Game of Trees Repos

Blob

Date:: Wed Jan 18 20:00:34 2023 UTC
Message:: gotd: fix "bad packfile with zero objects" error while creating branches Clients will send an empty pack file if they are only creating new references and have no objects to upload. Make gotd handle this and add a regression test which triggers the bug. Problem found by op@. The new regression test caught an unrelated issue where the client connection was left lingering after references had been updated, which made 'got send' followed by 'got clone -l' fail with the connection limit configured for the test suite (just one connection is allowed at a time). Fix this as well. ok op@
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2022, 2023 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/queue.h>
19 #include <sys/tree.h>
20 #include <sys/socket.h>
21 #include <sys/uio.h>
22 
23 #include <errno.h>
24 #include <event.h>
25 #include <limits.h>
26 #include <sha1.h>
27 #include <signal.h>
28 #include <stdint.h>
29 #include <stdio.h>
30 #include <stdlib.h>
31 #include <string.h>
32 #include <imsg.h>
33 #include <unistd.h>
34 
35 #include "got_error.h"
36 #include "got_repository.h"
37 #include "got_object.h"
38 #include "got_path.h"
39 #include "got_reference.h"
40 #include "got_opentemp.h"
41 
42 #include "got_lib_sha1.h"
43 #include "got_lib_delta.h"
44 #include "got_lib_object.h"
45 #include "got_lib_object_cache.h"
46 #include "got_lib_pack.h"
47 #include "got_lib_repository.h"
48 #include "got_lib_gitproto.h"
49 
50 #include "gotd.h"
51 #include "log.h"
52 #include "session.h"
53 
54 
55 static struct gotd_session {
56 	pid_t pid;
57 	const char *title;
58 	struct got_repository *repo;
59 	int *pack_fds;
60 	int *temp_fds;
61 	struct gotd_imsgev parent_iev;
62 	struct timeval request_timeout;
63 } gotd_session;
64 
65 static struct gotd_session_client {
66 	enum gotd_session_state		 state;
67 	int				 is_writing;
68 	struct gotd_client_capability	*capabilities;
69 	size_t				 ncapa_alloc;
70 	size_t				 ncapabilities;
71 	uint32_t			 id;
72 	int				 fd;
73 	int				 delta_cache_fd;
74 	struct gotd_imsgev		 iev;
75 	struct gotd_imsgev		 repo_child_iev;
76 	struct event			 tmo;
77 	uid_t				 euid;
78 	gid_t				 egid;
79 	char				*packfile_path;
80 	char				*packidx_path;
81 	int				 nref_updates;
82 } gotd_session_client;
83 
84 void gotd_session_sighdlr(int sig, short event, void *arg);
85 static void gotd_session_shutdown(void);
86 
87 static void
88 disconnect(struct gotd_session_client *client)
89 {
90 	log_debug("uid %d: disconnecting", client->euid);
91 
92 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
93 	    GOTD_IMSG_DISCONNECT, PROC_SESSION, -1, NULL, 0) == -1)
94 		log_warn("imsg compose DISCONNECT");
95 
96 	imsg_clear(&client->repo_child_iev.ibuf);
97 	event_del(&client->repo_child_iev.ev);
98 	evtimer_del(&client->tmo);
99 	close(client->fd);
100 	if (client->delta_cache_fd != -1)
101 		close(client->delta_cache_fd);
102 	if (client->packfile_path) {
103 		if (unlink(client->packfile_path) == -1 && errno != ENOENT)
104 			log_warn("unlink %s: ", client->packfile_path);
105 		free(client->packfile_path);
106 	}
107 	if (client->packidx_path) {
108 		if (unlink(client->packidx_path) == -1 && errno != ENOENT)
109 			log_warn("unlink %s: ", client->packidx_path);
110 		free(client->packidx_path);
111 	}
112 	free(client->capabilities);
113 
114 	gotd_session_shutdown();
115 }
116 
117 static void
118 disconnect_on_error(struct gotd_session_client *client,
119     const struct got_error *err)
120 {
121 	struct imsgbuf ibuf;
122 
123 	log_warnx("uid %d: %s", client->euid, err->msg);
124 	if (err->code != GOT_ERR_EOF) {
125 		imsg_init(&ibuf, client->fd);
126 		gotd_imsg_send_error(&ibuf, 0, PROC_SESSION, err);
127 		imsg_clear(&ibuf);
128 	}
129 
130 	disconnect(client);
131 }
132 
133 static void
134 gotd_request_timeout(int fd, short events, void *arg)
135 {
136 	struct gotd_session_client *client = arg;
137 
138 	log_debug("disconnecting uid %d due to timeout", client->euid);
139 	disconnect(client);
140 }
141 
142 void
143 gotd_session_sighdlr(int sig, short event, void *arg)
144 {
145 	/*
146 	 * Normal signal handler rules don't apply because libevent
147 	 * decouples for us.
