Game of Trees Repos

Blob

Date:: Wed Feb 8 09:31:55 2023 UTC
Message:: drop double process name from some gotd logs i.e. "listen: listen: shutting down" -> "listen: shutting down" the procname is already prepended by vlog() ok jamsek
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2022, 2023 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/queue.h>
19 #include <sys/tree.h>
20 #include <sys/socket.h>
21 #include <sys/stat.h>
22 #include <sys/uio.h>
23 
24 #include <errno.h>
25 #include <event.h>
26 #include <limits.h>
27 #include <sha1.h>
28 #include <signal.h>
29 #include <stdint.h>
30 #include <stdio.h>
31 #include <stdlib.h>
32 #include <string.h>
33 #include <imsg.h>
34 #include <unistd.h>
35 
36 #include "got_error.h"
37 #include "got_repository.h"
38 #include "got_object.h"
39 #include "got_path.h"
40 #include "got_reference.h"
41 #include "got_opentemp.h"
42 
43 #include "got_lib_sha1.h"
44 #include "got_lib_delta.h"
45 #include "got_lib_object.h"
46 #include "got_lib_object_cache.h"
47 #include "got_lib_pack.h"
48 #include "got_lib_repository.h"
49 #include "got_lib_gitproto.h"
50 
51 #include "gotd.h"
52 #include "log.h"
53 #include "session.h"
54 
55 
56 static struct gotd_session {
57 	pid_t pid;
58 	const char *title;
59 	struct got_repository *repo;
60 	int *pack_fds;
61 	int *temp_fds;
62 	struct gotd_imsgev parent_iev;
63 	struct timeval request_timeout;
64 } gotd_session;
65 
66 static struct gotd_session_client {
67 	enum gotd_session_state		 state;
68 	int				 is_writing;
69 	struct gotd_client_capability	*capabilities;
70 	size_t				 ncapa_alloc;
71 	size_t				 ncapabilities;
72 	uint32_t			 id;
73 	int				 fd;
74 	int				 delta_cache_fd;
75 	struct gotd_imsgev		 iev;
76 	struct gotd_imsgev		 repo_child_iev;
77 	struct event			 tmo;
78 	uid_t				 euid;
79 	gid_t				 egid;
80 	char				*packfile_path;
81 	char				*packidx_path;
82 	int				 nref_updates;
83 	int				 accept_flush_pkt;
84 } gotd_session_client;
85 
86 void gotd_session_sighdlr(int sig, short event, void *arg);
87 static void gotd_session_shutdown(void);
88 
89 static void
90 disconnect(struct gotd_session_client *client)
91 {
92 	log_debug("uid %d: disconnecting", client->euid);
93 
94 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
95 	    GOTD_IMSG_DISCONNECT, PROC_SESSION, -1, NULL, 0) == -1)
96 		log_warn("imsg compose DISCONNECT");
97 
98 	imsg_clear(&client->repo_child_iev.ibuf);
99 	event_del(&client->repo_child_iev.ev);
100 	evtimer_del(&client->tmo);
101 	close(client->fd);
102 	if (client->delta_cache_fd != -1)
103 		close(client->delta_cache_fd);
104 	if (client->packfile_path) {
105 		if (unlink(client->packfile_path) == -1 && errno != ENOENT)
106 			log_warn("unlink %s: ", client->packfile_path);
107 		free(client->packfile_path);
108 	}
109 	if (client->packidx_path) {
110 		if (unlink(client->packidx_path) == -1 && errno != ENOENT)
111 			log_warn("unlink %s: ", client->packidx_path);
112 		free(client->packidx_path);
113 	}
114 	free(client->capabilities);
115 
116 	gotd_session_shutdown();
117 }
118 
119 static void
120 disconnect_on_error(struct gotd_session_client *client,
121     const struct got_error *err)
122 {
123 	struct imsgbuf ibuf;
124 
125 	log_warnx("uid %d: %s", client->euid, err->msg);
126 	if (err->code != GOT_ERR_EOF) {
127 		imsg_init(&ibuf, client->fd);
128 		gotd_imsg_send_error(&ibuf, 0, PROC_SESSION, err);
129 		imsg_clear(&ibuf);
130 	}
131 
132 	disconnect(client);
133 }
134 
135 static void
136 gotd_request_timeout(int fd, short events, void *arg)
137 {
138 	struct gotd_session_client *client = arg;
139 
140 	log_debug("disconnecting uid %d due to timeout", client->euid);
141 	disconnect(client);
142 }
143 
144 void
145 gotd_session_sighdlr(int sig, short event, void *arg)
146 {
147 	/*
148 	 * Normal signal handler rules don't apply because libevent
149 	 * decouples for us.
150 	 */
151 
152 	switch (sig) {
153 	case SIGHUP:
154 		log_info("%s: ignoring SIGHUP", __func__);
155 		break;
156 	case SIGUSR1:
157 		log_info("%s: ignoring SIGUSR1", __func__);
158 		break;
159 	case SIGTERM:
160 	case SIGINT:
161 		gotd_session_shutdown();
162 		/* NOTREACHED */
163 		break;
164 	default:
165 		fatalx("unexpected signal");
166 	}
167 }
168 
169 static const struct got_error *
170 recv_packfile_done(uint32_t *client_id, struct imsg *imsg)
171 {
172 	struct gotd_imsg_packfile_done idone;
173 	size_t datalen;
174 
175 	log_debug("packfile-done received");
176 
177 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
178 	if (datalen != sizeof(idone))
179 		return got_error(GOT_ERR_PRIVSEP_LEN);
180 	memcpy(&idone, imsg->data, sizeof(idone));
181 
182 	*client_id = idone.client_id;
183 	return NULL;
184 }
185 
186 static const struct got_error *
187 recv_packfile_install(uint32_t *client_id, struct imsg *imsg)
188 {
189 	struct gotd_imsg_packfile_install inst;
190 	size_t datalen;
191 
192 	log_debug("packfile-install received");
193 
194 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
195 	if (datalen != sizeof(inst))
196 		return got_error(GOT_ERR_PRIVSEP_LEN);
197 	memcpy(&inst, imsg->data, sizeof(inst));
198 
199 	*client_id = inst.client_id;
200 	return NULL;
201 }
202 
203 static const struct got_error *
204 recv_ref_updates_start(uint32_t *client_id, struct imsg *imsg)
205 {
206 	struct gotd_imsg_ref_updates_start istart;
207 	size_t datalen;
208 
209 	log_debug("ref-updates-start received");
210 
211 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
212 	if (datalen != sizeof(istart))
213 		return got_error(GOT_ERR_PRIVSEP_LEN);
214 	memcpy(&istart, imsg->data, sizeof(istart));
215 
216 	*client_id = istart.client_id;
217 	return NULL;
218 }
219 
220 static const struct got_error *
221 recv_ref_update(uint32_t *client_id, struct imsg *imsg)
222 {
223 	struct gotd_imsg_ref_update iref;
