Gotweb

Blob

Date:: Wed Jan 31 22:01:32 2024 UTC
Message:: remove unneded wbuf->fd = -1 There's no need to set the fd to -1 on ibufs created with imsg_create(3), and it was probably never needed.
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2022, 2023 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include "got_compat.h"
18 
19 #include <sys/types.h>
20 #include <sys/queue.h>
21 #include <sys/socket.h>
22 #include <sys/stat.h>
23 #include <sys/uio.h>
24 
25 #include <errno.h>
26 #include <event.h>
27 #include <limits.h>
28 #include <signal.h>
29 #include <stdint.h>
30 #include <stdio.h>
31 #include <stdlib.h>
32 #include <string.h>
33 #include <imsg.h>
34 #include <unistd.h>
35 
36 #include "got_compat.h"
37 
38 #include "got_error.h"
39 #include "got_repository.h"
40 #include "got_object.h"
41 #include "got_path.h"
42 #include "got_reference.h"
43 #include "got_opentemp.h"
44 
45 #include "got_lib_hash.h"
46 #include "got_lib_delta.h"
47 #include "got_lib_object.h"
48 #include "got_lib_object_cache.h"
49 #include "got_lib_pack.h"
50 #include "got_lib_repository.h"
51 #include "got_lib_gitproto.h"
52 
53 #include "gotd.h"
54 #include "log.h"
55 #include "session.h"
56 
57 
58 static struct gotd_session {
59 	pid_t pid;
60 	const char *title;
61 	struct got_repository *repo;
62 	int *pack_fds;
63 	int *temp_fds;
64 	struct gotd_imsgev parent_iev;
65 	struct timeval request_timeout;
66 	enum gotd_procid proc_id;
67 } gotd_session;
68 
69 static struct gotd_session_client {
70 	enum gotd_session_state		 state;
71 	int				 is_writing;
72 	struct gotd_client_capability	*capabilities;
73 	size_t				 ncapa_alloc;
74 	size_t				 ncapabilities;
75 	uint32_t			 id;
76 	int				 fd;
77 	int				 delta_cache_fd;
78 	struct gotd_imsgev		 iev;
79 	struct gotd_imsgev		 repo_child_iev;
80 	struct event			 tmo;
81 	uid_t				 euid;
82 	gid_t				 egid;
83 	char				*packfile_path;
84 	char				*packidx_path;
85 	int				 nref_updates;
86 	int				 accept_flush_pkt;
87 	int				 flush_disconnect;
88 } gotd_session_client;
89 
90 void gotd_session_sighdlr(int sig, short event, void *arg);
91 static void gotd_session_shutdown(void);
92 
93 static void
94 disconnect(struct gotd_session_client *client)
95 {
96 	log_debug("uid %d: disconnecting", client->euid);
97 
98 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
99 	    GOTD_IMSG_DISCONNECT, gotd_session.proc_id, -1, NULL, 0) == -1)
100 		log_warn("imsg compose DISCONNECT");
101 
102 	imsg_clear(&client->repo_child_iev.ibuf);
103 	event_del(&client->repo_child_iev.ev);
104 	evtimer_del(&client->tmo);
105 	close(client->fd);
106 	if (client->delta_cache_fd != -1)
107 		close(client->delta_cache_fd);
108 	if (client->packfile_path) {
109 		if (unlink(client->packfile_path) == -1 && errno != ENOENT)
110 			log_warn("unlink %s: ", client->packfile_path);
111 		free(client->packfile_path);
112 	}
113 	if (client->packidx_path) {
114 		if (unlink(client->packidx_path) == -1 && errno != ENOENT)
115 			log_warn("unlink %s: ", client->packidx_path);
116 		free(client->packidx_path);
117 	}
118 	free(client->capabilities);
119 
120 	gotd_session_shutdown();
121 }
122 
123 static void
124 disconnect_on_error(struct gotd_session_client *client,
125     const struct got_error *err)
126 {
127 	struct imsgbuf ibuf;
128 
129 	if (err->code != GOT_ERR_EOF) {
130 		log_warnx("uid %d: %s", client->euid, err->msg);
131 		imsg_init(&ibuf, client->fd);
132 		gotd_imsg_send_error(&ibuf, 0, gotd_session.proc_id, err);
133 		imsg_clear(&ibuf);
134 	}
135 
136 	disconnect(client);
137 }
138 
139 static void
140 gotd_request_timeout(int fd, short events, void *arg)
141 {
142 	struct gotd_session_client *client = arg;
143 
144 	log_debug("disconnecting uid %d due to timeout", client->euid);
145 	disconnect(client);
146 }
147 
148 void
149 gotd_session_sighdlr(int sig, short event, void *arg)
150 {
151 	/*
152 	 * Normal signal handler rules don't apply because libevent
153 	 * decouples for us.
154 	 */
155 
156 	switch (sig) {
157 	case SIGHUP:
158 		log_info("%s: ignoring SIGHUP", __func__);
159 		break;
160 	case SIGUSR1:
161 		log_info("%s: ignoring SIGUSR1", __func__);
162 		break;
163 	case SIGTERM:
164 	case SIGINT:
165 		gotd_session_shutdown();
166 		/* NOTREACHED */
167 		break;
168 	default:
169 		fatalx("unexpected signal");
170 	}
171 }
172 
173 static const struct got_error *
174 recv_packfile_done(uint32_t *client_id, struct imsg *imsg)
175 {
176 	struct gotd_imsg_packfile_done idone;
177 	size_t datalen;
178 
179 	log_debug("packfile-done received");
180 
181 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
182 	if (datalen != sizeof(idone))
183 		return got_error(GOT_ERR_PRIVSEP_LEN);
184 	memcpy(&idone, imsg->data, sizeof(idone));
185 
186 	*client_id = idone.client_id;
187 	return NULL;
188 }
189 
190 static const struct got_error *
191 recv_packfile_install(uint32_t *client_id, struct imsg *imsg)
192 {
193 	struct gotd_imsg_packfile_install inst;
194 	size_t datalen;
195 
196 	log_debug("packfile-install received");
197 
198 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
199 	if (datalen != sizeof(inst))
200 		return got_error(GOT_ERR_PRIVSEP_LEN);
201 	memcpy(&inst, imsg->data, sizeof(inst));
202 
203 	*client_id = inst.client_id;
204 	return NULL;
205 }
206 
207 static const struct got_error *
208 recv_ref_updates_start(uint32_t *client_id, struct imsg *imsg)
209 {
210 	struct gotd_imsg_ref_updates_start istart;
211 	size_t datalen;
212 
213 	log_debug("ref-updates-start received");
214 
215 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
216 	if (datalen != sizeof(istart))
217 		return got_error(GOT_ERR_PRIVSEP_LEN);
218 	memcpy(&istart, imsg->data, sizeof(istart));
219 
220 	*client_id = istart.client_id;
221 	return NULL;
222 }
223 
224 static const struct got_error *
225 recv_ref_update(uint32_t *client_id, struct imsg *imsg)
226 {
227 	struct gotd_imsg_ref_update iref;
228 	size_t datalen;
229 
230 	log_debug("ref-update received");
231 
232 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
233 	if (datalen < sizeof(iref))
234 		return got_error(GOT_ERR_PRIVSEP_LEN);
235 	memcpy(&iref, imsg->data, sizeof(iref));
236 
237 	*client_id = iref.client_id;
238 	return NULL;
239 }