148 	 */
149 
150 	switch (sig) {
151 	case SIGHUP:
152 		log_info("%s: ignoring SIGHUP", __func__);
153 		break;
154 	case SIGUSR1:
155 		log_info("%s: ignoring SIGUSR1", __func__);
156 		break;
157 	case SIGTERM:
158 	case SIGINT:
159 		gotd_session_shutdown();
160 		/* NOTREACHED */
161 		break;
162 	default:
163 		fatalx("unexpected signal");
164 	}
165 }
166 
167 static const struct got_error *
168 recv_packfile_done(uint32_t *client_id, struct imsg *imsg)
169 {
170 	struct gotd_imsg_packfile_done idone;
171 	size_t datalen;
172 
173 	log_debug("packfile-done received");
174 
175 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
176 	if (datalen != sizeof(idone))
177 		return got_error(GOT_ERR_PRIVSEP_LEN);
178 	memcpy(&idone, imsg->data, sizeof(idone));
179 
180 	*client_id = idone.client_id;
181 	return NULL;
182 }
183 
184 static const struct got_error *
185 recv_packfile_install(uint32_t *client_id, struct imsg *imsg)
186 {
187 	struct gotd_imsg_packfile_install inst;
188 	size_t datalen;
189 
190 	log_debug("packfile-install received");
191 
192 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
193 	if (datalen != sizeof(inst))
194 		return got_error(GOT_ERR_PRIVSEP_LEN);
195 	memcpy(&inst, imsg->data, sizeof(inst));
196 
197 	*client_id = inst.client_id;
198 	return NULL;
199 }
200 
201 static const struct got_error *
202 recv_ref_updates_start(uint32_t *client_id, struct imsg *imsg)
203 {
204 	struct gotd_imsg_ref_updates_start istart;
205 	size_t datalen;
206 
207 	log_debug("ref-updates-start received");
208 
209 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
210 	if (datalen != sizeof(istart))
211 		return got_error(GOT_ERR_PRIVSEP_LEN);
212 	memcpy(&istart, imsg->data, sizeof(istart));
213 
214 	*client_id = istart.client_id;
215 	return NULL;
216 }
217 
218 static const struct got_error *
219 recv_ref_update(uint32_t *client_id, struct imsg *imsg)
220 {
221 	struct gotd_imsg_ref_update iref;
222 	size_t datalen;
223 
224 	log_debug("ref-update received");
225 
226 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
227 	if (datalen < sizeof(iref))
228 		return got_error(GOT_ERR_PRIVSEP_LEN);
229 	memcpy(&iref, imsg->data, sizeof(iref));
230 
231 	*client_id = iref.client_id;
232 	return NULL;
233 }
234 
235 static const struct got_error *
236 send_ref_update_ok(struct gotd_session_client *client,
237     struct gotd_imsg_ref_update *iref, const char *refname)
238 {
239 	struct gotd_imsg_ref_update_ok iok;
240 	struct gotd_imsgev *iev = &client->iev;
241 	struct ibuf *wbuf;
242 	size_t len;
243 
244 	memset(&iok, 0, sizeof(iok));
245 	iok.client_id = client->id;
246 	memcpy(iok.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
247 	memcpy(iok.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
248 	iok.name_len = strlen(refname);
249 
250 	len = sizeof(iok) + iok.name_len;
251 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE_OK,
252 	    PROC_SESSION, gotd_session.pid, len);
253 	if (wbuf == NULL)
254 		return got_error_from_errno("imsg_create REF_UPDATE_OK");
255 
256 	if (imsg_add(wbuf, &iok, sizeof(iok)) == -1)
257 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
258 	if (imsg_add(wbuf, refname, iok.name_len) == -1)
259 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
260 
261 	wbuf->fd = -1;
262 	imsg_close(&iev->ibuf, wbuf);
263 	gotd_imsg_event_add(iev);
264 	return NULL;
265 }
266 
267 static void
268 send_refs_updated(struct gotd_session_client *client)
269 {
270 	if (gotd_imsg_compose_event(&client->iev, GOTD_IMSG_REFS_UPDATED,
271 	    PROC_SESSION, -1, NULL, 0) == -1)
272 		log_warn("imsg compose REFS_UPDATED");
273 }
274 
275 static const struct got_error *
276 send_ref_update_ng(struct gotd_session_client *client,
277     struct gotd_imsg_ref_update *iref, const char *refname,
278     const char *reason)
279 {
280 	const struct got_error *ng_err;
281 	struct gotd_imsg_ref_update_ng ing;
282 	struct gotd_imsgev *iev = &client->iev;
283 	struct ibuf *wbuf;
284 	size_t len;
285 
286 	memset(&ing, 0, sizeof(ing));
287 	ing.client_id = client->id;
288 	memcpy(ing.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
289 	memcpy(ing.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
290 	ing.name_len = strlen(refname);
291 
292 	ng_err = got_error_fmt(GOT_ERR_REF_BUSY, "%s", reason);
293 	ing.reason_len = strlen(ng_err->msg);
294 
295 	len = sizeof(ing) + ing.name_len + ing.reason_len;
296 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE_NG,
297 	    PROC_SESSION, gotd_session.pid, len);
298 	if (wbuf == NULL)
299 		return got_error_from_errno("imsg_create REF_UPDATE_NG");
300 
301 	if (imsg_add(wbuf, &ing, sizeof(ing)) == -1)
302 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
303 	if (imsg_add(wbuf, refname, ing.name_len) == -1)
304 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
305 	if (imsg_add(wbuf, ng_err->msg, ing.reason_len) == -1)
306 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
307 
308 	wbuf->fd = -1;
309 	imsg_close(&iev->ibuf, wbuf);
310 	gotd_imsg_event_add(iev);
311 	return NULL;
312 }
313 
314 static const struct got_error *
315 install_pack(struct gotd_session_client *client, const char *repo_path,
316     struct imsg *imsg)
317 {
318 	const struct got_error *err = NULL;
319 	struct gotd_imsg_packfile_install inst;
320 	char hex[SHA1_DIGEST_STRING_LENGTH];
321 	size_t datalen;
322 	char *packfile_path = NULL, *packidx_path = NULL;
323 
324 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
325 	if (datalen != sizeof(inst))
326 		return got_error(GOT_ERR_PRIVSEP_LEN);
327 	memcpy(&inst, imsg->data, sizeof(inst));
328 
329 	if (client->packfile_path == NULL)
330 		return got_error_msg(GOT_ERR_BAD_REQUEST,
331 		    "client has no pack file");