224 	size_t datalen;
225 
226 	log_debug("ref-update received");
227 
228 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
229 	if (datalen < sizeof(iref))
230 		return got_error(GOT_ERR_PRIVSEP_LEN);
231 	memcpy(&iref, imsg->data, sizeof(iref));
232 
233 	*client_id = iref.client_id;
234 	return NULL;
235 }
236 
237 static const struct got_error *
238 send_ref_update_ok(struct gotd_session_client *client,
239     struct gotd_imsg_ref_update *iref, const char *refname)
240 {
241 	struct gotd_imsg_ref_update_ok iok;
242 	struct gotd_imsgev *iev = &client->iev;
243 	struct ibuf *wbuf;
244 	size_t len;
245 
246 	memset(&iok, 0, sizeof(iok));
247 	iok.client_id = client->id;
248 	memcpy(iok.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
249 	memcpy(iok.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
250 	iok.name_len = strlen(refname);
251 
252 	len = sizeof(iok) + iok.name_len;
253 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE_OK,
254 	    PROC_SESSION, gotd_session.pid, len);
255 	if (wbuf == NULL)
256 		return got_error_from_errno("imsg_create REF_UPDATE_OK");
257 
258 	if (imsg_add(wbuf, &iok, sizeof(iok)) == -1)
259 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
260 	if (imsg_add(wbuf, refname, iok.name_len) == -1)
261 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
262 
263 	wbuf->fd = -1;
264 	imsg_close(&iev->ibuf, wbuf);
265 	gotd_imsg_event_add(iev);
266 	return NULL;
267 }
268 
269 static void
270 send_refs_updated(struct gotd_session_client *client)
271 {
272 	if (gotd_imsg_compose_event(&client->iev, GOTD_IMSG_REFS_UPDATED,
273 	    PROC_SESSION, -1, NULL, 0) == -1)
274 		log_warn("imsg compose REFS_UPDATED");
275 }
276 
277 static const struct got_error *
278 send_ref_update_ng(struct gotd_session_client *client,
279     struct gotd_imsg_ref_update *iref, const char *refname,
280     const char *reason)
281 {
282 	const struct got_error *ng_err;
283 	struct gotd_imsg_ref_update_ng ing;
284 	struct gotd_imsgev *iev = &client->iev;
285 	struct ibuf *wbuf;
286 	size_t len;
287 
288 	memset(&ing, 0, sizeof(ing));
289 	ing.client_id = client->id;
290 	memcpy(ing.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
291 	memcpy(ing.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
292 	ing.name_len = strlen(refname);
293 
294 	ng_err = got_error_fmt(GOT_ERR_REF_BUSY, "%s", reason);
295 	ing.reason_len = strlen(ng_err->msg);
296 
297 	len = sizeof(ing) + ing.name_len + ing.reason_len;
298 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE_NG,
299 	    PROC_SESSION, gotd_session.pid, len);
300 	if (wbuf == NULL)
301 		return got_error_from_errno("imsg_create REF_UPDATE_NG");
302 
303 	if (imsg_add(wbuf, &ing, sizeof(ing)) == -1)
304 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
305 	if (imsg_add(wbuf, refname, ing.name_len) == -1)
306 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
307 	if (imsg_add(wbuf, ng_err->msg, ing.reason_len) == -1)
308 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
309 
310 	wbuf->fd = -1;
311 	imsg_close(&iev->ibuf, wbuf);
312 	gotd_imsg_event_add(iev);
313 	return NULL;
314 }
315 
316 static const struct got_error *
317 install_pack(struct gotd_session_client *client, const char *repo_path,
318     struct imsg *imsg)
319 {
320 	const struct got_error *err = NULL;
321 	struct gotd_imsg_packfile_install inst;
322 	char hex[SHA1_DIGEST_STRING_LENGTH];
323 	size_t datalen;
324 	char *packfile_path = NULL, *packidx_path = NULL;
325 
326 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
327 	if (datalen != sizeof(inst))
328 		return got_error(GOT_ERR_PRIVSEP_LEN);
329 	memcpy(&inst, imsg->data, sizeof(inst));
330 
331 	if (client->packfile_path == NULL)
332 		return got_error_msg(GOT_ERR_BAD_REQUEST,
333 		    "client has no pack file");
334 	if (client->packidx_path == NULL)
335 		return got_error_msg(GOT_ERR_BAD_REQUEST,
336 		    "client has no pack file index");
337 
338 	if (got_sha1_digest_to_str(inst.pack_sha1, hex, sizeof(hex)) == NULL)
339 		return got_error_msg(GOT_ERR_NO_SPACE,
340 		    "could not convert pack file SHA1 to hex");
341 
342 	if (asprintf(&packfile_path, "/%s/%s/pack-%s.pack",
343 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
344 		err = got_error_from_errno("asprintf");
345 		goto done;
346 	}
347 
348 	if (asprintf(&packidx_path, "/%s/%s/pack-%s.idx",
349 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
350 		err = got_error_from_errno("asprintf");
351 		goto done;
352 	}
353 
354 	if (rename(client->packfile_path, packfile_path) == -1) {
355 		err = got_error_from_errno3("rename", client->packfile_path,
356 		    packfile_path);
357 		goto done;
358 	}
359 
360 	free(client->packfile_path);
361 	client->packfile_path = NULL;
362 
363 	if (rename(client->packidx_path, packidx_path) == -1) {
364 		err = got_error_from_errno3("rename", client->packidx_path,
365 		    packidx_path);
366 		goto done;
367 	}
368 
369 	free(client->packidx_path);
370 	client->packidx_path = NULL;
371 done:
372 	free(packfile_path);
373 	free(packidx_path);
374 	return err;
375 }
376 
377 static const struct got_error *
378 begin_ref_updates(struct gotd_session_client *client, struct imsg *imsg)
379 {
380 	struct gotd_imsg_ref_updates_start istart;
381 	size_t datalen;
382 
383 	if (client->nref_updates != -1)
384 		return got_error(GOT_ERR_PRIVSEP_MSG);
385 
386 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
387 	if (datalen != sizeof(istart))
388 		return got_error(GOT_ERR_PRIVSEP_LEN);
389 	memcpy(&istart, imsg->data, sizeof(istart));
390 
391 	if (istart.nref_updates <= 0)
392 		return got_error(GOT_ERR_PRIVSEP_MSG);
393 
394 	client->nref_updates = istart.nref_updates;
395 	return NULL;
396 }
397 
398 static const struct got_error *
399 update_ref(int *shut, struct gotd_session_client *client,
