238 	struct repo_write_client *client = &repo_write_client;
1239 	struct gotd_imsg_packfile_pipe ireq;
1240 	size_t datalen;
1241 
1242 	log_debug("receving pack pipe descriptor");
1243 
1244 	if (imsg->fd == -1)
1245 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1246 
1247 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1248 	if (datalen != sizeof(ireq))
1249 		return got_error(GOT_ERR_PRIVSEP_LEN);
1250 	memcpy(&ireq, imsg->data, sizeof(ireq));
1251 
1252 	if (client->pack_pipe != -1)
1253 		return got_error(GOT_ERR_PRIVSEP_MSG);
1254 
1255 	client->pack_pipe = imsg->fd;
1256 	return NULL;
1257 }
1258 
1259 static const struct got_error *
1260 receive_pack_idx(struct imsg *imsg, struct gotd_imsgev *iev)
1261 {
1262 	struct repo_write_client *client = &repo_write_client;
1263 	struct gotd_imsg_packidx_file ireq;
1264 	size_t datalen;
1265 
1266 	log_debug("receving pack index output file");
1267 
1268 	if (imsg->fd == -1)
1269 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1270 
1271 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1272 	if (datalen != sizeof(ireq))
1273 		return got_error(GOT_ERR_PRIVSEP_LEN);
1274 	memcpy(&ireq, imsg->data, sizeof(ireq));
1275 
1276 	if (client->packidx_fd != -1)
1277 		return got_error(GOT_ERR_PRIVSEP_MSG);
1278 
1279 	client->packidx_fd = imsg->fd;
1280 	return NULL;
1281 }
1282 
1283 static void
1284 repo_write_dispatch_session(int fd, short event, void *arg)
1285 {
1286 	const struct got_error *err = NULL;
1287 	struct gotd_imsgev *iev = arg;
1288 	struct imsgbuf *ibuf = &iev->ibuf;
1289 	struct imsg imsg;
1290 	struct repo_write_client *client = &repo_write_client;
1291 	ssize_t n;
1292 	int shut = 0, have_packfile = 0;
1293 
1294 	if (event & EV_READ) {
1295 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1296 			fatal("imsg_read error");
1297 		if (n == 0)	/* Connection closed. */
1298 			shut = 1;
1299 	}
1300 
1301 	if (event & EV_WRITE) {
1302 		n = msgbuf_write(&ibuf->w);
1303 		if (n == -1 && errno != EAGAIN)
1304 			fatal("msgbuf_write");
1305 		if (n == 0)	/* Connection closed. */
1306 			shut = 1;
1307 	}
1308 
1309 	for (;;) {
1310 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1311 			fatal("%s: imsg_get error", __func__);
1312 		if (n == 0)	/* No more messages. */
1313 			break;
1314 
1315 		if (imsg.hdr.type != GOTD_IMSG_LIST_REFS_INTERNAL &&
1316 		    client->id == 0) {
1317 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1318 			break;
1319 		}
1320 
1321 		switch (imsg.hdr.type) {
1322 		case GOTD_IMSG_LIST_REFS_INTERNAL:
1323 			err = list_refs(&imsg);
1324 			if (err)
1325 				log_warnx("%s: ls-refs: %s", repo_write.title,
1326 				    err->msg);
1327 			break;
1328 		case GOTD_IMSG_REF_UPDATE:
1329 			err = recv_ref_update(&imsg);
1330 			if (err)
1331 				log_warnx("%s: ref-update: %s",
1332 				    repo_write.title, err->msg);
1333 			break;
1334 		case GOTD_IMSG_PACKFILE_PIPE:
1335 			err = receive_pack_pipe(&imsg, iev);
1336 			if (err) {
1337 				log_warnx("%s: receiving pack pipe: %s",
1338 				    repo_write.title, err->msg);
1339 				break;
1340 			}
1341 			break;
