Gotweb

Blob

Date:: Thu Feb 23 21:58:18 2023 UTC
Message:: portable: rework SHA detection Simply the SHA detection by not predicating on libcrypto, but instead checking individual header files.
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2022, 2023 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/queue.h>
19 #include <sys/tree.h>
20 #include <sys/socket.h>
21 #include <sys/stat.h>
22 #include <sys/uio.h>
23 
24 #include <errno.h>
25 #include <event.h>
26 #include <limits.h>
27 #include <signal.h>
28 #include <stdint.h>
29 #include <stdio.h>
30 #include <stdlib.h>
31 #include <string.h>
32 #include <imsg.h>
33 #include <unistd.h>
34 
35 #include "got_error.h"
36 #include "got_repository.h"
37 #include "got_object.h"
38 #include "got_path.h"
39 #include "got_reference.h"
40 #include "got_opentemp.h"
41 
42 #include "got_lib_hash.h"
43 #include "got_lib_delta.h"
44 #include "got_lib_object.h"
45 #include "got_lib_object_cache.h"
46 #include "got_lib_pack.h"
47 #include "got_lib_repository.h"
48 #include "got_lib_gitproto.h"
49 
50 #include "gotd.h"
51 #include "log.h"
52 #include "session.h"
53 
54 
55 static struct gotd_session {
56 	pid_t pid;
57 	const char *title;
58 	struct got_repository *repo;
59 	int *pack_fds;
60 	int *temp_fds;
61 	struct gotd_imsgev parent_iev;
62 	struct timeval request_timeout;
63 } gotd_session;
64 
65 static struct gotd_session_client {
66 	enum gotd_session_state		 state;
67 	int				 is_writing;
68 	struct gotd_client_capability	*capabilities;
69 	size_t				 ncapa_alloc;
70 	size_t				 ncapabilities;
71 	uint32_t			 id;
72 	int				 fd;
73 	int				 delta_cache_fd;
74 	struct gotd_imsgev		 iev;
75 	struct gotd_imsgev		 repo_child_iev;
76 	struct event			 tmo;
77 	uid_t				 euid;
78 	gid_t				 egid;
79 	char				*packfile_path;
80 	char				*packidx_path;
81 	int				 nref_updates;
82 	int				 accept_flush_pkt;
83 } gotd_session_client;
84 
85 void gotd_session_sighdlr(int sig, short event, void *arg);
86 static void gotd_session_shutdown(void);
87 
88 static void
89 disconnect(struct gotd_session_client *client)
90 {
91 	log_debug("uid %d: disconnecting", client->euid);
92 
93 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
94 	    GOTD_IMSG_DISCONNECT, PROC_SESSION, -1, NULL, 0) == -1)
95 		log_warn("imsg compose DISCONNECT");
96 
97 	imsg_clear(&client->repo_child_iev.ibuf);
98 	event_del(&client->repo_child_iev.ev);
99 	evtimer_del(&client->tmo);
100 	close(client->fd);
101 	if (client->delta_cache_fd != -1)
102 		close(client->delta_cache_fd);
103 	if (client->packfile_path) {
104 		if (unlink(client->packfile_path) == -1 && errno != ENOENT)
105 			log_warn("unlink %s: ", client->packfile_path);
106 		free(client->packfile_path);
107 	}
108 	if (client->packidx_path) {
109 		if (unlink(client->packidx_path) == -1 && errno != ENOENT)
110 			log_warn("unlink %s: ", client->packidx_path);
111 		free(client->packidx_path);
112 	}
113 	free(client->capabilities);
114 
115 	gotd_session_shutdown();
116 }
117 
118 static void
119 disconnect_on_error(struct gotd_session_client *client,
120     const struct got_error *err)
121 {
122 	struct imsgbuf ibuf;
123 
124 	log_warnx("uid %d: %s", client->euid, err->msg);
125 	if (err->code != GOT_ERR_EOF) {
126 		imsg_init(&ibuf, client->fd);
127 		gotd_imsg_send_error(&ibuf, 0, PROC_SESSION, err);
128 		imsg_clear(&ibuf);
129 	}
130 
131 	disconnect(client);
132 }
133 
134 static void
135 gotd_request_timeout(int fd, short events, void *arg)
136 {
137 	struct gotd_session_client *client = arg;
138 
139 	log_debug("disconnecting uid %d due to timeout", client->euid);
140 	disconnect(client);
141 }
142 
143 void
144 gotd_session_sighdlr(int sig, short event, void *arg)
145 {
146 	/*
147 	 * Normal signal handler rules don't apply because libevent
148 	 * decouples for us.
149 	 */
150 
151 	switch (sig) {
152 	case SIGHUP:
153 		log_info("%s: ignoring SIGHUP", __func__);
154 		break;
155 	case SIGUSR1:
156 		log_info("%s: ignoring SIGUSR1", __func__);
157 		break;
158 	case SIGTERM:
159 	case SIGINT:
160 		gotd_session_shutdown();
161 		/* NOTREACHED */
162 		break;
163 	default:
164 		fatalx("unexpected signal");
165 	}
166 }
167 
168 static const struct got_error *
169 recv_packfile_done(uint32_t *client_id, struct imsg *imsg)
170 {
171 	struct gotd_imsg_packfile_done idone;
172 	size_t datalen;
173 
174 	log_debug("packfile-done received");
175 
176 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
177 	if (datalen != sizeof(idone))
178 		return got_error(GOT_ERR_PRIVSEP_LEN);
179 	memcpy(&idone, imsg->data, sizeof(idone));
180 
181 	*client_id = idone.client_id;
182 	return NULL;
183 }
184 
185 static const struct got_error *
186 recv_packfile_install(uint32_t *client_id, struct imsg *imsg)
187 {
188 	struct gotd_imsg_packfile_install inst;
189 	size_t datalen;
190 
191 	log_debug("packfile-install received");
192 
193 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
194 	if (datalen != sizeof(inst))
195 		return got_error(GOT_ERR_PRIVSEP_LEN);
196 	memcpy(&inst, imsg->data, sizeof(inst));
197 
198 	*client_id = inst.client_id;
199 	return NULL;
200 }
201 
202 static const struct got_error *
203 recv_ref_updates_start(uint32_t *client_id, struct imsg *imsg)
204 {
205 	struct gotd_imsg_ref_updates_start istart;
206 	size_t datalen;
207 
208 	log_debug("ref-updates-start received");
209 
210 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
211 	if (datalen != sizeof(istart))
212 		return got_error(GOT_ERR_PRIVSEP_LEN);
213 	memcpy(&istart, imsg->data, sizeof(istart));
214 
215 	*client_id = istart.client_id;
216 	return NULL;
217 }
218 
219 static const struct got_error *
220 recv_ref_update(uint32_t *client_id, struct imsg *imsg)
221 {
222 	struct gotd_imsg_ref_update iref;
223 	size_t datalen;
224 
