Game of Trees Repos

Blob

Date:: Tue Aug 22 08:17:56 2023 UTC
Message:: make gotd flush pending messages before disconnecting the client upon success This prevents gotd from closing the client connection before ref-update status reports have been sent. Seen while testing gotd on Linux, though I see no obvious reason why this race would not trigger on OpenBSD.
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2022, 2023 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/queue.h>
19 #include <sys/tree.h>
20 #include <sys/socket.h>
21 #include <sys/stat.h>
22 #include <sys/uio.h>
23 
24 #include <errno.h>
25 #include <event.h>
26 #include <limits.h>
27 #include <sha1.h>
28 #include <sha2.h>
29 #include <signal.h>
30 #include <stdint.h>
31 #include <stdio.h>
32 #include <stdlib.h>
33 #include <string.h>
34 #include <imsg.h>
35 #include <unistd.h>
36 
37 #include "got_error.h"
38 #include "got_repository.h"
39 #include "got_object.h"
40 #include "got_path.h"
41 #include "got_reference.h"
42 #include "got_opentemp.h"
43 
44 #include "got_lib_hash.h"
45 #include "got_lib_delta.h"
46 #include "got_lib_object.h"
47 #include "got_lib_object_cache.h"
48 #include "got_lib_pack.h"
49 #include "got_lib_repository.h"
50 #include "got_lib_gitproto.h"
51 
52 #include "gotd.h"
53 #include "log.h"
54 #include "session.h"
55 
56 
57 static struct gotd_session {
58 	pid_t pid;
59 	const char *title;
60 	struct got_repository *repo;
61 	int *pack_fds;
62 	int *temp_fds;
63 	struct gotd_imsgev parent_iev;
64 	struct timeval request_timeout;
65 	enum gotd_procid proc_id;
66 } gotd_session;
67 
68 static struct gotd_session_client {
69 	enum gotd_session_state		 state;
70 	int				 is_writing;
71 	struct gotd_client_capability	*capabilities;
72 	size_t				 ncapa_alloc;
73 	size_t				 ncapabilities;
74 	uint32_t			 id;
75 	int				 fd;
76 	int				 delta_cache_fd;
77 	struct gotd_imsgev		 iev;
78 	struct gotd_imsgev		 repo_child_iev;
79 	struct event			 tmo;
80 	uid_t				 euid;
81 	gid_t				 egid;
82 	char				*packfile_path;
83 	char				*packidx_path;
84 	int				 nref_updates;
85 	int				 accept_flush_pkt;
86 	int				 flush_disconnect;
87 } gotd_session_client;
88 
89 void gotd_session_sighdlr(int sig, short event, void *arg);
90 static void gotd_session_shutdown(void);
91 
92 static void
93 disconnect(struct gotd_session_client *client)
94 {
95 	log_debug("uid %d: disconnecting", client->euid);
96 
97 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
98 	    GOTD_IMSG_DISCONNECT, gotd_session.proc_id, -1, NULL, 0) == -1)
99 		log_warn("imsg compose DISCONNECT");
100 
101 	imsg_clear(&client->repo_child_iev.ibuf);
102 	event_del(&client->repo_child_iev.ev);
103 	evtimer_del(&client->tmo);
104 	close(client->fd);
105 	if (client->delta_cache_fd != -1)
106 		close(client->delta_cache_fd);
107 	if (client->packfile_path) {
108 		if (unlink(client->packfile_path) == -1 && errno != ENOENT)
109 			log_warn("unlink %s: ", client->packfile_path);
110 		free(client->packfile_path);
111 	}
112 	if (client->packidx_path) {
113 		if (unlink(client->packidx_path) == -1 && errno != ENOENT)
114 			log_warn("unlink %s: ", client->packidx_path);
115 		free(client->packidx_path);
116 	}
117 	free(client->capabilities);
118 
119 	gotd_session_shutdown();
120 }
121 
122 static void
123 disconnect_on_error(struct gotd_session_client *client,
124     const struct got_error *err)
125 {
126 	struct imsgbuf ibuf;
127 
128 	if (err->code != GOT_ERR_EOF) {
129 		log_warnx("uid %d: %s", client->euid, err->msg);
130 		imsg_init(&ibuf, client->fd);
131 		gotd_imsg_send_error(&ibuf, 0, gotd_session.proc_id, err);
132 		imsg_clear(&ibuf);
133 	}
134 
135 	disconnect(client);
136 }
137 
138 static void
139 gotd_request_timeout(int fd, short events, void *arg)
140 {
141 	struct gotd_session_client *client = arg;
142 
143 	log_debug("disconnecting uid %d due to timeout", client->euid);
144 	disconnect(client);
145 }
146 
147 void
148 gotd_session_sighdlr(int sig, short event, void *arg)
149 {
150 	/*
151 	 * Normal signal handler rules don't apply because libevent
152 	 * decouples for us.
153 	 */
154 
155 	switch (sig) {
156 	case SIGHUP:
157 		log_info("%s: ignoring SIGHUP", __func__);
158 		break;
159 	case SIGUSR1:
160 		log_info("%s: ignoring SIGUSR1", __func__);
161 		break;
162 	case SIGTERM:
163 	case SIGINT:
164 		gotd_session_shutdown();
165 		/* NOTREACHED */
166 		break;
167 	default:
168 		fatalx("unexpected signal");
169 	}
170 }
171 
172 static const struct got_error *
173 recv_packfile_done(uint32_t *client_id, struct imsg *imsg)
174 {
175 	struct gotd_imsg_packfile_done idone;
176 	size_t datalen;
177 
178 	log_debug("packfile-done received");
179 
180 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
181 	if (datalen != sizeof(idone))
182 		return got_error(GOT_ERR_PRIVSEP_LEN);
183 	memcpy(&idone, imsg->data, sizeof(idone));
184 
185 	*client_id = idone.client_id;
186 	return NULL;
187 }
188 
189 static const struct got_error *
190 recv_packfile_install(uint32_t *client_id, struct imsg *imsg)
191 {
192 	struct gotd_imsg_packfile_install inst;
193 	size_t datalen;
194 
195 	log_debug("packfile-install received");
196 
197 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
198 	if (datalen != sizeof(inst))
199 		return got_error(GOT_ERR_PRIVSEP_LEN);
200 	memcpy(&inst, imsg->data, sizeof(inst));
201 
202 	*client_id = inst.client_id;
203 	return NULL;
204 }
205 
206 static const struct got_error *
207 recv_ref_updates_start(uint32_t *client_id, struct imsg *imsg)
208 {
209 	struct gotd_imsg_ref_updates_start istart;
210 	size_t datalen;
211 
212 	log_debug("ref-updates-start received");
213 
214 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
215 	if (datalen != sizeof(istart))
216 		return got_error(GOT_ERR_PRIVSEP_LEN);
217 	memcpy(&istart, imsg->data, sizeof(istart));
218 
219 	*client_id = istart.client_id;
220 	return NULL;
221 }
222 
223 static const struct got_error *
224 recv_ref_update(uint32_t *client_id, struct imsg *imsg)
225 {
226 	struct gotd_imsg_ref_update iref;
227 	size_t datalen;
228 
