op public repos

Blob

Date:: Wed Jan 11 08:33:41 2023 UTC
Message:: replace malloc+memcpy with strndup. no functional change intended ok stsp@
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2022, 2023 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/queue.h>
19 #include <sys/tree.h>
20 #include <sys/socket.h>
21 #include <sys/uio.h>
22 
23 #include <errno.h>
24 #include <event.h>
25 #include <limits.h>
26 #include <sha1.h>
27 #include <signal.h>
28 #include <stdint.h>
29 #include <stdio.h>
30 #include <stdlib.h>
31 #include <string.h>
32 #include <imsg.h>
33 #include <unistd.h>
34 
35 #include "got_error.h"
36 #include "got_repository.h"
37 #include "got_object.h"
38 #include "got_path.h"
39 #include "got_reference.h"
40 #include "got_opentemp.h"
41 
42 #include "got_lib_sha1.h"
43 #include "got_lib_delta.h"
44 #include "got_lib_object.h"
45 #include "got_lib_object_cache.h"
46 #include "got_lib_pack.h"
47 #include "got_lib_repository.h"
48 #include "got_lib_gitproto.h"
49 
50 #include "gotd.h"
51 #include "log.h"
52 #include "session.h"
53 
54 
55 static struct gotd_session {
56 	pid_t pid;
57 	const char *title;
58 	struct got_repository *repo;
59 	int *pack_fds;
60 	int *temp_fds;
61 	struct gotd_imsgev parent_iev;
62 	struct timeval request_timeout;
63 } gotd_session;
64 
65 static struct gotd_session_client {
66 	enum gotd_session_state		 state;
67 	int				 is_writing;
68 	struct gotd_client_capability	*capabilities;
69 	size_t				 ncapa_alloc;
70 	size_t				 ncapabilities;
71 	uint32_t			 id;
72 	int				 fd;
73 	int				 delta_cache_fd;
74 	struct gotd_imsgev		 iev;
75 	struct gotd_imsgev		 repo_child_iev;
76 	struct event			 tmo;
77 	uid_t				 euid;
78 	gid_t				 egid;
79 	char				*packfile_path;
80 	char				*packidx_path;
81 	int				 nref_updates;
82 } gotd_session_client;
83 
84 void gotd_session_sighdlr(int sig, short event, void *arg);
85 static void gotd_session_shutdown(void);
86 
87 static void
88 disconnect(struct gotd_session_client *client)
89 {
90 	log_debug("uid %d: disconnecting", client->euid);
91 
92 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
93 	    GOTD_IMSG_DISCONNECT, PROC_SESSION, -1, NULL, 0) == -1)
94 		log_warn("imsg compose DISCONNECT");
95 
96 	imsg_clear(&client->repo_child_iev.ibuf);
97 	event_del(&client->repo_child_iev.ev);
98 	evtimer_del(&client->tmo);
99 	close(client->fd);
100 	if (client->delta_cache_fd != -1)
101 		close(client->delta_cache_fd);
102 	if (client->packfile_path) {
103 		if (unlink(client->packfile_path) == -1 && errno != ENOENT)
104 			log_warn("unlink %s: ", client->packfile_path);
105 		free(client->packfile_path);
106 	}
107 	if (client->packidx_path) {
108 		if (unlink(client->packidx_path) == -1 && errno != ENOENT)
109 			log_warn("unlink %s: ", client->packidx_path);
110 		free(client->packidx_path);
111 	}
112 	free(client->capabilities);
113 
114 	gotd_session_shutdown();
115 }
116 
117 static void
118 disconnect_on_error(struct gotd_session_client *client,
119     const struct got_error *err)
120 {
121 	struct imsgbuf ibuf;
122 
123 	log_warnx("uid %d: %s", client->euid, err->msg);
124 	if (err->code != GOT_ERR_EOF) {
125 		imsg_init(&ibuf, client->fd);
126 		gotd_imsg_send_error(&ibuf, 0, PROC_SESSION, err);
127 		imsg_clear(&ibuf);
128 	}
129 
130 	disconnect(client);
131 }
132 
133 static void
134 gotd_request_timeout(int fd, short events, void *arg)
135 {
136 	struct gotd_session_client *client = arg;
137 
138 	log_debug("disconnecting uid %d due to timeout", client->euid);
139 	disconnect(client);
140 }
141 
142 void
143 gotd_session_sighdlr(int sig, short event, void *arg)
144 {
145 	/*
146 	 * Normal signal handler rules don't apply because libevent
147 	 * decouples for us.