400     const char *repo_path, struct imsg *imsg)
401 {
402 	const struct got_error *err = NULL;
403 	struct got_repository *repo = NULL;
404 	struct got_reference *ref = NULL;
405 	struct gotd_imsg_ref_update iref;
406 	struct got_object_id old_id, new_id;
407 	struct got_object_id *id = NULL;
408 	struct got_object *obj = NULL;
409 	char *refname = NULL;
410 	size_t datalen;
411 	int locked = 0;
412 
413 	log_debug("update-ref from uid %d", client->euid);
414 
415 	if (client->nref_updates <= 0)
416 		return got_error(GOT_ERR_PRIVSEP_MSG);
417 
418 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
419 	if (datalen < sizeof(iref))
420 		return got_error(GOT_ERR_PRIVSEP_LEN);
421 	memcpy(&iref, imsg->data, sizeof(iref));
422 	if (datalen != sizeof(iref) + iref.name_len)
423 		return got_error(GOT_ERR_PRIVSEP_LEN);
424 	refname = strndup(imsg->data + sizeof(iref), iref.name_len);
425 	if (refname == NULL)
426 		return got_error_from_errno("strndup");
427 
428 	log_debug("updating ref %s for uid %d", refname, client->euid);
429 
430 	err = got_repo_open(&repo, repo_path, NULL, NULL);
431 	if (err)
432 		goto done;
433 
434 	memcpy(old_id.sha1, iref.old_id, SHA1_DIGEST_LENGTH);
435 	memcpy(new_id.sha1, iref.new_id, SHA1_DIGEST_LENGTH);
436 	err = got_object_open(&obj, repo,
437 	    iref.delete_ref ? &old_id : &new_id);
438 	if (err)
439 		goto done;
440 
441 	if (iref.ref_is_new) {
442 		err = got_ref_open(&ref, repo, refname, 0);
443 		if (err) {
444 			if (err->code != GOT_ERR_NOT_REF)
445 				goto done;
446 			err = got_ref_alloc(&ref, refname, &new_id);
447 			if (err)
448 				goto done;
449 			err = got_ref_write(ref, repo); /* will lock/unlock */
450 			if (err)
451 				goto done;
452 		} else {
453 			err = got_error_fmt(GOT_ERR_REF_BUSY,
454 			    "%s has been created by someone else "
455 			    "while transaction was in progress",
456 			    got_ref_get_name(ref));
457 			goto done;
458 		}
459 	} else if (iref.delete_ref) {
460 		err = got_ref_open(&ref, repo, refname, 1 /* lock */);
461 		if (err)
462 			goto done;
463 		locked = 1;
464 
465 		err = got_ref_resolve(&id, repo, ref);
466 		if (err)
467 			goto done;
468 
469 		if (got_object_id_cmp(id, &old_id) != 0) {
470 			err = got_error_fmt(GOT_ERR_REF_BUSY,
471 			    "%s has been modified by someone else "
472 			    "while transaction was in progress",
473 			    got_ref_get_name(ref));
474 			goto done;
475 		}
476 
477 		err = got_ref_delete(ref, repo);
478 		if (err)
479 			goto done;
480 
481 		free(id);
482 		id = NULL;
483 	} else {
484 		err = got_ref_open(&ref, repo, refname, 1 /* lock */);
485 		if (err)
486 			goto done;
487 		locked = 1;
488 
489 		err = got_ref_resolve(&id, repo, ref);
490 		if (err)
491 			goto done;
492 
493 		if (got_object_id_cmp(id, &old_id) != 0) {
494 			err = got_error_fmt(GOT_ERR_REF_BUSY,
495 			    "%s has been modified by someone else "
496 			    "while transaction was in progress",
497 			    got_ref_get_name(ref));
498 			goto done;
499 		}
500 
501 		err = got_ref_change_ref(ref, &new_id);
502 		if (err)
503 			goto done;
504 
505 		err = got_ref_write(ref, repo);
506 		if (err)
507 			goto done;
508 
509 		free(id);
510 		id = NULL;
511 	}
512 done:
513 	if (err) {
514 		if (err->code == GOT_ERR_LOCKFILE_TIMEOUT) {
515 			err = got_error_fmt(GOT_ERR_LOCKFILE_TIMEOUT,
516 			    "could not acquire exclusive file lock for %s",
517 			    refname);
518 		}
519 		send_ref_update_ng(client, &iref, refname, err->msg);
520 	} else
521 		send_ref_update_ok(client, &iref, refname);
522 
523 	if (client->nref_updates > 0) {
524 		client->nref_updates--;
525 		if (client->nref_updates == 0) {
526 			send_refs_updated(client);
527 			*shut = 1;
528 		}
529 
530 	}
531 	if (locked) {
532 		const struct got_error *unlock_err;
533 		unlock_err = got_ref_unlock(ref);
534 		if (unlock_err && err == NULL)
535 			err = unlock_err;
536 	}
537 	if (ref)
538 		got_ref_close(ref);
539 	if (obj)
540 		got_object_close(obj);
541 	if (repo)
542 		got_repo_close(repo);
543 	free(refname);
544 	free(id);
545 	return err;
546 }
547 
548 static void
549 session_dispatch_repo_child(int fd, short event, void *arg)
550 {
551 	struct gotd_imsgev *iev = arg;
552 	struct imsgbuf *ibuf = &iev->ibuf;
553 	struct gotd_session_client *client = &gotd_session_client;
554 	ssize_t n;
555 	int shut = 0;
556 	struct imsg imsg;
557 
558 	if (event & EV_READ) {
559 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
560 			fatal("imsg_read error");
561 		if (n == 0) {
562 			/* Connection closed. */
563 			shut = 1;
564 			goto done;
565 		}
566 	}
567 
568 	if (event & EV_WRITE) {
569 		n = msgbuf_write(&ibuf->w);
570 		if (n == -1 && errno != EAGAIN)
571 			fatal("msgbuf_write");
572 		if (n == 0) {
573 			/* Connection closed. */
574 			shut = 1;
575 			goto done;
576 		}
577 	}
578 
579 	for (;;) {
580 		const struct got_error *err = NULL;
581 		uint32_t client_id = 0;
582 		int do_disconnect = 0;
583 		int do_ref_updates = 0, do_ref_update = 0;
584 		int do_packfile_install = 0;
585 
586 		if ((n = imsg_get(ibuf, &imsg)) == -1)
587 			fatal("%s: imsg_get error", __func__);
588 		if (n == 0)	/* No more messages. */
589 			break;
590 
591 		switch (imsg.hdr.type) {
592 		case GOTD_IMSG_ERROR:
593 			do_disconnect = 1;
594 			err = gotd_imsg_recv_error(&client_id, &imsg);
595 			break;
596 		case GOTD_IMSG_PACKFILE_DONE:
597 			do_disconnect = 1;
598 			err = recv_packfile_done(&client_id, &imsg);
599 			break;
600 		case GOTD_IMSG_PACKFILE_INSTALL:
601 			err = recv_packfile_install(&client_id, &imsg);
602 			if (err == NULL)
603 				do_packfile_install = 1;
604 			break;
605 		case GOTD_IMSG_REF_UPDATES_START:
606 			err = recv_ref_updates_start(&client_id, &imsg);
607 			if (err == NULL)
608 				do_ref_updates = 1;
609 			break;
