Game of Trees Repos

Blob

Date:: Tue Jan 30 11:31:28 2024 UTC
Message:: remove unneded wbuf->fd = -1 There's no need to set the fd to -1 on ibufs created with imsg_create(3), and it was probably never needed.
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2022, 2023 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/queue.h>
19 #include <sys/tree.h>
20 #include <sys/socket.h>
21 #include <sys/stat.h>
22 #include <sys/uio.h>
23 
24 #include <errno.h>
25 #include <event.h>
26 #include <limits.h>
27 #include <sha1.h>
28 #include <sha2.h>
29 #include <signal.h>
30 #include <stdint.h>
31 #include <stdio.h>
32 #include <stdlib.h>
33 #include <string.h>
34 #include <imsg.h>
35 #include <unistd.h>
36 
37 #include "got_error.h"
38 #include "got_repository.h"
39 #include "got_object.h"
40 #include "got_path.h"
41 #include "got_reference.h"
42 #include "got_opentemp.h"
43 
44 #include "got_lib_hash.h"
45 #include "got_lib_delta.h"
46 #include "got_lib_object.h"
47 #include "got_lib_object_cache.h"
48 #include "got_lib_pack.h"
49 #include "got_lib_repository.h"
50 #include "got_lib_gitproto.h"
51 
52 #include "gotd.h"
53 #include "log.h"
54 #include "session.h"
55 
56 
57 static struct gotd_session {
58 	pid_t pid;
59 	const char *title;
60 	struct got_repository *repo;
61 	int *pack_fds;
62 	int *temp_fds;
63 	struct gotd_imsgev parent_iev;
64 	struct timeval request_timeout;
65 	enum gotd_procid proc_id;
66 } gotd_session;
67 
68 static struct gotd_session_client {
69 	enum gotd_session_state		 state;
70 	int				 is_writing;
71 	struct gotd_client_capability	*capabilities;
72 	size_t				 ncapa_alloc;
73 	size_t				 ncapabilities;
74 	uint32_t			 id;
75 	int				 fd;
76 	int				 delta_cache_fd;
77 	struct gotd_imsgev		 iev;
78 	struct gotd_imsgev		 repo_child_iev;
79 	struct event			 tmo;
80 	uid_t				 euid;
81 	gid_t				 egid;
82 	char				*packfile_path;
83 	char				*packidx_path;
84 	int				 nref_updates;
85 	int				 accept_flush_pkt;
86 	int				 flush_disconnect;
87 } gotd_session_client;
88 
89 void gotd_session_sighdlr(int sig, short event, void *arg);
90 static void gotd_session_shutdown(void);
91 
92 static void
93 disconnect(struct gotd_session_client *client)
94 {
95 	log_debug("uid %d: disconnecting", client->euid);
96 
97 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
98 	    GOTD_IMSG_DISCONNECT, gotd_session.proc_id, -1, NULL, 0) == -1)
99 		log_warn("imsg compose DISCONNECT");
100 
101 	imsg_clear(&client->repo_child_iev.ibuf);
102 	event_del(&client->repo_child_iev.ev);
103 	evtimer_del(&client->tmo);
104 	close(client->fd);
105 	if (client->delta_cache_fd != -1)
106 		close(client->delta_cache_fd);
107 	if (client->packfile_path) {
108 		if (unlink(client->packfile_path) == -1 && errno != ENOENT)
109 			log_warn("unlink %s: ", client->packfile_path);
110 		free(client->packfile_path);
111 	}
112 	if (client->packidx_path) {
113 		if (unlink(client->packidx_path) == -1 && errno != ENOENT)
114 			log_warn("unlink %s: ", client->packidx_path);
115 		free(client->packidx_path);
116 	}
117 	free(client->capabilities);
118 
119 	gotd_session_shutdown();
120 }
121 
122 static void
123 disconnect_on_error(struct gotd_session_client *client,
124     const struct got_error *err)
125 {
126 	struct imsgbuf ibuf;
127 
128 	if (err->code != GOT_ERR_EOF) {
129 		log_warnx("uid %d: %s", client->euid, err->msg);
130 		imsg_init(&ibuf, client->fd);
131 		gotd_imsg_send_error(&ibuf, 0, gotd_session.proc_id, err);
132 		imsg_clear(&ibuf);
133 	}
134 
135 	disconnect(client);
136 }
137 
138 static void
139 gotd_request_timeout(int fd, short events, void *arg)
140 {
141 	struct gotd_session_client *client = arg;
142 
143 	log_debug("disconnecting uid %d due to timeout", client->euid);
144 	disconnect(client);
145 }
146 
147 void
148 gotd_session_sighdlr(int sig, short event, void *arg)
149 {
150 	/*
151 	 * Normal signal handler rules don't apply because libevent
152 	 * decouples for us.
153 	 */
154 
155 	switch (sig) {
156 	case SIGHUP:
157 		log_info("%s: ignoring SIGHUP", __func__);
158 		break;
159 	case SIGUSR1:
160 		log_info("%s: ignoring SIGUSR1", __func__);
161 		break;
162 	case SIGTERM:
163 	case SIGINT:
164 		gotd_session_shutdown();
165 		/* NOTREACHED */
166 		break;
167 	default:
168 		fatalx("unexpected signal");
169 	}
170 }
171 
172 static const struct got_error *
173 recv_packfile_done(uint32_t *client_id, struct imsg *imsg)
174 {
175 	struct gotd_imsg_packfile_done idone;
176 	size_t datalen;
177 
178 	log_debug("packfile-done received");
179 
180 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
181 	if (datalen != sizeof(idone))
182 		return got_error(GOT_ERR_PRIVSEP_LEN);
183 	memcpy(&idone, imsg->data, sizeof(idone));
184 
185 	*client_id = idone.client_id;
186 	return NULL;
187 }
188 
189 static const struct got_error *
190 recv_packfile_install(uint32_t *client_id, struct imsg *imsg)
191 {
192 	struct gotd_imsg_packfile_install inst;
193 	size_t datalen;
194 
195 	log_debug("packfile-install received");
196 
197 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
198 	if (datalen != sizeof(inst))
199 		return got_error(GOT_ERR_PRIVSEP_LEN);
200 	memcpy(&inst, imsg->data, sizeof(inst));
201 
202 	*client_id = inst.client_id;
203 	return NULL;
204 }
205 
206 static const struct got_error *
207 recv_ref_updates_start(uint32_t *client_id, struct imsg *imsg)
208 {
209 	struct gotd_imsg_ref_updates_start istart;
210 	size_t datalen;
211 
212 	log_debug("ref-updates-start received");
213 
214 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
215 	if (datalen != sizeof(istart))
216 		return got_error(GOT_ERR_PRIVSEP_LEN);
217 	memcpy(&istart, imsg->data, sizeof(istart));
218 
219 	*client_id = istart.client_id;
220 	return NULL;
221 }
222 
223 static const struct got_error *
224 recv_ref_update(uint32_t *client_id, struct imsg *imsg)
225 {
226 	struct gotd_imsg_ref_update iref;
227 	size_t datalen;
228 
229 	log_debug("ref-update received");
230 
231 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
232 	if (datalen < sizeof(iref))
233 		return got_error(GOT_ERR_PRIVSEP_LEN);
234 	memcpy(&iref, imsg->data, sizeof(iref));
235 
236 	*client_id = iref.client_id;
237 	return NULL;
238 }
239 