148 	 */
149 
150 	switch (sig) {
151 	case SIGHUP:
152 		log_info("%s: ignoring SIGHUP", __func__);
153 		break;
154 	case SIGUSR1:
155 		log_info("%s: ignoring SIGUSR1", __func__);
156 		break;
157 	case SIGTERM:
158 	case SIGINT:
159 		gotd_session_shutdown();
160 		/* NOTREACHED */
161 		break;
162 	default:
163 		fatalx("unexpected signal");
164 	}
165 }
166 
167 static const struct got_error *
168 recv_packfile_done(uint32_t *client_id, struct imsg *imsg)
169 {
170 	struct gotd_imsg_packfile_done idone;
171 	size_t datalen;
172 
173 	log_debug("packfile-done received");
174 
175 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
176 	if (datalen != sizeof(idone))
177 		return got_error(GOT_ERR_PRIVSEP_LEN);
178 	memcpy(&idone, imsg->data, sizeof(idone));
179 
180 	*client_id = idone.client_id;
181 	return NULL;
182 }
183 
184 static const struct got_error *
185 recv_packfile_install(uint32_t *client_id, struct imsg *imsg)
186 {
187 	struct gotd_imsg_packfile_install inst;
188 	size_t datalen;
189 
190 	log_debug("packfile-install received");
191 
192 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
193 	if (datalen != sizeof(inst))
194 		return got_error(GOT_ERR_PRIVSEP_LEN);
195 	memcpy(&inst, imsg->data, sizeof(inst));
196 
197 	*client_id = inst.client_id;
198 	return NULL;
199 }
200 
201 static const struct got_error *
202 recv_ref_updates_start(uint32_t *client_id, struct imsg *imsg)
203 {
204 	struct gotd_imsg_ref_updates_start istart;
205 	size_t datalen;
206 
207 	log_debug("ref-updates-start received");
208 
209 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
210 	if (datalen != sizeof(istart))
211 		return got_error(GOT_ERR_PRIVSEP_LEN);
212 	memcpy(&istart, imsg->data, sizeof(istart));
213 
214 	*client_id = istart.client_id;
215 	return NULL;
216 }
217 
218 static const struct got_error *
219 recv_ref_update(uint32_t *client_id, struct imsg *imsg)
220 {
221 	struct gotd_imsg_ref_update iref;
222 	size_t datalen;
223 
224 	log_debug("ref-update received");
225 
226 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
227 	if (datalen < sizeof(iref))
228 		return got_error(GOT_ERR_PRIVSEP_LEN);
229 	memcpy(&iref, imsg->data, sizeof(iref));
230 
231 	*client_id = iref.client_id;
232 	return NULL;
233 }
234 
235 static const struct got_error *
236 send_ref_update_ok(struct gotd_session_client *client,
237     struct gotd_imsg_ref_update *iref, const char *refname)
238 {
239 	struct gotd_imsg_ref_update_ok iok;
240 	struct gotd_imsgev *iev = &client->iev;
241 	struct ibuf *wbuf;
242 	size_t len;
243 
244 	memset(&iok, 0, sizeof(iok));
245 	iok.client_id = client->id;
246 	memcpy(iok.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
247 	memcpy(iok.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
248 	iok.name_len = strlen(refname);
249 
250 	len = sizeof(iok) + iok.name_len;
251 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE_OK,
252 	    PROC_SESSION, gotd_session.pid, len);
253 	if (wbuf == NULL)
254 		return got_error_from_errno("imsg_create REF_UPDATE_OK");
255 
256 	if (imsg_add(wbuf, &iok, sizeof(iok)) == -1)
257 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
258 	if (imsg_add(wbuf, refname, iok.name_len) == -1)
259 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
260 
261 	wbuf->fd = -1;
262 	imsg_close(&iev->ibuf, wbuf);
263 	gotd_imsg_event_add(iev);
264 	return NULL;
265 }
266 
267 static void
268 send_refs_updated(struct gotd_session_client *client)
269 {
270 	if (gotd_imsg_compose_event(&client->iev, GOTD_IMSG_REFS_UPDATED,
271 	    PROC_SESSION, -1, NULL, 0) == -1)
272 		log_warn("imsg compose REFS_UPDATED");
273 }
274 
275 static const struct got_error *