225 	log_debug("ref-update received");
226 
227 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
228 	if (datalen < sizeof(iref))
229 		return got_error(GOT_ERR_PRIVSEP_LEN);
230 	memcpy(&iref, imsg->data, sizeof(iref));
231 
232 	*client_id = iref.client_id;
233 	return NULL;
234 }
235 
236 static const struct got_error *
237 send_ref_update_ok(struct gotd_session_client *client,
238     struct gotd_imsg_ref_update *iref, const char *refname)
239 {
240 	struct gotd_imsg_ref_update_ok iok;
241 	struct gotd_imsgev *iev = &client->iev;
242 	struct ibuf *wbuf;
243 	size_t len;
244 
245 	memset(&iok, 0, sizeof(iok));
246 	iok.client_id = client->id;
247 	memcpy(iok.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
248 	memcpy(iok.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
249 	iok.name_len = strlen(refname);
250 
251 	len = sizeof(iok) + iok.name_len;
252 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE_OK,
253 	    PROC_SESSION, gotd_session.pid, len);
254 	if (wbuf == NULL)
255 		return got_error_from_errno("imsg_create REF_UPDATE_OK");
256 
257 	if (imsg_add(wbuf, &iok, sizeof(iok)) == -1)
258 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
259 	if (imsg_add(wbuf, refname, iok.name_len) == -1)
260 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
261 
262 	wbuf->fd = -1;
263 	imsg_close(&iev->ibuf, wbuf);
264 	gotd_imsg_event_add(iev);
265 	return NULL;
266 }
267 
268 static void
269 send_refs_updated(struct gotd_session_client *client)
270 {
271 	if (gotd_imsg_compose_event(&client->iev, GOTD_IMSG_REFS_UPDATED,
272 	    PROC_SESSION, -1, NULL, 0) == -1)
273 		log_warn("imsg compose REFS_UPDATED");
274 }
275 
276 static const struct got_error *
277 send_ref_update_ng(struct gotd_session_client *client,
278     struct gotd_imsg_ref_update *iref, const char *refname,
279     const char *reason)
280 {
281 	const struct got_error *ng_err;
282 	struct gotd_imsg_ref_update_ng ing;
283 	struct gotd_imsgev *iev = &client->iev;
284 	struct ibuf *wbuf;
285 	size_t len;
286 
287 	memset(&ing, 0, sizeof(ing));
288 	ing.client_id = client->id;
289 	memcpy(ing.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
290 	memcpy(ing.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
291 	ing.name_len = strlen(refname);
292 
293 	ng_err = got_error_fmt(GOT_ERR_REF_BUSY, "%s", reason);
294 	ing.reason_len = strlen(ng_err->msg);
295 
296 	len = sizeof(ing) + ing.name_len + ing.reason_len;
297 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE_NG,
298 	    PROC_SESSION, gotd_session.pid, len);
299 	if (wbuf == NULL)
300 		return got_error_from_errno("imsg_create REF_UPDATE_NG");
301 
302 	if (imsg_add(wbuf, &ing, sizeof(ing)) == -1)
303 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
304 	if (imsg_add(wbuf, refname, ing.name_len) == -1)
305 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
306 	if (imsg_add(wbuf, ng_err->msg, ing.reason_len) == -1)
307 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
308 
309 	wbuf->fd = -1;
310 	imsg_close(&iev->ibuf, wbuf);
311 	gotd_imsg_event_add(iev);
312 	return NULL;
313 }
314 
315 static const struct got_error *
316 install_pack(struct gotd_session_client *client, const char *repo_path,
317     struct imsg *imsg)
318 {
319 	const struct got_error *err = NULL;
320 	struct gotd_imsg_packfile_install inst;
321 	char hex[SHA1_DIGEST_STRING_LENGTH];
322 	size_t datalen;
323 	char *packfile_path = NULL, *packidx_path = NULL;
324 
325 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
326 	if (datalen != sizeof(inst))
327 		return got_error(GOT_ERR_PRIVSEP_LEN);
328 	memcpy(&inst, imsg->data, sizeof(inst));
329 
330 	if (client->packfile_path == NULL)
331 		return got_error_msg(GOT_ERR_BAD_REQUEST,
332 		    "client has no pack file");
333 	if (client->packidx_path == NULL)
334 		return got_error_msg(GOT_ERR_BAD_REQUEST,
335 		    "client has no pack file index");
336 
337 	if (got_sha1_digest_to_str(inst.pack_sha1, hex, sizeof(hex)) == NULL)
338 		return got_error_msg(GOT_ERR_NO_SPACE,
339 		    "could not convert pack file SHA1 to hex");
340 
341 	if (asprintf(&packfile_path, "/%s/%s/pack-%s.pack",
342 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
343 		err = got_error_from_errno("asprintf");
344 		goto done;
345 	}
346 
347 	if (asprintf(&packidx_path, "/%s/%s/pack-%s.idx",
348 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
349 		err = got_error_from_errno("asprintf");
350 		goto done;
351 	}
352 
353 	if (rename(client->packfile_path, packfile_path) == -1) {
354 		err = got_error_from_errno3("rename", client->packfile_path,
355 		    packfile_path);
356 		goto done;
357 	}
358 
359 	free(client->packfile_path);
360 	client->packfile_path = NULL;
361 
362 	if (rename(client->packidx_path, packidx_path) == -1) {
363 		err = got_error_from_errno3("rename", client->packidx_path,
364 		    packidx_path);
365 		goto done;
366 	}
367 
368 	free(client->packidx_path);
369 	client->packidx_path = NULL;
370 done:
371 	free(packfile_path);
372 	free(packidx_path);
373 	return err;
374 }
375 
376 static const struct got_error *
377 begin_ref_updates(struct gotd_session_client *client, struct imsg *imsg)
378 {
379 	struct gotd_imsg_ref_updates_start istart;
380 	size_t datalen;
381 
382 	if (client->nref_updates != -1)
383 		return got_error(GOT_ERR_PRIVSEP_MSG);
384 
385 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
386 	if (datalen != sizeof(istart))
387 		return got_error(GOT_ERR_PRIVSEP_LEN);
388 	memcpy(&istart, imsg->data, sizeof(istart));
389 
390 	if (istart.nref_updates <= 0)
391 		return got_error(GOT_ERR_PRIVSEP_MSG);
392 
393 	client->nref_updates = istart.nref_updates;
394 	return NULL;
395 }
396 
397 static const struct got_error *
398 update_ref(int *shut, struct gotd_session_client *client,
399     const char *repo_path, struct imsg *imsg)