240 static const struct got_error *
241 send_ref_update_ok(struct gotd_session_client *client,
242     struct gotd_imsg_ref_update *iref, const char *refname)
243 {
244 	struct gotd_imsg_ref_update_ok iok;
245 	struct gotd_imsgev *iev = &client->iev;
246 	struct ibuf *wbuf;
247 	size_t len;
248 
249 	memset(&iok, 0, sizeof(iok));
250 	iok.client_id = client->id;
251 	memcpy(iok.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
252 	memcpy(iok.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
253 	iok.name_len = strlen(refname);
254 
255 	len = sizeof(iok) + iok.name_len;
256 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE_OK,
257 	    gotd_session.proc_id, gotd_session.pid, len);
258 	if (wbuf == NULL)
259 		return got_error_from_errno("imsg_create REF_UPDATE_OK");
260 
261 	if (imsg_add(wbuf, &iok, sizeof(iok)) == -1)
262 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
263 	if (imsg_add(wbuf, refname, iok.name_len) == -1)
264 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
265 
266 	imsg_close(&iev->ibuf, wbuf);
267 	gotd_imsg_event_add(iev);
268 	return NULL;
269 }
270 
271 static void
272 send_refs_updated(struct gotd_session_client *client)
273 {
274 	if (gotd_imsg_compose_event(&client->iev, GOTD_IMSG_REFS_UPDATED,
275 	    gotd_session.proc_id, -1, NULL, 0) == -1)
276 		log_warn("imsg compose REFS_UPDATED");
277 }
278 
279 static const struct got_error *
280 send_ref_update_ng(struct gotd_session_client *client,
281     struct gotd_imsg_ref_update *iref, const char *refname,
282     const char *reason)
283 {
284 	const struct got_error *ng_err;
285 	struct gotd_imsg_ref_update_ng ing;
286 	struct gotd_imsgev *iev = &client->iev;
287 	struct ibuf *wbuf;
288 	size_t len;
289 
290 	memset(&ing, 0, sizeof(ing));
291 	ing.client_id = client->id;
292 	memcpy(ing.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
293 	memcpy(ing.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
294 	ing.name_len = strlen(refname);
295 
296 	ng_err = got_error_fmt(GOT_ERR_REF_BUSY, "%s", reason);
297 	ing.reason_len = strlen(ng_err->msg);
298 
299 	len = sizeof(ing) + ing.name_len + ing.reason_len;
300 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE_NG,
301 	    gotd_session.proc_id, gotd_session.pid, len);
302 	if (wbuf == NULL)
303 		return got_error_from_errno("imsg_create REF_UPDATE_NG");
304 
305 	if (imsg_add(wbuf, &ing, sizeof(ing)) == -1)
306 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
307 	if (imsg_add(wbuf, refname, ing.name_len) == -1)
308 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
309 	if (imsg_add(wbuf, ng_err->msg, ing.reason_len) == -1)
310 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
311 
312 	imsg_close(&iev->ibuf, wbuf);
313 	gotd_imsg_event_add(iev);
314 	return NULL;
315 }
316 
317 static const struct got_error *
318 install_pack(struct gotd_session_client *client, const char *repo_path,
319     struct imsg *imsg)
320 {
321 	const struct got_error *err = NULL;
322 	struct gotd_imsg_packfile_install inst;
323 	char hex[SHA1_DIGEST_STRING_LENGTH];
324 	size_t datalen;
325 	char *packfile_path = NULL, *packidx_path = NULL;
326 
327 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
328 	if (datalen != sizeof(inst))
329 		return got_error(GOT_ERR_PRIVSEP_LEN);
330 	memcpy(&inst, imsg->data, sizeof(inst));
331 
332 	if (client->packfile_path == NULL)
333 		return got_error_msg(GOT_ERR_BAD_REQUEST,
334 		    "client has no pack file");
335 	if (client->packidx_path == NULL)
336 		return got_error_msg(GOT_ERR_BAD_REQUEST,
337 		    "client has no pack file index");
338 
339 	if (got_sha1_digest_to_str(inst.pack_sha1, hex, sizeof(hex)) == NULL)
340 		return got_error_msg(GOT_ERR_NO_SPACE,
341 		    "could not convert pack file SHA1 to hex");
342 
343 	if (asprintf(&packfile_path, "/%s/%s/pack-%s.pack",
344 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
345 		err = got_error_from_errno("asprintf");
346 		goto done;
347 	}
348 
349 	if (asprintf(&packidx_path, "/%s/%s/pack-%s.idx",
350 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
351 		err = got_error_from_errno("asprintf");
352 		goto done;
353 	}
354 
355 	if (rename(client->packfile_path, packfile_path) == -1) {
356 		err = got_error_from_errno3("rename", client->packfile_path,
357 		    packfile_path);
358 		goto done;
359 	}
360 
361 	free(client->packfile_path);
362 	client->packfile_path = NULL;
363 
364 	if (rename(client->packidx_path, packidx_path) == -1) {
365 		err = got_error_from_errno3("rename", client->packidx_path,
366 		    packidx_path);
367 		goto done;
368 	}
369 
370 	free(client->packidx_path);
371 	client->packidx_path = NULL;
372 done:
373 	free(packfile_path);
374 	free(packidx_path);
375 	return err;
376 }
377 
378 static const struct got_error *
379 begin_ref_updates(struct gotd_session_client *client, struct imsg *imsg)
380 {
381 	struct gotd_imsg_ref_updates_start istart;
382 	size_t datalen;
383 
384 	if (client->nref_updates != -1)
385 		return got_error(GOT_ERR_PRIVSEP_MSG);
386 
387 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
388 	if (datalen != sizeof(istart))
389 		return got_error(GOT_ERR_PRIVSEP_LEN);
390 	memcpy(&istart, imsg->data, sizeof(istart));
391 
392 	if (istart.nref_updates <= 0)
393 		return got_error(GOT_ERR_PRIVSEP_MSG);
394 
395 	client->nref_updates = istart.nref_updates;
396 	return NULL;
397 }
398 
399 static const struct got_error *
400 update_ref(int *shut, struct gotd_session_client *client,
401     const char *repo_path, struct imsg *imsg)
402 {
403 	const struct got_error *err = NULL;
404 	struct got_repository *repo = NULL;
405 	struct got_reference *ref = NULL;
406 	struct gotd_imsg_ref_update iref;
407 	struct got_object_id old_id, new_id;
408 	struct got_object_id *id = NULL;
409 	char *refname = NULL;
410 	size_t datalen;
411 	int locked = 0;
412 	char hex1[SHA1_DIGEST_STRING_LENGTH];
413 	char hex2[SHA1_DIGEST_STRING_LENGTH];
414 
415 	log_debug("update-ref from uid %d", client->euid);
416 
417 	if (client->nref_updates <= 0)
418 		return got_error(GOT_ERR_PRIVSEP_MSG);
419 
420 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
421 	if (datalen < sizeof(iref))
422 		return got_error(GOT_ERR_PRIVSEP_LEN);
423 	memcpy(&iref, imsg->data, sizeof(iref));