610 		case GOTD_IMSG_REF_UPDATE:
611 			err = recv_ref_update(&client_id, &imsg);
612 			if (err == NULL)
613 				do_ref_update = 1;
614 			break;
615 		default:
616 			log_debug("unexpected imsg %d", imsg.hdr.type);
617 			break;
618 		}
619 
620 		if (do_disconnect) {
621 			if (err)
622 				disconnect_on_error(client, err);
623 			else
624 				disconnect(client);
625 		} else {
626 			if (do_packfile_install)
627 				err = install_pack(client,
628 				    gotd_session.repo->path, &imsg);
629 			else if (do_ref_updates)
630 				err = begin_ref_updates(client, &imsg);
631 			else if (do_ref_update)
632 				err = update_ref(&shut, client,
633 				    gotd_session.repo->path, &imsg);
634 			if (err)
635 				log_warnx("uid %d: %s", client->euid, err->msg);
636 		}
637 		imsg_free(&imsg);
638 	}
639 done:
640 	if (!shut) {
641 		gotd_imsg_event_add(iev);
642 	} else {
643 		/* This pipe is dead. Remove its event handler */
644 		event_del(&iev->ev);
645 		event_loopexit(NULL);
646 	}
647 }
648 
649 static const struct got_error *
650 recv_capabilities(struct gotd_session_client *client, struct imsg *imsg)
651 {
652 	struct gotd_imsg_capabilities icapas;
653 	size_t datalen;
654 
655 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
656 	if (datalen != sizeof(icapas))
657 		return got_error(GOT_ERR_PRIVSEP_LEN);
658 	memcpy(&icapas, imsg->data, sizeof(icapas));
659 
660 	client->ncapa_alloc = icapas.ncapabilities;
661 	client->capabilities = calloc(client->ncapa_alloc,
662 	    sizeof(*client->capabilities));
663 	if (client->capabilities == NULL) {
664 		client->ncapa_alloc = 0;
665 		return got_error_from_errno("calloc");
666 	}
667 
668 	log_debug("expecting %zu capabilities from uid %d",
669 	    client->ncapa_alloc, client->euid);
670 	return NULL;
671 }
672 
673 static const struct got_error *
674 recv_capability(struct gotd_session_client *client, struct imsg *imsg)
675 {
676 	struct gotd_imsg_capability icapa;
677 	struct gotd_client_capability *capa;
678 	size_t datalen;
679 	char *key, *value = NULL;
680 
681 	if (client->capabilities == NULL ||
682 	    client->ncapabilities >= client->ncapa_alloc) {
683 		return got_error_msg(GOT_ERR_BAD_REQUEST,
684 		    "unexpected capability received");
685 	}
686 
687 	memset(&icapa, 0, sizeof(icapa));
688 
689 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
690 	if (datalen < sizeof(icapa))
691 		return got_error(GOT_ERR_PRIVSEP_LEN);
692 	memcpy(&icapa, imsg->data, sizeof(icapa));
693 
694 	if (datalen != sizeof(icapa) + icapa.key_len + icapa.value_len)
695 		return got_error(GOT_ERR_PRIVSEP_LEN);
696 
697 	key = strndup(imsg->data + sizeof(icapa), icapa.key_len);
698 	if (key == NULL)
699 		return got_error_from_errno("strndup");
700 	if (icapa.value_len > 0) {
701 		value = strndup(imsg->data + sizeof(icapa) + icapa.key_len,
702 		    icapa.value_len);
703 		if (value == NULL) {
704 			free(key);
705 			return got_error_from_errno("strndup");
706 		}
707 	}
708 
709 	capa = &client->capabilities[client->ncapabilities++];
710 	capa->key = key;
711 	capa->value = value;
712 
713 	if (value)
714 		log_debug("uid %d: capability %s=%s", client->euid, key, value);
715 	else
716 		log_debug("uid %d: capability %s", client->euid, key);
717 
718 	return NULL;
719 }
720 
721 static const struct got_error *
722 ensure_client_is_reading(struct gotd_session_client *client)
723 {
724 	if (client->is_writing) {
725 		return got_error_fmt(GOT_ERR_BAD_PACKET,
726 		    "uid %d made a read-request but is not reading from "
727 		    "a repository", client->euid);
728 	}
729 
730 	return NULL;
731 }
732 
733 static const struct got_error *
734 ensure_client_is_writing(struct gotd_session_client *client)
735 {
736 	if (!client->is_writing) {
737 		return got_error_fmt(GOT_ERR_BAD_PACKET,
738 		    "uid %d made a write-request but is not writing to "
739 		    "a repository", client->euid);
740 	}
741 
742 	return NULL;
743 }
744 
745 static const struct got_error *
746 forward_want(struct gotd_session_client *client, struct imsg *imsg)
747 {
748 	struct gotd_imsg_want ireq;
749 	struct gotd_imsg_want iwant;
750 	size_t datalen;
751 
752 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
753 	if (datalen != sizeof(ireq))
754 		return got_error(GOT_ERR_PRIVSEP_LEN);
755 
756 	memcpy(&ireq, imsg->data, datalen);
757 
758 	memset(&iwant, 0, sizeof(iwant));
759 	memcpy(iwant.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
760 	iwant.client_id = client->id;
761 
762 	if (gotd_imsg_compose_event(&client->repo_child_iev, GOTD_IMSG_WANT,
763 	    PROC_SESSION, -1, &iwant, sizeof(iwant)) == -1)
764 		return got_error_from_errno("imsg compose WANT");
765 
766 	return NULL;
767 }
768 
769 static const struct got_error *
770 forward_ref_update(struct gotd_session_client *client, struct imsg *imsg)
771 {
772 	const struct got_error *err = NULL;
773 	struct gotd_imsg_ref_update ireq;
774 	struct gotd_imsg_ref_update *iref = NULL;
775 	size_t datalen;
776 
777 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
778 	if (datalen < sizeof(ireq))
779 		return got_error(GOT_ERR_PRIVSEP_LEN);
780 	memcpy(&ireq, imsg->data, sizeof(ireq));
781 	if (datalen != sizeof(ireq) + ireq.name_len)
782 		return got_error(GOT_ERR_PRIVSEP_LEN);
783 
784 	iref = malloc(datalen);
785 	if (iref == NULL)
786 		return got_error_from_errno("malloc");
787 	memcpy(iref, imsg->data, datalen);
788 
789 	iref->client_id = client->id;
790 	if (gotd_imsg_compose_event(&client->repo_child_iev,
791 	    GOTD_IMSG_REF_UPDATE, PROC_SESSION, -1, iref, datalen) == -1)
792 		err = got_error_from_errno("imsg compose REF_UPDATE");
793 	free(iref);
794 	return err;
795 }
796 
797 static const struct got_error *
798 forward_have(struct gotd_session_client *client, struct imsg *imsg)
799 {
800 	struct gotd_imsg_have ireq;