229 	log_debug("ref-update received");
230 
231 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
232 	if (datalen < sizeof(iref))
233 		return got_error(GOT_ERR_PRIVSEP_LEN);
234 	memcpy(&iref, imsg->data, sizeof(iref));
235 
236 	*client_id = iref.client_id;
237 	return NULL;
238 }
239 
240 static const struct got_error *
241 send_ref_update_ok(struct gotd_session_client *client,
242     struct gotd_imsg_ref_update *iref, const char *refname)
243 {
244 	struct gotd_imsg_ref_update_ok iok;
245 	struct gotd_imsgev *iev = &client->iev;
246 	struct ibuf *wbuf;
247 	size_t len;
248 
249 	memset(&iok, 0, sizeof(iok));
250 	iok.client_id = client->id;
251 	memcpy(iok.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
252 	memcpy(iok.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
253 	iok.name_len = strlen(refname);
254 
255 	len = sizeof(iok) + iok.name_len;
256 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE_OK,
257 	    gotd_session.proc_id, gotd_session.pid, len);
258 	if (wbuf == NULL)
259 		return got_error_from_errno("imsg_create REF_UPDATE_OK");
260 
261 	if (imsg_add(wbuf, &iok, sizeof(iok)) == -1)
262 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
263 	if (imsg_add(wbuf, refname, iok.name_len) == -1)
264 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
265 
266 	wbuf->fd = -1;
267 	imsg_close(&iev->ibuf, wbuf);
268 	gotd_imsg_event_add(iev);
269 	return NULL;
270 }
271 
272 static void
273 send_refs_updated(struct gotd_session_client *client)
274 {
275 	if (gotd_imsg_compose_event(&client->iev, GOTD_IMSG_REFS_UPDATED,
276 	    gotd_session.proc_id, -1, NULL, 0) == -1)
277 		log_warn("imsg compose REFS_UPDATED");
278 }
279 
280 static const struct got_error *
281 send_ref_update_ng(struct gotd_session_client *client,
282     struct gotd_imsg_ref_update *iref, const char *refname,
283     const char *reason)
284 {
285 	const struct got_error *ng_err;
286 	struct gotd_imsg_ref_update_ng ing;
287 	struct gotd_imsgev *iev = &client->iev;
288 	struct ibuf *wbuf;
289 	size_t len;
290 
291 	memset(&ing, 0, sizeof(ing));
292 	ing.client_id = client->id;
293 	memcpy(ing.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
294 	memcpy(ing.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
295 	ing.name_len = strlen(refname);
296 
297 	ng_err = got_error_fmt(GOT_ERR_REF_BUSY, "%s", reason);
298 	ing.reason_len = strlen(ng_err->msg);
299 
300 	len = sizeof(ing) + ing.name_len + ing.reason_len;
301 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE_NG,
302 	    gotd_session.proc_id, gotd_session.pid, len);
303 	if (wbuf == NULL)
304 		return got_error_from_errno("imsg_create REF_UPDATE_NG");
305 
306 	if (imsg_add(wbuf, &ing, sizeof(ing)) == -1)
307 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
308 	if (imsg_add(wbuf, refname, ing.name_len) == -1)
309 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
310 	if (imsg_add(wbuf, ng_err->msg, ing.reason_len) == -1)
311 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
312 
313 	wbuf->fd = -1;
314 	imsg_close(&iev->ibuf, wbuf);
315 	gotd_imsg_event_add(iev);
316 	return NULL;
317 }
318 
319 static const struct got_error *
320 install_pack(struct gotd_session_client *client, const char *repo_path,
321     struct imsg *imsg)
322 {
323 	const struct got_error *err = NULL;
324 	struct gotd_imsg_packfile_install inst;
325 	char hex[SHA1_DIGEST_STRING_LENGTH];
326 	size_t datalen;
327 	char *packfile_path = NULL, *packidx_path = NULL;
328 
329 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
330 	if (datalen != sizeof(inst))
331 		return got_error(GOT_ERR_PRIVSEP_LEN);
332 	memcpy(&inst, imsg->data, sizeof(inst));
333 
334 	if (client->packfile_path == NULL)
335 		return got_error_msg(GOT_ERR_BAD_REQUEST,
336 		    "client has no pack file");
337 	if (client->packidx_path == NULL)
338 		return got_error_msg(GOT_ERR_BAD_REQUEST,
339 		    "client has no pack file index");
340 
341 	if (got_sha1_digest_to_str(inst.pack_sha1, hex, sizeof(hex)) == NULL)
342 		return got_error_msg(GOT_ERR_NO_SPACE,
343 		    "could not convert pack file SHA1 to hex");
344 
345 	if (asprintf(&packfile_path, "/%s/%s/pack-%s.pack",
346 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
347 		err = got_error_from_errno("asprintf");
348 		goto done;
349 	}
350 
351 	if (asprintf(&packidx_path, "/%s/%s/pack-%s.idx",
352 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
353 		err = got_error_from_errno("asprintf");
354 		goto done;
355 	}
356 
357 	if (rename(client->packfile_path, packfile_path) == -1) {
358 		err = got_error_from_errno3("rename", client->packfile_path,
359 		    packfile_path);
360 		goto done;
361 	}
362 
363 	free(client->packfile_path);
364 	client->packfile_path = NULL;
365 
366 	if (rename(client->packidx_path, packidx_path) == -1) {
367 		err = got_error_from_errno3("rename", client->packidx_path,
368 		    packidx_path);
369 		goto done;
370 	}
371 
372 	free(client->packidx_path);
373 	client->packidx_path = NULL;
374 done:
375 	free(packfile_path);
376 	free(packidx_path);
377 	return err;
378 }
379 
380 static const struct got_error *
381 begin_ref_updates(struct gotd_session_client *client, struct imsg *imsg)
382 {
383 	struct gotd_imsg_ref_updates_start istart;
384 	size_t datalen;
385 
386 	if (client->nref_updates != -1)
387 		return got_error(GOT_ERR_PRIVSEP_MSG);
388 
389 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
390 	if (datalen != sizeof(istart))
391 		return got_error(GOT_ERR_PRIVSEP_LEN);
392 	memcpy(&istart, imsg->data, sizeof(istart));
393 
394 	if (istart.nref_updates <= 0)
395 		return got_error(GOT_ERR_PRIVSEP_MSG);
396 
397 	client->nref_updates = istart.nref_updates;
398 	return NULL;
399 }
400 
401 static const struct got_error *
402 update_ref(int *shut, struct gotd_session_client *client,
403     const char *repo_path, struct imsg *imsg)
404 {
405 	const struct got_error *err = NULL;
406 	struct got_repository *repo = NULL;
407 	struct got_reference *ref = NULL;
408 	struct gotd_imsg_ref_update iref;
409 	struct got_object_id old_id, new_id;
410 	struct got_object_id *id = NULL;
