Gotweb

Blob

Date:: Sat Mar 30 18:17:17 2024 UTC
Message:: portable: gotd: enable got-notify-http
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2022, 2023 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include "got_compat.h"
18 
19 #include <sys/types.h>
20 #include <sys/queue.h>
21 #include <sys/socket.h>
22 #include <sys/stat.h>
23 #include <sys/uio.h>
24 
25 #include <errno.h>
26 #include <event.h>
27 #include <limits.h>
28 #include <signal.h>
29 #include <stdint.h>
30 #include <stdio.h>
31 #include <stdlib.h>
32 #include <string.h>
33 #include <imsg.h>
34 #include <unistd.h>
35 
36 #include "got_error.h"
37 #include "got_repository.h"
38 #include "got_object.h"
39 #include "got_path.h"
40 #include "got_reference.h"
41 #include "got_opentemp.h"
42 
43 #include "got_lib_hash.h"
44 #include "got_lib_delta.h"
45 #include "got_lib_object.h"
46 #include "got_lib_object_cache.h"
47 #include "got_lib_pack.h"
48 #include "got_lib_repository.h"
49 #include "got_lib_gitproto.h"
50 
51 #include "gotd.h"
52 #include "log.h"
53 #include "session_read.h"
54 
55 enum gotd_session_read_state {
56 	GOTD_STATE_EXPECT_LIST_REFS,
57 	GOTD_STATE_EXPECT_CAPABILITIES,
58 	GOTD_STATE_EXPECT_WANT,
59 	GOTD_STATE_EXPECT_HAVE,
60 	GOTD_STATE_EXPECT_DONE,
61 	GOTD_STATE_DONE,
62 };
63 
64 static struct gotd_session_read {
65 	pid_t pid;
66 	const char *title;
67 	struct got_repository *repo;
68 	struct gotd_repo *repo_cfg;
69 	int *pack_fds;
70 	int *temp_fds;
71 	struct gotd_imsgev parent_iev;
72 	struct gotd_imsgev notifier_iev;
73 	struct timeval request_timeout;
74 	enum gotd_session_read_state state;
75 	struct gotd_imsgev repo_child_iev;
76 } gotd_session;
77 
78 static struct gotd_session_client {
79 	struct gotd_client_capability	*capabilities;
80 	size_t				 ncapa_alloc;
81 	size_t				 ncapabilities;
82 	uint32_t			 id;
83 	int				 fd;
84 	int				 delta_cache_fd;
85 	struct gotd_imsgev		 iev;
86 	struct event			 tmo;
87 	uid_t				 euid;
88 	gid_t				 egid;
89 	char				*username;
90 	char				*packfile_path;
91 	char				*packidx_path;
92 	int				 nref_updates;
93 	int				 accept_flush_pkt;
94 	int				 flush_disconnect;
95 } gotd_session_client;
96 
97 static void session_read_shutdown(void);
98 
99 static void
100 disconnect(struct gotd_session_client *client)
101 {
102 	log_debug("uid %d: disconnecting", client->euid);
103 
104 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
105 	    GOTD_IMSG_DISCONNECT, PROC_SESSION_READ, -1, NULL, 0) == -1)
106 		log_warn("imsg compose DISCONNECT");
107 
108 	imsg_clear(&gotd_session.repo_child_iev.ibuf);
109 	event_del(&gotd_session.repo_child_iev.ev);
110 	evtimer_del(&client->tmo);
111 	close(client->fd);
112 	if (client->delta_cache_fd != -1)
113 		close(client->delta_cache_fd);
114 	if (client->packfile_path) {
115 		if (unlink(client->packfile_path) == -1 && errno != ENOENT)
116 			log_warn("unlink %s: ", client->packfile_path);
117 		free(client->packfile_path);
118 	}
119 	if (client->packidx_path) {
120 		if (unlink(client->packidx_path) == -1 && errno != ENOENT)
121 			log_warn("unlink %s: ", client->packidx_path);
122 		free(client->packidx_path);
123 	}
124 	free(client->capabilities);
125 
126 	session_read_shutdown();
127 }
128 
129 static void
130 disconnect_on_error(struct gotd_session_client *client,
131     const struct got_error *err)
132 {
133 	struct imsgbuf ibuf;
134 
135 	if (err->code != GOT_ERR_EOF) {
136 		log_warnx("uid %d: %s", client->euid, err->msg);
137 		imsg_init(&ibuf, client->fd);
138 		gotd_imsg_send_error(&ibuf, 0, PROC_SESSION_READ, err);
139 		imsg_clear(&ibuf);
140 	}
141 
142 	disconnect(client);
143 }
144 
145 static void
146 gotd_request_timeout(int fd, short events, void *arg)
147 {
148 	struct gotd_session_client *client = arg;
149 
150 	log_debug("disconnecting uid %d due to timeout", client->euid);
151 	disconnect(client);
152 }
153 
154 static void
155 session_read_sighdlr(int sig, short event, void *arg)
156 {
157 	/*
158 	 * Normal signal handler rules don't apply because libevent
159 	 * decouples for us.