240 
241 static const struct got_error *
242 send_ref_update_ok(struct gotd_session_client *client,
243     struct gotd_imsg_ref_update *iref, const char *refname)
244 {
245 	struct gotd_imsg_ref_update_ok iok;
246 	struct gotd_imsgev *iev = &client->iev;
247 	struct ibuf *wbuf;
248 	size_t len;
249 
250 	memset(&iok, 0, sizeof(iok));
251 	iok.client_id = client->id;
252 	memcpy(iok.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
253 	memcpy(iok.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
254 	iok.name_len = strlen(refname);
255 
256 	len = sizeof(iok) + iok.name_len;
257 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE_OK,
258 	    gotd_session.proc_id, gotd_session.pid, len);
259 	if (wbuf == NULL)
260 		return got_error_from_errno("imsg_create REF_UPDATE_OK");
261 
262 	if (imsg_add(wbuf, &iok, sizeof(iok)) == -1)
263 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
264 	if (imsg_add(wbuf, refname, iok.name_len) == -1)
265 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
266 
267 	imsg_close(&iev->ibuf, wbuf);
268 	gotd_imsg_event_add(iev);
269 	return NULL;
270 }
271 
272 static void
273 send_refs_updated(struct gotd_session_client *client)
274 {
275 	if (gotd_imsg_compose_event(&client->iev, GOTD_IMSG_REFS_UPDATED,
276 	    gotd_session.proc_id, -1, NULL, 0) == -1)
277 		log_warn("imsg compose REFS_UPDATED");
278 }
279 
280 static const struct got_error *
281 send_ref_update_ng(struct gotd_session_client *client,
282     struct gotd_imsg_ref_update *iref, const char *refname,
283     const char *reason)
284 {
285 	const struct got_error *ng_err;
286 	struct gotd_imsg_ref_update_ng ing;
287 	struct gotd_imsgev *iev = &client->iev;
288 	struct ibuf *wbuf;
289 	size_t len;
290 
291 	memset(&ing, 0, sizeof(ing));
292 	ing.client_id = client->id;
293 	memcpy(ing.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
294 	memcpy(ing.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
295 	ing.name_len = strlen(refname);
296 
297 	ng_err = got_error_fmt(GOT_ERR_REF_BUSY, "%s", reason);
298 	ing.reason_len = strlen(ng_err->msg);
299 
300 	len = sizeof(ing) + ing.name_len + ing.reason_len;
301 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE_NG,
302 	    gotd_session.proc_id, gotd_session.pid, len);
303 	if (wbuf == NULL)
304 		return got_error_from_errno("imsg_create REF_UPDATE_NG");
305 
306 	if (imsg_add(wbuf, &ing, sizeof(ing)) == -1)
307 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
308 	if (imsg_add(wbuf, refname, ing.name_len) == -1)
309 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
310 	if (imsg_add(wbuf, ng_err->msg, ing.reason_len) == -1)
311 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
312 
313 	imsg_close(&iev->ibuf, wbuf);
314 	gotd_imsg_event_add(iev);
315 	return NULL;
316 }
317 
318 static const struct got_error *
319 install_pack(struct gotd_session_client *client, const char *repo_path,
320     struct imsg *imsg)
321 {
322 	const struct got_error *err = NULL;
323 	struct gotd_imsg_packfile_install inst;
324 	char hex[SHA1_DIGEST_STRING_LENGTH];
325 	size_t datalen;
326 	char *packfile_path = NULL, *packidx_path = NULL;
327 
328 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
329 	if (datalen != sizeof(inst))
330 		return got_error(GOT_ERR_PRIVSEP_LEN);
331 	memcpy(&inst, imsg->data, sizeof(inst));
332 
333 	if (client->packfile_path == NULL)
334 		return got_error_msg(GOT_ERR_BAD_REQUEST,
335 		    "client has no pack file");
336 	if (client->packidx_path == NULL)
337 		return got_error_msg(GOT_ERR_BAD_REQUEST,
338 		    "client has no pack file index");
339 
340 	if (got_sha1_digest_to_str(inst.pack_sha1, hex, sizeof(hex)) == NULL)
341 		return got_error_msg(GOT_ERR_NO_SPACE,
342 		    "could not convert pack file SHA1 to hex");
343 
344 	if (asprintf(&packfile_path, "/%s/%s/pack-%s.pack",
345 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
346 		err = got_error_from_errno("asprintf");
347 		goto done;
348 	}
349 
350 	if (asprintf(&packidx_path, "/%s/%s/pack-%s.idx",
351 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
352 		err = got_error_from_errno("asprintf");
353 		goto done;
354 	}
355 
356 	if (rename(client->packfile_path, packfile_path) == -1) {
357 		err = got_error_from_errno3("rename", client->packfile_path,
358 		    packfile_path);
359 		goto done;
360 	}
361 
362 	free(client->packfile_path);
363 	client->packfile_path = NULL;
364 
365 	if (rename(client->packidx_path, packidx_path) == -1) {
366 		err = got_error_from_errno3("rename", client->packidx_path,
367 		    packidx_path);
368 		goto done;
369 	}
370 
371 	free(client->packidx_path);
372 	client->packidx_path = NULL;
373 done:
374 	free(packfile_path);
375 	free(packidx_path);
376 	return err;
377 }
378 
379 static const struct got_error *
380 begin_ref_updates(struct gotd_session_client *client, struct imsg *imsg)
381 {
382 	struct gotd_imsg_ref_updates_start istart;
383 	size_t datalen;
384 
385 	if (client->nref_updates != -1)
386 		return got_error(GOT_ERR_PRIVSEP_MSG);
387 
388 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
389 	if (datalen != sizeof(istart))
390 		return got_error(GOT_ERR_PRIVSEP_LEN);
391 	memcpy(&istart, imsg->data, sizeof(istart));
392 
393 	if (istart.nref_updates <= 0)
394 		return got_error(GOT_ERR_PRIVSEP_MSG);
395 
396 	client->nref_updates = istart.nref_updates;
397 	return NULL;
398 }
399 
400 static const struct got_error *
401 update_ref(int *shut, struct gotd_session_client *client,
402     const char *repo_path, struct imsg *imsg)
403 {
404 	const struct got_error *err = NULL;
405 	struct got_repository *repo = NULL;
406 	struct got_reference *ref = NULL;
407 	struct gotd_imsg_ref_update iref;
408 	struct got_object_id old_id, new_id;
409 	struct got_object_id *id = NULL;
410 	char *refname = NULL;
411 	size_t datalen;
412 	int locked = 0;
413 	char hex1[SHA1_DIGEST_STRING_LENGTH];
414 	char hex2[SHA1_DIGEST_STRING_LENGTH];
415 
416 	log_debug("update-ref from uid %d", client->euid);
417 
418 	if (client->nref_updates <= 0)
419 		return got_error(GOT_ERR_PRIVSEP_MSG);
420 
421 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
422 	if (datalen < sizeof(iref))
423 		return got_error(GOT_ERR_PRIVSEP_LEN);