400 {
401 	const struct got_error *err = NULL;
402 	struct got_repository *repo = NULL;
403 	struct got_reference *ref = NULL;
404 	struct gotd_imsg_ref_update iref;
405 	struct got_object_id old_id, new_id;
406 	struct got_object_id *id = NULL;
407 	struct got_object *obj = NULL;
408 	char *refname = NULL;
409 	size_t datalen;
410 	int locked = 0;
411 
412 	log_debug("update-ref from uid %d", client->euid);
413 
414 	if (client->nref_updates <= 0)
415 		return got_error(GOT_ERR_PRIVSEP_MSG);
416 
417 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
418 	if (datalen < sizeof(iref))
419 		return got_error(GOT_ERR_PRIVSEP_LEN);
420 	memcpy(&iref, imsg->data, sizeof(iref));
421 	if (datalen != sizeof(iref) + iref.name_len)
422 		return got_error(GOT_ERR_PRIVSEP_LEN);
423 	refname = strndup(imsg->data + sizeof(iref), iref.name_len);
424 	if (refname == NULL)
425 		return got_error_from_errno("strndup");
426 
427 	log_debug("updating ref %s for uid %d", refname, client->euid);
428 
429 	err = got_repo_open(&repo, repo_path, NULL, NULL);
430 	if (err)
431 		goto done;
432 
433 	memcpy(old_id.sha1, iref.old_id, SHA1_DIGEST_LENGTH);
434 	memcpy(new_id.sha1, iref.new_id, SHA1_DIGEST_LENGTH);
435 	err = got_object_open(&obj, repo,
436 	    iref.delete_ref ? &old_id : &new_id);
437 	if (err)
438 		goto done;
439 
440 	if (iref.ref_is_new) {
441 		err = got_ref_open(&ref, repo, refname, 0);
442 		if (err) {
443 			if (err->code != GOT_ERR_NOT_REF)
444 				goto done;
445 			err = got_ref_alloc(&ref, refname, &new_id);
446 			if (err)
447 				goto done;
448 			err = got_ref_write(ref, repo); /* will lock/unlock */
449 			if (err)
450 				goto done;
451 		} else {
452 			err = got_error_fmt(GOT_ERR_REF_BUSY,
453 			    "%s has been created by someone else "
454 			    "while transaction was in progress",
455 			    got_ref_get_name(ref));
456 			goto done;
457 		}
458 	} else if (iref.delete_ref) {
459 		err = got_ref_open(&ref, repo, refname, 1 /* lock */);
460 		if (err)
461 			goto done;
462 		locked = 1;
463 
464 		err = got_ref_resolve(&id, repo, ref);
465 		if (err)
466 			goto done;
467 
468 		if (got_object_id_cmp(id, &old_id) != 0) {
469 			err = got_error_fmt(GOT_ERR_REF_BUSY,
470 			    "%s has been modified by someone else "
471 			    "while transaction was in progress",
472 			    got_ref_get_name(ref));
473 			goto done;
474 		}
475 
476 		err = got_ref_delete(ref, repo);
477 		if (err)
478 			goto done;
479 
480 		free(id);
481 		id = NULL;
482 	} else {
483 		err = got_ref_open(&ref, repo, refname, 1 /* lock */);
484 		if (err)
485 			goto done;
486 		locked = 1;
487 
488 		err = got_ref_resolve(&id, repo, ref);
489 		if (err)
490 			goto done;
491 
492 		if (got_object_id_cmp(id, &old_id) != 0) {
493 			err = got_error_fmt(GOT_ERR_REF_BUSY,
494 			    "%s has been modified by someone else "
495 			    "while transaction was in progress",
496 			    got_ref_get_name(ref));
497 			goto done;
498 		}
499 
500 		err = got_ref_change_ref(ref, &new_id);
501 		if (err)
502 			goto done;
503 
504 		err = got_ref_write(ref, repo);
505 		if (err)
506 			goto done;
507 
508 		free(id);
509 		id = NULL;
510 	}
511 done:
512 	if (err) {
513 		if (err->code == GOT_ERR_LOCKFILE_TIMEOUT) {
514 			err = got_error_fmt(GOT_ERR_LOCKFILE_TIMEOUT,
515 			    "could not acquire exclusive file lock for %s",
516 			    refname);
517 		}
518 		send_ref_update_ng(client, &iref, refname, err->msg);
519 	} else
520 		send_ref_update_ok(client, &iref, refname);
521 
522 	if (client->nref_updates > 0) {
523 		client->nref_updates--;
524 		if (client->nref_updates == 0) {
525 			send_refs_updated(client);
526 			*shut = 1;
527 		}
528 
529 	}
530 	if (locked) {
531 		const struct got_error *unlock_err;
532 		unlock_err = got_ref_unlock(ref);
533 		if (unlock_err && err == NULL)
534 			err = unlock_err;
535 	}
536 	if (ref)
537 		got_ref_close(ref);
538 	if (obj)
539 		got_object_close(obj);
540 	if (repo)
541 		got_repo_close(repo);
542 	free(refname);
543 	free(id);
544 	return err;
545 }
546 
547 static void
548 session_dispatch_repo_child(int fd, short event, void *arg)
549 {
550 	struct gotd_imsgev *iev = arg;
551 	struct imsgbuf *ibuf = &iev->ibuf;
552 	struct gotd_session_client *client = &gotd_session_client;
553 	ssize_t n;
554 	int shut = 0;
555 	struct imsg imsg;
556 
557 	if (event & EV_READ) {
558 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
559 			fatal("imsg_read error");
560 		if (n == 0) {
561 			/* Connection closed. */
562 			shut = 1;
563 			goto done;
564 		}
565 	}
566 
567 	if (event & EV_WRITE) {
568 		n = msgbuf_write(&ibuf->w);
569 		if (n == -1 && errno != EAGAIN)
570 			fatal("msgbuf_write");
571 		if (n == 0) {
572 			/* Connection closed. */
573 			shut = 1;
574 			goto done;
575 		}
576 	}
577 
578 	for (;;) {
579 		const struct got_error *err = NULL;
580 		uint32_t client_id = 0;
581 		int do_disconnect = 0;
582 		int do_ref_updates = 0, do_ref_update = 0;
583 		int do_packfile_install = 0;
584 
585 		if ((n = imsg_get(ibuf, &imsg)) == -1)
586 			fatal("%s: imsg_get error", __func__);
587 		if (n == 0)	/* No more messages. */
588 			break;
589 
590 		switch (imsg.hdr.type) {
591 		case GOTD_IMSG_ERROR:
592 			do_disconnect = 1;
593 			err = gotd_imsg_recv_error(&client_id, &imsg);
594 			break;
595 		case GOTD_IMSG_PACKFILE_DONE:
596 			do_disconnect = 1;
597 			err = recv_packfile_done(&client_id, &imsg);
598 			break;
599 		case GOTD_IMSG_PACKFILE_INSTALL:
600 			err = recv_packfile_install(&client_id, &imsg);
601 			if (err == NULL)
602 				do_packfile_install = 1;
603 			break;
604 		case GOTD_IMSG_REF_UPDATES_START:
605 			err = recv_ref_updates_start(&client_id, &imsg);
606 			if (err == NULL)
607 				do_ref_updates = 1;
608 			break;
609 		case GOTD_IMSG_REF_UPDATE:
610 			err = recv_ref_update(&client_id, &imsg);
611 			if (err == NULL)
612 				do_ref_update = 1;
613 			break;
614 		default:
615 			log_debug("unexpected imsg %d", imsg.hdr.type);
616 			break;
617 		}
618 
619 		if (do_disconnect) {
620 			if (err)
621 				disconnect_on_error(client, err);
622 			else
623 				disconnect(client);
624 		} else {
625 			if (do_packfile_install)
626 				err = install_pack(client,
627 				    gotd_session.repo->path, &imsg);
628 			else if (do_ref_updates)
629 				err = begin_ref_updates(client, &imsg);
630 			else if (do_ref_update)
631 				err = update_ref(&shut, client,
632 				    gotd_session.repo->path, &imsg);
633 			if (err)
634 				log_warnx("uid %d: %s", client->euid, err->msg);
635 		}
636 		imsg_free(&imsg);
637 	}
638 done:
639 	if (!shut) {
640 		gotd_imsg_event_add(iev);
641 	} else {
642 		/* This pipe is dead. Remove its event handler */
643 		event_del(&iev->ev);
644 		event_loopexit(NULL);
645 	}
646 }
647 
648 static const struct got_error *
649 recv_capabilities(struct gotd_session_client *client, struct imsg *imsg)
650 {
651 	struct gotd_imsg_capabilities icapas;
652 	size_t datalen;
653 
654 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
655 	if (datalen != sizeof(icapas))
656 		return got_error(GOT_ERR_PRIVSEP_LEN);
657 	memcpy(&icapas, imsg->data, sizeof(icapas));
658 
659 	client->ncapa_alloc = icapas.ncapabilities;
660 	client->capabilities = calloc(client->ncapa_alloc,
661 	    sizeof(*client->capabilities));
662 	if (client->capabilities == NULL) {
663 		client->ncapa_alloc = 0;
664 		return got_error_from_errno("calloc");
665 	}
666 
667 	log_debug("expecting %zu capabilities from uid %d",
668 	    client->ncapa_alloc, client->euid);
669 	return NULL;
670 }
671 
672 static const struct got_error *
673 recv_capability(struct gotd_session_client *client, struct imsg *imsg)
674 {
675 	struct gotd_imsg_capability icapa;
676 	struct gotd_client_capability *capa;
677 	size_t datalen;
678 	char *key, *value = NULL;
679 
680 	if (client->capabilities == NULL ||
681 	    client->ncapabilities >= client->ncapa_alloc) {
682 		return got_error_msg(GOT_ERR_BAD_REQUEST,
683 		    "unexpected capability received");
684 	}
685 
686 	memset(&icapa, 0, sizeof(icapa));
687 
688 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
689 	if (datalen < sizeof(icapa))
690 		return got_error(GOT_ERR_PRIVSEP_LEN);
691 	memcpy(&icapa, imsg->data, sizeof(icapa));
692 
693 	if (datalen != sizeof(icapa) + icapa.key_len + icapa.value_len)
694 		return got_error(GOT_ERR_PRIVSEP_LEN);
695 
696 	key = strndup(imsg->data + sizeof(icapa), icapa.key_len);
697 	if (key == NULL)
698 		return got_error_from_errno("strndup");
699 	if (icapa.value_len > 0) {
700 		value = strndup(imsg->data + sizeof(icapa) + icapa.key_len,
701 		    icapa.value_len);
702 		if (value == NULL) {
703 			free(key);
704 			return got_error_from_errno("strndup");
705 		}
706 	}
707 
708 	capa = &client->capabilities[client->ncapabilities++];
709 	capa->key = key;
710 	capa->value = value;
711 
712 	if (value)
713 		log_debug("uid %d: capability %s=%s", client->euid, key, value);
714 	else
715 		log_debug("uid %d: capability %s", client->euid, key);
716 
717 	return NULL;
718 }
719 
720 static const struct got_error *
721 ensure_client_is_reading(struct gotd_session_client *client)
722 {
723 	if (client->is_writing) {
724 		return got_error_fmt(GOT_ERR_BAD_PACKET,
725 		    "uid %d made a read-request but is not reading from "
726 		    "a repository", client->euid);
727 	}
728 
729 	return NULL;
730 }
731 
732 static const struct got_error *
733 ensure_client_is_writing(struct gotd_session_client *client)
734 {
735 	if (!client->is_writing) {
736 		return got_error_fmt(GOT_ERR_BAD_PACKET,
737 		    "uid %d made a write-request but is not writing to "
738 		    "a repository", client->euid);
739 	}
740 
741 	return NULL;
742 }
743 
744 static const struct got_error *
745 forward_want(struct gotd_session_client *client, struct imsg *imsg)
746 {
747 	struct gotd_imsg_want ireq;
748 	struct gotd_imsg_want iwant;
749 	size_t datalen;
750 
751 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
752 	if (datalen != sizeof(ireq))
753 		return got_error(GOT_ERR_PRIVSEP_LEN);
754 
755 	memcpy(&ireq, imsg->data, datalen);
756 
757 	memset(&iwant, 0, sizeof(iwant));
758 	memcpy(iwant.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
759 	iwant.client_id = client->id;
760 
761 	if (gotd_imsg_compose_event(&client->repo_child_iev, GOTD_IMSG_WANT,
762 	    PROC_SESSION, -1, &iwant, sizeof(iwant)) == -1)
763 		return got_error_from_errno("imsg compose WANT");
764 
765 	return NULL;
766 }
767 
768 static const struct got_error *
769 forward_ref_update(struct gotd_session_client *client, struct imsg *imsg)
770 {
771 	const struct got_error *err = NULL;
772 	struct gotd_imsg_ref_update ireq;
773 	struct gotd_imsg_ref_update *iref = NULL;
774 	size_t datalen;
775 
776 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
777 	if (datalen < sizeof(ireq))
778 		return got_error(GOT_ERR_PRIVSEP_LEN);
779 	memcpy(&ireq, imsg->data, sizeof(ireq));
780 	if (datalen != sizeof(ireq) + ireq.name_len)
781 		return got_error(GOT_ERR_PRIVSEP_LEN);
782 
783 	iref = malloc(datalen);
784 	if (iref == NULL)
785 		return got_error_from_errno("malloc");
786 	memcpy(iref, imsg->data, datalen);
787 
788 	iref->client_id = client->id;
789 	if (gotd_imsg_compose_event(&client->repo_child_iev,
790 	    GOTD_IMSG_REF_UPDATE, PROC_SESSION, -1, iref, datalen) == -1)
791 		err = got_error_from_errno("imsg compose REF_UPDATE");
792 	free(iref);
793 	return err;
794 }
795 
796 static const struct got_error *
797 forward_have(struct gotd_session_client *client, struct imsg *imsg)
798 {
799 	struct gotd_imsg_have ireq;
800 	struct gotd_imsg_have ihave;