801 	struct gotd_imsg_have ihave;
802 	size_t datalen;
803 
804 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
805 	if (datalen != sizeof(ireq))
806 		return got_error(GOT_ERR_PRIVSEP_LEN);
807 
808 	memcpy(&ireq, imsg->data, datalen);
809 
810 	memset(&ihave, 0, sizeof(ihave));
811 	memcpy(ihave.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
812 	ihave.client_id = client->id;
813 
814 	if (gotd_imsg_compose_event(&client->repo_child_iev, GOTD_IMSG_HAVE,
815 	    PROC_SESSION, -1, &ihave, sizeof(ihave)) == -1)
816 		return got_error_from_errno("imsg compose HAVE");
817 
818 	return NULL;
819 }
820 
821 static int
822 client_has_capability(struct gotd_session_client *client, const char *capastr)
823 {
824 	struct gotd_client_capability *capa;
825 	size_t i;
826 
827 	if (client->ncapabilities == 0)
828 		return 0;
829 
830 	for (i = 0; i < client->ncapabilities; i++) {
831 		capa = &client->capabilities[i];
832 		if (strcmp(capa->key, capastr) == 0)
833 			return 1;
834 	}
835 
836 	return 0;
837 }
838 
839 static const struct got_error *
840 recv_packfile(struct gotd_session_client *client)
841 {
842 	const struct got_error *err = NULL;
843 	struct gotd_imsg_recv_packfile ipack;
844 	struct gotd_imsg_packfile_pipe ipipe;
845 	struct gotd_imsg_packidx_file ifile;
846 	char *basepath = NULL, *pack_path = NULL, *idx_path = NULL;
847 	int packfd = -1, idxfd = -1;
848 	int pipe[2] = { -1, -1 };
849 
850 	if (client->packfile_path) {
851 		return got_error_fmt(GOT_ERR_PRIVSEP_MSG,
852 		    "uid %d already has a pack file", client->euid);
853 	}
854 
855 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
856 		return got_error_from_errno("socketpair");
857 
858 	memset(&ipipe, 0, sizeof(ipipe));
859 	ipipe.client_id = client->id;
860 
861 	/* Send pack pipe end 0 to repo child process. */
862 	if (gotd_imsg_compose_event(&client->repo_child_iev,
863 	    GOTD_IMSG_PACKFILE_PIPE, PROC_SESSION, pipe[0],
864 	        &ipipe, sizeof(ipipe)) == -1) {
865 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
866 		pipe[0] = -1;
867 		goto done;
868 	}
869 	pipe[0] = -1;
870 
871 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
872 	if (gotd_imsg_compose_event(&client->iev,
873 	    GOTD_IMSG_PACKFILE_PIPE, PROC_SESSION, pipe[1], NULL, 0) == -1)
874 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
875 	pipe[1] = -1;
876 
877 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.pack",
878 	    got_repo_get_path(gotd_session.repo), GOT_OBJECTS_PACK_DIR,
879 	    client->euid) == -1) {
880 		err = got_error_from_errno("asprintf");
881 		goto done;
882 	}
883 
884 	err = got_opentemp_named_fd(&pack_path, &packfd, basepath, "");
885 	if (err)
886 		goto done;
887 	if (fchmod(packfd, GOT_DEFAULT_PACK_MODE) == -1) {
888 		err = got_error_from_errno2("fchmod", pack_path);
889 		goto done;
890 	}
891 
892 	free(basepath);
893 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.idx",
894 	    got_repo_get_path(gotd_session.repo), GOT_OBJECTS_PACK_DIR,
895 	    client->euid) == -1) {
896 		err = got_error_from_errno("asprintf");
897 		basepath = NULL;
898 		goto done;
899 	}
900 	err = got_opentemp_named_fd(&idx_path, &idxfd, basepath, "");
901 	if (err)
902 		goto done;
903 	if (fchmod(idxfd, GOT_DEFAULT_PACK_MODE) == -1) {
904 		err = got_error_from_errno2("fchmod", idx_path);
905 		goto done;
906 	}
907 
908 	memset(&ifile, 0, sizeof(ifile));
909 	ifile.client_id = client->id;
910 	if (gotd_imsg_compose_event(&client->repo_child_iev,
911 	    GOTD_IMSG_PACKIDX_FILE, PROC_SESSION,
912 	    idxfd, &ifile, sizeof(ifile)) == -1) {
913 		err = got_error_from_errno("imsg compose PACKIDX_FILE");
914 		idxfd = -1;
915 		goto done;
916 	}
917 	idxfd = -1;
918 
919 	memset(&ipack, 0, sizeof(ipack));
920 	ipack.client_id = client->id;
921 	if (client_has_capability(client, GOT_CAPA_REPORT_STATUS))
922 		ipack.report_status = 1;
923 
924 	if (gotd_imsg_compose_event(&client->repo_child_iev,
925 	    GOTD_IMSG_RECV_PACKFILE, PROC_SESSION, packfd,
926 	    &ipack, sizeof(ipack)) == -1) {
927 		err = got_error_from_errno("imsg compose RECV_PACKFILE");
928 		packfd = -1;
929 		goto done;
930 	}
931 	packfd = -1;
932 
933 done:
934 	free(basepath);
935 	if (pipe[0] != -1 && close(pipe[0]) == -1 && err == NULL)
936 		err = got_error_from_errno("close");
937 	if (pipe[1] != -1 && close(pipe[1]) == -1 && err == NULL)
938 		err = got_error_from_errno("close");
939 	if (packfd != -1 && close(packfd) == -1 && err == NULL)
940 		err = got_error_from_errno("close");
941 	if (idxfd != -1 && close(idxfd) == -1 && err == NULL)
942 		err = got_error_from_errno("close");
943 	if (err) {
944 		free(pack_path);
945 		free(idx_path);
946 	} else {
947 		client->packfile_path = pack_path;
948 		client->packidx_path = idx_path;
949 	}
950 	return err;
951 }
952 
953 static const struct got_error *
954 send_packfile(struct gotd_session_client *client)
955 {
956 	const struct got_error *err = NULL;
957 	struct gotd_imsg_send_packfile ipack;
958 	struct gotd_imsg_packfile_pipe ipipe;
959 	int pipe[2];
960 
961 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
962 		return got_error_from_errno("socketpair");
963 
964 	memset(&ipack, 0, sizeof(ipack));
965 	memset(&ipipe, 0, sizeof(ipipe));
966 
967 	ipack.client_id = client->id;
968 	if (client_has_capability(client, GOT_CAPA_SIDE_BAND_64K))
969 		ipack.report_progress = 1;
970 
971 	client->delta_cache_fd = got_opentempfd();
972 	if (client->delta_cache_fd == -1)
973 		return got_error_from_errno("got_opentempfd");
974 
975 	if (gotd_imsg_compose_event(&client->repo_child_iev,
976 	    GOTD_IMSG_SEND_PACKFILE, PROC_GOTD, client->delta_cache_fd,
977 	    &ipack, sizeof(ipack)) == -1) {
978 		err = got_error_from_errno("imsg compose SEND_PACKFILE");
979 		close(pipe[0]);
980 		close(pipe[1]);