160 	 */
161 
162 	switch (sig) {
163 	case SIGHUP:
164 		log_info("%s: ignoring SIGHUP", __func__);
165 		break;
166 	case SIGUSR1:
167 		log_info("%s: ignoring SIGUSR1", __func__);
168 		break;
169 	case SIGTERM:
170 	case SIGINT:
171 		session_read_shutdown();
172 		/* NOTREACHED */
173 		break;
174 	default:
175 		fatalx("unexpected signal");
176 	}
177 }
178 
179 static const struct got_error *
180 recv_packfile_done(struct imsg *imsg)
181 {
182 	size_t datalen;
183 
184 	log_debug("packfile-done received");
185 
186 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
187 	if (datalen != 0)
188 		return got_error(GOT_ERR_PRIVSEP_LEN);
189 
190 	return NULL;
191 }
192 
193 static void
194 session_dispatch_repo_child(int fd, short event, void *arg)
195 {
196 	struct gotd_imsgev *iev = arg;
197 	struct imsgbuf *ibuf = &iev->ibuf;
198 	struct gotd_session_client *client = &gotd_session_client;
199 	ssize_t n;
200 	int shut = 0;
201 	struct imsg imsg;
202 
203 	if (event & EV_READ) {
204 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
205 			fatal("imsg_read error");
206 		if (n == 0) {
207 			/* Connection closed. */
208 			shut = 1;
209 			goto done;
210 		}
211 	}
212 
213 	if (event & EV_WRITE) {
214 		n = msgbuf_write(&ibuf->w);
215 		if (n == -1 && errno != EAGAIN)
216 			fatal("msgbuf_write");
217 		if (n == 0) {
218 			/* Connection closed. */
219 			shut = 1;
220 			goto done;
221 		}
222 	}
223 
224 	for (;;) {
225 		const struct got_error *err = NULL;
226 		uint32_t client_id = 0;
227 		int do_disconnect = 0;
228 
229 		if ((n = imsg_get(ibuf, &imsg)) == -1)
230 			fatal("%s: imsg_get error", __func__);
231 		if (n == 0)	/* No more messages. */
232 			break;
233 
234 		switch (imsg.hdr.type) {
235 		case GOTD_IMSG_ERROR:
236 			do_disconnect = 1;
237 			err = gotd_imsg_recv_error(&client_id, &imsg);
238 			break;
239 		case GOTD_IMSG_PACKFILE_DONE:
240 			do_disconnect = 1;
241 			err = recv_packfile_done(&imsg);
242 			break;
243 		default:
244 			log_debug("unexpected imsg %d", imsg.hdr.type);
245 			break;
246 		}
247 
248 		if (do_disconnect) {
249 			if (err)
250 				disconnect_on_error(client, err);
251 			else
252 				disconnect(client);
253 		} else {
254 			if (err)
255 				log_warnx("uid %d: %s", client->euid, err->msg);
256 		}
257 		imsg_free(&imsg);
258 	}
259 done:
260 	if (!shut) {
261 		gotd_imsg_event_add(iev);
262 	} else {
263 		/* This pipe is dead. Remove its event handler */
264 		event_del(&iev->ev);
265 		event_loopexit(NULL);
266 	}
267 }
268 
269 static const struct got_error *
270 recv_capabilities(struct gotd_session_client *client, struct imsg *imsg)
271 {
272 	struct gotd_imsg_capabilities icapas;
273 	size_t datalen;
274 
275 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
276 	if (datalen != sizeof(icapas))
277 		return got_error(GOT_ERR_PRIVSEP_LEN);
278 	memcpy(&icapas, imsg->data, sizeof(icapas));
279 
280 	client->ncapa_alloc = icapas.ncapabilities;
281 	client->capabilities = calloc(client->ncapa_alloc,
282 	    sizeof(*client->capabilities));
283 	if (client->capabilities == NULL) {
284 		client->ncapa_alloc = 0;
285 		return got_error_from_errno("calloc");
286 	}
287 
288 	log_debug("expecting %zu capabilities from uid %d",