332 	if (client->packidx_path == NULL)
333 		return got_error_msg(GOT_ERR_BAD_REQUEST,
334 		    "client has no pack file index");
335 
336 	if (got_sha1_digest_to_str(inst.pack_sha1, hex, sizeof(hex)) == NULL)
337 		return got_error_msg(GOT_ERR_NO_SPACE,
338 		    "could not convert pack file SHA1 to hex");
339 
340 	if (asprintf(&packfile_path, "/%s/%s/pack-%s.pack",
341 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
342 		err = got_error_from_errno("asprintf");
343 		goto done;
344 	}
345 
346 	if (asprintf(&packidx_path, "/%s/%s/pack-%s.idx",
347 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
348 		err = got_error_from_errno("asprintf");
349 		goto done;
350 	}
351 
352 	if (rename(client->packfile_path, packfile_path) == -1) {
353 		err = got_error_from_errno3("rename", client->packfile_path,
354 		    packfile_path);
355 		goto done;
356 	}
357 
358 	free(client->packfile_path);
359 	client->packfile_path = NULL;
360 
361 	if (rename(client->packidx_path, packidx_path) == -1) {
362 		err = got_error_from_errno3("rename", client->packidx_path,
363 		    packidx_path);
364 		goto done;
365 	}
366 
367 	free(client->packidx_path);
368 	client->packidx_path = NULL;
369 done:
370 	free(packfile_path);
371 	free(packidx_path);
372 	return err;
373 }
374 
375 static const struct got_error *
376 begin_ref_updates(struct gotd_session_client *client, struct imsg *imsg)
377 {
378 	struct gotd_imsg_ref_updates_start istart;
379 	size_t datalen;
380 
381 	if (client->nref_updates != -1)
382 		return got_error(GOT_ERR_PRIVSEP_MSG);
383 
384 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
385 	if (datalen != sizeof(istart))
386 		return got_error(GOT_ERR_PRIVSEP_LEN);
387 	memcpy(&istart, imsg->data, sizeof(istart));
388 
389 	if (istart.nref_updates <= 0)
390 		return got_error(GOT_ERR_PRIVSEP_MSG);
391 
392 	client->nref_updates = istart.nref_updates;
393 	return NULL;
394 }
395 
396 static const struct got_error *
397 update_ref(int *shut, struct gotd_session_client *client,
398     const char *repo_path, struct imsg *imsg)
399 {
400 	const struct got_error *err = NULL;
401 	struct got_repository *repo = NULL;
402 	struct got_reference *ref = NULL;
403 	struct gotd_imsg_ref_update iref;
404 	struct got_object_id old_id, new_id;
405 	struct got_object_id *id = NULL;
406 	struct got_object *obj = NULL;
407 	char *refname = NULL;
408 	size_t datalen;
409 	int locked = 0;
410 
411 	log_debug("update-ref from uid %d", client->euid);
412 
413 	if (client->nref_updates <= 0)
414 		return got_error(GOT_ERR_PRIVSEP_MSG);
415 
416 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
417 	if (datalen < sizeof(iref))
418 		return got_error(GOT_ERR_PRIVSEP_LEN);
419 	memcpy(&iref, imsg->data, sizeof(iref));
420 	if (datalen != sizeof(iref) + iref.name_len)
421 		return got_error(GOT_ERR_PRIVSEP_LEN);
422 	refname = strndup(imsg->data + sizeof(iref), iref.name_len);
423 	if (refname == NULL)
424 		return got_error_from_errno("strndup");
425 
426 	log_debug("updating ref %s for uid %d", refname, client->euid);
427 
428 	err = got_repo_open(&repo, repo_path, NULL, NULL);
429 	if (err)
430 		goto done;
431 
432 	memcpy(old_id.sha1, iref.old_id, SHA1_DIGEST_LENGTH);
433 	memcpy(new_id.sha1, iref.new_id, SHA1_DIGEST_LENGTH);
434 	err = got_object_open(&obj, repo, &new_id);
435 	if (err)
436 		goto done;
437 
438 	if (iref.ref_is_new) {
439 		err = got_ref_open(&ref, repo, refname, 0);
440 		if (err) {
441 			if (err->code != GOT_ERR_NOT_REF)
442 				goto done;
443 			err = got_ref_alloc(&ref, refname, &new_id);
444 			if (err)
445 				goto done;
446 			err = got_ref_write(ref, repo); /* will lock/unlock */
447 			if (err)
448 				goto done;
449 		} else {
450 			err = got_error_fmt(GOT_ERR_REF_BUSY,
451 			    "%s has been created by someone else "
452 			    "while transaction was in progress",
453 			    got_ref_get_name(ref));
454 			goto done;
455 		}
456 	} else {
457 		err = got_ref_open(&ref, repo, refname, 1 /* lock */);
458 		if (err)
459 			goto done;
460 		locked = 1;
461 
462 		err = got_ref_resolve(&id, repo, ref);
463 		if (err)
464 			goto done;
465 
466 		if (got_object_id_cmp(id, &old_id) != 0) {
467 			err = got_error_fmt(GOT_ERR_REF_BUSY,
468 			    "%s has been modified by someone else "
469 			    "while transaction was in progress",
470 			    got_ref_get_name(ref));
471 			goto done;
472 		}
473 
474 		err = got_ref_change_ref(ref, &new_id);
475 		if (err)
476 			goto done;
477 
478 		err = got_ref_write(ref, repo);
479 		if (err)
480 			goto done;
481 
482 		free(id);
483 		id = NULL;
484 	}
485 done:
486 	if (err) {
487 		if (err->code == GOT_ERR_LOCKFILE_TIMEOUT) {
488 			err = got_error_fmt(GOT_ERR_LOCKFILE_TIMEOUT,
489 			    "could not acquire exclusive file lock for %s",
490 			    refname);
491 		}
492 		send_ref_update_ng(client, &iref, refname, err->msg);
493 	} else
494 		send_ref_update_ok(client, &iref, refname);
495 
496 	if (client->nref_updates > 0) {
497 		client->nref_updates--;
498 		if (client->nref_updates == 0) {
499 			send_refs_updated(client);
500 			*shut = 1;
501 		}
502 
503 	}
504 	if (locked) {
505 		const struct got_error *unlock_err;
506 		unlock_err = got_ref_unlock(ref);
507 		if (unlock_err && err == NULL)
508 			err = unlock_err;
509 	}
510 	if (ref)
511 		got_ref_close(ref);
512 	if (obj)
513 		got_object_close(obj);
514 	if (repo)
515 		got_repo_close(repo);
516 	free(refname);
517 	free(id);
518 	return err;
519 }
520 
521 static void
522 session_dispatch_repo_child(int fd, short event, void *arg)
523 {
524 	struct gotd_imsgev *iev = arg;
525 	struct imsgbuf *ibuf = &iev->ibuf;
526 	struct gotd_session_client *client = &gotd_session_client;
527 	ssize_t n;
528 	int shut = 0;
529 	struct imsg imsg;