801 	size_t datalen;
802 
803 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
804 	if (datalen != sizeof(ireq))
805 		return got_error(GOT_ERR_PRIVSEP_LEN);
806 
807 	memcpy(&ireq, imsg->data, datalen);
808 
809 	memset(&ihave, 0, sizeof(ihave));
810 	memcpy(ihave.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
811 	ihave.client_id = client->id;
812 
813 	if (gotd_imsg_compose_event(&client->repo_child_iev, GOTD_IMSG_HAVE,
814 	    PROC_SESSION, -1, &ihave, sizeof(ihave)) == -1)
815 		return got_error_from_errno("imsg compose HAVE");
816 
817 	return NULL;
818 }
819 
820 static int
821 client_has_capability(struct gotd_session_client *client, const char *capastr)
822 {
823 	struct gotd_client_capability *capa;
824 	size_t i;
825 
826 	if (client->ncapabilities == 0)
827 		return 0;
828 
829 	for (i = 0; i < client->ncapabilities; i++) {
830 		capa = &client->capabilities[i];
831 		if (strcmp(capa->key, capastr) == 0)
832 			return 1;
833 	}
834 
835 	return 0;
836 }
837 
838 static const struct got_error *
839 recv_packfile(struct gotd_session_client *client)
840 {
841 	const struct got_error *err = NULL;
842 	struct gotd_imsg_recv_packfile ipack;
843 	struct gotd_imsg_packfile_pipe ipipe;
844 	struct gotd_imsg_packidx_file ifile;
845 	char *basepath = NULL, *pack_path = NULL, *idx_path = NULL;
846 	int packfd = -1, idxfd = -1;
847 	int pipe[2] = { -1, -1 };
848 
849 	if (client->packfile_path) {
850 		return got_error_fmt(GOT_ERR_PRIVSEP_MSG,
851 		    "uid %d already has a pack file", client->euid);
852 	}
853 
854 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
855 		return got_error_from_errno("socketpair");
856 
857 	memset(&ipipe, 0, sizeof(ipipe));
858 	ipipe.client_id = client->id;
859 
860 	/* Send pack pipe end 0 to repo child process. */
861 	if (gotd_imsg_compose_event(&client->repo_child_iev,
862 	    GOTD_IMSG_PACKFILE_PIPE, PROC_SESSION, pipe[0],
863 	        &ipipe, sizeof(ipipe)) == -1) {
864 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
865 		pipe[0] = -1;
866 		goto done;
867 	}
868 	pipe[0] = -1;
869 
870 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
871 	if (gotd_imsg_compose_event(&client->iev,
872 	    GOTD_IMSG_PACKFILE_PIPE, PROC_SESSION, pipe[1], NULL, 0) == -1)
873 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
874 	pipe[1] = -1;
875 
876 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.pack",
877 	    got_repo_get_path(gotd_session.repo), GOT_OBJECTS_PACK_DIR,
878 	    client->euid) == -1) {
879 		err = got_error_from_errno("asprintf");
880 		goto done;
881 	}
882 
883 	err = got_opentemp_named_fd(&pack_path, &packfd, basepath, "");
884 	if (err)
885 		goto done;
886 	if (fchmod(packfd, GOT_DEFAULT_PACK_MODE) == -1) {
887 		err = got_error_from_errno2("fchmod", pack_path);
888 		goto done;
889 	}
890 
891 	free(basepath);
892 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.idx",
893 	    got_repo_get_path(gotd_session.repo), GOT_OBJECTS_PACK_DIR,
894 	    client->euid) == -1) {
895 		err = got_error_from_errno("asprintf");
896 		basepath = NULL;
897 		goto done;
898 	}
899 	err = got_opentemp_named_fd(&idx_path, &idxfd, basepath, "");
900 	if (err)
901 		goto done;
902 	if (fchmod(idxfd, GOT_DEFAULT_PACK_MODE) == -1) {
903 		err = got_error_from_errno2("fchmod", idx_path);
904 		goto done;
905 	}
906 
907 	memset(&ifile, 0, sizeof(ifile));
908 	ifile.client_id = client->id;
909 	if (gotd_imsg_compose_event(&client->repo_child_iev,
910 	    GOTD_IMSG_PACKIDX_FILE, PROC_SESSION,
911 	    idxfd, &ifile, sizeof(ifile)) == -1) {
912 		err = got_error_from_errno("imsg compose PACKIDX_FILE");
913 		idxfd = -1;
914 		goto done;
915 	}
916 	idxfd = -1;
917 
918 	memset(&ipack, 0, sizeof(ipack));
919 	ipack.client_id = client->id;
920 	if (client_has_capability(client, GOT_CAPA_REPORT_STATUS))
921 		ipack.report_status = 1;
922 
923 	if (gotd_imsg_compose_event(&client->repo_child_iev,
924 	    GOTD_IMSG_RECV_PACKFILE, PROC_SESSION, packfd,
925 	    &ipack, sizeof(ipack)) == -1) {
926 		err = got_error_from_errno("imsg compose RECV_PACKFILE");
927 		packfd = -1;
928 		goto done;
929 	}
930 	packfd = -1;
931 
932 done:
933 	free(basepath);
934 	if (pipe[0] != -1 && close(pipe[0]) == -1 && err == NULL)
935 		err = got_error_from_errno("close");
936 	if (pipe[1] != -1 && close(pipe[1]) == -1 && err == NULL)
937 		err = got_error_from_errno("close");
938 	if (packfd != -1 && close(packfd) == -1 && err == NULL)
939 		err = got_error_from_errno("close");
940 	if (idxfd != -1 && close(idxfd) == -1 && err == NULL)
941 		err = got_error_from_errno("close");
942 	if (err) {
943 		free(pack_path);
944 		free(idx_path);
945 	} else {
946 		client->packfile_path = pack_path;
947 		client->packidx_path = idx_path;
948 	}
949 	return err;
950 }
951 
952 static const struct got_error *
953 send_packfile(struct gotd_session_client *client)
954 {
955 	const struct got_error *err = NULL;
956 	struct gotd_imsg_send_packfile ipack;
957 	struct gotd_imsg_packfile_pipe ipipe;
958 	int pipe[2];
959 
960 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
961 		return got_error_from_errno("socketpair");
962 
963 	memset(&ipack, 0, sizeof(ipack));
964 	memset(&ipipe, 0, sizeof(ipipe));
965 
966 	ipack.client_id = client->id;
967 	if (client_has_capability(client, GOT_CAPA_SIDE_BAND_64K))
968 		ipack.report_progress = 1;
969 
970 	client->delta_cache_fd = got_opentempfd();
971 	if (client->delta_cache_fd == -1)
972 		return got_error_from_errno("got_opentempfd");
973 
974 	if (gotd_imsg_compose_event(&client->repo_child_iev,
975 	    GOTD_IMSG_SEND_PACKFILE, PROC_GOTD, client->delta_cache_fd,
976 	    &ipack, sizeof(ipack)) == -1) {
977 		err = got_error_from_errno("imsg compose SEND_PACKFILE");
978 		close(pipe[0]);
979 		close(pipe[1]);
980 		return err;