411 	struct got_object *obj = NULL;
412 	char *refname = NULL;
413 	size_t datalen;
414 	int locked = 0;
415 	char hex1[SHA1_DIGEST_STRING_LENGTH];
416 	char hex2[SHA1_DIGEST_STRING_LENGTH];
417 
418 	log_debug("update-ref from uid %d", client->euid);
419 
420 	if (client->nref_updates <= 0)
421 		return got_error(GOT_ERR_PRIVSEP_MSG);
422 
423 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
424 	if (datalen < sizeof(iref))
425 		return got_error(GOT_ERR_PRIVSEP_LEN);
426 	memcpy(&iref, imsg->data, sizeof(iref));
427 	if (datalen != sizeof(iref) + iref.name_len)
428 		return got_error(GOT_ERR_PRIVSEP_LEN);
429 	refname = strndup(imsg->data + sizeof(iref), iref.name_len);
430 	if (refname == NULL)
431 		return got_error_from_errno("strndup");
432 
433 	log_debug("updating ref %s for uid %d", refname, client->euid);
434 
435 	err = got_repo_open(&repo, repo_path, NULL, NULL);
436 	if (err)
437 		goto done;
438 
439 	memcpy(old_id.sha1, iref.old_id, SHA1_DIGEST_LENGTH);
440 	memcpy(new_id.sha1, iref.new_id, SHA1_DIGEST_LENGTH);
441 	err = got_object_open(&obj, repo,
442 	    iref.delete_ref ? &old_id : &new_id);
443 	if (err)
444 		goto done;
445 
446 	if (iref.ref_is_new) {
447 		err = got_ref_open(&ref, repo, refname, 0);
448 		if (err) {
449 			if (err->code != GOT_ERR_NOT_REF)
450 				goto done;
451 			err = got_ref_alloc(&ref, refname, &new_id);
452 			if (err)
453 				goto done;
454 			err = got_ref_write(ref, repo); /* will lock/unlock */
455 			if (err)
456 				goto done;
457 		} else {
458 			err = got_ref_resolve(&id, repo, ref);
459 			if (err)
460 				goto done;
461 			got_object_id_hex(&new_id, hex1, sizeof(hex1));
462 			got_object_id_hex(id, hex2, sizeof(hex2));
463 			err = got_error_fmt(GOT_ERR_REF_BUSY,
464 			    "Addition %s: %s failed; %s: %s has been "
465 			    "created by someone else while transaction "
466 			    "was in progress",
467 			    got_ref_get_name(ref), hex1,
468 			    got_ref_get_name(ref), hex2);
469 			goto done;
470 		}
471 	} else if (iref.delete_ref) {
472 		err = got_ref_open(&ref, repo, refname, 1 /* lock */);
473 		if (err)
474 			goto done;
475 		locked = 1;
476 
477 		err = got_ref_resolve(&id, repo, ref);
478 		if (err)
479 			goto done;
480 
481 		if (got_object_id_cmp(id, &old_id) != 0) {
482 			got_object_id_hex(&old_id, hex1, sizeof(hex1));
483 			got_object_id_hex(id, hex2, sizeof(hex2));
484 			err = got_error_fmt(GOT_ERR_REF_BUSY,
485 			    "Deletion %s: %s failed; %s: %s has been "
486 			    "created by someone else while transaction "
487 			    "was in progress",
488 			    got_ref_get_name(ref), hex1,
489 			    got_ref_get_name(ref), hex2);
490 			goto done;
491 		}
492 
493 		err = got_ref_delete(ref, repo);
494 		if (err)
495 			goto done;
496 
497 		free(id);
498 		id = NULL;
499 	} else {
500 		err = got_ref_open(&ref, repo, refname, 1 /* lock */);
501 		if (err)
502 			goto done;
503 		locked = 1;
504 
505 		err = got_ref_resolve(&id, repo, ref);
506 		if (err)
507 			goto done;
508 
509 		if (got_object_id_cmp(id, &old_id) != 0) {
510 			got_object_id_hex(&old_id, hex1, sizeof(hex1));
511 			got_object_id_hex(id, hex2, sizeof(hex2));
512 			err = got_error_fmt(GOT_ERR_REF_BUSY,
513 			    "Update %s: %s failed; %s: %s has been "
514 			    "created by someone else while transaction "
515 			    "was in progress",
516 			    got_ref_get_name(ref), hex1,
517 			    got_ref_get_name(ref), hex2);
518 			goto done;
519 		}
520 
521 		if (got_object_id_cmp(&new_id, &old_id) != 0) {
522 			err = got_ref_change_ref(ref, &new_id);
523 			if (err)
524 				goto done;
525 
526 			err = got_ref_write(ref, repo);
527 			if (err)
528 				goto done;
529 		}
530 
531 		free(id);
532 		id = NULL;
533 	}
534 done:
535 	if (err) {
536 		if (err->code == GOT_ERR_LOCKFILE_TIMEOUT) {
537 			err = got_error_fmt(GOT_ERR_LOCKFILE_TIMEOUT,
538 			    "could not acquire exclusive file lock for %s",
539 			    refname);
540 		}
541 		send_ref_update_ng(client, &iref, refname, err->msg);
542 	} else
543 		send_ref_update_ok(client, &iref, refname);
544 
545 	if (client->nref_updates > 0) {
546 		client->nref_updates--;
547 		if (client->nref_updates == 0) {
548 			send_refs_updated(client);
549 			client->flush_disconnect = 1;
550 		}
551 
552 	}
553 	if (locked) {
554 		const struct got_error *unlock_err;
555 		unlock_err = got_ref_unlock(ref);
556 		if (unlock_err && err == NULL)
557 			err = unlock_err;
558 	}
559 	if (ref)
560 		got_ref_close(ref);
561 	if (obj)
562 		got_object_close(obj);
563 	if (repo)
564 		got_repo_close(repo);
565 	free(refname);
566 	free(id);
567 	return err;
568 }
569 
570 static void
571 session_dispatch_repo_child(int fd, short event, void *arg)
572 {
573 	struct gotd_imsgev *iev = arg;
574 	struct imsgbuf *ibuf = &iev->ibuf;
575 	struct gotd_session_client *client = &gotd_session_client;
576 	ssize_t n;
577 	int shut = 0;
578 	struct imsg imsg;
579 
580 	if (event & EV_READ) {
581 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
582 			fatal("imsg_read error");
583 		if (n == 0) {
584 			/* Connection closed. */
585 			shut = 1;
586 			goto done;
587 		}
588 	}
589 
590 	if (event & EV_WRITE) {
591 		n = msgbuf_write(&ibuf->w);
592 		if (n == -1 && errno != EAGAIN)
593 			fatal("msgbuf_write");
594 		if (n == 0) {
595 			/* Connection closed. */
596 			shut = 1;
597 			goto done;
598 		}
599 	}
600 
601 	for (;;) {
602 		const struct got_error *err = NULL;
603 		uint32_t client_id = 0;
604 		int do_disconnect = 0;
605 		int do_ref_updates = 0, do_ref_update = 0;
606 		int do_packfile_install = 0;
607 
608 		if ((n = imsg_get(ibuf, &imsg)) == -1)
609 			fatal("%s: imsg_get error", __func__);
610 		if (n == 0)	/* No more messages. */
611 			break;
612 
613 		switch (imsg.hdr.type) {
614 		case GOTD_IMSG_ERROR:
615 			do_disconnect = 1;
616 			err = gotd_imsg_recv_error(&client_id, &imsg);
617 			break;
618 		case GOTD_IMSG_PACKFILE_DONE:
619 			do_disconnect = 1;
620 			err = recv_packfile_done(&client_id, &imsg);
621 			break;
622 		case GOTD_IMSG_PACKFILE_INSTALL:
623 			err = recv_packfile_install(&client_id, &imsg);