424 	memcpy(&iref, imsg->data, sizeof(iref));
425 	if (datalen != sizeof(iref) + iref.name_len)
426 		return got_error(GOT_ERR_PRIVSEP_LEN);
427 	refname = strndup(imsg->data + sizeof(iref), iref.name_len);
428 	if (refname == NULL)
429 		return got_error_from_errno("strndup");
430 
431 	log_debug("updating ref %s for uid %d", refname, client->euid);
432 
433 	err = got_repo_open(&repo, repo_path, NULL, NULL);
434 	if (err)
435 		goto done;
436 
437 	memcpy(old_id.sha1, iref.old_id, SHA1_DIGEST_LENGTH);
438 	memcpy(new_id.sha1, iref.new_id, SHA1_DIGEST_LENGTH);
439 	err = got_repo_find_object_id(iref.delete_ref ? &old_id : &new_id,
440 	    repo);
441 	if (err)
442 		goto done;
443 
444 	if (iref.ref_is_new) {
445 		err = got_ref_open(&ref, repo, refname, 0);
446 		if (err) {
447 			if (err->code != GOT_ERR_NOT_REF)
448 				goto done;
449 			err = got_ref_alloc(&ref, refname, &new_id);
450 			if (err)
451 				goto done;
452 			err = got_ref_write(ref, repo); /* will lock/unlock */
453 			if (err)
454 				goto done;
455 		} else {
456 			err = got_ref_resolve(&id, repo, ref);
457 			if (err)
458 				goto done;
459 			got_object_id_hex(&new_id, hex1, sizeof(hex1));
460 			got_object_id_hex(id, hex2, sizeof(hex2));
461 			err = got_error_fmt(GOT_ERR_REF_BUSY,
462 			    "Addition %s: %s failed; %s: %s has been "
463 			    "created by someone else while transaction "
464 			    "was in progress",
465 			    got_ref_get_name(ref), hex1,
466 			    got_ref_get_name(ref), hex2);
467 			goto done;
468 		}
469 	} else if (iref.delete_ref) {
470 		err = got_ref_open(&ref, repo, refname, 1 /* lock */);
471 		if (err)
472 			goto done;
473 		locked = 1;
474 
475 		err = got_ref_resolve(&id, repo, ref);
476 		if (err)
477 			goto done;
478 
479 		if (got_object_id_cmp(id, &old_id) != 0) {
480 			got_object_id_hex(&old_id, hex1, sizeof(hex1));
481 			got_object_id_hex(id, hex2, sizeof(hex2));
482 			err = got_error_fmt(GOT_ERR_REF_BUSY,
483 			    "Deletion %s: %s failed; %s: %s has been "
484 			    "created by someone else while transaction "
485 			    "was in progress",
486 			    got_ref_get_name(ref), hex1,
487 			    got_ref_get_name(ref), hex2);
488 			goto done;
489 		}
490 
491 		err = got_ref_delete(ref, repo);
492 		if (err)
493 			goto done;
494 
495 		free(id);
496 		id = NULL;
497 	} else {
498 		err = got_ref_open(&ref, repo, refname, 1 /* lock */);
499 		if (err)
500 			goto done;
501 		locked = 1;
502 
503 		err = got_ref_resolve(&id, repo, ref);
504 		if (err)
505 			goto done;
506 
507 		if (got_object_id_cmp(id, &old_id) != 0) {
508 			got_object_id_hex(&old_id, hex1, sizeof(hex1));
509 			got_object_id_hex(id, hex2, sizeof(hex2));
510 			err = got_error_fmt(GOT_ERR_REF_BUSY,
511 			    "Update %s: %s failed; %s: %s has been "
512 			    "created by someone else while transaction "
513 			    "was in progress",
514 			    got_ref_get_name(ref), hex1,
515 			    got_ref_get_name(ref), hex2);
516 			goto done;
517 		}
518 
519 		if (got_object_id_cmp(&new_id, &old_id) != 0) {
520 			err = got_ref_change_ref(ref, &new_id);
521 			if (err)
522 				goto done;
523 
524 			err = got_ref_write(ref, repo);
525 			if (err)
526 				goto done;
527 		}
528 
529 		free(id);
530 		id = NULL;
531 	}
532 done:
533 	if (err) {
534 		if (err->code == GOT_ERR_LOCKFILE_TIMEOUT) {
535 			err = got_error_fmt(GOT_ERR_LOCKFILE_TIMEOUT,
536 			    "could not acquire exclusive file lock for %s",
537 			    refname);
538 		}
539 		send_ref_update_ng(client, &iref, refname, err->msg);
540 	} else
541 		send_ref_update_ok(client, &iref, refname);
542 
543 	if (client->nref_updates > 0) {
544 		client->nref_updates--;
545 		if (client->nref_updates == 0) {
546 			send_refs_updated(client);
547 			client->flush_disconnect = 1;
548 		}
549 
550 	}
551 	if (locked) {
552 		const struct got_error *unlock_err;
553 		unlock_err = got_ref_unlock(ref);
554 		if (unlock_err && err == NULL)
555 			err = unlock_err;
556 	}
557 	if (ref)
558 		got_ref_close(ref);
559 	if (repo)
560 		got_repo_close(repo);
561 	free(refname);
562 	free(id);
563 	return err;
564 }
565 
566 static void
567 session_dispatch_repo_child(int fd, short event, void *arg)
568 {
569 	struct gotd_imsgev *iev = arg;
570 	struct imsgbuf *ibuf = &iev->ibuf;
571 	struct gotd_session_client *client = &gotd_session_client;
572 	ssize_t n;
573 	int shut = 0;
574 	struct imsg imsg;
575 
576 	if (event & EV_READ) {
577 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
578 			fatal("imsg_read error");
579 		if (n == 0) {
580 			/* Connection closed. */
581 			shut = 1;
582 			goto done;
583 		}
584 	}
585 
586 	if (event & EV_WRITE) {
587 		n = msgbuf_write(&ibuf->w);
588 		if (n == -1 && errno != EAGAIN)
589 			fatal("msgbuf_write");
590 		if (n == 0) {
591 			/* Connection closed. */
592 			shut = 1;
593 			goto done;
594 		}
595 	}
596 
597 	for (;;) {
598 		const struct got_error *err = NULL;
599 		uint32_t client_id = 0;
600 		int do_disconnect = 0;
601 		int do_ref_updates = 0, do_ref_update = 0;
602 		int do_packfile_install = 0;
603 
604 		if ((n = imsg_get(ibuf, &imsg)) == -1)
605 			fatal("%s: imsg_get error", __func__);
606 		if (n == 0)	/* No more messages. */
607 			break;
608 
609 		switch (imsg.hdr.type) {
610 		case GOTD_IMSG_ERROR:
611 			do_disconnect = 1;
612 			err = gotd_imsg_recv_error(&client_id, &imsg);
613 			break;
614 		case GOTD_IMSG_PACKFILE_DONE:
615 			do_disconnect = 1;
616 			err = recv_packfile_done(&client_id, &imsg);
617 			break;
618 		case GOTD_IMSG_PACKFILE_INSTALL:
619 			err = recv_packfile_install(&client_id, &imsg);
620 			if (err == NULL)
621 				do_packfile_install = 1;
622 			break;
623 		case GOTD_IMSG_REF_UPDATES_START:
624 			err = recv_ref_updates_start(&client_id, &imsg);
625 			if (err == NULL)
626 				do_ref_updates = 1;
627 			break;
628 		case GOTD_IMSG_REF_UPDATE:
629 			err = recv_ref_update(&client_id, &imsg);
630 			if (err == NULL)
631 				do_ref_update = 1;
632 			break;
633 		default:
634 			log_debug("unexpected imsg %d", imsg.hdr.type);
635 			break;
636 		}
637 
638 		if (do_disconnect) {
639 			if (err)
640 				disconnect_on_error(client, err);
641 			else
642 				disconnect(client);
643 		} else {
644 			if (do_packfile_install)
645 				err = install_pack(client,