981 	}
982 
983 	ipipe.client_id = client->id;
984 
985 	/* Send pack pipe end 0 to repo child process. */
986 	if (gotd_imsg_compose_event(&client->repo_child_iev,
987 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD,
988 	    pipe[0], &ipipe, sizeof(ipipe)) == -1) {
989 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
990 		close(pipe[1]);
991 		return err;
992 	}
993 
994 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
995 	if (gotd_imsg_compose_event(&client->iev,
996 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD, pipe[1], NULL, 0) == -1)
997 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
998 
999 	return err;
1000 }
1001 
1002 static void
1003 session_dispatch_client(int fd, short events, void *arg)
1004 {
1005 	struct gotd_imsgev *iev = arg;
1006 	struct imsgbuf *ibuf = &iev->ibuf;
1007 	struct gotd_session_client *client = &gotd_session_client;
1008 	const struct got_error *err = NULL;
1009 	struct imsg imsg;
1010 	ssize_t n;
1011 
1012 	if (events & EV_WRITE) {
1013 		while (ibuf->w.queued) {
1014 			n = msgbuf_write(&ibuf->w);
1015 			if (n == -1 && errno == EPIPE) {
1016 				/*
1017 				 * The client has closed its socket.
1018 				 * This can happen when Git clients are
1019 				 * done sending pack file data.
1020 				 */
1021 				msgbuf_clear(&ibuf->w);
1022 				continue;
1023 			} else if (n == -1 && errno != EAGAIN) {
1024 				err = got_error_from_errno("imsg_flush");
1025 				disconnect_on_error(client, err);
1026 				return;
1027 			}
1028 			if (n == 0) {
1029 				/* Connection closed. */
1030 				err = got_error(GOT_ERR_EOF);
1031 				disconnect_on_error(client, err);
1032 				return;
1033 			}
1034 		}
1035 	}
1036 
1037 	if ((events & EV_READ) == 0)
1038 		return;
1039 
1040 	memset(&imsg, 0, sizeof(imsg));
1041 
1042 	while (err == NULL) {
1043 		err = gotd_imsg_recv(&imsg, ibuf, 0);
1044 		if (err) {
1045 			if (err->code == GOT_ERR_PRIVSEP_READ)
1046 				err = NULL;
1047 			break;
1048 		}
1049 
1050 		evtimer_del(&client->tmo);
1051 
1052 		switch (imsg.hdr.type) {
1053 		case GOTD_IMSG_CAPABILITIES:
1054 			if (client->state != GOTD_STATE_EXPECT_CAPABILITIES) {
1055 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1056 				    "unexpected capabilities received");
1057 				break;
1058 			}
1059 			log_debug("receiving capabilities from uid %d",
1060 			    client->euid);
1061 			err = recv_capabilities(client, &imsg);
1062 			break;
1063 		case GOTD_IMSG_CAPABILITY:
1064 			if (client->state != GOTD_STATE_EXPECT_CAPABILITIES) {
1065 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1066 				    "unexpected capability received");
1067 				break;
1068 			}
1069 			err = recv_capability(client, &imsg);
1070 			if (err || client->ncapabilities < client->ncapa_alloc)
1071 				break;
1072 			if (!client->is_writing) {
1073 				client->state = GOTD_STATE_EXPECT_WANT;
1074 				client->accept_flush_pkt = 1;
1075 				log_debug("uid %d: expecting want-lines",
1076 				    client->euid);
1077 			} else if (client->is_writing) {
1078 				client->state = GOTD_STATE_EXPECT_REF_UPDATE;
1079 				client->accept_flush_pkt = 1;
1080 				log_debug("uid %d: expecting ref-update-lines",
1081 				    client->euid);
1082 			} else
1083 				fatalx("client %d is both reading and writing",
1084 				    client->euid);
1085 			break;
1086 		case GOTD_IMSG_WANT:
1087 			if (client->state != GOTD_STATE_EXPECT_WANT) {
1088 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1089 				    "unexpected want-line received");
1090 				break;
1091 			}
1092 			log_debug("received want-line from uid %d",
1093 			    client->euid);
1094 			err = ensure_client_is_reading(client);
1095 			if (err)
1096 				break;
1097 			client->accept_flush_pkt = 1;
1098 			err = forward_want(client, &imsg);
1099 			break;
1100 		case GOTD_IMSG_REF_UPDATE:
1101 			if (client->state != GOTD_STATE_EXPECT_REF_UPDATE &&
1102 			    client->state !=
1103 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1104 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1105 				    "unexpected ref-update-line received");
1106 				break;
1107 			}
1108 			log_debug("received ref-update-line from uid %d",
1109 			    client->euid);
1110 			err = ensure_client_is_writing(client);
1111 			if (err)
1112 				break;
1113 			err = forward_ref_update(client, &imsg);
1114 			if (err)
1115 				break;
1116 			client->state = GOTD_STATE_EXPECT_MORE_REF_UPDATES;
1117 			client->accept_flush_pkt = 1;
1118 			break;
1119 		case GOTD_IMSG_HAVE:
1120 			if (client->state != GOTD_STATE_EXPECT_HAVE) {
1121 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1122 				    "unexpected have-line received");
1123 				break;
1124 			}
1125 			log_debug("received have-line from uid %d",
1126 			    client->euid);
1127 			err = ensure_client_is_reading(client);
1128 			if (err)
1129 				break;
1130 			err = forward_have(client, &imsg);
1131 			if (err)
1132 				break;
1133 			client->accept_flush_pkt = 1;
1134 			break;
1135 		case GOTD_IMSG_FLUSH:
1136 			if (client->state == GOTD_STATE_EXPECT_WANT ||
1137 			    client->state == GOTD_STATE_EXPECT_HAVE) {
1138 				err = ensure_client_is_reading(client);
1139 				if (err)
1140 					break;
1141 			} else if (client->state ==
1142 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1143 				err = ensure_client_is_writing(client);
1144 				if (err)
1145 					break;
1146 			} else if (client->state != GOTD_STATE_EXPECT_DONE) {
1147 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1148 				    "unexpected flush-pkt received");
1149 				break;
1150 			}
1151 			if (!client->accept_flush_pkt) {
1152 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1153 				    "unexpected flush-pkt received");
1154 				break;
1155 			}
1156 
1157 			/*
1158 			 * Accept just one flush packet at a time.