981 		return err;
982 	}
983 
984 	ipipe.client_id = client->id;
985 
986 	/* Send pack pipe end 0 to repo child process. */
987 	if (gotd_imsg_compose_event(&client->repo_child_iev,
988 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD,
989 	    pipe[0], &ipipe, sizeof(ipipe)) == -1) {
990 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
991 		close(pipe[1]);
992 		return err;
993 	}
994 
995 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
996 	if (gotd_imsg_compose_event(&client->iev,
997 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD, pipe[1], NULL, 0) == -1)
998 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
999 
1000 	return err;
1001 }
1002 
1003 static void
1004 session_dispatch_client(int fd, short events, void *arg)
1005 {
1006 	struct gotd_imsgev *iev = arg;
1007 	struct imsgbuf *ibuf = &iev->ibuf;
1008 	struct gotd_session_client *client = &gotd_session_client;
1009 	const struct got_error *err = NULL;
1010 	struct imsg imsg;
1011 	ssize_t n;
1012 
1013 	if (events & EV_WRITE) {
1014 		while (ibuf->w.queued) {
1015 			n = msgbuf_write(&ibuf->w);
1016 			if (n == -1 && errno == EPIPE) {
1017 				/*
1018 				 * The client has closed its socket.
1019 				 * This can happen when Git clients are
1020 				 * done sending pack file data.
1021 				 */
1022 				msgbuf_clear(&ibuf->w);
1023 				continue;
1024 			} else if (n == -1 && errno != EAGAIN) {
1025 				err = got_error_from_errno("imsg_flush");
1026 				disconnect_on_error(client, err);
1027 				return;
1028 			}
1029 			if (n == 0) {
1030 				/* Connection closed. */
1031 				err = got_error(GOT_ERR_EOF);
1032 				disconnect_on_error(client, err);
1033 				return;
1034 			}
1035 		}
1036 	}
1037 
1038 	if ((events & EV_READ) == 0)
1039 		return;
1040 
1041 	memset(&imsg, 0, sizeof(imsg));
1042 
1043 	while (err == NULL) {
1044 		err = gotd_imsg_recv(&imsg, ibuf, 0);
1045 		if (err) {
1046 			if (err->code == GOT_ERR_PRIVSEP_READ)
1047 				err = NULL;
1048 			break;
1049 		}
1050 
1051 		evtimer_del(&client->tmo);
1052 
1053 		switch (imsg.hdr.type) {
1054 		case GOTD_IMSG_CAPABILITIES:
1055 			if (client->state != GOTD_STATE_EXPECT_CAPABILITIES) {
1056 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1057 				    "unexpected capabilities received");
1058 				break;
1059 			}
1060 			log_debug("receiving capabilities from uid %d",
1061 			    client->euid);
1062 			err = recv_capabilities(client, &imsg);
1063 			break;
1064 		case GOTD_IMSG_CAPABILITY:
1065 			if (client->state != GOTD_STATE_EXPECT_CAPABILITIES) {
1066 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1067 				    "unexpected capability received");
1068 				break;
1069 			}
1070 			err = recv_capability(client, &imsg);
1071 			if (err || client->ncapabilities < client->ncapa_alloc)
1072 				break;
1073 			if (!client->is_writing) {
1074 				client->state = GOTD_STATE_EXPECT_WANT;
1075 				client->accept_flush_pkt = 1;
1076 				log_debug("uid %d: expecting want-lines",
1077 				    client->euid);
1078 			} else if (client->is_writing) {
1079 				client->state = GOTD_STATE_EXPECT_REF_UPDATE;
1080 				client->accept_flush_pkt = 1;
1081 				log_debug("uid %d: expecting ref-update-lines",
1082 				    client->euid);
1083 			} else
1084 				fatalx("client %d is both reading and writing",
1085 				    client->euid);
1086 			break;
1087 		case GOTD_IMSG_WANT:
1088 			if (client->state != GOTD_STATE_EXPECT_WANT) {
1089 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1090 				    "unexpected want-line received");
1091 				break;
1092 			}
1093 			log_debug("received want-line from uid %d",
1094 			    client->euid);
1095 			err = ensure_client_is_reading(client);
1096 			if (err)
1097 				break;
1098 			client->accept_flush_pkt = 1;
1099 			err = forward_want(client, &imsg);
1100 			break;
1101 		case GOTD_IMSG_REF_UPDATE:
1102 			if (client->state != GOTD_STATE_EXPECT_REF_UPDATE &&
1103 			    client->state !=
1104 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1105 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1106 				    "unexpected ref-update-line received");
1107 				break;
1108 			}
1109 			log_debug("received ref-update-line from uid %d",
1110 			    client->euid);
1111 			err = ensure_client_is_writing(client);
1112 			if (err)
1113 				break;
1114 			err = forward_ref_update(client, &imsg);
1115 			if (err)
1116 				break;
1117 			client->state = GOTD_STATE_EXPECT_MORE_REF_UPDATES;
1118 			client->accept_flush_pkt = 1;
1119 			break;
1120 		case GOTD_IMSG_HAVE:
1121 			if (client->state != GOTD_STATE_EXPECT_HAVE) {
1122 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1123 				    "unexpected have-line received");
1124 				break;
1125 			}
1126 			log_debug("received have-line from uid %d",
1127 			    client->euid);
1128 			err = ensure_client_is_reading(client);
1129 			if (err)
1130 				break;
1131 			err = forward_have(client, &imsg);
1132 			if (err)
1133 				break;
1134 			client->accept_flush_pkt = 1;
1135 			break;
1136 		case GOTD_IMSG_FLUSH:
1137 			if (client->state == GOTD_STATE_EXPECT_WANT ||
1138 			    client->state == GOTD_STATE_EXPECT_HAVE) {
1139 				err = ensure_client_is_reading(client);
1140 				if (err)
1141 					break;
1142 			} else if (client->state ==
1143 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1144 				err = ensure_client_is_writing(client);
1145 				if (err)
1146 					break;
1147 			} else if (client->state != GOTD_STATE_EXPECT_DONE) {
1148 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1149 				    "unexpected flush-pkt received");
1150 				break;
1151 			}
1152 			if (!client->accept_flush_pkt) {
1153 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1154 				    "unexpected flush-pkt received");
1155 				break;
1156 			}
1157 
1158 			/*
1159 			 * Accept just one flush packet at a time.