289 	    client->ncapa_alloc, client->euid);
290 	return NULL;
291 }
292 
293 static const struct got_error *
294 recv_capability(struct gotd_session_client *client, struct imsg *imsg)
295 {
296 	struct gotd_imsg_capability icapa;
297 	struct gotd_client_capability *capa;
298 	size_t datalen;
299 	char *key, *value = NULL;
300 
301 	if (client->capabilities == NULL ||
302 	    client->ncapabilities >= client->ncapa_alloc) {
303 		return got_error_msg(GOT_ERR_BAD_REQUEST,
304 		    "unexpected capability received");
305 	}
306 
307 	memset(&icapa, 0, sizeof(icapa));
308 
309 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
310 	if (datalen < sizeof(icapa))
311 		return got_error(GOT_ERR_PRIVSEP_LEN);
312 	memcpy(&icapa, imsg->data, sizeof(icapa));
313 
314 	if (datalen != sizeof(icapa) + icapa.key_len + icapa.value_len)
315 		return got_error(GOT_ERR_PRIVSEP_LEN);
316 
317 	key = strndup(imsg->data + sizeof(icapa), icapa.key_len);
318 	if (key == NULL)
319 		return got_error_from_errno("strndup");
320 	if (icapa.value_len > 0) {
321 		value = strndup(imsg->data + sizeof(icapa) + icapa.key_len,
322 		    icapa.value_len);
323 		if (value == NULL) {
324 			free(key);
325 			return got_error_from_errno("strndup");
326 		}
327 	}
328 
329 	capa = &client->capabilities[client->ncapabilities++];
330 	capa->key = key;
331 	capa->value = value;
332 
333 	if (value)
334 		log_debug("uid %d: capability %s=%s", client->euid, key, value);
335 	else
336 		log_debug("uid %d: capability %s", client->euid, key);
337 
338 	return NULL;
339 }
340 
341 static const struct got_error *
342 forward_want(struct gotd_session_client *client, struct imsg *imsg)
343 {
344 	struct gotd_imsg_want ireq;
345 	struct gotd_imsg_want iwant;
346 	size_t datalen;
347 
348 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
349 	if (datalen != sizeof(ireq))
350 		return got_error(GOT_ERR_PRIVSEP_LEN);
351 
352 	memcpy(&ireq, imsg->data, datalen);
353 
354 	memset(&iwant, 0, sizeof(iwant));
355 	memcpy(iwant.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
356 
357 	if (gotd_imsg_compose_event(&gotd_session.repo_child_iev,
358 	    GOTD_IMSG_WANT, PROC_SESSION_READ, -1,
359 	    &iwant, sizeof(iwant)) == -1)
360 		return got_error_from_errno("imsg compose WANT");
361 
362 	return NULL;
363 }
364 
365 static const struct got_error *
366 forward_have(struct gotd_session_client *client, struct imsg *imsg)
367 {
368 	struct gotd_imsg_have ireq;
369 	struct gotd_imsg_have ihave;
370 	size_t datalen;
371 
372 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
373 	if (datalen != sizeof(ireq))
374 		return got_error(GOT_ERR_PRIVSEP_LEN);
375 
376 	memcpy(&ireq, imsg->data, datalen);
377 
378 	memset(&ihave, 0, sizeof(ihave));
379 	memcpy(ihave.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
380 
381 	if (gotd_imsg_compose_event(&gotd_session.repo_child_iev,
382 	    GOTD_IMSG_HAVE, PROC_SESSION_READ, -1,
383 	    &ihave, sizeof(ihave)) == -1)
384 		return got_error_from_errno("imsg compose HAVE");
385 
386 	return NULL;
387 }
388 
389 static int
390 client_has_capability(struct gotd_session_client *client, const char *capastr)
391 {
392 	struct gotd_client_capability *capa;
393 	size_t i;
394 
395 	if (client->ncapabilities == 0)
396 		return 0;
397 