1342 		case GOTD_IMSG_PACKIDX_FILE:
1343 			err = receive_pack_idx(&imsg, iev);
1344 			if (err) {
1345 				log_warnx("%s: receiving pack index: %s",
1346 				    repo_write.title, err->msg);
1347 				break;
1348 			}
1349 			break;
1350 		case GOTD_IMSG_RECV_PACKFILE:
1351 			err = recv_packfile(&have_packfile, &imsg);
1352 			if (err) {
1353 				log_warnx("%s: receive packfile: %s",
1354 				    repo_write.title, err->msg);
1355 				break;
1356 			}
1357 			if (have_packfile) {
1358 				err = verify_packfile();
1359 				if (err) {
1360 					log_warnx("%s: verify packfile: %s",
1361 					    repo_write.title, err->msg);
1362 					break;
1363 				}
1364 				err = install_packfile(iev);
1365 				if (err) {
1366 					log_warnx("%s: install packfile: %s",
1367 					    repo_write.title, err->msg);
1368 					break;
1369 				}
1370 			}
1371 			err = update_refs(iev);
1372 			if (err) {
1373 				log_warnx("%s: update refs: %s",
1374 				    repo_write.title, err->msg);
1375 			}
1376 			break;
1377 		case GOTD_IMSG_DISCONNECT:
1378 			err = recv_disconnect(&imsg);
1379 			if (err)
1380 				log_warnx("%s: disconnect: %s",
1381 				    repo_write.title, err->msg);
1382 			shut = 1;
1383 			break;
1384 		default:
1385 			log_debug("%s: unexpected imsg %d", repo_write.title,
1386 			    imsg.hdr.type);
1387 			break;
1388 		}
1389 
1390 		imsg_free(&imsg);
1391 	}
1392 
1393 	if (!shut && check_cancelled(NULL) == NULL) {
1394 		if (err &&
1395 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
1396 		        client->id, err) == -1) {
1397 			log_warnx("could not send error to parent: %s",
1398 			    err->msg);
1399 		}
1400 		gotd_imsg_event_add(iev);
1401 	} else {
1402 		/* This pipe is dead. Remove its event handler */
1403 		event_del(&iev->ev);
1404 		event_loopexit(NULL);
1405 	}
1406 }
1407 
1408 static const struct got_error *
1409 recv_connect(struct imsg *imsg)
1410 {
1411 	struct gotd_imsgev *iev = &repo_write.session_iev;
1412 	size_t datalen;
1413 
1414 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1415 	if (datalen != 0)
1416 		return got_error(GOT_ERR_PRIVSEP_LEN);
1417 	if (imsg->fd == -1)
1418 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1419 
1420 	if (repo_write.session_fd != -1)
1421 		return got_error(GOT_ERR_PRIVSEP_MSG);
1422 
1423 	repo_write.session_fd = imsg->fd;
1424 
1425 	imsg_init(&iev->ibuf, repo_write.session_fd);
1426 	iev->handler = repo_write_dispatch_session;
1427 	iev->events = EV_READ;
1428 	iev->handler_arg = NULL;
1429 	event_set(&iev->ev, iev->ibuf.fd, EV_READ,
1430 	    repo_write_dispatch_session, iev);
1431 	gotd_imsg_event_add(iev);
1432 
1433 	return NULL;
1434 }
1435 
1436 static void
1437 repo_write_dispatch(int fd, short event, void *arg)
1438 {
1439 	const struct got_error *err = NULL;
1440 	struct gotd_imsgev *iev = arg;
1441 	struct imsgbuf *ibuf = &iev->ibuf;
1442 	struct imsg imsg;
1443 	ssize_t n;
1444 	int shut = 0;
1445 	struct repo_write_client *client = &repo_write_client;
1446 
1447 	if (event & EV_READ) {
1448 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1449 			fatal("imsg_read error");
1450 		if (n == 0)	/* Connection closed. */