1160 			 * Future client state transitions will set this flag
1161 			 * again if another flush packet is expected.
1162 			 */
1163 			client->accept_flush_pkt = 0;
1164 
1165 			log_debug("received flush-pkt from uid %d",
1166 			    client->euid);
1167 			if (client->state == GOTD_STATE_EXPECT_WANT) {
1168 				client->state = GOTD_STATE_EXPECT_HAVE;
1169 				log_debug("uid %d: expecting have-lines",
1170 				    client->euid);
1171 			} else if (client->state == GOTD_STATE_EXPECT_HAVE) {
1172 				client->state = GOTD_STATE_EXPECT_DONE;
1173 				client->accept_flush_pkt = 1;
1174 				log_debug("uid %d: expecting 'done'",
1175 				    client->euid);
1176 			} else if (client->state ==
1177 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1178 				client->state = GOTD_STATE_EXPECT_PACKFILE;
1179 				log_debug("uid %d: expecting packfile",
1180 				    client->euid);
1181 				err = recv_packfile(client);
1182 			} else if (client->state != GOTD_STATE_EXPECT_DONE) {
1183 				/* should not happen, see above */
1184 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1185 				    "unexpected client state");
1186 				break;
1187 			}
1188 			break;
1189 		case GOTD_IMSG_DONE:
1190 			if (client->state != GOTD_STATE_EXPECT_HAVE &&
1191 			    client->state != GOTD_STATE_EXPECT_DONE) {
1192 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1193 				    "unexpected flush-pkt received");
1194 				break;
1195 			}
1196 			log_debug("received 'done' from uid %d", client->euid);
1197 			err = ensure_client_is_reading(client);
1198 			if (err)
1199 				break;
1200 			client->state = GOTD_STATE_DONE;
1201 			client->accept_flush_pkt = 1;
1202 			err = send_packfile(client);
1203 			break;
1204 		default:
1205 			log_debug("unexpected imsg %d", imsg.hdr.type);
1206 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1207 			break;
1208 		}
1209 
1210 		imsg_free(&imsg);
1211 	}
1212 
1213 	if (err) {
1214 		if (err->code != GOT_ERR_EOF ||
1215 		    client->state != GOTD_STATE_EXPECT_PACKFILE)
1216 			disconnect_on_error(client, err);
1217 	} else {
1218 		gotd_imsg_event_add(iev);
1219 		evtimer_add(&client->tmo, &gotd_session.request_timeout);
1220 	}
1221 }
1222 
1223 static const struct got_error *
1224 list_refs_request(void)
1225 {
1226 	static const struct got_error *err;
1227 	struct gotd_session_client *client = &gotd_session_client;
1228 	struct gotd_imsgev *iev = &client->repo_child_iev;
1229 	struct gotd_imsg_list_refs_internal ilref;
1230 	int fd;
1231 
1232 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1233 		return got_error(GOT_ERR_PRIVSEP_MSG);
1234 
1235 	memset(&ilref, 0, sizeof(ilref));
1236 	ilref.client_id = client->id;
1237 
1238 	fd = dup(client->fd);
1239 	if (fd == -1)
1240 		return got_error_from_errno("dup");
1241 
1242 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_LIST_REFS_INTERNAL,
1243 	    PROC_SESSION, fd, &ilref, sizeof(ilref)) == -1) {
1244 		err = got_error_from_errno("imsg compose LIST_REFS_INTERNAL");
1245 		close(fd);
1246 		return err;
1247 	}
1248 
1249 	client->state = GOTD_STATE_EXPECT_CAPABILITIES;
1250 	log_debug("uid %d: expecting capabilities", client->euid);
1251 	return NULL;
1252 }
1253 
1254 static const struct got_error *
1255 recv_connect(struct imsg *imsg)
1256 {
1257 	struct gotd_session_client *client = &gotd_session_client;
1258 	struct gotd_imsg_connect iconnect;
1259 	size_t datalen;
1260 
1261 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1262 		return got_error(GOT_ERR_PRIVSEP_MSG);
1263 
1264 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1265 	if (datalen != sizeof(iconnect))
1266 		return got_error(GOT_ERR_PRIVSEP_LEN);
1267 	memcpy(&iconnect, imsg->data, sizeof(iconnect));
1268 
1269 	if (imsg->fd == -1)
1270 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1271 
1272 	client->fd = imsg->fd;
1273 	client->euid = iconnect.euid;
1274 	client->egid = iconnect.egid;
1275 
1276 	imsg_init(&client->iev.ibuf, client->fd);
1277 	client->iev.handler = session_dispatch_client;
1278 	client->iev.events = EV_READ;
1279 	client->iev.handler_arg = NULL;
1280 	event_set(&client->iev.ev, client->iev.ibuf.fd, EV_READ,
1281 	    session_dispatch_client, &client->iev);
1282 	gotd_imsg_event_add(&client->iev);
1283 	evtimer_set(&client->tmo, gotd_request_timeout, client);
1284 
1285 	return NULL;
1286 }
1287 
1288 static const struct got_error *
1289 recv_repo_child(struct imsg *imsg)
1290 {
1291 	struct gotd_imsg_connect_repo_child ichild;
1292 	struct gotd_session_client *client = &gotd_session_client;
1293 	size_t datalen;
1294 
1295 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1296 		return got_error(GOT_ERR_PRIVSEP_MSG);
1297 
1298 	/* We should already have received a pipe to the listener. */
1299 	if (client->fd == -1)
1300 		return got_error(GOT_ERR_PRIVSEP_MSG);
1301 
1302 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1303 	if (datalen != sizeof(ichild))
1304 		return got_error(GOT_ERR_PRIVSEP_LEN);
1305 
1306 	memcpy(&ichild, imsg->data, sizeof(ichild));
1307 
1308 	client->id = ichild.client_id;
1309 	if (ichild.proc_id == PROC_REPO_WRITE)
1310 		client->is_writing = 1;
1311 	else if (ichild.proc_id == PROC_REPO_READ)
1312 		client->is_writing = 0;
1313 	else
1314 		return got_error_msg(GOT_ERR_PRIVSEP_MSG,
1315 		    "bad child process type");
1316 
1317 	if (imsg->fd == -1)
1318 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1319 