398 	for (i = 0; i < client->ncapabilities; i++) {
399 		capa = &client->capabilities[i];
400 		if (strcmp(capa->key, capastr) == 0)
401 			return 1;
402 	}
403 
404 	return 0;
405 }
406 
407 static const struct got_error *
408 send_packfile(struct gotd_session_client *client)
409 {
410 	const struct got_error *err = NULL;
411 	struct gotd_imsg_send_packfile ipack;
412 	int pipe[2];
413 
414 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
415 		return got_error_from_errno("socketpair");
416 
417 	memset(&ipack, 0, sizeof(ipack));
418 
419 	if (client_has_capability(client, GOT_CAPA_SIDE_BAND_64K))
420 		ipack.report_progress = 1;
421 
422 	client->delta_cache_fd = got_opentempfd();
423 	if (client->delta_cache_fd == -1)
424 		return got_error_from_errno("got_opentempfd");
425 
426 	if (gotd_imsg_compose_event(&gotd_session.repo_child_iev,
427 	    GOTD_IMSG_SEND_PACKFILE, PROC_GOTD, client->delta_cache_fd,
428 	    &ipack, sizeof(ipack)) == -1) {
429 		err = got_error_from_errno("imsg compose SEND_PACKFILE");
430 		close(pipe[0]);
431 		close(pipe[1]);
432 		return err;
433 	}
434 
435 	/* Send pack pipe end 0 to repo child process. */
436 	if (gotd_imsg_compose_event(&gotd_session.repo_child_iev,
437 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD, pipe[0], NULL, 0) == -1) {
438 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
439 		close(pipe[1]);
440 		return err;
441 	}
442 
443 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
444 	if (gotd_imsg_compose_event(&client->iev,
445 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD, pipe[1], NULL, 0) == -1)
446 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
447 
448 	return err;
449 }
450 
451 static void
452 session_dispatch_client(int fd, short events, void *arg)
453 {
454 	struct gotd_imsgev *iev = arg;
455 	struct imsgbuf *ibuf = &iev->ibuf;
456 	struct gotd_session_client *client = &gotd_session_client;
457 	const struct got_error *err = NULL;
458 	struct imsg imsg;
459 	ssize_t n;
460 
461 	if (events & EV_WRITE) {
462 		while (ibuf->w.queued) {
463 			n = msgbuf_write(&ibuf->w);
464 			if (n == -1 && errno == EPIPE) {
465 				/*
466 				 * The client has closed its socket.
467 				 * This can happen when Git clients are
468 				 * done sending pack file data.
469 				 */
470 				msgbuf_clear(&ibuf->w);
471 				continue;
472 			} else if (n == -1 && errno != EAGAIN) {
473 				err = got_error_from_errno("imsg_flush");
474 				disconnect_on_error(client, err);
475 				return;
476 			}
477 			if (n == 0) {
478 				/* Connection closed. */
479 				err = got_error(GOT_ERR_EOF);
480 				disconnect_on_error(client, err);
481 				return;
482 			}
483 		}
484 
485 		if (client->flush_disconnect) {
486 			disconnect(client);
487 			return;
488 		}
489 	}
490 
491 	if ((events & EV_READ) == 0)
492 		return;
493 
494 	memset(&imsg, 0, sizeof(imsg));
495 
496 	while (err == NULL) {
497 		err = gotd_imsg_recv(&imsg, ibuf, 0);
498 		if (err) {
499 			if (err->code == GOT_ERR_PRIVSEP_READ)
500 				err = NULL;
501 			else if (err->code == GOT_ERR_EOF &&
502 			    gotd_session.state ==
503 			    GOTD_STATE_EXPECT_CAPABILITIES) {
504 				/*
505 				 * The client has closed its socket before
506 				 * sending its capability announcement.