624 			if (err == NULL)
625 				do_packfile_install = 1;
626 			break;
627 		case GOTD_IMSG_REF_UPDATES_START:
628 			err = recv_ref_updates_start(&client_id, &imsg);
629 			if (err == NULL)
630 				do_ref_updates = 1;
631 			break;
632 		case GOTD_IMSG_REF_UPDATE:
633 			err = recv_ref_update(&client_id, &imsg);
634 			if (err == NULL)
635 				do_ref_update = 1;
636 			break;
637 		default:
638 			log_debug("unexpected imsg %d", imsg.hdr.type);
639 			break;
640 		}
641 
642 		if (do_disconnect) {
643 			if (err)
644 				disconnect_on_error(client, err);
645 			else
646 				disconnect(client);
647 		} else {
648 			if (do_packfile_install)
649 				err = install_pack(client,
650 				    gotd_session.repo->path, &imsg);
651 			else if (do_ref_updates)
652 				err = begin_ref_updates(client, &imsg);
653 			else if (do_ref_update)
654 				err = update_ref(&shut, client,
655 				    gotd_session.repo->path, &imsg);
656 			if (err)
657 				log_warnx("uid %d: %s", client->euid, err->msg);
658 		}
659 		imsg_free(&imsg);
660 	}
661 done:
662 	if (!shut) {
663 		gotd_imsg_event_add(iev);
664 	} else {
665 		/* This pipe is dead. Remove its event handler */
666 		event_del(&iev->ev);
667 		event_loopexit(NULL);
668 	}
669 }
670 
671 static const struct got_error *
672 recv_capabilities(struct gotd_session_client *client, struct imsg *imsg)
673 {
674 	struct gotd_imsg_capabilities icapas;
675 	size_t datalen;
676 
677 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
678 	if (datalen != sizeof(icapas))
679 		return got_error(GOT_ERR_PRIVSEP_LEN);
680 	memcpy(&icapas, imsg->data, sizeof(icapas));
681 
682 	client->ncapa_alloc = icapas.ncapabilities;
683 	client->capabilities = calloc(client->ncapa_alloc,
684 	    sizeof(*client->capabilities));
685 	if (client->capabilities == NULL) {
686 		client->ncapa_alloc = 0;
687 		return got_error_from_errno("calloc");
688 	}
689 
690 	log_debug("expecting %zu capabilities from uid %d",
691 	    client->ncapa_alloc, client->euid);
692 	return NULL;
693 }
694 
695 static const struct got_error *
696 recv_capability(struct gotd_session_client *client, struct imsg *imsg)
697 {
698 	struct gotd_imsg_capability icapa;
699 	struct gotd_client_capability *capa;
700 	size_t datalen;
701 	char *key, *value = NULL;
702 
703 	if (client->capabilities == NULL ||
704 	    client->ncapabilities >= client->ncapa_alloc) {
705 		return got_error_msg(GOT_ERR_BAD_REQUEST,
706 		    "unexpected capability received");
707 	}
708 
709 	memset(&icapa, 0, sizeof(icapa));
710 
711 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
712 	if (datalen < sizeof(icapa))
713 		return got_error(GOT_ERR_PRIVSEP_LEN);
714 	memcpy(&icapa, imsg->data, sizeof(icapa));
715 
716 	if (datalen != sizeof(icapa) + icapa.key_len + icapa.value_len)
717 		return got_error(GOT_ERR_PRIVSEP_LEN);
718 
719 	key = strndup(imsg->data + sizeof(icapa), icapa.key_len);
720 	if (key == NULL)
721 		return got_error_from_errno("strndup");
722 	if (icapa.value_len > 0) {
723 		value = strndup(imsg->data + sizeof(icapa) + icapa.key_len,
724 		    icapa.value_len);
725 		if (value == NULL) {
726 			free(key);
727 			return got_error_from_errno("strndup");
728 		}
729 	}
730 
731 	capa = &client->capabilities[client->ncapabilities++];
732 	capa->key = key;
733 	capa->value = value;
734 
735 	if (value)
736 		log_debug("uid %d: capability %s=%s", client->euid, key, value);
737 	else
738 		log_debug("uid %d: capability %s", client->euid, key);
739 
740 	return NULL;
741 }
742 
743 static const struct got_error *
744 ensure_client_is_reading(struct gotd_session_client *client)
745 {
746 	if (client->is_writing) {
747 		return got_error_fmt(GOT_ERR_BAD_PACKET,
748 		    "uid %d made a read-request but is not reading from "
749 		    "a repository", client->euid);
750 	}
751 
752 	return NULL;
753 }
754 
755 static const struct got_error *
756 ensure_client_is_writing(struct gotd_session_client *client)
757 {
758 	if (!client->is_writing) {
759 		return got_error_fmt(GOT_ERR_BAD_PACKET,
760 		    "uid %d made a write-request but is not writing to "
761 		    "a repository", client->euid);
762 	}
763 
764 	return NULL;
765 }
766 
767 static const struct got_error *
768 forward_want(struct gotd_session_client *client, struct imsg *imsg)
769 {
770 	struct gotd_imsg_want ireq;
771 	struct gotd_imsg_want iwant;
772 	size_t datalen;
773 
774 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
775 	if (datalen != sizeof(ireq))
776 		return got_error(GOT_ERR_PRIVSEP_LEN);
777 
778 	memcpy(&ireq, imsg->data, datalen);
779 
780 	memset(&iwant, 0, sizeof(iwant));
781 	memcpy(iwant.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
782 	iwant.client_id = client->id;
783 
784 	if (gotd_imsg_compose_event(&client->repo_child_iev, GOTD_IMSG_WANT,
785 	    gotd_session.proc_id, -1, &iwant, sizeof(iwant)) == -1)
786 		return got_error_from_errno("imsg compose WANT");
787 
788 	return NULL;
789 }
790 
791 static const struct got_error *
792 forward_ref_update(struct gotd_session_client *client, struct imsg *imsg)
793 {
794 	const struct got_error *err = NULL;
795 	struct gotd_imsg_ref_update ireq;
796 	struct gotd_imsg_ref_update *iref = NULL;
797 	size_t datalen;
798 
799 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
800 	if (datalen < sizeof(ireq))
801 		return got_error(GOT_ERR_PRIVSEP_LEN);
802 	memcpy(&ireq, imsg->data, sizeof(ireq));
803 	if (datalen != sizeof(ireq) + ireq.name_len)
804 		return got_error(GOT_ERR_PRIVSEP_LEN);
805 
806 	iref = malloc(datalen);
807 	if (iref == NULL)
808 		return got_error_from_errno("malloc");
809 	memcpy(iref, imsg->data, datalen);
810 
811 	iref->client_id = client->id;
812 	if (gotd_imsg_compose_event(&client->repo_child_iev,
813 	    GOTD_IMSG_REF_UPDATE, gotd_session.proc_id, -1,
814 	    iref, datalen) == -1)
815 		err = got_error_from_errno("imsg compose REF_UPDATE");
816 	free(iref);
817 	return err;
818 }
819 
820 static const struct got_error *
821 forward_have(struct gotd_session_client *client, struct imsg *imsg)
822 {
823 	struct gotd_imsg_have ireq;