530 
531 	if (event & EV_READ) {
532 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
533 			fatal("imsg_read error");
534 		if (n == 0) {
535 			/* Connection closed. */
536 			shut = 1;
537 			goto done;
538 		}
539 	}
540 
541 	if (event & EV_WRITE) {
542 		n = msgbuf_write(&ibuf->w);
543 		if (n == -1 && errno != EAGAIN)
544 			fatal("msgbuf_write");
545 		if (n == 0) {
546 			/* Connection closed. */
547 			shut = 1;
548 			goto done;
549 		}
550 	}
551 
552 	for (;;) {
553 		const struct got_error *err = NULL;
554 		uint32_t client_id = 0;
555 		int do_disconnect = 0;
556 		int do_ref_updates = 0, do_ref_update = 0;
557 		int do_packfile_install = 0;
558 
559 		if ((n = imsg_get(ibuf, &imsg)) == -1)
560 			fatal("%s: imsg_get error", __func__);
561 		if (n == 0)	/* No more messages. */
562 			break;
563 
564 		switch (imsg.hdr.type) {
565 		case GOTD_IMSG_ERROR:
566 			do_disconnect = 1;
567 			err = gotd_imsg_recv_error(&client_id, &imsg);
568 			break;
569 		case GOTD_IMSG_PACKFILE_DONE:
570 			do_disconnect = 1;
571 			err = recv_packfile_done(&client_id, &imsg);
572 			break;
573 		case GOTD_IMSG_PACKFILE_INSTALL:
574 			err = recv_packfile_install(&client_id, &imsg);
575 			if (err == NULL)
576 				do_packfile_install = 1;
577 			break;
578 		case GOTD_IMSG_REF_UPDATES_START:
579 			err = recv_ref_updates_start(&client_id, &imsg);
580 			if (err == NULL)
581 				do_ref_updates = 1;
582 			break;
583 		case GOTD_IMSG_REF_UPDATE:
584 			err = recv_ref_update(&client_id, &imsg);
585 			if (err == NULL)
586 				do_ref_update = 1;
587 			break;
588 		default:
589 			log_debug("unexpected imsg %d", imsg.hdr.type);
590 			break;
591 		}
592 
593 		if (do_disconnect) {
594 			if (err)
595 				disconnect_on_error(client, err);
596 			else
597 				disconnect(client);
598 		} else {
599 			if (do_packfile_install)
600 				err = install_pack(client,
601 				    gotd_session.repo->path, &imsg);
602 			else if (do_ref_updates)
603 				err = begin_ref_updates(client, &imsg);
604 			else if (do_ref_update)
605 				err = update_ref(&shut, client,
606 				    gotd_session.repo->path, &imsg);
607 			if (err)
608 				log_warnx("uid %d: %s", client->euid, err->msg);
609 		}
610 		imsg_free(&imsg);
611 	}
612 done:
613 	if (!shut) {
614 		gotd_imsg_event_add(iev);
615 	} else {
616 		/* This pipe is dead. Remove its event handler */
617 		event_del(&iev->ev);
618 		event_loopexit(NULL);
619 	}
620 }
621 
622 static const struct got_error *
623 recv_capabilities(struct gotd_session_client *client, struct imsg *imsg)
624 {
625 	struct gotd_imsg_capabilities icapas;
626 	size_t datalen;
627 
628 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
629 	if (datalen != sizeof(icapas))
630 		return got_error(GOT_ERR_PRIVSEP_LEN);
631 	memcpy(&icapas, imsg->data, sizeof(icapas));
632 
633 	client->ncapa_alloc = icapas.ncapabilities;
634 	client->capabilities = calloc(client->ncapa_alloc,
635 	    sizeof(*client->capabilities));
636 	if (client->capabilities == NULL) {
637 		client->ncapa_alloc = 0;
638 		return got_error_from_errno("calloc");
639 	}
640 
641 	log_debug("expecting %zu capabilities from uid %d",
642 	    client->ncapa_alloc, client->euid);
643 	return NULL;
644 }
645 
646 static const struct got_error *
647 recv_capability(struct gotd_session_client *client, struct imsg *imsg)
648 {
649 	struct gotd_imsg_capability icapa;
650 	struct gotd_client_capability *capa;
651 	size_t datalen;
652 	char *key, *value = NULL;
653 
654 	if (client->capabilities == NULL ||
655 	    client->ncapabilities >= client->ncapa_alloc) {
656 		return got_error_msg(GOT_ERR_BAD_REQUEST,
657 		    "unexpected capability received");
658 	}
659 
660 	memset(&icapa, 0, sizeof(icapa));
661 
662 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
663 	if (datalen < sizeof(icapa))
664 		return got_error(GOT_ERR_PRIVSEP_LEN);
665 	memcpy(&icapa, imsg->data, sizeof(icapa));
666 
667 	if (datalen != sizeof(icapa) + icapa.key_len + icapa.value_len)
668 		return got_error(GOT_ERR_PRIVSEP_LEN);
669 
670 	key = strndup(imsg->data + sizeof(icapa), icapa.key_len);
671 	if (key == NULL)
672 		return got_error_from_errno("strndup");
673 	if (icapa.value_len > 0) {
674 		value = strndup(imsg->data + sizeof(icapa) + icapa.key_len,
675 		    icapa.value_len);
676 		if (value == NULL) {
677 			free(key);
678 			return got_error_from_errno("strndup");
679 		}
680 	}
681 
682 	capa = &client->capabilities[client->ncapabilities++];
683 	capa->key = key;
684 	capa->value = value;
685 
686 	if (value)
687 		log_debug("uid %d: capability %s=%s", client->euid, key, value);
688 	else
689 		log_debug("uid %d: capability %s", client->euid, key);
690 
691 	return NULL;
692 }
693 
694 static const struct got_error *
695 ensure_client_is_reading(struct gotd_session_client *client)
696 {
697 	if (client->is_writing) {
698 		return got_error_fmt(GOT_ERR_BAD_PACKET,
699 		    "uid %d made a read-request but is not reading from "
700 		    "a repository", client->euid);
701 	}
702 
703 	return NULL;
704 }
705 
706 static const struct got_error *
707 ensure_client_is_writing(struct gotd_session_client *client)
708 {
709 	if (!client->is_writing) {
710 		return got_error_fmt(GOT_ERR_BAD_PACKET,
711 		    "uid %d made a write-request but is not writing to "
712 		    "a repository", client->euid);
713 	}
714 
715 	return NULL;
716 }
717 
718 static const struct got_error *
719 forward_want(struct gotd_session_client *client, struct imsg *imsg)
720 {
721 	struct gotd_imsg_want ireq;
722 	struct gotd_imsg_want iwant;
723 	size_t datalen;
724 
725 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
726 	if (datalen != sizeof(ireq))
727 		return got_error(GOT_ERR_PRIVSEP_LEN);
728 