646 				    gotd_session.repo->path, &imsg);
647 			else if (do_ref_updates)
648 				err = begin_ref_updates(client, &imsg);
649 			else if (do_ref_update)
650 				err = update_ref(&shut, client,
651 				    gotd_session.repo->path, &imsg);
652 			if (err)
653 				log_warnx("uid %d: %s", client->euid, err->msg);
654 		}
655 		imsg_free(&imsg);
656 	}
657 done:
658 	if (!shut) {
659 		gotd_imsg_event_add(iev);
660 	} else {
661 		/* This pipe is dead. Remove its event handler */
662 		event_del(&iev->ev);
663 		event_loopexit(NULL);
664 	}
665 }
666 
667 static const struct got_error *
668 recv_capabilities(struct gotd_session_client *client, struct imsg *imsg)
669 {
670 	struct gotd_imsg_capabilities icapas;
671 	size_t datalen;
672 
673 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
674 	if (datalen != sizeof(icapas))
675 		return got_error(GOT_ERR_PRIVSEP_LEN);
676 	memcpy(&icapas, imsg->data, sizeof(icapas));
677 
678 	client->ncapa_alloc = icapas.ncapabilities;
679 	client->capabilities = calloc(client->ncapa_alloc,
680 	    sizeof(*client->capabilities));
681 	if (client->capabilities == NULL) {
682 		client->ncapa_alloc = 0;
683 		return got_error_from_errno("calloc");
684 	}
685 
686 	log_debug("expecting %zu capabilities from uid %d",
687 	    client->ncapa_alloc, client->euid);
688 	return NULL;
689 }
690 
691 static const struct got_error *
692 recv_capability(struct gotd_session_client *client, struct imsg *imsg)
693 {
694 	struct gotd_imsg_capability icapa;
695 	struct gotd_client_capability *capa;
696 	size_t datalen;
697 	char *key, *value = NULL;
698 
699 	if (client->capabilities == NULL ||
700 	    client->ncapabilities >= client->ncapa_alloc) {
701 		return got_error_msg(GOT_ERR_BAD_REQUEST,
702 		    "unexpected capability received");
703 	}
704 
705 	memset(&icapa, 0, sizeof(icapa));
706 
707 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
708 	if (datalen < sizeof(icapa))
709 		return got_error(GOT_ERR_PRIVSEP_LEN);
710 	memcpy(&icapa, imsg->data, sizeof(icapa));
711 
712 	if (datalen != sizeof(icapa) + icapa.key_len + icapa.value_len)
713 		return got_error(GOT_ERR_PRIVSEP_LEN);
714 
715 	key = strndup(imsg->data + sizeof(icapa), icapa.key_len);
716 	if (key == NULL)
717 		return got_error_from_errno("strndup");
718 	if (icapa.value_len > 0) {
719 		value = strndup(imsg->data + sizeof(icapa) + icapa.key_len,
720 		    icapa.value_len);
721 		if (value == NULL) {
722 			free(key);
723 			return got_error_from_errno("strndup");
724 		}
725 	}
726 
727 	capa = &client->capabilities[client->ncapabilities++];
728 	capa->key = key;
729 	capa->value = value;
730 
731 	if (value)
732 		log_debug("uid %d: capability %s=%s", client->euid, key, value);
733 	else
734 		log_debug("uid %d: capability %s", client->euid, key);
735 
736 	return NULL;
737 }
738 
739 static const struct got_error *
740 ensure_client_is_reading(struct gotd_session_client *client)
741 {
742 	if (client->is_writing) {
743 		return got_error_fmt(GOT_ERR_BAD_PACKET,
744 		    "uid %d made a read-request but is not reading from "
745 		    "a repository", client->euid);
746 	}
747 
748 	return NULL;
749 }
750 
751 static const struct got_error *
752 ensure_client_is_writing(struct gotd_session_client *client)
753 {
754 	if (!client->is_writing) {
755 		return got_error_fmt(GOT_ERR_BAD_PACKET,
756 		    "uid %d made a write-request but is not writing to "
757 		    "a repository", client->euid);
758 	}
759 
760 	return NULL;
761 }
762 
763 static const struct got_error *
764 forward_want(struct gotd_session_client *client, struct imsg *imsg)
765 {
766 	struct gotd_imsg_want ireq;
767 	struct gotd_imsg_want iwant;
768 	size_t datalen;
769 
770 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
771 	if (datalen != sizeof(ireq))
772 		return got_error(GOT_ERR_PRIVSEP_LEN);
773 
774 	memcpy(&ireq, imsg->data, datalen);
775 
776 	memset(&iwant, 0, sizeof(iwant));
777 	memcpy(iwant.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
778 	iwant.client_id = client->id;
779 
780 	if (gotd_imsg_compose_event(&client->repo_child_iev, GOTD_IMSG_WANT,
781 	    gotd_session.proc_id, -1, &iwant, sizeof(iwant)) == -1)
782 		return got_error_from_errno("imsg compose WANT");
783 
784 	return NULL;
785 }
786 
787 static const struct got_error *
788 forward_ref_update(struct gotd_session_client *client, struct imsg *imsg)
789 {
790 	const struct got_error *err = NULL;
791 	struct gotd_imsg_ref_update ireq;
792 	struct gotd_imsg_ref_update *iref = NULL;
793 	size_t datalen;
794 
795 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
796 	if (datalen < sizeof(ireq))
797 		return got_error(GOT_ERR_PRIVSEP_LEN);
798 	memcpy(&ireq, imsg->data, sizeof(ireq));
799 	if (datalen != sizeof(ireq) + ireq.name_len)
800 		return got_error(GOT_ERR_PRIVSEP_LEN);
801 
802 	iref = malloc(datalen);
803 	if (iref == NULL)
804 		return got_error_from_errno("malloc");
805 	memcpy(iref, imsg->data, datalen);
806 
807 	iref->client_id = client->id;
808 	if (gotd_imsg_compose_event(&client->repo_child_iev,
809 	    GOTD_IMSG_REF_UPDATE, gotd_session.proc_id, -1,
810 	    iref, datalen) == -1)
811 		err = got_error_from_errno("imsg compose REF_UPDATE");
812 	free(iref);
813 	return err;
814 }
815 
816 static const struct got_error *
817 forward_have(struct gotd_session_client *client, struct imsg *imsg)
818 {
819 	struct gotd_imsg_have ireq;
820 	struct gotd_imsg_have ihave;
821 	size_t datalen;
822 
823 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
824 	if (datalen != sizeof(ireq))
825 		return got_error(GOT_ERR_PRIVSEP_LEN);
826 
827 	memcpy(&ireq, imsg->data, datalen);
828 
829 	memset(&ihave, 0, sizeof(ihave));
830 	memcpy(ihave.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
831 	ihave.client_id = client->id;
832 
833 	if (gotd_imsg_compose_event(&client->repo_child_iev, GOTD_IMSG_HAVE,
834 	    gotd_session.proc_id, -1, &ihave, sizeof(ihave)) == -1)
835 		return got_error_from_errno("imsg compose HAVE");
836 
837 	return NULL;
838 }
839 
840 static int
841 client_has_capability(struct gotd_session_client *client, const char *capastr)
842 {
843 	struct gotd_client_capability *capa;
844 	size_t i;
845 
846 	if (client->ncapabilities == 0)
847 		return 0;