824 	struct gotd_imsg_have ihave;
825 	size_t datalen;
826 
827 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
828 	if (datalen != sizeof(ireq))
829 		return got_error(GOT_ERR_PRIVSEP_LEN);
830 
831 	memcpy(&ireq, imsg->data, datalen);
832 
833 	memset(&ihave, 0, sizeof(ihave));
834 	memcpy(ihave.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
835 	ihave.client_id = client->id;
836 
837 	if (gotd_imsg_compose_event(&client->repo_child_iev, GOTD_IMSG_HAVE,
838 	    gotd_session.proc_id, -1, &ihave, sizeof(ihave)) == -1)
839 		return got_error_from_errno("imsg compose HAVE");
840 
841 	return NULL;
842 }
843 
844 static int
845 client_has_capability(struct gotd_session_client *client, const char *capastr)
846 {
847 	struct gotd_client_capability *capa;
848 	size_t i;
849 
850 	if (client->ncapabilities == 0)
851 		return 0;
852 
853 	for (i = 0; i < client->ncapabilities; i++) {
854 		capa = &client->capabilities[i];
855 		if (strcmp(capa->key, capastr) == 0)
856 			return 1;
857 	}
858 
859 	return 0;
860 }
861 
862 static const struct got_error *
863 recv_packfile(struct gotd_session_client *client)
864 {
865 	const struct got_error *err = NULL;
866 	struct gotd_imsg_recv_packfile ipack;
867 	struct gotd_imsg_packfile_pipe ipipe;
868 	struct gotd_imsg_packidx_file ifile;
869 	char *basepath = NULL, *pack_path = NULL, *idx_path = NULL;
870 	int packfd = -1, idxfd = -1;
871 	int pipe[2] = { -1, -1 };
872 
873 	if (client->packfile_path) {
874 		return got_error_fmt(GOT_ERR_PRIVSEP_MSG,
875 		    "uid %d already has a pack file", client->euid);
876 	}
877 
878 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
879 		return got_error_from_errno("socketpair");
880 
881 	memset(&ipipe, 0, sizeof(ipipe));
882 	ipipe.client_id = client->id;
883 
884 	/* Send pack pipe end 0 to repo child process. */
885 	if (gotd_imsg_compose_event(&client->repo_child_iev,
886 	    GOTD_IMSG_PACKFILE_PIPE, gotd_session.proc_id, pipe[0],
887 	        &ipipe, sizeof(ipipe)) == -1) {
888 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
889 		pipe[0] = -1;
890 		goto done;
891 	}
892 	pipe[0] = -1;
893 
894 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
895 	if (gotd_imsg_compose_event(&client->iev,
896 	    GOTD_IMSG_PACKFILE_PIPE, gotd_session.proc_id, pipe[1],
897 	    NULL, 0) == -1)
898 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
899 	pipe[1] = -1;
900 
901 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.pack",
902 	    got_repo_get_path(gotd_session.repo), GOT_OBJECTS_PACK_DIR,
903 	    client->euid) == -1) {
904 		err = got_error_from_errno("asprintf");
905 		goto done;
906 	}
907 
908 	err = got_opentemp_named_fd(&pack_path, &packfd, basepath, "");
909 	if (err)
910 		goto done;
911 	if (fchmod(packfd, GOT_DEFAULT_PACK_MODE) == -1) {
912 		err = got_error_from_errno2("fchmod", pack_path);
913 		goto done;
914 	}
915 
916 	free(basepath);
917 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.idx",
918 	    got_repo_get_path(gotd_session.repo), GOT_OBJECTS_PACK_DIR,
919 	    client->euid) == -1) {
920 		err = got_error_from_errno("asprintf");
921 		basepath = NULL;
922 		goto done;
923 	}
924 	err = got_opentemp_named_fd(&idx_path, &idxfd, basepath, "");
925 	if (err)
926 		goto done;
927 	if (fchmod(idxfd, GOT_DEFAULT_PACK_MODE) == -1) {
928 		err = got_error_from_errno2("fchmod", idx_path);
929 		goto done;
930 	}
931 
932 	memset(&ifile, 0, sizeof(ifile));
933 	ifile.client_id = client->id;
934 	if (gotd_imsg_compose_event(&client->repo_child_iev,
935 	    GOTD_IMSG_PACKIDX_FILE, gotd_session.proc_id,
936 	    idxfd, &ifile, sizeof(ifile)) == -1) {
937 		err = got_error_from_errno("imsg compose PACKIDX_FILE");
938 		idxfd = -1;
939 		goto done;
940 	}
941 	idxfd = -1;
942 
943 	memset(&ipack, 0, sizeof(ipack));
944 	ipack.client_id = client->id;
945 	if (client_has_capability(client, GOT_CAPA_REPORT_STATUS))
946 		ipack.report_status = 1;
947 
948 	if (gotd_imsg_compose_event(&client->repo_child_iev,
949 	    GOTD_IMSG_RECV_PACKFILE, gotd_session.proc_id, packfd,
950 	    &ipack, sizeof(ipack)) == -1) {
951 		err = got_error_from_errno("imsg compose RECV_PACKFILE");
952 		packfd = -1;
953 		goto done;
954 	}
955 	packfd = -1;
956 
957 done:
958 	free(basepath);
959 	if (pipe[0] != -1 && close(pipe[0]) == -1 && err == NULL)
960 		err = got_error_from_errno("close");
961 	if (pipe[1] != -1 && close(pipe[1]) == -1 && err == NULL)
962 		err = got_error_from_errno("close");
963 	if (packfd != -1 && close(packfd) == -1 && err == NULL)
964 		err = got_error_from_errno("close");
965 	if (idxfd != -1 && close(idxfd) == -1 && err == NULL)
966 		err = got_error_from_errno("close");
967 	if (err) {
968 		free(pack_path);
969 		free(idx_path);
970 	} else {
971 		client->packfile_path = pack_path;
972 		client->packidx_path = idx_path;
973 	}
974 	return err;
975 }
976 
977 static const struct got_error *
978 send_packfile(struct gotd_session_client *client)
979 {
980 	const struct got_error *err = NULL;
981 	struct gotd_imsg_send_packfile ipack;
982 	struct gotd_imsg_packfile_pipe ipipe;
983 	int pipe[2];
984 
985 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
986 		return got_error_from_errno("socketpair");
987 
988 	memset(&ipack, 0, sizeof(ipack));
989 	memset(&ipipe, 0, sizeof(ipipe));
990 
991 	ipack.client_id = client->id;
992 	if (client_has_capability(client, GOT_CAPA_SIDE_BAND_64K))
993 		ipack.report_progress = 1;
994 
995 	client->delta_cache_fd = got_opentempfd();
996 	if (client->delta_cache_fd == -1)
997 		return got_error_from_errno("got_opentempfd");
998 
999 	if (gotd_imsg_compose_event(&client->repo_child_iev,
1000 	    GOTD_IMSG_SEND_PACKFILE, PROC_GOTD, client->delta_cache_fd,
1001 	    &ipack, sizeof(ipack)) == -1) {
1002 		err = got_error_from_errno("imsg compose SEND_PACKFILE");
1003 		close(pipe[0]);
1004 		close(pipe[1]);
1005 		return err;
1006 	}
1007 
1008 	ipipe.client_id = client->id;
1009 
1010 	/* Send pack pipe end 0 to repo child process. */
1011 	if (gotd_imsg_compose_event(&client->repo_child_iev,
1012 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD,