424 	if (datalen != sizeof(iref) + iref.name_len)
425 		return got_error(GOT_ERR_PRIVSEP_LEN);
426 	refname = strndup(imsg->data + sizeof(iref), iref.name_len);
427 	if (refname == NULL)
428 		return got_error_from_errno("strndup");
429 
430 	log_debug("updating ref %s for uid %d", refname, client->euid);
431 
432 	err = got_repo_open(&repo, repo_path, NULL, NULL);
433 	if (err)
434 		goto done;
435 
436 	memcpy(old_id.sha1, iref.old_id, SHA1_DIGEST_LENGTH);
437 	memcpy(new_id.sha1, iref.new_id, SHA1_DIGEST_LENGTH);
438 	err = got_repo_find_object_id(iref.delete_ref ? &old_id : &new_id,
439 	    repo);
440 	if (err)
441 		goto done;
442 
443 	if (iref.ref_is_new) {
444 		err = got_ref_open(&ref, repo, refname, 0);
445 		if (err) {
446 			if (err->code != GOT_ERR_NOT_REF)
447 				goto done;
448 			err = got_ref_alloc(&ref, refname, &new_id);
449 			if (err)
450 				goto done;
451 			err = got_ref_write(ref, repo); /* will lock/unlock */
452 			if (err)
453 				goto done;
454 		} else {
455 			err = got_ref_resolve(&id, repo, ref);
456 			if (err)
457 				goto done;
458 			got_object_id_hex(&new_id, hex1, sizeof(hex1));
459 			got_object_id_hex(id, hex2, sizeof(hex2));
460 			err = got_error_fmt(GOT_ERR_REF_BUSY,
461 			    "Addition %s: %s failed; %s: %s has been "
462 			    "created by someone else while transaction "
463 			    "was in progress",
464 			    got_ref_get_name(ref), hex1,
465 			    got_ref_get_name(ref), hex2);
466 			goto done;
467 		}
468 	} else if (iref.delete_ref) {
469 		err = got_ref_open(&ref, repo, refname, 1 /* lock */);
470 		if (err)
471 			goto done;
472 		locked = 1;
473 
474 		err = got_ref_resolve(&id, repo, ref);
475 		if (err)
476 			goto done;
477 
478 		if (got_object_id_cmp(id, &old_id) != 0) {
479 			got_object_id_hex(&old_id, hex1, sizeof(hex1));
480 			got_object_id_hex(id, hex2, sizeof(hex2));
481 			err = got_error_fmt(GOT_ERR_REF_BUSY,
482 			    "Deletion %s: %s failed; %s: %s has been "
483 			    "created by someone else while transaction "
484 			    "was in progress",
485 			    got_ref_get_name(ref), hex1,
486 			    got_ref_get_name(ref), hex2);
487 			goto done;
488 		}
489 
490 		err = got_ref_delete(ref, repo);
491 		if (err)
492 			goto done;
493 
494 		free(id);
495 		id = NULL;
496 	} else {
497 		err = got_ref_open(&ref, repo, refname, 1 /* lock */);
498 		if (err)
499 			goto done;
500 		locked = 1;
501 
502 		err = got_ref_resolve(&id, repo, ref);
503 		if (err)
504 			goto done;
505 
506 		if (got_object_id_cmp(id, &old_id) != 0) {
507 			got_object_id_hex(&old_id, hex1, sizeof(hex1));
508 			got_object_id_hex(id, hex2, sizeof(hex2));
509 			err = got_error_fmt(GOT_ERR_REF_BUSY,
510 			    "Update %s: %s failed; %s: %s has been "
511 			    "created by someone else while transaction "
512 			    "was in progress",
513 			    got_ref_get_name(ref), hex1,
514 			    got_ref_get_name(ref), hex2);
515 			goto done;
516 		}
517 
518 		if (got_object_id_cmp(&new_id, &old_id) != 0) {
519 			err = got_ref_change_ref(ref, &new_id);
520 			if (err)
521 				goto done;
522 
523 			err = got_ref_write(ref, repo);
524 			if (err)
525 				goto done;
526 		}
527 
528 		free(id);
529 		id = NULL;
530 	}
531 done:
532 	if (err) {
533 		if (err->code == GOT_ERR_LOCKFILE_TIMEOUT) {
534 			err = got_error_fmt(GOT_ERR_LOCKFILE_TIMEOUT,
535 			    "could not acquire exclusive file lock for %s",
536 			    refname);
537 		}
538 		send_ref_update_ng(client, &iref, refname, err->msg);
539 	} else
540 		send_ref_update_ok(client, &iref, refname);
541 
542 	if (client->nref_updates > 0) {
543 		client->nref_updates--;
544 		if (client->nref_updates == 0) {
545 			send_refs_updated(client);
546 			client->flush_disconnect = 1;
547 		}
548 
549 	}
550 	if (locked) {
551 		const struct got_error *unlock_err;
552 		unlock_err = got_ref_unlock(ref);
553 		if (unlock_err && err == NULL)
554 			err = unlock_err;
555 	}
556 	if (ref)
557 		got_ref_close(ref);
558 	if (repo)
559 		got_repo_close(repo);
560 	free(refname);
561 	free(id);
562 	return err;
563 }
564 
565 static void
566 session_dispatch_repo_child(int fd, short event, void *arg)
567 {
568 	struct gotd_imsgev *iev = arg;
569 	struct imsgbuf *ibuf = &iev->ibuf;
570 	struct gotd_session_client *client = &gotd_session_client;
571 	ssize_t n;
572 	int shut = 0;
573 	struct imsg imsg;
574 
575 	if (event & EV_READ) {
576 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
577 			fatal("imsg_read error");
578 		if (n == 0) {
579 			/* Connection closed. */
580 			shut = 1;
581 			goto done;
582 		}
583 	}
584 
585 	if (event & EV_WRITE) {
586 		n = msgbuf_write(&ibuf->w);
587 		if (n == -1 && errno != EAGAIN)
588 			fatal("msgbuf_write");
589 		if (n == 0) {
590 			/* Connection closed. */
591 			shut = 1;
592 			goto done;
593 		}
594 	}
595 
596 	for (;;) {
597 		const struct got_error *err = NULL;
598 		uint32_t client_id = 0;
599 		int do_disconnect = 0;
600 		int do_ref_updates = 0, do_ref_update = 0;
601 		int do_packfile_install = 0;
602 
603 		if ((n = imsg_get(ibuf, &imsg)) == -1)
604 			fatal("%s: imsg_get error", __func__);
605 		if (n == 0)	/* No more messages. */
606 			break;
607 
608 		switch (imsg.hdr.type) {
609 		case GOTD_IMSG_ERROR:
610 			do_disconnect = 1;
611 			err = gotd_imsg_recv_error(&client_id, &imsg);
612 			break;
613 		case GOTD_IMSG_PACKFILE_DONE:
614 			do_disconnect = 1;
615 			err = recv_packfile_done(&client_id, &imsg);
616 			break;
617 		case GOTD_IMSG_PACKFILE_INSTALL:
618 			err = recv_packfile_install(&client_id, &imsg);
619 			if (err == NULL)
620 				do_packfile_install = 1;
621 			break;
622 		case GOTD_IMSG_REF_UPDATES_START:
623 			err = recv_ref_updates_start(&client_id, &imsg);
624 			if (err == NULL)
625 				do_ref_updates = 1;
626 			break;
627 		case GOTD_IMSG_REF_UPDATE:
628 			err = recv_ref_update(&client_id, &imsg);
629 			if (err == NULL)
630 				do_ref_update = 1;
631 			break;
632 		default:
633 			log_debug("unexpected imsg %d", imsg.hdr.type);
634 			break;
635 		}
636 
637 		if (do_disconnect) {
638 			if (err)
639 				disconnect_on_error(client, err);
640 			else
641 				disconnect(client);
642 		} else {
643 			if (do_packfile_install)
644 				err = install_pack(client,