729 	memcpy(&ireq, imsg->data, datalen);
730 
731 	memset(&iwant, 0, sizeof(iwant));
732 	memcpy(iwant.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
733 	iwant.client_id = client->id;
734 
735 	if (gotd_imsg_compose_event(&client->repo_child_iev, GOTD_IMSG_WANT,
736 	    PROC_SESSION, -1, &iwant, sizeof(iwant)) == -1)
737 		return got_error_from_errno("imsg compose WANT");
738 
739 	return NULL;
740 }
741 
742 static const struct got_error *
743 forward_ref_update(struct gotd_session_client *client, struct imsg *imsg)
744 {
745 	const struct got_error *err = NULL;
746 	struct gotd_imsg_ref_update ireq;
747 	struct gotd_imsg_ref_update *iref = NULL;
748 	size_t datalen;
749 
750 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
751 	if (datalen < sizeof(ireq))
752 		return got_error(GOT_ERR_PRIVSEP_LEN);
753 	memcpy(&ireq, imsg->data, sizeof(ireq));
754 	if (datalen != sizeof(ireq) + ireq.name_len)
755 		return got_error(GOT_ERR_PRIVSEP_LEN);
756 
757 	iref = malloc(datalen);
758 	if (iref == NULL)
759 		return got_error_from_errno("malloc");
760 	memcpy(iref, imsg->data, datalen);
761 
762 	iref->client_id = client->id;
763 	if (gotd_imsg_compose_event(&client->repo_child_iev,
764 	    GOTD_IMSG_REF_UPDATE, PROC_SESSION, -1, iref, datalen) == -1)
765 		err = got_error_from_errno("imsg compose REF_UPDATE");
766 	free(iref);
767 	return err;
768 }
769 
770 static const struct got_error *
771 forward_have(struct gotd_session_client *client, struct imsg *imsg)
772 {
773 	struct gotd_imsg_have ireq;
774 	struct gotd_imsg_have ihave;
775 	size_t datalen;
776 
777 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
778 	if (datalen != sizeof(ireq))
779 		return got_error(GOT_ERR_PRIVSEP_LEN);
780 
781 	memcpy(&ireq, imsg->data, datalen);
782 
783 	memset(&ihave, 0, sizeof(ihave));
784 	memcpy(ihave.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
785 	ihave.client_id = client->id;
786 
787 	if (gotd_imsg_compose_event(&client->repo_child_iev, GOTD_IMSG_HAVE,
788 	    PROC_SESSION, -1, &ihave, sizeof(ihave)) == -1)
789 		return got_error_from_errno("imsg compose HAVE");
790 
791 	return NULL;
792 }
793 
794 static int
795 client_has_capability(struct gotd_session_client *client, const char *capastr)
796 {
797 	struct gotd_client_capability *capa;
798 	size_t i;
799 
800 	if (client->ncapabilities == 0)
801 		return 0;
802 
803 	for (i = 0; i < client->ncapabilities; i++) {
804 		capa = &client->capabilities[i];
805 		if (strcmp(capa->key, capastr) == 0)
806 			return 1;
807 	}
808 
809 	return 0;
810 }
811 
812 static const struct got_error *
813 recv_packfile(struct gotd_session_client *client)
814 {
815 	const struct got_error *err = NULL;
816 	struct gotd_imsg_recv_packfile ipack;
817 	struct gotd_imsg_packfile_pipe ipipe;
818 	struct gotd_imsg_packidx_file ifile;
819 	char *basepath = NULL, *pack_path = NULL, *idx_path = NULL;
820 	int packfd = -1, idxfd = -1;
821 	int pipe[2] = { -1, -1 };
822 
823 	if (client->packfile_path) {
824 		return got_error_fmt(GOT_ERR_PRIVSEP_MSG,
825 		    "uid %d already has a pack file", client->euid);
826 	}
827 
828 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
829 		return got_error_from_errno("socketpair");
830 
831 	memset(&ipipe, 0, sizeof(ipipe));
832 	ipipe.client_id = client->id;
833 
834 	/* Send pack pipe end 0 to repo child process. */
835 	if (gotd_imsg_compose_event(&client->repo_child_iev,
836 	    GOTD_IMSG_PACKFILE_PIPE, PROC_SESSION, pipe[0],
837 	        &ipipe, sizeof(ipipe)) == -1) {
838 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
839 		pipe[0] = -1;
840 		goto done;
841 	}
842 	pipe[0] = -1;
843 
844 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
845 	if (gotd_imsg_compose_event(&client->iev,
846 	    GOTD_IMSG_PACKFILE_PIPE, PROC_SESSION, pipe[1], NULL, 0) == -1)
847 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
848 	pipe[1] = -1;
849 
850 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.pack",
851 	    got_repo_get_path(gotd_session.repo), GOT_OBJECTS_PACK_DIR,
852 	    client->euid) == -1) {
853 		err = got_error_from_errno("asprintf");
854 		goto done;
855 	}
856 
857 	err = got_opentemp_named_fd(&pack_path, &packfd, basepath, "");
858 	if (err)
859 		goto done;
860 
861 	free(basepath);
862 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.idx",
863 	    got_repo_get_path(gotd_session.repo), GOT_OBJECTS_PACK_DIR,
864 	    client->euid) == -1) {
865 		err = got_error_from_errno("asprintf");
866 		basepath = NULL;
867 		goto done;
868 	}
869 	err = got_opentemp_named_fd(&idx_path, &idxfd, basepath, "");
870 	if (err)
871 		goto done;
872 
873 	memset(&ifile, 0, sizeof(ifile));
874 	ifile.client_id = client->id;
875 	if (gotd_imsg_compose_event(&client->repo_child_iev,
876 	    GOTD_IMSG_PACKIDX_FILE, PROC_SESSION,
877 	    idxfd, &ifile, sizeof(ifile)) == -1) {
878 		err = got_error_from_errno("imsg compose PACKIDX_FILE");
879 		idxfd = -1;
880 		goto done;
881 	}
882 	idxfd = -1;
883 
884 	memset(&ipack, 0, sizeof(ipack));
885 	ipack.client_id = client->id;
886 	if (client_has_capability(client, GOT_CAPA_REPORT_STATUS))
887 		ipack.report_status = 1;
888 
889 	if (gotd_imsg_compose_event(&client->repo_child_iev,
890 	    GOTD_IMSG_RECV_PACKFILE, PROC_SESSION, packfd,
891 	    &ipack, sizeof(ipack)) == -1) {
892 		err = got_error_from_errno("imsg compose RECV_PACKFILE");
893 		packfd = -1;
894 		goto done;
895 	}
896 	packfd = -1;
897 
898 done:
899 	free(basepath);
900 	if (pipe[0] != -1 && close(pipe[0]) == -1 && err == NULL)
901 		err = got_error_from_errno("close");
902 	if (pipe[1] != -1 && close(pipe[1]) == -1 && err == NULL)
903 		err = got_error_from_errno("close");
904 	if (packfd != -1 && close(packfd) == -1 && err == NULL)