1013 	    pipe[0], &ipipe, sizeof(ipipe)) == -1) {
1014 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
1015 		close(pipe[1]);
1016 		return err;
1017 	}
1018 
1019 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
1020 	if (gotd_imsg_compose_event(&client->iev,
1021 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD, pipe[1], NULL, 0) == -1)
1022 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
1023 
1024 	return err;
1025 }
1026 
1027 static void
1028 session_dispatch_client(int fd, short events, void *arg)
1029 {
1030 	struct gotd_imsgev *iev = arg;
1031 	struct imsgbuf *ibuf = &iev->ibuf;
1032 	struct gotd_session_client *client = &gotd_session_client;
1033 	const struct got_error *err = NULL;
1034 	struct imsg imsg;
1035 	ssize_t n;
1036 
1037 	if (events & EV_WRITE) {
1038 		while (ibuf->w.queued) {
1039 			n = msgbuf_write(&ibuf->w);
1040 			if (n == -1 && errno == EPIPE) {
1041 				/*
1042 				 * The client has closed its socket.
1043 				 * This can happen when Git clients are
1044 				 * done sending pack file data.
1045 				 */
1046 				msgbuf_clear(&ibuf->w);
1047 				continue;
1048 			} else if (n == -1 && errno != EAGAIN) {
1049 				err = got_error_from_errno("imsg_flush");
1050 				disconnect_on_error(client, err);
1051 				return;
1052 			}
1053 			if (n == 0) {
1054 				/* Connection closed. */
1055 				err = got_error(GOT_ERR_EOF);
1056 				disconnect_on_error(client, err);
1057 				return;
1058 			}
1059 		}
1060 
1061 		if (client->flush_disconnect) {
1062 			disconnect(client);
1063 			return;
1064 		}
1065 	}
1066 
1067 	if ((events & EV_READ) == 0)
1068 		return;
1069 
1070 	memset(&imsg, 0, sizeof(imsg));
1071 
1072 	while (err == NULL) {
1073 		err = gotd_imsg_recv(&imsg, ibuf, 0);
1074 		if (err) {
1075 			if (err->code == GOT_ERR_PRIVSEP_READ)
1076 				err = NULL;
1077 			else if (err->code == GOT_ERR_EOF &&
1078 			    client->state == GOTD_STATE_EXPECT_CAPABILITIES) {
1079 				/*
1080 				 * The client has closed its socket before
1081 				 * sending its capability announcement.
1082 				 * This can happen when Git clients have
1083 				 * no ref-updates to send.
1084 				 */
1085 				disconnect_on_error(client, err);
1086 				return;
1087 			}
1088 			break;
1089 		}
1090 
1091 		evtimer_del(&client->tmo);
1092 
1093 		switch (imsg.hdr.type) {
1094 		case GOTD_IMSG_CAPABILITIES:
1095 			if (client->state != GOTD_STATE_EXPECT_CAPABILITIES) {
1096 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1097 				    "unexpected capabilities received");
1098 				break;
1099 			}
1100 			log_debug("receiving capabilities from uid %d",
1101 			    client->euid);
1102 			err = recv_capabilities(client, &imsg);
1103 			break;
1104 		case GOTD_IMSG_CAPABILITY:
1105 			if (client->state != GOTD_STATE_EXPECT_CAPABILITIES) {
1106 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1107 				    "unexpected capability received");
1108 				break;
1109 			}
1110 			err = recv_capability(client, &imsg);
1111 			if (err || client->ncapabilities < client->ncapa_alloc)
1112 				break;
1113 			if (!client->is_writing) {
1114 				client->state = GOTD_STATE_EXPECT_WANT;
1115 				client->accept_flush_pkt = 1;
1116 				log_debug("uid %d: expecting want-lines",
1117 				    client->euid);
1118 			} else if (client->is_writing) {
1119 				client->state = GOTD_STATE_EXPECT_REF_UPDATE;
1120 				client->accept_flush_pkt = 1;
1121 				log_debug("uid %d: expecting ref-update-lines",
1122 				    client->euid);
1123 			} else
1124 				fatalx("client %d is both reading and writing",
1125 				    client->euid);
1126 			break;
1127 		case GOTD_IMSG_WANT:
1128 			if (client->state != GOTD_STATE_EXPECT_WANT) {
1129 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1130 				    "unexpected want-line received");
1131 				break;
1132 			}
1133 			log_debug("received want-line from uid %d",
1134 			    client->euid);
1135 			err = ensure_client_is_reading(client);
1136 			if (err)
1137 				break;
1138 			client->accept_flush_pkt = 1;
1139 			err = forward_want(client, &imsg);
1140 			break;
1141 		case GOTD_IMSG_REF_UPDATE:
1142 			if (client->state != GOTD_STATE_EXPECT_REF_UPDATE &&
1143 			    client->state !=
1144 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1145 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1146 				    "unexpected ref-update-line received");
1147 				break;
1148 			}
1149 			log_debug("received ref-update-line from uid %d",
1150 			    client->euid);
1151 			err = ensure_client_is_writing(client);
1152 			if (err)
1153 				break;
1154 			err = forward_ref_update(client, &imsg);
1155 			if (err)
1156 				break;
1157 			client->state = GOTD_STATE_EXPECT_MORE_REF_UPDATES;
1158 			client->accept_flush_pkt = 1;
1159 			break;
1160 		case GOTD_IMSG_HAVE:
1161 			if (client->state != GOTD_STATE_EXPECT_HAVE) {
1162 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1163 				    "unexpected have-line received");
1164 				break;
1165 			}
1166 			log_debug("received have-line from uid %d",
1167 			    client->euid);
1168 			err = ensure_client_is_reading(client);
1169 			if (err)
1170 				break;
1171 			err = forward_have(client, &imsg);
1172 			if (err)
1173 				break;
1174 			client->accept_flush_pkt = 1;
1175 			break;
1176 		case GOTD_IMSG_FLUSH:
1177 			if (client->state == GOTD_STATE_EXPECT_WANT ||
1178 			    client->state == GOTD_STATE_EXPECT_HAVE) {
1179 				err = ensure_client_is_reading(client);
1180 				if (err)
1181 					break;
1182 			} else if (client->state ==
1183 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1184 				err = ensure_client_is_writing(client);
1185 				if (err)
1186 					break;
1187 			} else if (client->state != GOTD_STATE_EXPECT_DONE) {
1188 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1189 				    "unexpected flush-pkt received");
1190 				break;
1191 			}
1192 			if (!client->accept_flush_pkt) {
1193 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1194 				    "unexpected flush-pkt received");
1195 				break;
1196 			}
1197 
1198 			/*
1199 			 * Accept just one flush packet at a time.