645 				    gotd_session.repo->path, &imsg);
646 			else if (do_ref_updates)
647 				err = begin_ref_updates(client, &imsg);
648 			else if (do_ref_update)
649 				err = update_ref(&shut, client,
650 				    gotd_session.repo->path, &imsg);
651 			if (err)
652 				log_warnx("uid %d: %s", client->euid, err->msg);
653 		}
654 		imsg_free(&imsg);
655 	}
656 done:
657 	if (!shut) {
658 		gotd_imsg_event_add(iev);
659 	} else {
660 		/* This pipe is dead. Remove its event handler */
661 		event_del(&iev->ev);
662 		event_loopexit(NULL);
663 	}
664 }
665 
666 static const struct got_error *
667 recv_capabilities(struct gotd_session_client *client, struct imsg *imsg)
668 {
669 	struct gotd_imsg_capabilities icapas;
670 	size_t datalen;
671 
672 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
673 	if (datalen != sizeof(icapas))
674 		return got_error(GOT_ERR_PRIVSEP_LEN);
675 	memcpy(&icapas, imsg->data, sizeof(icapas));
676 
677 	client->ncapa_alloc = icapas.ncapabilities;
678 	client->capabilities = calloc(client->ncapa_alloc,
679 	    sizeof(*client->capabilities));
680 	if (client->capabilities == NULL) {
681 		client->ncapa_alloc = 0;
682 		return got_error_from_errno("calloc");
683 	}
684 
685 	log_debug("expecting %zu capabilities from uid %d",
686 	    client->ncapa_alloc, client->euid);
687 	return NULL;
688 }
689 
690 static const struct got_error *
691 recv_capability(struct gotd_session_client *client, struct imsg *imsg)
692 {
693 	struct gotd_imsg_capability icapa;
694 	struct gotd_client_capability *capa;
695 	size_t datalen;
696 	char *key, *value = NULL;
697 
698 	if (client->capabilities == NULL ||
699 	    client->ncapabilities >= client->ncapa_alloc) {
700 		return got_error_msg(GOT_ERR_BAD_REQUEST,
701 		    "unexpected capability received");
702 	}
703 
704 	memset(&icapa, 0, sizeof(icapa));
705 
706 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
707 	if (datalen < sizeof(icapa))
708 		return got_error(GOT_ERR_PRIVSEP_LEN);
709 	memcpy(&icapa, imsg->data, sizeof(icapa));
710 
711 	if (datalen != sizeof(icapa) + icapa.key_len + icapa.value_len)
712 		return got_error(GOT_ERR_PRIVSEP_LEN);
713 
714 	key = strndup(imsg->data + sizeof(icapa), icapa.key_len);
715 	if (key == NULL)
716 		return got_error_from_errno("strndup");
717 	if (icapa.value_len > 0) {
718 		value = strndup(imsg->data + sizeof(icapa) + icapa.key_len,
719 		    icapa.value_len);
720 		if (value == NULL) {
721 			free(key);
722 			return got_error_from_errno("strndup");
723 		}
724 	}
725 
726 	capa = &client->capabilities[client->ncapabilities++];
727 	capa->key = key;
728 	capa->value = value;
729 
730 	if (value)
731 		log_debug("uid %d: capability %s=%s", client->euid, key, value);
732 	else
733 		log_debug("uid %d: capability %s", client->euid, key);
734 
735 	return NULL;
736 }
737 
738 static const struct got_error *
739 ensure_client_is_reading(struct gotd_session_client *client)
740 {
741 	if (client->is_writing) {
742 		return got_error_fmt(GOT_ERR_BAD_PACKET,
743 		    "uid %d made a read-request but is not reading from "
744 		    "a repository", client->euid);
745 	}
746 
747 	return NULL;
748 }
749 
750 static const struct got_error *
751 ensure_client_is_writing(struct gotd_session_client *client)
752 {
753 	if (!client->is_writing) {
754 		return got_error_fmt(GOT_ERR_BAD_PACKET,
755 		    "uid %d made a write-request but is not writing to "
756 		    "a repository", client->euid);
757 	}
758 
759 	return NULL;
760 }
761 
762 static const struct got_error *
763 forward_want(struct gotd_session_client *client, struct imsg *imsg)
764 {
765 	struct gotd_imsg_want ireq;
766 	struct gotd_imsg_want iwant;
767 	size_t datalen;
768 
769 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
770 	if (datalen != sizeof(ireq))
771 		return got_error(GOT_ERR_PRIVSEP_LEN);
772 
773 	memcpy(&ireq, imsg->data, datalen);
774 
775 	memset(&iwant, 0, sizeof(iwant));
776 	memcpy(iwant.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
777 	iwant.client_id = client->id;
778 
779 	if (gotd_imsg_compose_event(&client->repo_child_iev, GOTD_IMSG_WANT,
780 	    gotd_session.proc_id, -1, &iwant, sizeof(iwant)) == -1)
781 		return got_error_from_errno("imsg compose WANT");
782 
783 	return NULL;
784 }
785 
786 static const struct got_error *
787 forward_ref_update(struct gotd_session_client *client, struct imsg *imsg)
788 {
789 	const struct got_error *err = NULL;
790 	struct gotd_imsg_ref_update ireq;
791 	struct gotd_imsg_ref_update *iref = NULL;
792 	size_t datalen;
793 
794 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
795 	if (datalen < sizeof(ireq))
796 		return got_error(GOT_ERR_PRIVSEP_LEN);
797 	memcpy(&ireq, imsg->data, sizeof(ireq));
798 	if (datalen != sizeof(ireq) + ireq.name_len)
799 		return got_error(GOT_ERR_PRIVSEP_LEN);
800 
801 	iref = malloc(datalen);
802 	if (iref == NULL)
803 		return got_error_from_errno("malloc");
804 	memcpy(iref, imsg->data, datalen);
805 
806 	iref->client_id = client->id;
807 	if (gotd_imsg_compose_event(&client->repo_child_iev,
808 	    GOTD_IMSG_REF_UPDATE, gotd_session.proc_id, -1,
809 	    iref, datalen) == -1)
810 		err = got_error_from_errno("imsg compose REF_UPDATE");
811 	free(iref);
812 	return err;
813 }
814 
815 static const struct got_error *
816 forward_have(struct gotd_session_client *client, struct imsg *imsg)
817 {
818 	struct gotd_imsg_have ireq;
819 	struct gotd_imsg_have ihave;
820 	size_t datalen;
821 
822 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
823 	if (datalen != sizeof(ireq))
824 		return got_error(GOT_ERR_PRIVSEP_LEN);
825 
826 	memcpy(&ireq, imsg->data, datalen);
827 
828 	memset(&ihave, 0, sizeof(ihave));
829 	memcpy(ihave.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
830 	ihave.client_id = client->id;
831 
832 	if (gotd_imsg_compose_event(&client->repo_child_iev, GOTD_IMSG_HAVE,
833 	    gotd_session.proc_id, -1, &ihave, sizeof(ihave)) == -1)
834 		return got_error_from_errno("imsg compose HAVE");
835 
836 	return NULL;
837 }
838 
839 static int
840 client_has_capability(struct gotd_session_client *client, const char *capastr)
841 {
842 	struct gotd_client_capability *capa;
843 	size_t i;
844 
845 	if (client->ncapabilities == 0)
846 		return 0;