905 		err = got_error_from_errno("close");
906 	if (idxfd != -1 && close(idxfd) == -1 && err == NULL)
907 		err = got_error_from_errno("close");
908 	if (err) {
909 		free(pack_path);
910 		free(idx_path);
911 	} else {
912 		client->packfile_path = pack_path;
913 		client->packidx_path = idx_path;
914 	}
915 	return err;
916 }
917 
918 static const struct got_error *
919 send_packfile(struct gotd_session_client *client)
920 {
921 	const struct got_error *err = NULL;
922 	struct gotd_imsg_send_packfile ipack;
923 	struct gotd_imsg_packfile_pipe ipipe;
924 	int pipe[2];
925 
926 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
927 		return got_error_from_errno("socketpair");
928 
929 	memset(&ipack, 0, sizeof(ipack));
930 	memset(&ipipe, 0, sizeof(ipipe));
931 
932 	ipack.client_id = client->id;
933 	if (client_has_capability(client, GOT_CAPA_SIDE_BAND_64K))
934 		ipack.report_progress = 1;
935 
936 	client->delta_cache_fd = got_opentempfd();
937 	if (client->delta_cache_fd == -1)
938 		return got_error_from_errno("got_opentempfd");
939 
940 	if (gotd_imsg_compose_event(&client->repo_child_iev,
941 	    GOTD_IMSG_SEND_PACKFILE, PROC_GOTD, client->delta_cache_fd,
942 	    &ipack, sizeof(ipack)) == -1) {
943 		err = got_error_from_errno("imsg compose SEND_PACKFILE");
944 		close(pipe[0]);
945 		close(pipe[1]);
946 		return err;
947 	}
948 
949 	ipipe.client_id = client->id;
950 
951 	/* Send pack pipe end 0 to repo child process. */
952 	if (gotd_imsg_compose_event(&client->repo_child_iev,
953 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD,
954 	    pipe[0], &ipipe, sizeof(ipipe)) == -1) {
955 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
956 		close(pipe[1]);
957 		return err;
958 	}
959 
960 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
961 	if (gotd_imsg_compose_event(&client->iev,
962 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD, pipe[1], NULL, 0) == -1)
963 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
964 
965 	return err;
966 }
967 
968 static void
969 session_dispatch_listener(int fd, short events, void *arg)
970 {
971 	struct gotd_imsgev *iev = arg;
972 	struct imsgbuf *ibuf = &iev->ibuf;
973 	struct gotd_session_client *client = &gotd_session_client;
974 	const struct got_error *err = NULL;
975 	struct imsg imsg;
976 	ssize_t n;
977 
978 	if (events & EV_WRITE) {
979 		while (ibuf->w.queued) {
980 			n = msgbuf_write(&ibuf->w);
981 			if (n == -1 && errno == EPIPE) {
982 				/*
983 				 * The client has closed its socket.
984 				 * This can happen when Git clients are
985 				 * done sending pack file data.
986 				 */
987 				msgbuf_clear(&ibuf->w);
988 				continue;
989 			} else if (n == -1 && errno != EAGAIN) {
990 				err = got_error_from_errno("imsg_flush");
991 				disconnect_on_error(client, err);
992 				return;
993 			}
994 			if (n == 0) {
995 				/* Connection closed. */
996 				err = got_error(GOT_ERR_EOF);
997 				disconnect_on_error(client, err);
998 				return;
999 			}
1000 		}
1001 	}
1002 
1003 	if ((events & EV_READ) == 0)
1004 		return;
1005 
1006 	memset(&imsg, 0, sizeof(imsg));
1007 
1008 	while (err == NULL) {
1009 		err = gotd_imsg_recv(&imsg, ibuf, 0);
1010 		if (err) {
1011 			if (err->code == GOT_ERR_PRIVSEP_READ)
1012 				err = NULL;
1013 			break;
1014 		}
1015 
1016 		evtimer_del(&client->tmo);
1017 
1018 		switch (imsg.hdr.type) {
1019 		case GOTD_IMSG_CAPABILITIES:
1020 			if (client->state != GOTD_STATE_EXPECT_CAPABILITIES) {
1021 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1022 				    "unexpected capabilities received");
1023 				break;
1024 			}
1025 			log_debug("receiving capabilities from uid %d",
1026 			    client->euid);
1027 			err = recv_capabilities(client, &imsg);
1028 			break;
1029 		case GOTD_IMSG_CAPABILITY:
1030 			if (client->state != GOTD_STATE_EXPECT_CAPABILITIES) {
1031 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1032 				    "unexpected capability received");
1033 				break;
1034 			}
1035 			err = recv_capability(client, &imsg);
1036 			if (err || client->ncapabilities < client->ncapa_alloc)
1037 				break;
1038 			if (!client->is_writing) {
1039 				client->state = GOTD_STATE_EXPECT_WANT;
1040 				log_debug("uid %d: expecting want-lines",
1041 				    client->euid);
1042 			} else if (client->is_writing) {
1043 				client->state = GOTD_STATE_EXPECT_REF_UPDATE;
1044 				log_debug("uid %d: expecting ref-update-lines",
1045 				    client->euid);
1046 			} else
1047 				fatalx("client %d is both reading and writing",
1048 				    client->euid);
1049 			break;
1050 		case GOTD_IMSG_WANT:
1051 			if (client->state != GOTD_STATE_EXPECT_WANT) {
1052 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1053 				    "unexpected want-line received");
1054 				break;
1055 			}
1056 			log_debug("received want-line from uid %d",
1057 			    client->euid);
1058 			err = ensure_client_is_reading(client);
1059 			if (err)
1060 				break;
1061 			err = forward_want(client, &imsg);
1062 			break;
1063 		case GOTD_IMSG_REF_UPDATE:
1064 			if (client->state != GOTD_STATE_EXPECT_REF_UPDATE &&
1065 			    client->state !=
1066 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1067 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1068 				    "unexpected ref-update-line received");
1069 				break;
1070 			}
1071 			log_debug("received ref-update-line from uid %d",
1072 			    client->euid);
1073 			err = ensure_client_is_writing(client);
1074 			if (err)
1075 				break;
1076 			err = forward_ref_update(client, &imsg);
1077 			if (err)
1078 				break;
1079 			client->state = GOTD_STATE_EXPECT_MORE_REF_UPDATES;
1080 			break;
1081 		case GOTD_IMSG_HAVE:
1082 			if (client->state != GOTD_STATE_EXPECT_HAVE) {