848 
849 	for (i = 0; i < client->ncapabilities; i++) {
850 		capa = &client->capabilities[i];
851 		if (strcmp(capa->key, capastr) == 0)
852 			return 1;
853 	}
854 
855 	return 0;
856 }
857 
858 static const struct got_error *
859 recv_packfile(struct gotd_session_client *client)
860 {
861 	const struct got_error *err = NULL;
862 	struct gotd_imsg_recv_packfile ipack;
863 	struct gotd_imsg_packfile_pipe ipipe;
864 	struct gotd_imsg_packidx_file ifile;
865 	char *basepath = NULL, *pack_path = NULL, *idx_path = NULL;
866 	int packfd = -1, idxfd = -1;
867 	int pipe[2] = { -1, -1 };
868 
869 	if (client->packfile_path) {
870 		return got_error_fmt(GOT_ERR_PRIVSEP_MSG,
871 		    "uid %d already has a pack file", client->euid);
872 	}
873 
874 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
875 		return got_error_from_errno("socketpair");
876 
877 	memset(&ipipe, 0, sizeof(ipipe));
878 	ipipe.client_id = client->id;
879 
880 	/* Send pack pipe end 0 to repo child process. */
881 	if (gotd_imsg_compose_event(&client->repo_child_iev,
882 	    GOTD_IMSG_PACKFILE_PIPE, gotd_session.proc_id, pipe[0],
883 	        &ipipe, sizeof(ipipe)) == -1) {
884 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
885 		pipe[0] = -1;
886 		goto done;
887 	}
888 	pipe[0] = -1;
889 
890 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
891 	if (gotd_imsg_compose_event(&client->iev,
892 	    GOTD_IMSG_PACKFILE_PIPE, gotd_session.proc_id, pipe[1],
893 	    NULL, 0) == -1)
894 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
895 	pipe[1] = -1;
896 
897 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.pack",
898 	    got_repo_get_path(gotd_session.repo), GOT_OBJECTS_PACK_DIR,
899 	    client->euid) == -1) {
900 		err = got_error_from_errno("asprintf");
901 		goto done;
902 	}
903 
904 	err = got_opentemp_named_fd(&pack_path, &packfd, basepath, "");
905 	if (err)
906 		goto done;
907 	if (fchmod(packfd, GOT_DEFAULT_PACK_MODE) == -1) {
908 		err = got_error_from_errno2("fchmod", pack_path);
909 		goto done;
910 	}
911 
912 	free(basepath);
913 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.idx",
914 	    got_repo_get_path(gotd_session.repo), GOT_OBJECTS_PACK_DIR,
915 	    client->euid) == -1) {
916 		err = got_error_from_errno("asprintf");
917 		basepath = NULL;
918 		goto done;
919 	}
920 	err = got_opentemp_named_fd(&idx_path, &idxfd, basepath, "");
921 	if (err)
922 		goto done;
923 	if (fchmod(idxfd, GOT_DEFAULT_PACK_MODE) == -1) {
924 		err = got_error_from_errno2("fchmod", idx_path);
925 		goto done;
926 	}
927 
928 	memset(&ifile, 0, sizeof(ifile));
929 	ifile.client_id = client->id;
930 	if (gotd_imsg_compose_event(&client->repo_child_iev,
931 	    GOTD_IMSG_PACKIDX_FILE, gotd_session.proc_id,
932 	    idxfd, &ifile, sizeof(ifile)) == -1) {
933 		err = got_error_from_errno("imsg compose PACKIDX_FILE");
934 		idxfd = -1;
935 		goto done;
936 	}
937 	idxfd = -1;
938 
939 	memset(&ipack, 0, sizeof(ipack));
940 	ipack.client_id = client->id;
941 	if (client_has_capability(client, GOT_CAPA_REPORT_STATUS))
942 		ipack.report_status = 1;
943 
944 	if (gotd_imsg_compose_event(&client->repo_child_iev,
945 	    GOTD_IMSG_RECV_PACKFILE, gotd_session.proc_id, packfd,
946 	    &ipack, sizeof(ipack)) == -1) {
947 		err = got_error_from_errno("imsg compose RECV_PACKFILE");
948 		packfd = -1;
949 		goto done;
950 	}
951 	packfd = -1;
952 
953 done:
954 	free(basepath);
955 	if (pipe[0] != -1 && close(pipe[0]) == -1 && err == NULL)
956 		err = got_error_from_errno("close");
957 	if (pipe[1] != -1 && close(pipe[1]) == -1 && err == NULL)
958 		err = got_error_from_errno("close");
959 	if (packfd != -1 && close(packfd) == -1 && err == NULL)
960 		err = got_error_from_errno("close");
961 	if (idxfd != -1 && close(idxfd) == -1 && err == NULL)
962 		err = got_error_from_errno("close");
963 	if (err) {
964 		free(pack_path);
965 		free(idx_path);
966 	} else {
967 		client->packfile_path = pack_path;
968 		client->packidx_path = idx_path;
969 	}
970 	return err;
971 }
972 
973 static const struct got_error *
974 send_packfile(struct gotd_session_client *client)
975 {
976 	const struct got_error *err = NULL;
977 	struct gotd_imsg_send_packfile ipack;
978 	struct gotd_imsg_packfile_pipe ipipe;
979 	int pipe[2];
980 
981 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
982 		return got_error_from_errno("socketpair");
983 
984 	memset(&ipack, 0, sizeof(ipack));
985 	memset(&ipipe, 0, sizeof(ipipe));
986 
987 	ipack.client_id = client->id;
988 	if (client_has_capability(client, GOT_CAPA_SIDE_BAND_64K))
989 		ipack.report_progress = 1;
990 
991 	client->delta_cache_fd = got_opentempfd();
992 	if (client->delta_cache_fd == -1)
993 		return got_error_from_errno("got_opentempfd");
994 
995 	if (gotd_imsg_compose_event(&client->repo_child_iev,
996 	    GOTD_IMSG_SEND_PACKFILE, PROC_GOTD, client->delta_cache_fd,
997 	    &ipack, sizeof(ipack)) == -1) {
998 		err = got_error_from_errno("imsg compose SEND_PACKFILE");
999 		close(pipe[0]);
1000 		close(pipe[1]);
1001 		return err;
1002 	}
1003 
1004 	ipipe.client_id = client->id;
1005 
1006 	/* Send pack pipe end 0 to repo child process. */
1007 	if (gotd_imsg_compose_event(&client->repo_child_iev,
1008 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD,
1009 	    pipe[0], &ipipe, sizeof(ipipe)) == -1) {
1010 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
1011 		close(pipe[1]);
1012 		return err;
1013 	}
1014 
1015 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
1016 	if (gotd_imsg_compose_event(&client->iev,
1017 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD, pipe[1], NULL, 0) == -1)
1018 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
1019 
1020 	return err;
1021 }
1022 
1023 static void
1024 session_dispatch_client(int fd, short events, void *arg)
1025 {
1026 	struct gotd_imsgev *iev = arg;
1027 	struct imsgbuf *ibuf = &iev->ibuf;
1028 	struct gotd_session_client *client = &gotd_session_client;
1029 	const struct got_error *err = NULL;
1030 	struct imsg imsg;
1031 	ssize_t n;
1032 
1033 	if (events & EV_WRITE) {
1034 		while (ibuf->w.queued) {
1035 			n = msgbuf_write(&ibuf->w);
1036 			if (n == -1 && errno == EPIPE) {
1037 				/*
1038 				 * The client has closed its socket.