847 
848 	for (i = 0; i < client->ncapabilities; i++) {
849 		capa = &client->capabilities[i];
850 		if (strcmp(capa->key, capastr) == 0)
851 			return 1;
852 	}
853 
854 	return 0;
855 }
856 
857 static const struct got_error *
858 recv_packfile(struct gotd_session_client *client)
859 {
860 	const struct got_error *err = NULL;
861 	struct gotd_imsg_recv_packfile ipack;
862 	struct gotd_imsg_packfile_pipe ipipe;
863 	struct gotd_imsg_packidx_file ifile;
864 	char *basepath = NULL, *pack_path = NULL, *idx_path = NULL;
865 	int packfd = -1, idxfd = -1;
866 	int pipe[2] = { -1, -1 };
867 
868 	if (client->packfile_path) {
869 		return got_error_fmt(GOT_ERR_PRIVSEP_MSG,
870 		    "uid %d already has a pack file", client->euid);
871 	}
872 
873 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
874 		return got_error_from_errno("socketpair");
875 
876 	memset(&ipipe, 0, sizeof(ipipe));
877 	ipipe.client_id = client->id;
878 
879 	/* Send pack pipe end 0 to repo child process. */
880 	if (gotd_imsg_compose_event(&client->repo_child_iev,
881 	    GOTD_IMSG_PACKFILE_PIPE, gotd_session.proc_id, pipe[0],
882 	        &ipipe, sizeof(ipipe)) == -1) {
883 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
884 		pipe[0] = -1;
885 		goto done;
886 	}
887 	pipe[0] = -1;
888 
889 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
890 	if (gotd_imsg_compose_event(&client->iev,
891 	    GOTD_IMSG_PACKFILE_PIPE, gotd_session.proc_id, pipe[1],
892 	    NULL, 0) == -1)
893 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
894 	pipe[1] = -1;
895 
896 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.pack",
897 	    got_repo_get_path(gotd_session.repo), GOT_OBJECTS_PACK_DIR,
898 	    client->euid) == -1) {
899 		err = got_error_from_errno("asprintf");
900 		goto done;
901 	}
902 
903 	err = got_opentemp_named_fd(&pack_path, &packfd, basepath, "");
904 	if (err)
905 		goto done;
906 	if (fchmod(packfd, GOT_DEFAULT_PACK_MODE) == -1) {
907 		err = got_error_from_errno2("fchmod", pack_path);
908 		goto done;
909 	}
910 
911 	free(basepath);
912 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.idx",
913 	    got_repo_get_path(gotd_session.repo), GOT_OBJECTS_PACK_DIR,
914 	    client->euid) == -1) {
915 		err = got_error_from_errno("asprintf");
916 		basepath = NULL;
917 		goto done;
918 	}
919 	err = got_opentemp_named_fd(&idx_path, &idxfd, basepath, "");
920 	if (err)
921 		goto done;
922 	if (fchmod(idxfd, GOT_DEFAULT_PACK_MODE) == -1) {
923 		err = got_error_from_errno2("fchmod", idx_path);
924 		goto done;
925 	}
926 
927 	memset(&ifile, 0, sizeof(ifile));
928 	ifile.client_id = client->id;
929 	if (gotd_imsg_compose_event(&client->repo_child_iev,
930 	    GOTD_IMSG_PACKIDX_FILE, gotd_session.proc_id,
931 	    idxfd, &ifile, sizeof(ifile)) == -1) {
932 		err = got_error_from_errno("imsg compose PACKIDX_FILE");
933 		idxfd = -1;
934 		goto done;
935 	}
936 	idxfd = -1;
937 
938 	memset(&ipack, 0, sizeof(ipack));
939 	ipack.client_id = client->id;
940 	if (client_has_capability(client, GOT_CAPA_REPORT_STATUS))
941 		ipack.report_status = 1;
942 
943 	if (gotd_imsg_compose_event(&client->repo_child_iev,
944 	    GOTD_IMSG_RECV_PACKFILE, gotd_session.proc_id, packfd,
945 	    &ipack, sizeof(ipack)) == -1) {
946 		err = got_error_from_errno("imsg compose RECV_PACKFILE");
947 		packfd = -1;
948 		goto done;
949 	}
950 	packfd = -1;
951 
952 done:
953 	free(basepath);
954 	if (pipe[0] != -1 && close(pipe[0]) == -1 && err == NULL)
955 		err = got_error_from_errno("close");
956 	if (pipe[1] != -1 && close(pipe[1]) == -1 && err == NULL)
957 		err = got_error_from_errno("close");
958 	if (packfd != -1 && close(packfd) == -1 && err == NULL)
959 		err = got_error_from_errno("close");
960 	if (idxfd != -1 && close(idxfd) == -1 && err == NULL)
961 		err = got_error_from_errno("close");
962 	if (err) {
963 		free(pack_path);
964 		free(idx_path);
965 	} else {
966 		client->packfile_path = pack_path;
967 		client->packidx_path = idx_path;
968 	}
969 	return err;
970 }
971 
972 static const struct got_error *
973 send_packfile(struct gotd_session_client *client)
974 {
975 	const struct got_error *err = NULL;
976 	struct gotd_imsg_send_packfile ipack;
977 	struct gotd_imsg_packfile_pipe ipipe;
978 	int pipe[2];
979 
980 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
981 		return got_error_from_errno("socketpair");
982 
983 	memset(&ipack, 0, sizeof(ipack));
984 	memset(&ipipe, 0, sizeof(ipipe));
985 
986 	ipack.client_id = client->id;
987 	if (client_has_capability(client, GOT_CAPA_SIDE_BAND_64K))
988 		ipack.report_progress = 1;
989 
990 	client->delta_cache_fd = got_opentempfd();
991 	if (client->delta_cache_fd == -1)
992 		return got_error_from_errno("got_opentempfd");
993 
994 	if (gotd_imsg_compose_event(&client->repo_child_iev,
995 	    GOTD_IMSG_SEND_PACKFILE, PROC_GOTD, client->delta_cache_fd,
996 	    &ipack, sizeof(ipack)) == -1) {
997 		err = got_error_from_errno("imsg compose SEND_PACKFILE");
998 		close(pipe[0]);
999 		close(pipe[1]);
1000 		return err;
1001 	}
1002 
1003 	ipipe.client_id = client->id;
1004 
1005 	/* Send pack pipe end 0 to repo child process. */
1006 	if (gotd_imsg_compose_event(&client->repo_child_iev,
1007 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD,
1008 	    pipe[0], &ipipe, sizeof(ipipe)) == -1) {
1009 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
1010 		close(pipe[1]);
1011 		return err;
1012 	}
1013 
1014 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
1015 	if (gotd_imsg_compose_event(&client->iev,
1016 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD, pipe[1], NULL, 0) == -1)
1017 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
1018 
1019 	return err;
1020 }
1021 
1022 static void
1023 session_dispatch_client(int fd, short events, void *arg)
1024 {
1025 	struct gotd_imsgev *iev = arg;
1026 	struct imsgbuf *ibuf = &iev->ibuf;
1027 	struct gotd_session_client *client = &gotd_session_client;
1028 	const struct got_error *err = NULL;
1029 	struct imsg imsg;
1030 	ssize_t n;
1031 
1032 	if (events & EV_WRITE) {
1033 		while (ibuf->w.queued) {
1034 			n = msgbuf_write(&ibuf->w);
1035 			if (n == -1 && errno == EPIPE) {
1036 				/*
1037 				 * The client has closed its socket.