276 send_ref_update_ng(struct gotd_session_client *client,
277     struct gotd_imsg_ref_update *iref, const char *refname,
278     const char *reason)
279 {
280 	const struct got_error *ng_err;
281 	struct gotd_imsg_ref_update_ng ing;
282 	struct gotd_imsgev *iev = &client->iev;
283 	struct ibuf *wbuf;
284 	size_t len;
285 
286 	memset(&ing, 0, sizeof(ing));
287 	ing.client_id = client->id;
288 	memcpy(ing.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
289 	memcpy(ing.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
290 	ing.name_len = strlen(refname);
291 
292 	ng_err = got_error_fmt(GOT_ERR_REF_BUSY, "%s", reason);
293 	ing.reason_len = strlen(ng_err->msg);
294 
295 	len = sizeof(ing) + ing.name_len + ing.reason_len;
296 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE_NG,
297 	    PROC_SESSION, gotd_session.pid, len);
298 	if (wbuf == NULL)
299 		return got_error_from_errno("imsg_create REF_UPDATE_NG");
300 
301 	if (imsg_add(wbuf, &ing, sizeof(ing)) == -1)
302 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
303 	if (imsg_add(wbuf, refname, ing.name_len) == -1)
304 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
305 	if (imsg_add(wbuf, ng_err->msg, ing.reason_len) == -1)
306 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
307 
308 	wbuf->fd = -1;
309 	imsg_close(&iev->ibuf, wbuf);
310 	gotd_imsg_event_add(iev);
311 	return NULL;
312 }
313 
314 static const struct got_error *
315 install_pack(struct gotd_session_client *client, const char *repo_path,
316     struct imsg *imsg)
317 {
318 	const struct got_error *err = NULL;
319 	struct gotd_imsg_packfile_install inst;
320 	char hex[SHA1_DIGEST_STRING_LENGTH];
321 	size_t datalen;
322 	char *packfile_path = NULL, *packidx_path = NULL;
323 
324 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
325 	if (datalen != sizeof(inst))
326 		return got_error(GOT_ERR_PRIVSEP_LEN);
327 	memcpy(&inst, imsg->data, sizeof(inst));
328 
329 	if (client->packfile_path == NULL)
330 		return got_error_msg(GOT_ERR_BAD_REQUEST,
331 		    "client has no pack file");
332 	if (client->packidx_path == NULL)
333 		return got_error_msg(GOT_ERR_BAD_REQUEST,
334 		    "client has no pack file index");
335 
336 	if (got_sha1_digest_to_str(inst.pack_sha1, hex, sizeof(hex)) == NULL)
337 		return got_error_msg(GOT_ERR_NO_SPACE,
338 		    "could not convert pack file SHA1 to hex");
339 
340 	if (asprintf(&packfile_path, "/%s/%s/pack-%s.pack",
341 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
342 		err = got_error_from_errno("asprintf");
343 		goto done;
344 	}
345 
346 	if (asprintf(&packidx_path, "/%s/%s/pack-%s.idx",
347 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
348 		err = got_error_from_errno("asprintf");
349 		goto done;
350 	}
351 
352 	if (rename(client->packfile_path, packfile_path) == -1) {
353 		err = got_error_from_errno3("rename", client->packfile_path,
354 		    packfile_path);
355 		goto done;
356 	}
357 
358 	free(client->packfile_path);
359 	client->packfile_path = NULL;
360 
361 	if (rename(client->packidx_path, packidx_path) == -1) {
362 		err = got_error_from_errno3("rename", client->packidx_path,
363 		    packidx_path);
364 		goto done;
365 	}
366 
367 	free(client->packidx_path);
368 	client->packidx_path = NULL;
369 done:
370 	free(packfile_path);
371 	free(packidx_path);
372 	return err;
373 }
374 
375 static const struct got_error *
376 begin_ref_updates(struct gotd_session_client *client, struct imsg *imsg)
377 {
378 	struct gotd_imsg_ref_updates_start istart;
379 	size_t datalen;
380 
381 	if (client->nref_updates != -1)
382 		return got_error(GOT_ERR_PRIVSEP_MSG);
383 
384 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
385 	if (datalen != sizeof(istart))