507 				 * This can happen when Git clients have
508 				 * no ref-updates to send.
509 				 */
510 				disconnect_on_error(client, err);
511 				return;
512 			}
513 			break;
514 		}
515 
516 		evtimer_del(&client->tmo);
517 
518 		switch (imsg.hdr.type) {
519 		case GOTD_IMSG_CAPABILITIES:
520 			if (gotd_session.state !=
521 			    GOTD_STATE_EXPECT_CAPABILITIES) {
522 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
523 				    "unexpected capabilities received");
524 				break;
525 			}
526 			log_debug("receiving capabilities from uid %d",
527 			    client->euid);
528 			err = recv_capabilities(client, &imsg);
529 			break;
530 		case GOTD_IMSG_CAPABILITY:
531 			if (gotd_session.state != GOTD_STATE_EXPECT_CAPABILITIES) {
532 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
533 				    "unexpected capability received");
534 				break;
535 			}
536 			err = recv_capability(client, &imsg);
537 			if (err || client->ncapabilities < client->ncapa_alloc)
538 				break;
539 			gotd_session.state = GOTD_STATE_EXPECT_WANT;
540 			client->accept_flush_pkt = 1;
541 			log_debug("uid %d: expecting want-lines", client->euid);
542 			break;
543 		case GOTD_IMSG_WANT:
544 			if (gotd_session.state != GOTD_STATE_EXPECT_WANT) {
545 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
546 				    "unexpected want-line received");
547 				break;
548 			}
549 			log_debug("received want-line from uid %d",
550 			    client->euid);
551 			client->accept_flush_pkt = 1;
552 			err = forward_want(client, &imsg);
553 			break;
554 		case GOTD_IMSG_HAVE:
555 			if (gotd_session.state != GOTD_STATE_EXPECT_HAVE) {
556 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
557 				    "unexpected have-line received");
558 				break;
559 			}
560 			log_debug("received have-line from uid %d",
561 			    client->euid);
562 			err = forward_have(client, &imsg);
563 			if (err)
564 				break;
565 			client->accept_flush_pkt = 1;
566 			break;
567 		case GOTD_IMSG_FLUSH:
568 			if (gotd_session.state != GOTD_STATE_EXPECT_WANT && 
569 			    gotd_session.state != GOTD_STATE_EXPECT_HAVE &&
570 			    gotd_session.state != GOTD_STATE_EXPECT_DONE) {
571 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
572 				    "unexpected flush-pkt received");
573 				break;
574 			}
575 			if (!client->accept_flush_pkt) {
576 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
577 				    "unexpected flush-pkt received");
578 				break;
579 			}
580 
581 			/*
582 			 * Accept just one flush packet at a time.
583 			 * Future client state transitions will set this flag
584 			 * again if another flush packet is expected.