1038 				 * This can happen when Git clients are
1039 				 * done sending pack file data.
1040 				 */
1041 				msgbuf_clear(&ibuf->w);
1042 				continue;
1043 			} else if (n == -1 && errno != EAGAIN) {
1044 				err = got_error_from_errno("imsg_flush");
1045 				disconnect_on_error(client, err);
1046 				return;
1047 			}
1048 			if (n == 0) {
1049 				/* Connection closed. */
1050 				err = got_error(GOT_ERR_EOF);
1051 				disconnect_on_error(client, err);
1052 				return;
1053 			}
1054 		}
1055 
1056 		if (client->flush_disconnect) {
1057 			disconnect(client);
1058 			return;
1059 		}
1060 	}
1061 
1062 	if ((events & EV_READ) == 0)
1063 		return;
1064 
1065 	memset(&imsg, 0, sizeof(imsg));
1066 
1067 	while (err == NULL) {
1068 		err = gotd_imsg_recv(&imsg, ibuf, 0);
1069 		if (err) {
1070 			if (err->code == GOT_ERR_PRIVSEP_READ)
1071 				err = NULL;
1072 			else if (err->code == GOT_ERR_EOF &&
1073 			    client->state == GOTD_STATE_EXPECT_CAPABILITIES) {
1074 				/*
1075 				 * The client has closed its socket before
1076 				 * sending its capability announcement.
1077 				 * This can happen when Git clients have
1078 				 * no ref-updates to send.
1079 				 */
1080 				disconnect_on_error(client, err);
1081 				return;
1082 			}
1083 			break;
1084 		}
1085 
1086 		evtimer_del(&client->tmo);
1087 
1088 		switch (imsg.hdr.type) {
1089 		case GOTD_IMSG_CAPABILITIES:
1090 			if (client->state != GOTD_STATE_EXPECT_CAPABILITIES) {
1091 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1092 				    "unexpected capabilities received");
1093 				break;
1094 			}
1095 			log_debug("receiving capabilities from uid %d",
1096 			    client->euid);
1097 			err = recv_capabilities(client, &imsg);
1098 			break;
1099 		case GOTD_IMSG_CAPABILITY:
1100 			if (client->state != GOTD_STATE_EXPECT_CAPABILITIES) {
1101 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1102 				    "unexpected capability received");
1103 				break;
1104 			}
1105 			err = recv_capability(client, &imsg);
1106 			if (err || client->ncapabilities < client->ncapa_alloc)
1107 				break;
1108 			if (!client->is_writing) {
1109 				client->state = GOTD_STATE_EXPECT_WANT;
1110 				client->accept_flush_pkt = 1;
1111 				log_debug("uid %d: expecting want-lines",
1112 				    client->euid);
1113 			} else if (client->is_writing) {
1114 				client->state = GOTD_STATE_EXPECT_REF_UPDATE;
1115 				client->accept_flush_pkt = 1;
1116 				log_debug("uid %d: expecting ref-update-lines",
1117 				    client->euid);
1118 			} else
1119 				fatalx("client %d is both reading and writing",
1120 				    client->euid);
1121 			break;
1122 		case GOTD_IMSG_WANT:
1123 			if (client->state != GOTD_STATE_EXPECT_WANT) {
1124 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1125 				    "unexpected want-line received");
1126 				break;
1127 			}
1128 			log_debug("received want-line from uid %d",
1129 			    client->euid);
1130 			err = ensure_client_is_reading(client);
1131 			if (err)
1132 				break;
1133 			client->accept_flush_pkt = 1;
1134 			err = forward_want(client, &imsg);
1135 			break;
1136 		case GOTD_IMSG_REF_UPDATE:
1137 			if (client->state != GOTD_STATE_EXPECT_REF_UPDATE &&
1138 			    client->state !=
1139 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1140 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1141 				    "unexpected ref-update-line received");
1142 				break;
1143 			}
1144 			log_debug("received ref-update-line from uid %d",
1145 			    client->euid);
1146 			err = ensure_client_is_writing(client);
1147 			if (err)
1148 				break;
1149 			err = forward_ref_update(client, &imsg);
1150 			if (err)
1151 				break;
1152 			client->state = GOTD_STATE_EXPECT_MORE_REF_UPDATES;
1153 			client->accept_flush_pkt = 1;
1154 			break;
1155 		case GOTD_IMSG_HAVE:
1156 			if (client->state != GOTD_STATE_EXPECT_HAVE) {
1157 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1158 				    "unexpected have-line received");
1159 				break;
1160 			}
1161 			log_debug("received have-line from uid %d",
1162 			    client->euid);
1163 			err = ensure_client_is_reading(client);
1164 			if (err)
1165 				break;
1166 			err = forward_have(client, &imsg);
1167 			if (err)
1168 				break;
1169 			client->accept_flush_pkt = 1;
1170 			break;
1171 		case GOTD_IMSG_FLUSH:
1172 			if (client->state == GOTD_STATE_EXPECT_WANT ||
1173 			    client->state == GOTD_STATE_EXPECT_HAVE) {
1174 				err = ensure_client_is_reading(client);
1175 				if (err)
1176 					break;
1177 			} else if (client->state ==
1178 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1179 				err = ensure_client_is_writing(client);
1180 				if (err)
1181 					break;
1182 			} else if (client->state != GOTD_STATE_EXPECT_DONE) {
1183 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1184 				    "unexpected flush-pkt received");
1185 				break;
1186 			}
1187 			if (!client->accept_flush_pkt) {
1188 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1189 				    "unexpected flush-pkt received");
1190 				break;
1191 			}
1192 
1193 			/*
1194 			 * Accept just one flush packet at a time.