386 		return got_error(GOT_ERR_PRIVSEP_LEN);
387 	memcpy(&istart, imsg->data, sizeof(istart));
388 
389 	if (istart.nref_updates <= 0)
390 		return got_error(GOT_ERR_PRIVSEP_MSG);
391 
392 	client->nref_updates = istart.nref_updates;
393 	return NULL;
394 }
395 
396 static const struct got_error *
397 update_ref(struct gotd_session_client *client, const char *repo_path,
398     struct imsg *imsg)
399 {
400 	const struct got_error *err = NULL;
401 	struct got_repository *repo = NULL;
402 	struct got_reference *ref = NULL;
403 	struct gotd_imsg_ref_update iref;
404 	struct got_object_id old_id, new_id;
405 	struct got_object_id *id = NULL;
406 	struct got_object *obj = NULL;
407 	char *refname = NULL;
408 	size_t datalen;
409 	int locked = 0;
410 
411 	log_debug("update-ref from uid %d", client->euid);
412 
413 	if (client->nref_updates <= 0)
414 		return got_error(GOT_ERR_PRIVSEP_MSG);
415 
416 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
417 	if (datalen < sizeof(iref))
418 		return got_error(GOT_ERR_PRIVSEP_LEN);
419 	memcpy(&iref, imsg->data, sizeof(iref));
420 	if (datalen != sizeof(iref) + iref.name_len)
421 		return got_error(GOT_ERR_PRIVSEP_LEN);
422 	refname = strndup(imsg->data + sizeof(iref), iref.name_len);
423 	if (refname == NULL)
424 		return got_error_from_errno("strndup");
425 
426 	log_debug("updating ref %s for uid %d", refname, client->euid);
427 
428 	err = got_repo_open(&repo, repo_path, NULL, NULL);
429 	if (err)
430 		goto done;
431 
432 	memcpy(old_id.sha1, iref.old_id, SHA1_DIGEST_LENGTH);
433 	memcpy(new_id.sha1, iref.new_id, SHA1_DIGEST_LENGTH);
434 	err = got_object_open(&obj, repo, &new_id);
435 	if (err)
436 		goto done;
437 
438 	if (iref.ref_is_new) {
439 		err = got_ref_open(&ref, repo, refname, 0);
440 		if (err) {
441 			if (err->code != GOT_ERR_NOT_REF)
442 				goto done;
443 			err = got_ref_alloc(&ref, refname, &new_id);
444 			if (err)
445 				goto done;
446 			err = got_ref_write(ref, repo); /* will lock/unlock */
447 			if (err)
448 				goto done;
449 		} else {
450 			err = got_error_fmt(GOT_ERR_REF_BUSY,
451 			    "%s has been created by someone else "
452 			    "while transaction was in progress",
453 			    got_ref_get_name(ref));
454 			goto done;
455 		}
456 	} else {
457 		err = got_ref_open(&ref, repo, refname, 1 /* lock */);
458 		if (err)
459 			goto done;
460 		locked = 1;
461 
462 		err = got_ref_resolve(&id, repo, ref);
463 		if (err)
464 			goto done;
465 
466 		if (got_object_id_cmp(id, &old_id) != 0) {
467 			err = got_error_fmt(GOT_ERR_REF_BUSY,
468 			    "%s has been modified by someone else "
469 			    "while transaction was in progress",
470 			    got_ref_get_name(ref));
471 			goto done;
472 		}
473 
474 		err = got_ref_change_ref(ref, &new_id);
475 		if (err)
476 			goto done;
477 
478 		err = got_ref_write(ref, repo);
479 		if (err)
480 			goto done;
481 
482 		free(id);
483 		id = NULL;
484 	}
485 done:
486 	if (err) {
487 		if (err->code == GOT_ERR_LOCKFILE_TIMEOUT) {
488 			err = got_error_fmt(GOT_ERR_LOCKFILE_TIMEOUT,
489 			    "could not acquire exclusive file lock for %s",
490 			    refname);
491 		}
492 		send_ref_update_ng(client, &iref, refname, err->msg);
493 	} else
494 		send_ref_update_ok(client, &iref, refname);
495 
496 	if (client->nref_updates > 0) {
497 		client->nref_updates--;
498 		if (client->nref_updates == 0)
499 			send_refs_updated(client);
500 
501 	}
502 	if (locked) {
503 		const struct got_error *unlock_err;
504 		unlock_err = got_ref_unlock(ref);
505 		if (unlock_err && err == NULL)
506 			err = unlock_err;
507 	}
508 	if (ref)
509 		got_ref_close(ref);
510 	if (obj)
511 		got_object_close(obj);
512 	if (repo)
513 		got_repo_close(repo);