1039 				 * This can happen when Git clients are
1040 				 * done sending pack file data.
1041 				 */
1042 				msgbuf_clear(&ibuf->w);
1043 				continue;
1044 			} else if (n == -1 && errno != EAGAIN) {
1045 				err = got_error_from_errno("imsg_flush");
1046 				disconnect_on_error(client, err);
1047 				return;
1048 			}
1049 			if (n == 0) {
1050 				/* Connection closed. */
1051 				err = got_error(GOT_ERR_EOF);
1052 				disconnect_on_error(client, err);
1053 				return;
1054 			}
1055 		}
1056 
1057 		if (client->flush_disconnect) {
1058 			disconnect(client);
1059 			return;
1060 		}
1061 	}
1062 
1063 	if ((events & EV_READ) == 0)
1064 		return;
1065 
1066 	memset(&imsg, 0, sizeof(imsg));
1067 
1068 	while (err == NULL) {
1069 		err = gotd_imsg_recv(&imsg, ibuf, 0);
1070 		if (err) {
1071 			if (err->code == GOT_ERR_PRIVSEP_READ)
1072 				err = NULL;
1073 			else if (err->code == GOT_ERR_EOF &&
1074 			    client->state == GOTD_STATE_EXPECT_CAPABILITIES) {
1075 				/*
1076 				 * The client has closed its socket before
1077 				 * sending its capability announcement.
1078 				 * This can happen when Git clients have
1079 				 * no ref-updates to send.
1080 				 */
1081 				disconnect_on_error(client, err);
1082 				return;
1083 			}
1084 			break;
1085 		}
1086 
1087 		evtimer_del(&client->tmo);
1088 
1089 		switch (imsg.hdr.type) {
1090 		case GOTD_IMSG_CAPABILITIES:
1091 			if (client->state != GOTD_STATE_EXPECT_CAPABILITIES) {
1092 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1093 				    "unexpected capabilities received");
1094 				break;
1095 			}
1096 			log_debug("receiving capabilities from uid %d",
1097 			    client->euid);
1098 			err = recv_capabilities(client, &imsg);
1099 			break;
1100 		case GOTD_IMSG_CAPABILITY:
1101 			if (client->state != GOTD_STATE_EXPECT_CAPABILITIES) {
1102 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1103 				    "unexpected capability received");
1104 				break;
1105 			}
1106 			err = recv_capability(client, &imsg);
1107 			if (err || client->ncapabilities < client->ncapa_alloc)
1108 				break;
1109 			if (!client->is_writing) {
1110 				client->state = GOTD_STATE_EXPECT_WANT;
1111 				client->accept_flush_pkt = 1;
1112 				log_debug("uid %d: expecting want-lines",
1113 				    client->euid);
1114 			} else if (client->is_writing) {
1115 				client->state = GOTD_STATE_EXPECT_REF_UPDATE;
1116 				client->accept_flush_pkt = 1;
1117 				log_debug("uid %d: expecting ref-update-lines",
1118 				    client->euid);
1119 			} else
1120 				fatalx("client %d is both reading and writing",
1121 				    client->euid);
1122 			break;
1123 		case GOTD_IMSG_WANT:
1124 			if (client->state != GOTD_STATE_EXPECT_WANT) {
1125 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1126 				    "unexpected want-line received");
1127 				break;
1128 			}
1129 			log_debug("received want-line from uid %d",
1130 			    client->euid);
1131 			err = ensure_client_is_reading(client);
1132 			if (err)
1133 				break;
1134 			client->accept_flush_pkt = 1;
1135 			err = forward_want(client, &imsg);
1136 			break;
1137 		case GOTD_IMSG_REF_UPDATE:
1138 			if (client->state != GOTD_STATE_EXPECT_REF_UPDATE &&
1139 			    client->state !=
1140 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1141 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1142 				    "unexpected ref-update-line received");
1143 				break;
1144 			}
1145 			log_debug("received ref-update-line from uid %d",
1146 			    client->euid);
1147 			err = ensure_client_is_writing(client);
1148 			if (err)
1149 				break;
1150 			err = forward_ref_update(client, &imsg);
1151 			if (err)
1152 				break;
1153 			client->state = GOTD_STATE_EXPECT_MORE_REF_UPDATES;
1154 			client->accept_flush_pkt = 1;
1155 			break;
1156 		case GOTD_IMSG_HAVE:
1157 			if (client->state != GOTD_STATE_EXPECT_HAVE) {
1158 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1159 				    "unexpected have-line received");
1160 				break;
1161 			}
1162 			log_debug("received have-line from uid %d",
1163 			    client->euid);
1164 			err = ensure_client_is_reading(client);
1165 			if (err)
1166 				break;
1167 			err = forward_have(client, &imsg);
1168 			if (err)
1169 				break;
1170 			client->accept_flush_pkt = 1;
1171 			break;
1172 		case GOTD_IMSG_FLUSH:
1173 			if (client->state == GOTD_STATE_EXPECT_WANT ||
1174 			    client->state == GOTD_STATE_EXPECT_HAVE) {
1175 				err = ensure_client_is_reading(client);
1176 				if (err)
1177 					break;
1178 			} else if (client->state ==
1179 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1180 				err = ensure_client_is_writing(client);
1181 				if (err)
1182 					break;
1183 			} else if (client->state != GOTD_STATE_EXPECT_DONE) {
1184 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1185 				    "unexpected flush-pkt received");
1186 				break;
1187 			}
1188 			if (!client->accept_flush_pkt) {
1189 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1190 				    "unexpected flush-pkt received");
1191 				break;
1192 			}
1193 
1194 			/*
1195 			 * Accept just one flush packet at a time.