1083 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1084 				    "unexpected have-line received");
1085 				break;
1086 			}
1087 			log_debug("received have-line from uid %d",
1088 			    client->euid);
1089 			err = ensure_client_is_reading(client);
1090 			if (err)
1091 				break;
1092 			err = forward_have(client, &imsg);
1093 			if (err)
1094 				break;
1095 			break;
1096 		case GOTD_IMSG_FLUSH:
1097 			if (client->state == GOTD_STATE_EXPECT_WANT ||
1098 			    client->state == GOTD_STATE_EXPECT_HAVE) {
1099 				err = ensure_client_is_reading(client);
1100 				if (err)
1101 					break;
1102 			} else if (client->state ==
1103 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1104 				err = ensure_client_is_writing(client);
1105 				if (err)
1106 					break;
1107 			} else if (client->state != GOTD_STATE_EXPECT_DONE) {
1108 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1109 				    "unexpected flush-pkt received");
1110 				break;
1111 			}
1112 			log_debug("received flush-pkt from uid %d",
1113 			    client->euid);
1114 			if (client->state == GOTD_STATE_EXPECT_WANT) {
1115 				client->state = GOTD_STATE_EXPECT_HAVE;
1116 				log_debug("uid %d: expecting have-lines",
1117 				    client->euid);
1118 			} else if (client->state == GOTD_STATE_EXPECT_HAVE) {
1119 				client->state = GOTD_STATE_EXPECT_DONE;
1120 				log_debug("uid %d: expecting 'done'",
1121 				    client->euid);
1122 			} else if (client->state ==
1123 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1124 				client->state = GOTD_STATE_EXPECT_PACKFILE;
1125 				log_debug("uid %d: expecting packfile",
1126 				    client->euid);
1127 				err = recv_packfile(client);
1128 			} else if (client->state != GOTD_STATE_EXPECT_DONE) {
1129 				/* should not happen, see above */
1130 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1131 				    "unexpected client state");
1132 				break;
1133 			}
1134 			break;
1135 		case GOTD_IMSG_DONE:
1136 			if (client->state != GOTD_STATE_EXPECT_HAVE &&
1137 			    client->state != GOTD_STATE_EXPECT_DONE) {
1138 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1139 				    "unexpected flush-pkt received");
1140 				break;
1141 			}
1142 			log_debug("received 'done' from uid %d", client->euid);
1143 			err = ensure_client_is_reading(client);
1144 			if (err)
1145 				break;
1146 			client->state = GOTD_STATE_DONE;
1147 			err = send_packfile(client);
1148 			break;
1149 		default:
1150 			log_debug("unexpected imsg %d", imsg.hdr.type);
1151 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1152 			break;
1153 		}
1154 
1155 		imsg_free(&imsg);
1156 	}
1157 
1158 	if (err) {
1159 		if (err->code != GOT_ERR_EOF ||
1160 		    client->state != GOTD_STATE_EXPECT_PACKFILE)
1161 			disconnect_on_error(client, err);
1162 	} else {
1163 		gotd_imsg_event_add(iev);
1164 		evtimer_add(&client->tmo, &gotd_session.request_timeout);
1165 	}
1166 }
1167 
1168 static const struct got_error *
1169 list_refs_request(void)
1170 {
1171 	static const struct got_error *err;
1172 	struct gotd_session_client *client = &gotd_session_client;
1173 	struct gotd_imsgev *iev = &client->repo_child_iev;
1174 	struct gotd_imsg_list_refs_internal ilref;
1175 	int fd;
1176 
1177 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1178 		return got_error(GOT_ERR_PRIVSEP_MSG);
1179 
1180 	memset(&ilref, 0, sizeof(ilref));
1181 	ilref.client_id = client->id;
1182 
1183 	fd = dup(client->fd);
1184 	if (fd == -1)
1185 		return got_error_from_errno("dup");
1186 
1187 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_LIST_REFS_INTERNAL,
1188 	    PROC_SESSION, fd, &ilref, sizeof(ilref)) == -1) {
1189 		err = got_error_from_errno("imsg compose LIST_REFS_INTERNAL");
1190 		close(fd);
1191 		return err;
1192 	}
1193 
1194 	client->state = GOTD_STATE_EXPECT_CAPABILITIES;
1195 	log_debug("uid %d: expecting capabilities", client->euid);
1196 	return NULL;
1197 }
1198 
1199 static const struct got_error *
1200 recv_connect(struct imsg *imsg)
1201 {
1202 	struct gotd_session_client *client = &gotd_session_client;
1203 	struct gotd_imsg_connect iconnect;
1204 	size_t datalen;
1205 
1206 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1207 		return got_error(GOT_ERR_PRIVSEP_MSG);
1208 
1209 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1210 	if (datalen != sizeof(iconnect))
1211 		return got_error(GOT_ERR_PRIVSEP_LEN);
1212 	memcpy(&iconnect, imsg->data, sizeof(iconnect));
1213 
1214 	if (imsg->fd == -1)
1215 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1216 
1217 	client->fd = imsg->fd;
1218 	client->euid = iconnect.euid;
1219 	client->egid = iconnect.egid;
1220 
1221 	imsg_init(&client->iev.ibuf, client->fd);
1222 	client->iev.handler = session_dispatch_listener;
1223 	client->iev.events = EV_READ;
1224 	client->iev.handler_arg = NULL;
1225 	event_set(&client->iev.ev, client->iev.ibuf.fd, EV_READ,
1226 	    session_dispatch_listener, &client->iev);
1227 	gotd_imsg_event_add(&client->iev);
1228 	evtimer_set(&client->tmo, gotd_request_timeout, client);
1229 
1230 	return NULL;
1231 }
1232 
1233 static const struct got_error *
1234 recv_repo_child(struct imsg *imsg)
1235 {
1236 	struct gotd_imsg_connect_repo_child ichild;
1237 	struct gotd_session_client *client = &gotd_session_client;
1238 	size_t datalen;
1239 
1240 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1241 		return got_error(GOT_ERR_PRIVSEP_MSG);
1242 
1243 	/* We should already have received a pipe to the listener. */
1244 	if (client->fd == -1)
1245 		return got_error(GOT_ERR_PRIVSEP_MSG);
1246 
1247 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1248 	if (datalen != sizeof(ichild))
1249 		return got_error(GOT_ERR_PRIVSEP_LEN);
1250 
1251 	memcpy(&ichild, imsg->data, sizeof(ichild));
1252 
1253 	client->id = ichild.client_id;