1320 	imsg_init(&client->repo_child_iev.ibuf, imsg->fd);
1321 	client->repo_child_iev.handler = session_dispatch_repo_child;
1322 	client->repo_child_iev.events = EV_READ;
1323 	client->repo_child_iev.handler_arg = NULL;
1324 	event_set(&client->repo_child_iev.ev, client->repo_child_iev.ibuf.fd,
1325 	    EV_READ, session_dispatch_repo_child, &client->repo_child_iev);
1326 	gotd_imsg_event_add(&client->repo_child_iev);
1327 
1328 	/* The "recvfd" pledge promise is no longer needed. */
1329 	if (pledge("stdio rpath wpath cpath sendfd fattr flock", NULL) == -1)
1330 		fatal("pledge");
1331 
1332 	return NULL;
1333 }
1334 
1335 static void
1336 session_dispatch(int fd, short event, void *arg)
1337 {
1338 	struct gotd_imsgev *iev = arg;
1339 	struct imsgbuf *ibuf = &iev->ibuf;
1340 	struct gotd_session_client *client = &gotd_session_client;
1341 	ssize_t n;
1342 	int shut = 0;
1343 	struct imsg imsg;
1344 
1345 	if (event & EV_READ) {
1346 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1347 			fatal("imsg_read error");
1348 		if (n == 0) {
1349 			/* Connection closed. */
1350 			shut = 1;
1351 			goto done;
1352 		}
1353 	}
1354 
1355 	if (event & EV_WRITE) {
1356 		n = msgbuf_write(&ibuf->w);
1357 		if (n == -1 && errno != EAGAIN)
1358 			fatal("msgbuf_write");
1359 		if (n == 0) {
1360 			/* Connection closed. */
1361 			shut = 1;
1362 			goto done;
1363 		}
1364 	}
1365 
1366 	for (;;) {
1367 		const struct got_error *err = NULL;
1368 		uint32_t client_id = 0;
1369 		int do_disconnect = 0, do_list_refs = 0;
1370 
1371 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1372 			fatal("%s: imsg_get error", __func__);
1373 		if (n == 0)	/* No more messages. */
1374 			break;
1375 
1376 		switch (imsg.hdr.type) {
1377 		case GOTD_IMSG_ERROR:
1378 			do_disconnect = 1;
1379 			err = gotd_imsg_recv_error(&client_id, &imsg);
1380 			break;
1381 		case GOTD_IMSG_CONNECT:
1382 			err = recv_connect(&imsg);
1383 			break;
1384 		case GOTD_IMSG_DISCONNECT:
1385 			do_disconnect = 1;
1386 			break;
1387 		case GOTD_IMSG_CONNECT_REPO_CHILD:
1388 			err = recv_repo_child(&imsg);
1389 			if (err)
1390 				break;
1391 			do_list_refs = 1;
1392 			break;
1393 		default:
1394 			log_debug("unexpected imsg %d", imsg.hdr.type);
1395 			break;
1396 		}
1397 		imsg_free(&imsg);
1398 
1399 		if (do_disconnect) {
1400 			if (err)
1401 				disconnect_on_error(client, err);
1402 			else
1403 				disconnect(client);
1404 		} else if (do_list_refs)
1405 			err = list_refs_request();
1406 
1407 		if (err)
1408 			log_warnx("uid %d: %s", client->euid, err->msg);
1409 	}
1410 done:
1411 	if (!shut) {
1412 		gotd_imsg_event_add(iev);
1413 	} else {
1414 		/* This pipe is dead. Remove its event handler */
1415 		event_del(&iev->ev);
1416 		event_loopexit(NULL);
1417 	}
1418 }
1419 
1420 void
1421 session_main(const char *title, const char *repo_path,
1422     int *pack_fds, int *temp_fds, struct timeval *request_timeout)
1423 {
1424 	const struct got_error *err = NULL;
1425 	struct event evsigint, evsigterm, evsighup, evsigusr1;
1426 
1427 	gotd_session.title = title;
1428 	gotd_session.pid = getpid();
1429 	gotd_session.pack_fds = pack_fds;
1430 	gotd_session.temp_fds = temp_fds;
1431 	memcpy(&gotd_session.request_timeout, request_timeout,
1432 	    sizeof(gotd_session.request_timeout));
1433 
1434 	err = got_repo_open(&gotd_session.repo, repo_path, NULL, pack_fds);
1435 	if (err)
1436 		goto done;
1437 	if (!got_repo_is_bare(gotd_session.repo)) {
1438 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
1439 		    "bare git repository required");
1440 		goto done;
1441 	}
1442 
1443 	got_repo_temp_fds_set(gotd_session.repo, temp_fds);
1444 
1445 	signal_set(&evsigint, SIGINT, gotd_session_sighdlr, NULL);
1446 	signal_set(&evsigterm, SIGTERM, gotd_session_sighdlr, NULL);
1447 	signal_set(&evsighup, SIGHUP, gotd_session_sighdlr, NULL);
1448 	signal_set(&evsigusr1, SIGUSR1, gotd_session_sighdlr, NULL);
1449 	signal(SIGPIPE, SIG_IGN);
1450 
1451 	signal_add(&evsigint, NULL);
1452 	signal_add(&evsigterm, NULL);
1453 	signal_add(&evsighup, NULL);
1454 	signal_add(&evsigusr1, NULL);
1455 
1456 	gotd_session_client.state = GOTD_STATE_EXPECT_LIST_REFS;
1457 	gotd_session_client.fd = -1;
1458 	gotd_session_client.nref_updates = -1;
1459 	gotd_session_client.delta_cache_fd = -1;
1460 	gotd_session_client.accept_flush_pkt = 1;
1461 
1462 	imsg_init(&gotd_session.parent_iev.ibuf, GOTD_FILENO_MSG_PIPE);
1463 	gotd_session.parent_iev.handler = session_dispatch;
1464 	gotd_session.parent_iev.events = EV_READ;
1465 	gotd_session.parent_iev.handler_arg = NULL;
1466 	event_set(&gotd_session.parent_iev.ev, gotd_session.parent_iev.ibuf.fd,
1467 	    EV_READ, session_dispatch, &gotd_session.parent_iev);
1468 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
1469 	    GOTD_IMSG_CLIENT_SESSION_READY, PROC_SESSION, -1, NULL, 0) == -1) {
1470 		err = got_error_from_errno("imsg compose CLIENT_SESSION_READY");
1471 		goto done;
1472 	}
1473 
1474 	event_dispatch();
1475 done:
1476 	if (err)
1477 		log_warnx("%s: %s", title, err->msg);
1478 	gotd_session_shutdown();
1479 }
1480 
1481 void
1482 gotd_session_shutdown(void)
1483 {
1484 	log_debug("shutting down");
1485 	if (gotd_session.repo)
1486 		got_repo_close(gotd_session.repo);
1487 	got_repo_pack_fds_close(gotd_session.pack_fds);
1488 	got_repo_temp_fds_close(gotd_session.temp_fds);
1489 	exit(0);
1490 }