1196 			 * Future client state transitions will set this flag
1197 			 * again if another flush packet is expected.
1198 			 */
1199 			client->accept_flush_pkt = 0;
1200 
1201 			log_debug("received flush-pkt from uid %d",
1202 			    client->euid);
1203 			if (client->state == GOTD_STATE_EXPECT_WANT) {
1204 				client->state = GOTD_STATE_EXPECT_HAVE;
1205 				log_debug("uid %d: expecting have-lines",
1206 				    client->euid);
1207 			} else if (client->state == GOTD_STATE_EXPECT_HAVE) {
1208 				client->state = GOTD_STATE_EXPECT_DONE;
1209 				client->accept_flush_pkt = 1;
1210 				log_debug("uid %d: expecting 'done'",
1211 				    client->euid);
1212 			} else if (client->state ==
1213 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1214 				client->state = GOTD_STATE_EXPECT_PACKFILE;
1215 				log_debug("uid %d: expecting packfile",
1216 				    client->euid);
1217 				err = recv_packfile(client);
1218 			} else if (client->state != GOTD_STATE_EXPECT_DONE) {
1219 				/* should not happen, see above */
1220 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1221 				    "unexpected client state");
1222 				break;
1223 			}
1224 			break;
1225 		case GOTD_IMSG_DONE:
1226 			if (client->state != GOTD_STATE_EXPECT_HAVE &&
1227 			    client->state != GOTD_STATE_EXPECT_DONE) {
1228 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1229 				    "unexpected flush-pkt received");
1230 				break;
1231 			}
1232 			log_debug("received 'done' from uid %d", client->euid);
1233 			err = ensure_client_is_reading(client);
1234 			if (err)
1235 				break;
1236 			client->state = GOTD_STATE_DONE;
1237 			client->accept_flush_pkt = 1;
1238 			err = send_packfile(client);
1239 			break;
1240 		default:
1241 			log_debug("unexpected imsg %d", imsg.hdr.type);
1242 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1243 			break;
1244 		}
1245 
1246 		imsg_free(&imsg);
1247 	}
1248 
1249 	if (err) {
1250 		if (err->code != GOT_ERR_EOF ||
1251 		    client->state != GOTD_STATE_EXPECT_PACKFILE)
1252 			disconnect_on_error(client, err);
1253 	} else {
1254 		gotd_imsg_event_add(iev);
1255 		evtimer_add(&client->tmo, &gotd_session.request_timeout);
1256 	}
1257 }
1258 
1259 static const struct got_error *
1260 list_refs_request(void)
1261 {
1262 	static const struct got_error *err;
1263 	struct gotd_session_client *client = &gotd_session_client;
1264 	struct gotd_imsgev *iev = &client->repo_child_iev;
1265 	struct gotd_imsg_list_refs_internal ilref;
1266 	int fd;
1267 
1268 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1269 		return got_error(GOT_ERR_PRIVSEP_MSG);
1270 
1271 	memset(&ilref, 0, sizeof(ilref));
1272 	ilref.client_id = client->id;
1273 
1274 	fd = dup(client->fd);
1275 	if (fd == -1)
1276 		return got_error_from_errno("dup");
1277 
1278 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_LIST_REFS_INTERNAL,
1279 	    gotd_session.proc_id, fd, &ilref, sizeof(ilref)) == -1) {
1280 		err = got_error_from_errno("imsg compose LIST_REFS_INTERNAL");
1281 		close(fd);
1282 		return err;
1283 	}
1284 
1285 	client->state = GOTD_STATE_EXPECT_CAPABILITIES;
1286 	log_debug("uid %d: expecting capabilities", client->euid);
1287 	return NULL;
1288 }
1289 
1290 static const struct got_error *
1291 recv_connect(struct imsg *imsg)
1292 {
1293 	struct gotd_session_client *client = &gotd_session_client;
1294 	struct gotd_imsg_connect iconnect;
1295 	size_t datalen;
1296 
1297 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1298 		return got_error(GOT_ERR_PRIVSEP_MSG);
1299 
1300 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1301 	if (datalen != sizeof(iconnect))
1302 		return got_error(GOT_ERR_PRIVSEP_LEN);
1303 	memcpy(&iconnect, imsg->data, sizeof(iconnect));
1304 
1305 	client->euid = iconnect.euid;
1306 	client->egid = iconnect.egid;
1307 	client->fd = imsg_get_fd(imsg);
1308 	if (client->fd == -1)
1309 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1310 
1311 	imsg_init(&client->iev.ibuf, client->fd);
1312 	client->iev.handler = session_dispatch_client;
1313 	client->iev.events = EV_READ;
1314 	client->iev.handler_arg = NULL;
1315 	event_set(&client->iev.ev, client->iev.ibuf.fd, EV_READ,
1316 	    session_dispatch_client, &client->iev);
1317 	gotd_imsg_event_add(&client->iev);
1318 	evtimer_set(&client->tmo, gotd_request_timeout, client);
1319 
1320 	return NULL;
1321 }
1322 
1323 static const struct got_error *
1324 recv_repo_child(struct imsg *imsg)
1325 {
1326 	struct gotd_imsg_connect_repo_child ichild;
1327 	struct gotd_session_client *client = &gotd_session_client;
1328 	size_t datalen;
1329 	int fd;
1330 
1331 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1332 		return got_error(GOT_ERR_PRIVSEP_MSG);
1333 
1334 	/* We should already have received a pipe to the listener. */
1335 	if (client->fd == -1)
1336 		return got_error(GOT_ERR_PRIVSEP_MSG);
1337 
1338 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1339 	if (datalen != sizeof(ichild))
1340 		return got_error(GOT_ERR_PRIVSEP_LEN);
1341 
1342 	memcpy(&ichild, imsg->data, sizeof(ichild));
1343 
1344 	client->id = ichild.client_id;
1345 	if (ichild.proc_id == PROC_REPO_WRITE)
1346 		client->is_writing = 1;
1347 	else if (ichild.proc_id == PROC_REPO_READ)
1348 		client->is_writing = 0;
1349 	else
1350 		return got_error_msg(GOT_ERR_PRIVSEP_MSG,
1351 		    "bad child process type");
1352 
1353 	fd = imsg_get_fd(imsg);
1354 	if (fd == -1)
1355 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1356 