1195 			 * Future client state transitions will set this flag
1196 			 * again if another flush packet is expected.
1197 			 */
1198 			client->accept_flush_pkt = 0;
1199 
1200 			log_debug("received flush-pkt from uid %d",
1201 			    client->euid);
1202 			if (client->state == GOTD_STATE_EXPECT_WANT) {
1203 				client->state = GOTD_STATE_EXPECT_HAVE;
1204 				log_debug("uid %d: expecting have-lines",
1205 				    client->euid);
1206 			} else if (client->state == GOTD_STATE_EXPECT_HAVE) {
1207 				client->state = GOTD_STATE_EXPECT_DONE;
1208 				client->accept_flush_pkt = 1;
1209 				log_debug("uid %d: expecting 'done'",
1210 				    client->euid);
1211 			} else if (client->state ==
1212 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1213 				client->state = GOTD_STATE_EXPECT_PACKFILE;
1214 				log_debug("uid %d: expecting packfile",
1215 				    client->euid);
1216 				err = recv_packfile(client);
1217 			} else if (client->state != GOTD_STATE_EXPECT_DONE) {
1218 				/* should not happen, see above */
1219 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1220 				    "unexpected client state");
1221 				break;
1222 			}
1223 			break;
1224 		case GOTD_IMSG_DONE:
1225 			if (client->state != GOTD_STATE_EXPECT_HAVE &&
1226 			    client->state != GOTD_STATE_EXPECT_DONE) {
1227 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1228 				    "unexpected flush-pkt received");
1229 				break;
1230 			}
1231 			log_debug("received 'done' from uid %d", client->euid);
1232 			err = ensure_client_is_reading(client);
1233 			if (err)
1234 				break;
1235 			client->state = GOTD_STATE_DONE;
1236 			client->accept_flush_pkt = 1;
1237 			err = send_packfile(client);
1238 			break;
1239 		default:
1240 			log_debug("unexpected imsg %d", imsg.hdr.type);
1241 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1242 			break;
1243 		}
1244 
1245 		imsg_free(&imsg);
1246 	}
1247 
1248 	if (err) {
1249 		if (err->code != GOT_ERR_EOF ||
1250 		    client->state != GOTD_STATE_EXPECT_PACKFILE)
1251 			disconnect_on_error(client, err);
1252 	} else {
1253 		gotd_imsg_event_add(iev);
1254 		evtimer_add(&client->tmo, &gotd_session.request_timeout);
1255 	}
1256 }
1257 
1258 static const struct got_error *
1259 list_refs_request(void)
1260 {
1261 	static const struct got_error *err;
1262 	struct gotd_session_client *client = &gotd_session_client;
1263 	struct gotd_imsgev *iev = &client->repo_child_iev;
1264 	struct gotd_imsg_list_refs_internal ilref;
1265 	int fd;
1266 
1267 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1268 		return got_error(GOT_ERR_PRIVSEP_MSG);
1269 
1270 	memset(&ilref, 0, sizeof(ilref));
1271 	ilref.client_id = client->id;
1272 
1273 	fd = dup(client->fd);
1274 	if (fd == -1)
1275 		return got_error_from_errno("dup");
1276 
1277 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_LIST_REFS_INTERNAL,
1278 	    gotd_session.proc_id, fd, &ilref, sizeof(ilref)) == -1) {
1279 		err = got_error_from_errno("imsg compose LIST_REFS_INTERNAL");
1280 		close(fd);
1281 		return err;
1282 	}
1283 
1284 	client->state = GOTD_STATE_EXPECT_CAPABILITIES;
1285 	log_debug("uid %d: expecting capabilities", client->euid);
1286 	return NULL;
1287 }
1288 
1289 static const struct got_error *
1290 recv_connect(struct imsg *imsg)
1291 {
1292 	struct gotd_session_client *client = &gotd_session_client;
1293 	struct gotd_imsg_connect iconnect;
1294 	size_t datalen;
1295 
1296 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1297 		return got_error(GOT_ERR_PRIVSEP_MSG);
1298 
1299 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1300 	if (datalen != sizeof(iconnect))
1301 		return got_error(GOT_ERR_PRIVSEP_LEN);
1302 	memcpy(&iconnect, imsg->data, sizeof(iconnect));
1303 
1304 	client->euid = iconnect.euid;
1305 	client->egid = iconnect.egid;
1306 	client->fd = imsg_get_fd(imsg);
1307 	if (client->fd == -1)
1308 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1309 
1310 	imsg_init(&client->iev.ibuf, client->fd);
1311 	client->iev.handler = session_dispatch_client;
1312 	client->iev.events = EV_READ;
1313 	client->iev.handler_arg = NULL;
1314 	event_set(&client->iev.ev, client->iev.ibuf.fd, EV_READ,
1315 	    session_dispatch_client, &client->iev);
1316 	gotd_imsg_event_add(&client->iev);
1317 	evtimer_set(&client->tmo, gotd_request_timeout, client);
1318 
1319 	return NULL;
1320 }
1321 
1322 static const struct got_error *
1323 recv_repo_child(struct imsg *imsg)
1324 {
1325 	struct gotd_imsg_connect_repo_child ichild;
1326 	struct gotd_session_client *client = &gotd_session_client;
1327 	size_t datalen;
1328 	int fd;
1329 
1330 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1331 		return got_error(GOT_ERR_PRIVSEP_MSG);
1332 
1333 	/* We should already have received a pipe to the listener. */
1334 	if (client->fd == -1)
1335 		return got_error(GOT_ERR_PRIVSEP_MSG);
1336 
1337 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1338 	if (datalen != sizeof(ichild))
1339 		return got_error(GOT_ERR_PRIVSEP_LEN);
1340 
1341 	memcpy(&ichild, imsg->data, sizeof(ichild));
1342 
1343 	client->id = ichild.client_id;
1344 	if (ichild.proc_id == PROC_REPO_WRITE)
1345 		client->is_writing = 1;
1346 	else if (ichild.proc_id == PROC_REPO_READ)
1347 		client->is_writing = 0;
1348 	else
1349 		return got_error_msg(GOT_ERR_PRIVSEP_MSG,
1350 		    "bad child process type");
1351 
1352 	fd = imsg_get_fd(imsg);
1353 	if (fd == -1)
1354 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1355 