1159 			 * Future client state transitions will set this flag
1160 			 * again if another flush packet is expected.
1161 			 */
1162 			client->accept_flush_pkt = 0;
1163 
1164 			log_debug("received flush-pkt from uid %d",
1165 			    client->euid);
1166 			if (client->state == GOTD_STATE_EXPECT_WANT) {
1167 				client->state = GOTD_STATE_EXPECT_HAVE;
1168 				log_debug("uid %d: expecting have-lines",
1169 				    client->euid);
1170 			} else if (client->state == GOTD_STATE_EXPECT_HAVE) {
1171 				client->state = GOTD_STATE_EXPECT_DONE;
1172 				client->accept_flush_pkt = 1;
1173 				log_debug("uid %d: expecting 'done'",
1174 				    client->euid);
1175 			} else if (client->state ==
1176 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1177 				client->state = GOTD_STATE_EXPECT_PACKFILE;
1178 				log_debug("uid %d: expecting packfile",
1179 				    client->euid);
1180 				err = recv_packfile(client);
1181 			} else if (client->state != GOTD_STATE_EXPECT_DONE) {
1182 				/* should not happen, see above */
1183 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1184 				    "unexpected client state");
1185 				break;
1186 			}
1187 			break;
1188 		case GOTD_IMSG_DONE:
1189 			if (client->state != GOTD_STATE_EXPECT_HAVE &&
1190 			    client->state != GOTD_STATE_EXPECT_DONE) {
1191 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1192 				    "unexpected flush-pkt received");
1193 				break;
1194 			}
1195 			log_debug("received 'done' from uid %d", client->euid);
1196 			err = ensure_client_is_reading(client);
1197 			if (err)
1198 				break;
1199 			client->state = GOTD_STATE_DONE;
1200 			client->accept_flush_pkt = 1;
1201 			err = send_packfile(client);
1202 			break;
1203 		default:
1204 			log_debug("unexpected imsg %d", imsg.hdr.type);
1205 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1206 			break;
1207 		}
1208 
1209 		imsg_free(&imsg);
1210 	}
1211 
1212 	if (err) {
1213 		if (err->code != GOT_ERR_EOF ||
1214 		    client->state != GOTD_STATE_EXPECT_PACKFILE)
1215 			disconnect_on_error(client, err);
1216 	} else {
1217 		gotd_imsg_event_add(iev);
1218 		evtimer_add(&client->tmo, &gotd_session.request_timeout);
1219 	}
1220 }
1221 
1222 static const struct got_error *
1223 list_refs_request(void)
1224 {
1225 	static const struct got_error *err;
1226 	struct gotd_session_client *client = &gotd_session_client;
1227 	struct gotd_imsgev *iev = &client->repo_child_iev;
1228 	struct gotd_imsg_list_refs_internal ilref;
1229 	int fd;
1230 
1231 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1232 		return got_error(GOT_ERR_PRIVSEP_MSG);
1233 
1234 	memset(&ilref, 0, sizeof(ilref));
1235 	ilref.client_id = client->id;
1236 
1237 	fd = dup(client->fd);
1238 	if (fd == -1)
1239 		return got_error_from_errno("dup");
1240 
1241 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_LIST_REFS_INTERNAL,
1242 	    PROC_SESSION, fd, &ilref, sizeof(ilref)) == -1) {
1243 		err = got_error_from_errno("imsg compose LIST_REFS_INTERNAL");
1244 		close(fd);
1245 		return err;
1246 	}
1247 
1248 	client->state = GOTD_STATE_EXPECT_CAPABILITIES;
1249 	log_debug("uid %d: expecting capabilities", client->euid);
1250 	return NULL;
1251 }
1252 
1253 static const struct got_error *
1254 recv_connect(struct imsg *imsg)
1255 {
1256 	struct gotd_session_client *client = &gotd_session_client;
1257 	struct gotd_imsg_connect iconnect;
1258 	size_t datalen;
1259 
1260 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1261 		return got_error(GOT_ERR_PRIVSEP_MSG);
1262 
1263 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1264 	if (datalen != sizeof(iconnect))
1265 		return got_error(GOT_ERR_PRIVSEP_LEN);
1266 	memcpy(&iconnect, imsg->data, sizeof(iconnect));
1267 
1268 	if (imsg->fd == -1)
1269 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1270 
1271 	client->fd = imsg->fd;
1272 	client->euid = iconnect.euid;
1273 	client->egid = iconnect.egid;
1274 
1275 	imsg_init(&client->iev.ibuf, client->fd);
1276 	client->iev.handler = session_dispatch_client;
1277 	client->iev.events = EV_READ;
1278 	client->iev.handler_arg = NULL;
1279 	event_set(&client->iev.ev, client->iev.ibuf.fd, EV_READ,
1280 	    session_dispatch_client, &client->iev);
1281 	gotd_imsg_event_add(&client->iev);
1282 	evtimer_set(&client->tmo, gotd_request_timeout, client);
1283 
1284 	return NULL;
1285 }
1286 
1287 static const struct got_error *
1288 recv_repo_child(struct imsg *imsg)
1289 {
1290 	struct gotd_imsg_connect_repo_child ichild;
1291 	struct gotd_session_client *client = &gotd_session_client;
1292 	size_t datalen;
1293 
1294 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1295 		return got_error(GOT_ERR_PRIVSEP_MSG);
1296 
1297 	/* We should already have received a pipe to the listener. */
1298 	if (client->fd == -1)
1299 		return got_error(GOT_ERR_PRIVSEP_MSG);
1300 
1301 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1302 	if (datalen != sizeof(ichild))
1303 		return got_error(GOT_ERR_PRIVSEP_LEN);
1304 
1305 	memcpy(&ichild, imsg->data, sizeof(ichild));
1306 
1307 	client->id = ichild.client_id;
1308 	if (ichild.proc_id == PROC_REPO_WRITE)
1309 		client->is_writing = 1;
1310 	else if (ichild.proc_id == PROC_REPO_READ)
1311 		client->is_writing = 0;
1312 	else
1313 		return got_error_msg(GOT_ERR_PRIVSEP_MSG,
1314 		    "bad child process type");
1315 
1316 	if (imsg->fd == -1)
1317 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1318 