1357 	imsg_init(&client->repo_child_iev.ibuf, fd);
1358 	client->repo_child_iev.handler = session_dispatch_repo_child;
1359 	client->repo_child_iev.events = EV_READ;
1360 	client->repo_child_iev.handler_arg = NULL;
1361 	event_set(&client->repo_child_iev.ev, client->repo_child_iev.ibuf.fd,
1362 	    EV_READ, session_dispatch_repo_child, &client->repo_child_iev);
1363 	gotd_imsg_event_add(&client->repo_child_iev);
1364 
1365 	/* The "recvfd" pledge promise is no longer needed. */
1366 	if (pledge("stdio rpath wpath cpath sendfd fattr flock", NULL) == -1)
1367 		fatal("pledge");
1368 
1369 	return NULL;
1370 }
1371 
1372 static void
1373 session_dispatch(int fd, short event, void *arg)
1374 {
1375 	struct gotd_imsgev *iev = arg;
1376 	struct imsgbuf *ibuf = &iev->ibuf;
1377 	struct gotd_session_client *client = &gotd_session_client;
1378 	ssize_t n;
1379 	int shut = 0;
1380 	struct imsg imsg;
1381 
1382 	if (event & EV_READ) {
1383 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1384 			fatal("imsg_read error");
1385 		if (n == 0) {
1386 			/* Connection closed. */
1387 			shut = 1;
1388 			goto done;
1389 		}
1390 	}
1391 
1392 	if (event & EV_WRITE) {
1393 		n = msgbuf_write(&ibuf->w);
1394 		if (n == -1 && errno != EAGAIN)
1395 			fatal("msgbuf_write");
1396 		if (n == 0) {
1397 			/* Connection closed. */
1398 			shut = 1;
1399 			goto done;
1400 		}
1401 	}
1402 
1403 	for (;;) {
1404 		const struct got_error *err = NULL;
1405 		uint32_t client_id = 0;
1406 		int do_disconnect = 0, do_list_refs = 0;
1407 
1408 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1409 			fatal("%s: imsg_get error", __func__);
1410 		if (n == 0)	/* No more messages. */
1411 			break;
1412 
1413 		switch (imsg.hdr.type) {
1414 		case GOTD_IMSG_ERROR:
1415 			do_disconnect = 1;
1416 			err = gotd_imsg_recv_error(&client_id, &imsg);
1417 			break;
1418 		case GOTD_IMSG_CONNECT:
1419 			err = recv_connect(&imsg);
1420 			break;
1421 		case GOTD_IMSG_DISCONNECT:
1422 			do_disconnect = 1;
1423 			break;
1424 		case GOTD_IMSG_CONNECT_REPO_CHILD:
1425 			err = recv_repo_child(&imsg);
1426 			if (err)
1427 				break;
1428 			do_list_refs = 1;
1429 			break;
1430 		default:
1431 			log_debug("unexpected imsg %d", imsg.hdr.type);
1432 			break;
1433 		}
1434 		imsg_free(&imsg);
1435 
1436 		if (do_disconnect) {
1437 			if (err)
1438 				disconnect_on_error(client, err);
1439 			else
1440 				disconnect(client);
1441 		} else if (do_list_refs)
1442 			err = list_refs_request();
1443 
1444 		if (err)
1445 			log_warnx("uid %d: %s", client->euid, err->msg);
1446 	}
1447 done:
1448 	if (!shut) {
1449 		gotd_imsg_event_add(iev);
1450 	} else {
1451 		/* This pipe is dead. Remove its event handler */
1452 		event_del(&iev->ev);
1453 		event_loopexit(NULL);
1454 	}
1455 }
1456 
1457 void
1458 session_main(const char *title, const char *repo_path,
1459     int *pack_fds, int *temp_fds, struct timeval *request_timeout,
1460     enum gotd_procid proc_id)
1461 {
1462 	const struct got_error *err = NULL;
1463 	struct event evsigint, evsigterm, evsighup, evsigusr1;
1464 
1465 	gotd_session.title = title;
1466 	gotd_session.pid = getpid();
1467 	gotd_session.pack_fds = pack_fds;
1468 	gotd_session.temp_fds = temp_fds;
1469 	memcpy(&gotd_session.request_timeout, request_timeout,
1470 	    sizeof(gotd_session.request_timeout));
1471 	gotd_session.proc_id = proc_id;
1472 
1473 	err = got_repo_open(&gotd_session.repo, repo_path, NULL, pack_fds);
1474 	if (err)
1475 		goto done;
1476 	if (!got_repo_is_bare(gotd_session.repo)) {
1477 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
1478 		    "bare git repository required");
1479 		goto done;
1480 	}
1481 
1482 	got_repo_temp_fds_set(gotd_session.repo, temp_fds);
1483 
1484 	signal_set(&evsigint, SIGINT, gotd_session_sighdlr, NULL);
1485 	signal_set(&evsigterm, SIGTERM, gotd_session_sighdlr, NULL);
1486 	signal_set(&evsighup, SIGHUP, gotd_session_sighdlr, NULL);
1487 	signal_set(&evsigusr1, SIGUSR1, gotd_session_sighdlr, NULL);
1488 	signal(SIGPIPE, SIG_IGN);
1489 
1490 	signal_add(&evsigint, NULL);
1491 	signal_add(&evsigterm, NULL);
1492 	signal_add(&evsighup, NULL);
1493 	signal_add(&evsigusr1, NULL);
1494 
1495 	gotd_session_client.state = GOTD_STATE_EXPECT_LIST_REFS;
1496 	gotd_session_client.fd = -1;
1497 	gotd_session_client.nref_updates = -1;
1498 	gotd_session_client.delta_cache_fd = -1;
1499 	gotd_session_client.accept_flush_pkt = 1;
1500 
1501 	imsg_init(&gotd_session.parent_iev.ibuf, GOTD_FILENO_MSG_PIPE);
1502 	gotd_session.parent_iev.handler = session_dispatch;
1503 	gotd_session.parent_iev.events = EV_READ;
1504 	gotd_session.parent_iev.handler_arg = NULL;
1505 	event_set(&gotd_session.parent_iev.ev, gotd_session.parent_iev.ibuf.fd,
1506 	    EV_READ, session_dispatch, &gotd_session.parent_iev);
1507 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
1508 	    GOTD_IMSG_CLIENT_SESSION_READY, gotd_session.proc_id,
1509 	    -1, NULL, 0) == -1) {
1510 		err = got_error_from_errno("imsg compose CLIENT_SESSION_READY");
1511 		goto done;
1512 	}
1513 
1514 	event_dispatch();
1515 done:
1516 	if (err)
1517 		log_warnx("%s: %s", title, err->msg);
1518 	gotd_session_shutdown();
1519 }
1520 
1521 void
1522 gotd_session_shutdown(void)
1523 {
1524 	log_debug("shutting down");
1525 	if (gotd_session.repo)
1526 		got_repo_close(gotd_session.repo);
1527 	got_repo_pack_fds_close(gotd_session.pack_fds);
1528 	got_repo_temp_fds_close(gotd_session.temp_fds);
1529 	exit(0);
1530 }