514 	free(refname);
515 	free(id);
516 	return err;
517 }
518 
519 static void
520 session_dispatch_repo_child(int fd, short event, void *arg)
521 {
522 	struct gotd_imsgev *iev = arg;
523 	struct imsgbuf *ibuf = &iev->ibuf;
524 	struct gotd_session_client *client = &gotd_session_client;
525 	ssize_t n;
526 	int shut = 0;
527 	struct imsg imsg;
528 
529 	if (event & EV_READ) {
530 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
531 			fatal("imsg_read error");
532 		if (n == 0) {
533 			/* Connection closed. */
534 			shut = 1;
535 			goto done;
536 		}
537 	}
538 
539 	if (event & EV_WRITE) {
540 		n = msgbuf_write(&ibuf->w);
541 		if (n == -1 && errno != EAGAIN)
542 			fatal("msgbuf_write");
543 		if (n == 0) {
544 			/* Connection closed. */
545 			shut = 1;
546 			goto done;
547 		}
548 	}
549 
550 	for (;;) {
551 		const struct got_error *err = NULL;
552 		uint32_t client_id = 0;
553 		int do_disconnect = 0;
554 		int do_ref_updates = 0, do_ref_update = 0;
555 		int do_packfile_install = 0;
556 
557 		if ((n = imsg_get(ibuf, &imsg)) == -1)
558 			fatal("%s: imsg_get error", __func__);
559 		if (n == 0)	/* No more messages. */
560 			break;
561 
562 		switch (imsg.hdr.type) {
563 		case GOTD_IMSG_ERROR:
564 			do_disconnect = 1;
565 			err = gotd_imsg_recv_error(&client_id, &imsg);
566 			break;
567 		case GOTD_IMSG_PACKFILE_DONE:
568 			do_disconnect = 1;
569 			err = recv_packfile_done(&client_id, &imsg);
570 			break;
571 		case GOTD_IMSG_PACKFILE_INSTALL:
572 			err = recv_packfile_install(&client_id, &imsg);
573 			if (err == NULL)
574 				do_packfile_install = 1;
575 			break;
576 		case GOTD_IMSG_REF_UPDATES_START:
577 			err = recv_ref_updates_start(&client_id, &imsg);
578 			if (err == NULL)
579 				do_ref_updates = 1;
580 			break;
581 		case GOTD_IMSG_REF_UPDATE:
582 			err = recv_ref_update(&client_id, &imsg);
583 			if (err == NULL)
584 				do_ref_update = 1;
585 			break;
586 		default:
587 			log_debug("unexpected imsg %d", imsg.hdr.type);
588 			break;
589 		}
590 
591 		if (do_disconnect) {
592 			if (err)
593 				disconnect_on_error(client, err);
594 			else
595 				disconnect(client);
596 		} else {
597 			if (do_packfile_install)
598 				err = install_pack(client,
599 				    gotd_session.repo->path, &imsg);
600 			else if (do_ref_updates)
601 				err = begin_ref_updates(client, &imsg);
602 			else if (do_ref_update)
603 				err = update_ref(client,
604 				    gotd_session.repo->path, &imsg);
605 			if (err)
606 				log_warnx("uid %d: %s", client->euid, err->msg);
607 		}
608 		imsg_free(&imsg);
609 	}
610 done:
611 	if (!shut) {
612 		gotd_imsg_event_add(iev);
613 	} else {
614 		/* This pipe is dead. Remove its event handler */
615 		event_del(&iev->ev);
616 		event_loopexit(NULL);
617 	}
618 }
619 
620 static const struct got_error *
621 recv_capabilities(struct gotd_session_client *client, struct imsg *imsg)
622 {
623 	struct gotd_imsg_capabilities icapas;
624 	size_t datalen;
625 
626 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
627 	if (datalen != sizeof(icapas))
628 		return got_error(GOT_ERR_PRIVSEP_LEN);
629 	memcpy(&icapas, imsg->data, sizeof(icapas));
630 
631 	client->ncapa_alloc = icapas.ncapabilities;
632 	client->capabilities = calloc(client->ncapa_alloc,
633 	    sizeof(*client->capabilities));
634 	if (client->capabilities == NULL) {
635 		client->ncapa_alloc = 0;
636 		return got_error_from_errno("calloc");
637 	}
638 
639 	log_debug("expecting %zu capabilities from uid %d",
640 	    client->ncapa_alloc, client->euid);
641 	return NULL;
642 }
643 
644 static const struct got_error *
645 recv_capability(struct gotd_session_client *client, struct imsg *imsg)
646 {
647 	struct gotd_imsg_capability icapa;