1200 			 * Future client state transitions will set this flag
1201 			 * again if another flush packet is expected.
1202 			 */
1203 			client->accept_flush_pkt = 0;
1204 
1205 			log_debug("received flush-pkt from uid %d",
1206 			    client->euid);
1207 			if (client->state == GOTD_STATE_EXPECT_WANT) {
1208 				client->state = GOTD_STATE_EXPECT_HAVE;
1209 				log_debug("uid %d: expecting have-lines",
1210 				    client->euid);
1211 			} else if (client->state == GOTD_STATE_EXPECT_HAVE) {
1212 				client->state = GOTD_STATE_EXPECT_DONE;
1213 				client->accept_flush_pkt = 1;
1214 				log_debug("uid %d: expecting 'done'",
1215 				    client->euid);
1216 			} else if (client->state ==
1217 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1218 				client->state = GOTD_STATE_EXPECT_PACKFILE;
1219 				log_debug("uid %d: expecting packfile",
1220 				    client->euid);
1221 				err = recv_packfile(client);
1222 			} else if (client->state != GOTD_STATE_EXPECT_DONE) {
1223 				/* should not happen, see above */
1224 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1225 				    "unexpected client state");
1226 				break;
1227 			}
1228 			break;
1229 		case GOTD_IMSG_DONE:
1230 			if (client->state != GOTD_STATE_EXPECT_HAVE &&
1231 			    client->state != GOTD_STATE_EXPECT_DONE) {
1232 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1233 				    "unexpected flush-pkt received");
1234 				break;
1235 			}
1236 			log_debug("received 'done' from uid %d", client->euid);
1237 			err = ensure_client_is_reading(client);
1238 			if (err)
1239 				break;
1240 			client->state = GOTD_STATE_DONE;
1241 			client->accept_flush_pkt = 1;
1242 			err = send_packfile(client);
1243 			break;
1244 		default:
1245 			log_debug("unexpected imsg %d", imsg.hdr.type);
1246 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1247 			break;
1248 		}
1249 
1250 		imsg_free(&imsg);
1251 	}
1252 
1253 	if (err) {
1254 		if (err->code != GOT_ERR_EOF ||
1255 		    client->state != GOTD_STATE_EXPECT_PACKFILE)
1256 			disconnect_on_error(client, err);
1257 	} else {
1258 		gotd_imsg_event_add(iev);
1259 		evtimer_add(&client->tmo, &gotd_session.request_timeout);
1260 	}
1261 }
1262 
1263 static const struct got_error *
1264 list_refs_request(void)
1265 {
1266 	static const struct got_error *err;
1267 	struct gotd_session_client *client = &gotd_session_client;
1268 	struct gotd_imsgev *iev = &client->repo_child_iev;
1269 	struct gotd_imsg_list_refs_internal ilref;
1270 	int fd;
1271 
1272 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1273 		return got_error(GOT_ERR_PRIVSEP_MSG);
1274 
1275 	memset(&ilref, 0, sizeof(ilref));
1276 	ilref.client_id = client->id;
1277 
1278 	fd = dup(client->fd);
1279 	if (fd == -1)
1280 		return got_error_from_errno("dup");
1281 
1282 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_LIST_REFS_INTERNAL,
1283 	    gotd_session.proc_id, fd, &ilref, sizeof(ilref)) == -1) {
1284 		err = got_error_from_errno("imsg compose LIST_REFS_INTERNAL");
1285 		close(fd);
1286 		return err;
1287 	}
1288 
1289 	client->state = GOTD_STATE_EXPECT_CAPABILITIES;
1290 	log_debug("uid %d: expecting capabilities", client->euid);
1291 	return NULL;
1292 }
1293 
1294 static const struct got_error *
1295 recv_connect(struct imsg *imsg)
1296 {
1297 	struct gotd_session_client *client = &gotd_session_client;
1298 	struct gotd_imsg_connect iconnect;
1299 	size_t datalen;
1300 
1301 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1302 		return got_error(GOT_ERR_PRIVSEP_MSG);
1303 
1304 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1305 	if (datalen != sizeof(iconnect))
1306 		return got_error(GOT_ERR_PRIVSEP_LEN);
1307 	memcpy(&iconnect, imsg->data, sizeof(iconnect));
1308 
1309 	if (imsg->fd == -1)
1310 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1311 
1312 	client->fd = imsg->fd;
1313 	client->euid = iconnect.euid;
1314 	client->egid = iconnect.egid;
1315 
1316 	imsg_init(&client->iev.ibuf, client->fd);
1317 	client->iev.handler = session_dispatch_client;
1318 	client->iev.events = EV_READ;
1319 	client->iev.handler_arg = NULL;
1320 	event_set(&client->iev.ev, client->iev.ibuf.fd, EV_READ,
1321 	    session_dispatch_client, &client->iev);
1322 	gotd_imsg_event_add(&client->iev);
1323 	evtimer_set(&client->tmo, gotd_request_timeout, client);
1324 
1325 	return NULL;
1326 }
1327 
1328 static const struct got_error *
1329 recv_repo_child(struct imsg *imsg)
1330 {
1331 	struct gotd_imsg_connect_repo_child ichild;
1332 	struct gotd_session_client *client = &gotd_session_client;
1333 	size_t datalen;
1334 
1335 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1336 		return got_error(GOT_ERR_PRIVSEP_MSG);
1337 
1338 	/* We should already have received a pipe to the listener. */
1339 	if (client->fd == -1)
1340 		return got_error(GOT_ERR_PRIVSEP_MSG);
1341 
1342 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1343 	if (datalen != sizeof(ichild))
1344 		return got_error(GOT_ERR_PRIVSEP_LEN);
1345 
1346 	memcpy(&ichild, imsg->data, sizeof(ichild));
1347 
1348 	client->id = ichild.client_id;
1349 	if (ichild.proc_id == PROC_REPO_WRITE)
1350 		client->is_writing = 1;
1351 	else if (ichild.proc_id == PROC_REPO_READ)
1352 		client->is_writing = 0;
1353 	else
1354 		return got_error_msg(GOT_ERR_PRIVSEP_MSG,
1355 		    "bad child process type");
1356 
1357 	if (imsg->fd == -1)
1358 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1359 
1360 	imsg_init(&client->repo_child_iev.ibuf, imsg->fd);