1356 	imsg_init(&client->repo_child_iev.ibuf, fd);
1357 	client->repo_child_iev.handler = session_dispatch_repo_child;
1358 	client->repo_child_iev.events = EV_READ;
1359 	client->repo_child_iev.handler_arg = NULL;
1360 	event_set(&client->repo_child_iev.ev, client->repo_child_iev.ibuf.fd,
1361 	    EV_READ, session_dispatch_repo_child, &client->repo_child_iev);
1362 	gotd_imsg_event_add(&client->repo_child_iev);
1363 
1364 	/* The "recvfd" pledge promise is no longer needed. */
1365 	if (pledge("stdio rpath wpath cpath sendfd fattr flock", NULL) == -1)
1366 		fatal("pledge");
1367 
1368 	return NULL;
1369 }
1370 
1371 static void
1372 session_dispatch(int fd, short event, void *arg)
1373 {
1374 	struct gotd_imsgev *iev = arg;
1375 	struct imsgbuf *ibuf = &iev->ibuf;
1376 	struct gotd_session_client *client = &gotd_session_client;
1377 	ssize_t n;
1378 	int shut = 0;
1379 	struct imsg imsg;
1380 
1381 	if (event & EV_READ) {
1382 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1383 			fatal("imsg_read error");
1384 		if (n == 0) {
1385 			/* Connection closed. */
1386 			shut = 1;
1387 			goto done;
1388 		}
1389 	}
1390 
1391 	if (event & EV_WRITE) {
1392 		n = msgbuf_write(&ibuf->w);
1393 		if (n == -1 && errno != EAGAIN)
1394 			fatal("msgbuf_write");
1395 		if (n == 0) {
1396 			/* Connection closed. */
1397 			shut = 1;
1398 			goto done;
1399 		}
1400 	}
1401 
1402 	for (;;) {
1403 		const struct got_error *err = NULL;
1404 		uint32_t client_id = 0;
1405 		int do_disconnect = 0, do_list_refs = 0;
1406 
1407 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1408 			fatal("%s: imsg_get error", __func__);
1409 		if (n == 0)	/* No more messages. */
1410 			break;
1411 
1412 		switch (imsg.hdr.type) {
1413 		case GOTD_IMSG_ERROR:
1414 			do_disconnect = 1;
1415 			err = gotd_imsg_recv_error(&client_id, &imsg);
1416 			break;
1417 		case GOTD_IMSG_CONNECT:
1418 			err = recv_connect(&imsg);
1419 			break;
1420 		case GOTD_IMSG_DISCONNECT:
1421 			do_disconnect = 1;
1422 			break;
1423 		case GOTD_IMSG_CONNECT_REPO_CHILD:
1424 			err = recv_repo_child(&imsg);
1425 			if (err)
1426 				break;
1427 			do_list_refs = 1;
1428 			break;
1429 		default:
1430 			log_debug("unexpected imsg %d", imsg.hdr.type);
1431 			break;
1432 		}
1433 		imsg_free(&imsg);
1434 
1435 		if (do_disconnect) {
1436 			if (err)
1437 				disconnect_on_error(client, err);
1438 			else
1439 				disconnect(client);
1440 		} else if (do_list_refs)
1441 			err = list_refs_request();
1442 
1443 		if (err)
1444 			log_warnx("uid %d: %s", client->euid, err->msg);
1445 	}
1446 done:
1447 	if (!shut) {
1448 		gotd_imsg_event_add(iev);
1449 	} else {
1450 		/* This pipe is dead. Remove its event handler */
1451 		event_del(&iev->ev);
1452 		event_loopexit(NULL);
1453 	}
1454 }
1455 
1456 void
1457 session_main(const char *title, const char *repo_path,
1458     int *pack_fds, int *temp_fds, struct timeval *request_timeout,
1459     enum gotd_procid proc_id)
1460 {
1461 	const struct got_error *err = NULL;
1462 	struct event evsigint, evsigterm, evsighup, evsigusr1;
1463 
1464 	gotd_session.title = title;
1465 	gotd_session.pid = getpid();
1466 	gotd_session.pack_fds = pack_fds;
1467 	gotd_session.temp_fds = temp_fds;
1468 	memcpy(&gotd_session.request_timeout, request_timeout,
1469 	    sizeof(gotd_session.request_timeout));
1470 	gotd_session.proc_id = proc_id;
1471 
1472 	err = got_repo_open(&gotd_session.repo, repo_path, NULL, pack_fds);
1473 	if (err)
1474 		goto done;
1475 	if (!got_repo_is_bare(gotd_session.repo)) {
1476 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
1477 		    "bare git repository required");
1478 		goto done;
1479 	}
1480 
1481 	got_repo_temp_fds_set(gotd_session.repo, temp_fds);
1482 
1483 	signal_set(&evsigint, SIGINT, gotd_session_sighdlr, NULL);
1484 	signal_set(&evsigterm, SIGTERM, gotd_session_sighdlr, NULL);
1485 	signal_set(&evsighup, SIGHUP, gotd_session_sighdlr, NULL);
1486 	signal_set(&evsigusr1, SIGUSR1, gotd_session_sighdlr, NULL);
1487 	signal(SIGPIPE, SIG_IGN);
1488 
1489 	signal_add(&evsigint, NULL);
1490 	signal_add(&evsigterm, NULL);
1491 	signal_add(&evsighup, NULL);
1492 	signal_add(&evsigusr1, NULL);
1493 
1494 	gotd_session_client.state = GOTD_STATE_EXPECT_LIST_REFS;
1495 	gotd_session_client.fd = -1;
1496 	gotd_session_client.nref_updates = -1;
1497 	gotd_session_client.delta_cache_fd = -1;
1498 	gotd_session_client.accept_flush_pkt = 1;
1499 
1500 	imsg_init(&gotd_session.parent_iev.ibuf, GOTD_FILENO_MSG_PIPE);
1501 	gotd_session.parent_iev.handler = session_dispatch;
1502 	gotd_session.parent_iev.events = EV_READ;
1503 	gotd_session.parent_iev.handler_arg = NULL;
1504 	event_set(&gotd_session.parent_iev.ev, gotd_session.parent_iev.ibuf.fd,
1505 	    EV_READ, session_dispatch, &gotd_session.parent_iev);
1506 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
1507 	    GOTD_IMSG_CLIENT_SESSION_READY, gotd_session.proc_id,
1508 	    -1, NULL, 0) == -1) {
1509 		err = got_error_from_errno("imsg compose CLIENT_SESSION_READY");
1510 		goto done;
1511 	}
1512 
1513 	event_dispatch();
1514 done:
1515 	if (err)
1516 		log_warnx("%s: %s", title, err->msg);
1517 	gotd_session_shutdown();
1518 }
1519 
1520 void
1521 gotd_session_shutdown(void)
1522 {
1523 	log_debug("shutting down");
1524 	if (gotd_session.repo)
1525 		got_repo_close(gotd_session.repo);
1526 	got_repo_pack_fds_close(gotd_session.pack_fds);
1527 	got_repo_temp_fds_close(gotd_session.temp_fds);
1528 	exit(0);
1529 }