585 			 */
586 			client->accept_flush_pkt = 0;
587 
588 			log_debug("received flush-pkt from uid %d",
589 			    client->euid);
590 			if (gotd_session.state == GOTD_STATE_EXPECT_WANT) {
591 				gotd_session.state = GOTD_STATE_EXPECT_HAVE;
592 				log_debug("uid %d: expecting have-lines",
593 				    client->euid);
594 			} else if (gotd_session.state == GOTD_STATE_EXPECT_HAVE) {
595 				gotd_session.state = GOTD_STATE_EXPECT_DONE;
596 				client->accept_flush_pkt = 1;
597 				log_debug("uid %d: expecting 'done'",
598 				    client->euid);
599 			} else if (gotd_session.state != GOTD_STATE_EXPECT_DONE) {
600 				/* should not happen, see above */
601 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
602 				    "unexpected client state");
603 				break;
604 			}
605 			break;
606 		case GOTD_IMSG_DONE:
607 			if (gotd_session.state != GOTD_STATE_EXPECT_HAVE &&
608 			    gotd_session.state != GOTD_STATE_EXPECT_DONE) {
609 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
610 				    "unexpected flush-pkt received");
611 				break;
612 			}
613 			log_debug("received 'done' from uid %d", client->euid);
614 			gotd_session.state = GOTD_STATE_DONE;
615 			client->accept_flush_pkt = 1;
616 			err = send_packfile(client);
617 			break;
618 		default:
619 			log_debug("unexpected imsg %d", imsg.hdr.type);
620 			err = got_error(GOT_ERR_PRIVSEP_MSG);
621 			break;
622 		}
623 
624 		imsg_free(&imsg);
625 	}
626 
627 	if (err) {
628 		if (err->code != GOT_ERR_EOF)
629 			disconnect_on_error(client, err);
630 	} else {
631 		gotd_imsg_event_add(iev);
632 		evtimer_add(&client->tmo, &gotd_session.request_timeout);
633 	}
634 }
635 
636 static const struct got_error *
637 list_refs_request(void)
638 {
639 	static const struct got_error *err;
640 	struct gotd_session_client *client = &gotd_session_client;
641 	struct gotd_imsgev *iev = &gotd_session.repo_child_iev;
642 	int fd;
643 
644 	if (gotd_session.state != GOTD_STATE_EXPECT_LIST_REFS)
645 		return got_error(GOT_ERR_PRIVSEP_MSG);
646 
647 	fd = dup(client->fd);
648 	if (fd == -1)
649 		return got_error_from_errno("dup");
650 
651 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_LIST_REFS_INTERNAL,
652 	    PROC_SESSION_READ, fd, NULL, 0) == -1) {
653 		err = got_error_from_errno("imsg compose LIST_REFS_INTERNAL");
654 		close(fd);
655 		return err;
656 	}
657 
658 	gotd_session.state = GOTD_STATE_EXPECT_CAPABILITIES;
659 	log_debug("uid %d: expecting capabilities", client->euid);
660 	return NULL;
661 }
662 
663 static const struct got_error *
664 recv_connect(struct imsg *imsg)
665 {
666 	struct gotd_session_client *client = &gotd_session_client;
667 	struct gotd_imsg_connect iconnect;
668 	size_t datalen;
669 
670 	if (gotd_session.state != GOTD_STATE_EXPECT_LIST_REFS)
671 		return got_error(GOT_ERR_PRIVSEP_MSG);
672 
673 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
674 	if (datalen < sizeof(iconnect))
675 		return got_error(GOT_ERR_PRIVSEP_LEN);
676 	memcpy(&iconnect, imsg->data, sizeof(iconnect));
677 	if (iconnect.username_len == 0 ||
678 	    datalen != sizeof(iconnect) + iconnect.username_len)
679 		return got_error(GOT_ERR_PRIVSEP_LEN);
680 
681 	client->euid = iconnect.euid;
682 	client->egid = iconnect.egid;
683 	client->fd = imsg_get_fd(imsg);
684 	if (client->fd == -1)
685 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
686 
687 	client->username = strndup(imsg->data + sizeof(iconnect),
688 	    iconnect.username_len);