1361 	client->repo_child_iev.handler = session_dispatch_repo_child;
1362 	client->repo_child_iev.events = EV_READ;
1363 	client->repo_child_iev.handler_arg = NULL;
1364 	event_set(&client->repo_child_iev.ev, client->repo_child_iev.ibuf.fd,
1365 	    EV_READ, session_dispatch_repo_child, &client->repo_child_iev);
1366 	gotd_imsg_event_add(&client->repo_child_iev);
1367 
1368 	/* The "recvfd" pledge promise is no longer needed. */
1369 	if (pledge("stdio rpath wpath cpath sendfd fattr flock", NULL) == -1)
1370 		fatal("pledge");
1371 
1372 	return NULL;
1373 }
1374 
1375 static void
1376 session_dispatch(int fd, short event, void *arg)
1377 {
1378 	struct gotd_imsgev *iev = arg;
1379 	struct imsgbuf *ibuf = &iev->ibuf;
1380 	struct gotd_session_client *client = &gotd_session_client;
1381 	ssize_t n;
1382 	int shut = 0;
1383 	struct imsg imsg;
1384 
1385 	if (event & EV_READ) {
1386 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1387 			fatal("imsg_read error");
1388 		if (n == 0) {
1389 			/* Connection closed. */
1390 			shut = 1;
1391 			goto done;
1392 		}
1393 	}
1394 
1395 	if (event & EV_WRITE) {
1396 		n = msgbuf_write(&ibuf->w);
1397 		if (n == -1 && errno != EAGAIN)
1398 			fatal("msgbuf_write");
1399 		if (n == 0) {
1400 			/* Connection closed. */
1401 			shut = 1;
1402 			goto done;
1403 		}
1404 	}
1405 
1406 	for (;;) {
1407 		const struct got_error *err = NULL;
1408 		uint32_t client_id = 0;
1409 		int do_disconnect = 0, do_list_refs = 0;
1410 
1411 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1412 			fatal("%s: imsg_get error", __func__);
1413 		if (n == 0)	/* No more messages. */
1414 			break;
1415 
1416 		switch (imsg.hdr.type) {
1417 		case GOTD_IMSG_ERROR:
1418 			do_disconnect = 1;
1419 			err = gotd_imsg_recv_error(&client_id, &imsg);
1420 			break;
1421 		case GOTD_IMSG_CONNECT:
1422 			err = recv_connect(&imsg);
1423 			break;
1424 		case GOTD_IMSG_DISCONNECT:
1425 			do_disconnect = 1;
1426 			break;
1427 		case GOTD_IMSG_CONNECT_REPO_CHILD:
1428 			err = recv_repo_child(&imsg);
1429 			if (err)
1430 				break;
1431 			do_list_refs = 1;
1432 			break;
1433 		default:
1434 			log_debug("unexpected imsg %d", imsg.hdr.type);
1435 			break;
1436 		}
1437 		imsg_free(&imsg);
1438 
1439 		if (do_disconnect) {
1440 			if (err)
1441 				disconnect_on_error(client, err);
1442 			else
1443 				disconnect(client);
1444 		} else if (do_list_refs)
1445 			err = list_refs_request();
1446 
1447 		if (err)
1448 			log_warnx("uid %d: %s", client->euid, err->msg);
1449 	}
1450 done:
1451 	if (!shut) {
1452 		gotd_imsg_event_add(iev);
1453 	} else {
1454 		/* This pipe is dead. Remove its event handler */
1455 		event_del(&iev->ev);
1456 		event_loopexit(NULL);
1457 	}
1458 }
1459 
1460 void
1461 session_main(const char *title, const char *repo_path,
1462     int *pack_fds, int *temp_fds, struct timeval *request_timeout,
1463     enum gotd_procid proc_id)
1464 {
1465 	const struct got_error *err = NULL;
1466 	struct event evsigint, evsigterm, evsighup, evsigusr1;
1467 
1468 	gotd_session.title = title;
1469 	gotd_session.pid = getpid();
1470 	gotd_session.pack_fds = pack_fds;
1471 	gotd_session.temp_fds = temp_fds;
1472 	memcpy(&gotd_session.request_timeout, request_timeout,
1473 	    sizeof(gotd_session.request_timeout));
1474 	gotd_session.proc_id = proc_id;
1475 
1476 	err = got_repo_open(&gotd_session.repo, repo_path, NULL, pack_fds);
1477 	if (err)
1478 		goto done;
1479 	if (!got_repo_is_bare(gotd_session.repo)) {
1480 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
1481 		    "bare git repository required");
1482 		goto done;
1483 	}
1484 
1485 	got_repo_temp_fds_set(gotd_session.repo, temp_fds);
1486 
1487 	signal_set(&evsigint, SIGINT, gotd_session_sighdlr, NULL);
1488 	signal_set(&evsigterm, SIGTERM, gotd_session_sighdlr, NULL);
1489 	signal_set(&evsighup, SIGHUP, gotd_session_sighdlr, NULL);
1490 	signal_set(&evsigusr1, SIGUSR1, gotd_session_sighdlr, NULL);
1491 	signal(SIGPIPE, SIG_IGN);
1492 
1493 	signal_add(&evsigint, NULL);
1494 	signal_add(&evsigterm, NULL);
1495 	signal_add(&evsighup, NULL);
1496 	signal_add(&evsigusr1, NULL);
1497 
1498 	gotd_session_client.state = GOTD_STATE_EXPECT_LIST_REFS;
1499 	gotd_session_client.fd = -1;
1500 	gotd_session_client.nref_updates = -1;
1501 	gotd_session_client.delta_cache_fd = -1;
1502 	gotd_session_client.accept_flush_pkt = 1;
1503 
1504 	imsg_init(&gotd_session.parent_iev.ibuf, GOTD_FILENO_MSG_PIPE);
1505 	gotd_session.parent_iev.handler = session_dispatch;
1506 	gotd_session.parent_iev.events = EV_READ;
1507 	gotd_session.parent_iev.handler_arg = NULL;
1508 	event_set(&gotd_session.parent_iev.ev, gotd_session.parent_iev.ibuf.fd,
1509 	    EV_READ, session_dispatch, &gotd_session.parent_iev);
1510 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
1511 	    GOTD_IMSG_CLIENT_SESSION_READY, gotd_session.proc_id,
1512 	    -1, NULL, 0) == -1) {
1513 		err = got_error_from_errno("imsg compose CLIENT_SESSION_READY");
1514 		goto done;
1515 	}
1516 
1517 	event_dispatch();
1518 done:
1519 	if (err)
1520 		log_warnx("%s: %s", title, err->msg);
1521 	gotd_session_shutdown();
1522 }
1523 
1524 void
1525 gotd_session_shutdown(void)
1526 {
1527 	log_debug("shutting down");
1528 	if (gotd_session.repo)
1529 		got_repo_close(gotd_session.repo);
1530 	got_repo_pack_fds_close(gotd_session.pack_fds);
1531 	got_repo_temp_fds_close(gotd_session.temp_fds);
1532 	exit(0);
1533 }