1254 	if (ichild.proc_id == PROC_REPO_WRITE)
1255 		client->is_writing = 1;
1256 	else if (ichild.proc_id == PROC_REPO_READ)
1257 		client->is_writing = 0;
1258 	else
1259 		return got_error_msg(GOT_ERR_PRIVSEP_MSG,
1260 		    "bad child process type");
1261 		
1262 	if (imsg->fd == -1)
1263 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1264 
1265 	imsg_init(&client->repo_child_iev.ibuf, imsg->fd);
1266 	client->repo_child_iev.handler = session_dispatch_repo_child;
1267 	client->repo_child_iev.events = EV_READ;
1268 	client->repo_child_iev.handler_arg = NULL;
1269 	event_set(&client->repo_child_iev.ev, client->repo_child_iev.ibuf.fd,
1270 	    EV_READ, session_dispatch_repo_child, &client->repo_child_iev);
1271 	gotd_imsg_event_add(&client->repo_child_iev);
1272 
1273 	/* The "recvfd" pledge promise is no longer needed. */
1274 	if (pledge("stdio rpath wpath cpath sendfd fattr flock", NULL) == -1)
1275 		fatal("pledge");
1276 
1277 	return NULL;
1278 }
1279 
1280 static void
1281 session_dispatch(int fd, short event, void *arg)
1282 {
1283 	struct gotd_imsgev *iev = arg;
1284 	struct imsgbuf *ibuf = &iev->ibuf;
1285 	struct gotd_session_client *client = &gotd_session_client;
1286 	ssize_t n;
1287 	int shut = 0;
1288 	struct imsg imsg;
1289 
1290 	if (event & EV_READ) {
1291 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1292 			fatal("imsg_read error");
1293 		if (n == 0) {
1294 			/* Connection closed. */
1295 			shut = 1;
1296 			goto done;
1297 		}
1298 	}
1299 
1300 	if (event & EV_WRITE) {
1301 		n = msgbuf_write(&ibuf->w);
1302 		if (n == -1 && errno != EAGAIN)
1303 			fatal("msgbuf_write");
1304 		if (n == 0) {
1305 			/* Connection closed. */
1306 			shut = 1;
1307 			goto done;
1308 		}
1309 	}
1310 
1311 	for (;;) {
1312 		const struct got_error *err = NULL;
1313 		uint32_t client_id = 0;
1314 		int do_disconnect = 0, do_list_refs = 0;
1315 
1316 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1317 			fatal("%s: imsg_get error", __func__);
1318 		if (n == 0)	/* No more messages. */
1319 			break;
1320 
1321 		switch (imsg.hdr.type) {
1322 		case GOTD_IMSG_ERROR:
1323 			do_disconnect = 1;
1324 			err = gotd_imsg_recv_error(&client_id, &imsg);
1325 			break;
1326 		case GOTD_IMSG_CONNECT:
1327 			err = recv_connect(&imsg);
1328 			break;
1329 		case GOTD_IMSG_DISCONNECT:
1330 			do_disconnect = 1;
1331 			break;
1332 		case GOTD_IMSG_CONNECT_REPO_CHILD:
1333 			err = recv_repo_child(&imsg);
1334 			if (err)
1335 				break;
1336 			do_list_refs = 1;
1337 			break;
1338 		default:
1339 			log_debug("unexpected imsg %d", imsg.hdr.type);
1340 			break;
1341 		}
1342 		imsg_free(&imsg);
1343 
1344 		if (do_disconnect) {
1345 			if (err)
1346 				disconnect_on_error(client, err);
1347 			else
1348 				disconnect(client);
1349 		} else if (do_list_refs)
1350 			err = list_refs_request();
1351 
1352 		if (err)
1353 			log_warnx("uid %d: %s", client->euid, err->msg);
1354 	}
1355 done:
1356 	if (!shut) {
1357 		gotd_imsg_event_add(iev);
1358 	} else {
1359 		/* This pipe is dead. Remove its event handler */
1360 		event_del(&iev->ev);
1361 		event_loopexit(NULL);
1362 	}	
1363 }
1364 
1365 void
1366 session_main(const char *title, const char *repo_path,
1367     int *pack_fds, int *temp_fds, struct timeval *request_timeout)
1368 {
1369 	const struct got_error *err = NULL;
1370 	struct event evsigint, evsigterm, evsighup, evsigusr1;
1371 
1372 	gotd_session.title = title;
1373 	gotd_session.pid = getpid();
1374 	gotd_session.pack_fds = pack_fds;
1375 	gotd_session.temp_fds = temp_fds;
1376 	memcpy(&gotd_session.request_timeout, request_timeout,
1377 	    sizeof(gotd_session.request_timeout));
1378 
1379 	err = got_repo_open(&gotd_session.repo, repo_path, NULL, pack_fds);
1380 	if (err)
1381 		goto done;
1382 	if (!got_repo_is_bare(gotd_session.repo)) {
1383 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
1384 		    "bare git repository required");
1385 		goto done;
1386 	}
1387 
1388 	got_repo_temp_fds_set(gotd_session.repo, temp_fds);
1389 
1390 	signal_set(&evsigint, SIGINT, gotd_session_sighdlr, NULL);
1391 	signal_set(&evsigterm, SIGTERM, gotd_session_sighdlr, NULL);
1392 	signal_set(&evsighup, SIGHUP, gotd_session_sighdlr, NULL);
1393 	signal_set(&evsigusr1, SIGUSR1, gotd_session_sighdlr, NULL);
1394 	signal(SIGPIPE, SIG_IGN);
1395 
1396 	signal_add(&evsigint, NULL);
1397 	signal_add(&evsigterm, NULL);
1398 	signal_add(&evsighup, NULL);
1399 	signal_add(&evsigusr1, NULL);
1400 
1401 	gotd_session_client.state = GOTD_STATE_EXPECT_LIST_REFS;
1402 	gotd_session_client.fd = -1;
1403 	gotd_session_client.nref_updates = -1;
1404 	gotd_session_client.delta_cache_fd = -1;
1405 
1406 	imsg_init(&gotd_session.parent_iev.ibuf, GOTD_FILENO_MSG_PIPE);
1407 	gotd_session.parent_iev.handler = session_dispatch;
1408 	gotd_session.parent_iev.events = EV_READ;
1409 	gotd_session.parent_iev.handler_arg = NULL;
1410 	event_set(&gotd_session.parent_iev.ev, gotd_session.parent_iev.ibuf.fd,
1411 	    EV_READ, session_dispatch, &gotd_session.parent_iev);
1412 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
1413 	    GOTD_IMSG_CLIENT_SESSION_READY, PROC_SESSION, -1, NULL, 0) == -1) {
1414 		err = got_error_from_errno("imsg compose CLIENT_SESSION_READY");
1415 		goto done;
1416 	}
1417 
1418 	event_dispatch();
1419 done:
1420 	if (err)
1421 		log_warnx("%s: %s", title, err->msg);
1422 	gotd_session_shutdown();
1423 }
1424 
1425 void
1426 gotd_session_shutdown(void)
1427 {
1428 	log_debug("%s: shutting down", gotd_session.title);
1429 	if (gotd_session.repo)
1430 		got_repo_close(gotd_session.repo);
1431 	got_repo_pack_fds_close(gotd_session.pack_fds);
1432 	got_repo_temp_fds_close(gotd_session.temp_fds);
1433 	exit(0);
1434 }