689 	if (client->username == NULL)
690 		return got_error_from_errno("strndup");
691 
692 	imsg_init(&client->iev.ibuf, client->fd);
693 	client->iev.handler = session_dispatch_client;
694 	client->iev.events = EV_READ;
695 	client->iev.handler_arg = NULL;
696 	event_set(&client->iev.ev, client->iev.ibuf.fd, EV_READ,
697 	    session_dispatch_client, &client->iev);
698 	gotd_imsg_event_add(&client->iev);
699 	evtimer_set(&client->tmo, gotd_request_timeout, client);
700 
701 	return NULL;
702 }
703 
704 static const struct got_error *
705 recv_repo_child(struct imsg *imsg)
706 {
707 	struct gotd_imsg_connect_repo_child ichild;
708 	struct gotd_session_client *client = &gotd_session_client;
709 	size_t datalen;
710 	int fd;
711 
712 	if (gotd_session.state != GOTD_STATE_EXPECT_LIST_REFS)
713 		return got_error(GOT_ERR_PRIVSEP_MSG);
714 
715 	/* We should already have received a pipe to the listener. */
716 	if (client->fd == -1)
717 		return got_error(GOT_ERR_PRIVSEP_MSG);
718 
719 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
720 	if (datalen != sizeof(ichild))
721 		return got_error(GOT_ERR_PRIVSEP_LEN);
722 
723 	memcpy(&ichild, imsg->data, sizeof(ichild));
724 
725 	if (ichild.proc_id != PROC_REPO_READ)
726 		return got_error_msg(GOT_ERR_PRIVSEP_MSG,
727 		    "bad child process type");
728 
729 	fd = imsg_get_fd(imsg);
730 	if (fd == -1)
731 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
732 
733 	imsg_init(&gotd_session.repo_child_iev.ibuf, fd);
734 	gotd_session.repo_child_iev.handler = session_dispatch_repo_child;
735 	gotd_session.repo_child_iev.events = EV_READ;
736 	gotd_session.repo_child_iev.handler_arg = NULL;
737 	event_set(&gotd_session.repo_child_iev.ev,
738 	    gotd_session.repo_child_iev.ibuf.fd, EV_READ,
739 	    session_dispatch_repo_child, &gotd_session.repo_child_iev);
740 	gotd_imsg_event_add(&gotd_session.repo_child_iev);
741 
742 	/* The "recvfd" pledge promise is no longer needed. */
743 	if (pledge("stdio rpath wpath cpath sendfd fattr flock", NULL) == -1)
744 		fatal("pledge");
745 
746 	return NULL;
747 }
748 
749 static void
750 session_dispatch(int fd, short event, void *arg)
751 {
752 	struct gotd_imsgev *iev = arg;
753 	struct imsgbuf *ibuf = &iev->ibuf;
754 	struct gotd_session_client *client = &gotd_session_client;
755 	ssize_t n;
756 	int shut = 0;
757 	struct imsg imsg;
758 
759 	if (event & EV_READ) {
760 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
761 			fatal("imsg_read error");
762 		if (n == 0) {
763 			/* Connection closed. */
764 			shut = 1;
765 			goto done;
766 		}
767 	}
768 
769 	if (event & EV_WRITE) {
770 		n = msgbuf_write(&ibuf->w);
771 		if (n == -1 && errno != EAGAIN)
772 			fatal("msgbuf_write");
773 		if (n == 0) {
774 			/* Connection closed. */
775 			shut = 1;
776 			goto done;
777 		}
778 	}
779 
780 	for (;;) {
781 		const struct got_error *err = NULL;
782 		uint32_t client_id = 0;
783 		int do_disconnect = 0, do_list_refs = 0;
784 
785 		if ((n = imsg_get(ibuf, &imsg)) == -1)
786 			fatal("%s: imsg_get error", __func__);
787 		if (n == 0)	/* No more messages. */
788 			break;
789 
790 		switch (imsg.hdr.type) {
791 		case GOTD_IMSG_ERROR:
792 			do_disconnect = 1;
793 			err = gotd_imsg_recv_error(&client_id, &imsg);
794 			break;
795 		case GOTD_IMSG_CONNECT:
796 			err = recv_connect(&imsg);
797 			break;
798 		case GOTD_IMSG_DISCONNECT:
799 			do_disconnect = 1;
800 			break;
801 		case GOTD_IMSG_CONNECT_REPO_CHILD:
802 			err = recv_repo_child(&imsg);
803 			if (err)
804 				break;
805 			do_list_refs = 1;
806 			break;
807 		default:
808 			log_debug("unexpected imsg %d", imsg.hdr.type);
809 			break;
810 		}
811 		imsg_free(&imsg);
812 
813 		if (do_disconnect) {
814 			if (err)
815 				disconnect_on_error(client, err);
816 			else
817 				disconnect(client);
818 		} else if (do_list_refs)
819 			err = list_refs_request();
820 
821 		if (err)
822 			log_warnx("uid %d: %s", client->euid, err->msg);
823 	}
824 done:
825 	if (!shut) {
826 		gotd_imsg_event_add(iev);
827 	} else {
828 		/* This pipe is dead. Remove its event handler */
829 		event_del(&iev->ev);
830 		event_loopexit(NULL);
831 	}
832 }
833 
834 void
835 session_read_main(const char *title, const char *repo_path,
836     int *pack_fds, int *temp_fds, struct timeval *request_timeout,
837     struct gotd_repo *repo_cfg)
838 {
839 	const struct got_error *err = NULL;
840 	struct event evsigint, evsigterm, evsighup, evsigusr1;
841 
842 	gotd_session.title = title;
843 	gotd_session.pid = getpid();
844 	gotd_session.pack_fds = pack_fds;
845 	gotd_session.temp_fds = temp_fds;
846 	memcpy(&gotd_session.request_timeout, request_timeout,
847 	    sizeof(gotd_session.request_timeout));
848 	gotd_session.repo_cfg = repo_cfg;
849 
850 	imsg_init(&gotd_session.notifier_iev.ibuf, -1);
851 
852 	err = got_repo_open(&gotd_session.repo, repo_path, NULL, pack_fds);
853 	if (err)
854 		goto done;
855 	if (!got_repo_is_bare(gotd_session.repo)) {
856 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
857 		    "bare git repository required");
858 		goto done;
859 	}
860 
861 	got_repo_temp_fds_set(gotd_session.repo, temp_fds);
862 
863 	signal_set(&evsigint, SIGINT, session_read_sighdlr, NULL);
864 	signal_set(&evsigterm, SIGTERM, session_read_sighdlr, NULL);
865 	signal_set(&evsighup, SIGHUP, session_read_sighdlr, NULL);
866 	signal_set(&evsigusr1, SIGUSR1, session_read_sighdlr, NULL);
867 	signal(SIGPIPE, SIG_IGN);
868 
869 	signal_add(&evsigint, NULL);
870 	signal_add(&evsigterm, NULL);
871 	signal_add(&evsighup, NULL);
872 	signal_add(&evsigusr1, NULL);
873 
874 	gotd_session.state = GOTD_STATE_EXPECT_LIST_REFS;
875 
876 	gotd_session_client.fd = -1;
877 	gotd_session_client.nref_updates = -1;
878 	gotd_session_client.delta_cache_fd = -1;
879 	gotd_session_client.accept_flush_pkt = 1;
880 
881 	imsg_init(&gotd_session.parent_iev.ibuf, GOTD_FILENO_MSG_PIPE);
882 	gotd_session.parent_iev.handler = session_dispatch;
883 	gotd_session.parent_iev.events = EV_READ;
884 	gotd_session.parent_iev.handler_arg = NULL;
885 	event_set(&gotd_session.parent_iev.ev, gotd_session.parent_iev.ibuf.fd,
886 	    EV_READ, session_dispatch, &gotd_session.parent_iev);
887 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
888 	    GOTD_IMSG_CLIENT_SESSION_READY, PROC_SESSION_READ,
889 	    -1, NULL, 0) == -1) {
890 		err = got_error_from_errno("imsg compose CLIENT_SESSION_READY");
891 		goto done;
892 	}
893 
894 	event_dispatch();
895 done:
896 	if (err)
897 		log_warnx("%s: %s", title, err->msg);
898 	session_read_shutdown();
899 }
900 
901 static void
902 session_read_shutdown(void)
903 {
904 	log_debug("%s: shutting down", gotd_session.title);
905 
906 	if (gotd_session.repo)
907 		got_repo_close(gotd_session.repo);
908 	got_repo_pack_fds_close(gotd_session.pack_fds);
909 	got_repo_temp_fds_close(gotd_session.temp_fds);
910 	free(gotd_session_client.username);
911 	exit(0);
912 }