1319 	imsg_init(&client->repo_child_iev.ibuf, imsg->fd);
1320 	client->repo_child_iev.handler = session_dispatch_repo_child;
1321 	client->repo_child_iev.events = EV_READ;
1322 	client->repo_child_iev.handler_arg = NULL;
1323 	event_set(&client->repo_child_iev.ev, client->repo_child_iev.ibuf.fd,
1324 	    EV_READ, session_dispatch_repo_child, &client->repo_child_iev);
1325 	gotd_imsg_event_add(&client->repo_child_iev);
1326 
1327 	/* The "recvfd" pledge promise is no longer needed. */
1328 	if (pledge("stdio rpath wpath cpath sendfd fattr flock", NULL) == -1)
1329 		fatal("pledge");
1330 
1331 	return NULL;
1332 }
1333 
1334 static void
1335 session_dispatch(int fd, short event, void *arg)
1336 {
1337 	struct gotd_imsgev *iev = arg;
1338 	struct imsgbuf *ibuf = &iev->ibuf;
1339 	struct gotd_session_client *client = &gotd_session_client;
1340 	ssize_t n;
1341 	int shut = 0;
1342 	struct imsg imsg;
1343 
1344 	if (event & EV_READ) {
1345 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1346 			fatal("imsg_read error");
1347 		if (n == 0) {
1348 			/* Connection closed. */
1349 			shut = 1;
1350 			goto done;
1351 		}
1352 	}
1353 
1354 	if (event & EV_WRITE) {
1355 		n = msgbuf_write(&ibuf->w);
1356 		if (n == -1 && errno != EAGAIN)
1357 			fatal("msgbuf_write");
1358 		if (n == 0) {
1359 			/* Connection closed. */
1360 			shut = 1;
1361 			goto done;
1362 		}
1363 	}
1364 
1365 	for (;;) {
1366 		const struct got_error *err = NULL;
1367 		uint32_t client_id = 0;
1368 		int do_disconnect = 0, do_list_refs = 0;
1369 
1370 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1371 			fatal("%s: imsg_get error", __func__);
1372 		if (n == 0)	/* No more messages. */
1373 			break;
1374 
1375 		switch (imsg.hdr.type) {
1376 		case GOTD_IMSG_ERROR:
1377 			do_disconnect = 1;
1378 			err = gotd_imsg_recv_error(&client_id, &imsg);
1379 			break;
1380 		case GOTD_IMSG_CONNECT:
1381 			err = recv_connect(&imsg);
1382 			break;
1383 		case GOTD_IMSG_DISCONNECT:
1384 			do_disconnect = 1;
1385 			break;
1386 		case GOTD_IMSG_CONNECT_REPO_CHILD:
1387 			err = recv_repo_child(&imsg);
1388 			if (err)
1389 				break;
1390 			do_list_refs = 1;
1391 			break;
1392 		default:
1393 			log_debug("unexpected imsg %d", imsg.hdr.type);
1394 			break;
1395 		}
1396 		imsg_free(&imsg);
1397 
1398 		if (do_disconnect) {
1399 			if (err)
1400 				disconnect_on_error(client, err);
1401 			else
1402 				disconnect(client);
1403 		} else if (do_list_refs)
1404 			err = list_refs_request();
1405 
1406 		if (err)
1407 			log_warnx("uid %d: %s", client->euid, err->msg);
1408 	}
1409 done:
1410 	if (!shut) {
1411 		gotd_imsg_event_add(iev);
1412 	} else {
1413 		/* This pipe is dead. Remove its event handler */
1414 		event_del(&iev->ev);
1415 		event_loopexit(NULL);
1416 	}
1417 }
1418 
1419 void
1420 session_main(const char *title, const char *repo_path,
1421     int *pack_fds, int *temp_fds, struct timeval *request_timeout)
1422 {
1423 	const struct got_error *err = NULL;
1424 	struct event evsigint, evsigterm, evsighup, evsigusr1;
1425 
1426 	gotd_session.title = title;
1427 	gotd_session.pid = getpid();
1428 	gotd_session.pack_fds = pack_fds;
1429 	gotd_session.temp_fds = temp_fds;
1430 	memcpy(&gotd_session.request_timeout, request_timeout,
1431 	    sizeof(gotd_session.request_timeout));
1432 
1433 	err = got_repo_open(&gotd_session.repo, repo_path, NULL, pack_fds);
1434 	if (err)
1435 		goto done;
1436 	if (!got_repo_is_bare(gotd_session.repo)) {
1437 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
1438 		    "bare git repository required");
1439 		goto done;
1440 	}
1441 
1442 	got_repo_temp_fds_set(gotd_session.repo, temp_fds);
1443 
1444 	signal_set(&evsigint, SIGINT, gotd_session_sighdlr, NULL);
1445 	signal_set(&evsigterm, SIGTERM, gotd_session_sighdlr, NULL);
1446 	signal_set(&evsighup, SIGHUP, gotd_session_sighdlr, NULL);
1447 	signal_set(&evsigusr1, SIGUSR1, gotd_session_sighdlr, NULL);
1448 	signal(SIGPIPE, SIG_IGN);
1449 
1450 	signal_add(&evsigint, NULL);
1451 	signal_add(&evsigterm, NULL);
1452 	signal_add(&evsighup, NULL);
1453 	signal_add(&evsigusr1, NULL);
1454 
1455 	gotd_session_client.state = GOTD_STATE_EXPECT_LIST_REFS;
1456 	gotd_session_client.fd = -1;
1457 	gotd_session_client.nref_updates = -1;
1458 	gotd_session_client.delta_cache_fd = -1;
1459 	gotd_session_client.accept_flush_pkt = 1;
1460 
1461 	imsg_init(&gotd_session.parent_iev.ibuf, GOTD_FILENO_MSG_PIPE);
1462 	gotd_session.parent_iev.handler = session_dispatch;
1463 	gotd_session.parent_iev.events = EV_READ;
1464 	gotd_session.parent_iev.handler_arg = NULL;
1465 	event_set(&gotd_session.parent_iev.ev, gotd_session.parent_iev.ibuf.fd,
1466 	    EV_READ, session_dispatch, &gotd_session.parent_iev);
1467 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
1468 	    GOTD_IMSG_CLIENT_SESSION_READY, PROC_SESSION, -1, NULL, 0) == -1) {
1469 		err = got_error_from_errno("imsg compose CLIENT_SESSION_READY");
1470 		goto done;
1471 	}
1472 
1473 	event_dispatch();
1474 done:
1475 	if (err)
1476 		log_warnx("%s: %s", title, err->msg);
1477 	gotd_session_shutdown();
1478 }
1479 
1480 void
1481 gotd_session_shutdown(void)
1482 {
1483 	log_debug("shutting down");
1484 	if (gotd_session.repo)
1485 		got_repo_close(gotd_session.repo);
1486 	got_repo_pack_fds_close(gotd_session.pack_fds);
1487 	got_repo_temp_fds_close(gotd_session.temp_fds);
1488 	exit(0);
1489 }