1451 			shut = 1;
1452 	}
1453 
1454 	if (event & EV_WRITE) {
1455 		n = msgbuf_write(&ibuf->w);
1456 		if (n == -1 && errno != EAGAIN)
1457 			fatal("msgbuf_write");
1458 		if (n == 0)	/* Connection closed. */
1459 			shut = 1;
1460 	}
1461 
1462 	while (err == NULL && check_cancelled(NULL) == NULL) {
1463 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1464 			fatal("%s: imsg_get", __func__);
1465 		if (n == 0)	/* No more messages. */
1466 			break;
1467 
1468 		switch (imsg.hdr.type) {
1469 		case GOTD_IMSG_CONNECT_REPO_CHILD:
1470 			err = recv_connect(&imsg);
1471 			break;
1472 		default:
1473 			log_debug("%s: unexpected imsg %d", repo_write.title,
1474 			    imsg.hdr.type);
1475 			break;
1476 		}
1477 
1478 		imsg_free(&imsg);
1479 	}
1480 
1481 	if (!shut && check_cancelled(NULL) == NULL) {
1482 		if (err &&
1483 		    gotd_imsg_send_error_event(iev, PROC_REPO_WRITE,
1484 		        client->id, err) == -1) {
1485 			log_warnx("could not send error to parent: %s",
1486 			    err->msg);
1487 		}
1488 		gotd_imsg_event_add(iev);
1489 	} else {
1490 		/* This pipe is dead. Remove its event handler */
1491 		event_del(&iev->ev);
1492 		event_loopexit(NULL);
1493 	}
1494 }
1495 
1496 void
1497 repo_write_main(const char *title, const char *repo_path,
1498     int *pack_fds, int *temp_fds)
1499 {
1500 	const struct got_error *err = NULL;
1501 	struct gotd_imsgev iev;
1502 
1503 	repo_write.title = title;
1504 	repo_write.pid = getpid();
1505 	repo_write.pack_fds = pack_fds;
1506 	repo_write.temp_fds = temp_fds;
1507 	repo_write.session_fd = -1;
1508 	repo_write.session_iev.ibuf.fd = -1;
1509 
1510 	STAILQ_INIT(&repo_write_client.ref_updates);
1511 
1512 	err = got_repo_open(&repo_write.repo, repo_path, NULL, pack_fds);
1513 	if (err)
1514 		goto done;
1515 	if (!got_repo_is_bare(repo_write.repo)) {
1516 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
1517 		    "bare git repository required");
1518 		goto done;
1519 	}
1520 
1521 	got_repo_temp_fds_set(repo_write.repo, temp_fds);
1522 
1523 	signal(SIGINT, catch_sigint);
1524 	signal(SIGTERM, catch_sigterm);
1525 	signal(SIGPIPE, SIG_IGN);
1526 	signal(SIGHUP, SIG_IGN);
1527 
1528 	imsg_init(&iev.ibuf, GOTD_FILENO_MSG_PIPE);
1529 	iev.handler = repo_write_dispatch;
1530 	iev.events = EV_READ;
1531 	iev.handler_arg = NULL;
1532 	event_set(&iev.ev, iev.ibuf.fd, EV_READ, repo_write_dispatch, &iev);
1533 	if (gotd_imsg_compose_event(&iev, GOTD_IMSG_REPO_CHILD_READY,
1534 	    PROC_REPO_WRITE, -1, NULL, 0) == -1) {
1535 		err = got_error_from_errno("imsg compose REPO_CHILD_READY");
1536 		goto done;
1537 	}
1538 
1539 	event_dispatch();
1540 done:
1541 	if (err)
1542 		log_warnx("%s: %s", title, err->msg);
1543 	repo_write_shutdown();
1544 }
1545 
1546 void
1547 repo_write_shutdown(void)
1548 {
1549 	log_debug("%s: shutting down", repo_write.title);
1550 	if (repo_write.repo)
1551 		got_repo_close(repo_write.repo);
1552 	got_repo_pack_fds_close(repo_write.pack_fds);
1553 	got_repo_temp_fds_close(repo_write.temp_fds);
1554 	if (repo_write.session_fd != -1)
1555 		close(repo_write.session_fd);
1556 	exit(0);
1557 }