648 	struct gotd_client_capability *capa;
649 	size_t datalen;
650 	char *key, *value = NULL;
651 
652 	if (client->capabilities == NULL ||
653 	    client->ncapabilities >= client->ncapa_alloc) {
654 		return got_error_msg(GOT_ERR_BAD_REQUEST,
655 		    "unexpected capability received");
656 	}
657 
658 	memset(&icapa, 0, sizeof(icapa));
659 
660 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
661 	if (datalen < sizeof(icapa))
662 		return got_error(GOT_ERR_PRIVSEP_LEN);
663 	memcpy(&icapa, imsg->data, sizeof(icapa));
664 
665 	if (datalen != sizeof(icapa) + icapa.key_len + icapa.value_len)
666 		return got_error(GOT_ERR_PRIVSEP_LEN);
667 
668 	key = strndup(imsg->data + sizeof(icapa), icapa.key_len);
669 	if (key == NULL)
670 		return got_error_from_errno("strndup");
671 	if (icapa.value_len > 0) {
672 		value = strndup(imsg->data + sizeof(icapa) + icapa.key_len,
673 		    icapa.value_len);
674 		if (value == NULL) {
675 			free(key);
676 			return got_error_from_errno("strndup");
677 		}
678 	}
679 
680 	capa = &client->capabilities[client->ncapabilities++];
681 	capa->key = key;
682 	capa->value = value;
683 
684 	if (value)
685 		log_debug("uid %d: capability %s=%s", client->euid, key, value);
686 	else
687 		log_debug("uid %d: capability %s", client->euid, key);
688 
689 	return NULL;
690 }
691 
692 static const struct got_error *
693 ensure_client_is_reading(struct gotd_session_client *client)
694 {
695 	if (client->is_writing) {
696 		return got_error_fmt(GOT_ERR_BAD_PACKET,
697 		    "uid %d made a read-request but is not reading from "
698 		    "a repository", client->euid);
699 	}
700 
701 	return NULL;
702 }
703 
704 static const struct got_error *
705 ensure_client_is_writing(struct gotd_session_client *client)
706 {
707 	if (!client->is_writing) {
708 		return got_error_fmt(GOT_ERR_BAD_PACKET,
709 		    "uid %d made a write-request but is not writing to "
710 		    "a repository", client->euid);
711 	}
712 
713 	return NULL;
714 }
715 
716 static const struct got_error *
717 forward_want(struct gotd_session_client *client, struct imsg *imsg)
718 {
719 	struct gotd_imsg_want ireq;
720 	struct gotd_imsg_want iwant;
721 	size_t datalen;
722 
723 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
724 	if (datalen != sizeof(ireq))
725 		return got_error(GOT_ERR_PRIVSEP_LEN);
726 
727 	memcpy(&ireq, imsg->data, datalen);
728 
729 	memset(&iwant, 0, sizeof(iwant));
730 	memcpy(iwant.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
731 	iwant.client_id = client->id;
732 
733 	if (gotd_imsg_compose_event(&client->repo_child_iev, GOTD_IMSG_WANT,
734 	    PROC_SESSION, -1, &iwant, sizeof(iwant)) == -1)
735 		return got_error_from_errno("imsg compose WANT");
736 
737 	return NULL;
738 }
739 
740 static const struct got_error *
741 forward_ref_update(struct gotd_session_client *client, struct imsg *imsg)
742 {
743 	const struct got_error *err = NULL;
744 	struct gotd_imsg_ref_update ireq;
745 	struct gotd_imsg_ref_update *iref = NULL;
746 	size_t datalen;
747 
748 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
749 	if (datalen < sizeof(ireq))
750 		return got_error(GOT_ERR_PRIVSEP_LEN);
751 	memcpy(&ireq, imsg->data, sizeof(ireq));
752 	if (datalen != sizeof(ireq) + ireq.name_len)
753 		return got_error(GOT_ERR_PRIVSEP_LEN);
754 
755 	iref = malloc(datalen);
756 	if (iref == NULL)
757 		return got_error_from_errno("malloc");
758 	memcpy(iref, imsg->data, datalen);
759 
760 	iref->client_id = client->id;
761 	if (gotd_imsg_compose_event(&client->repo_child_iev,
762 	    GOTD_IMSG_REF_UPDATE, PROC_SESSION, -1, iref, datalen) == -1)
763 		err = got_error_from_errno("imsg compose REF_UPDATE");
764 	free(iref);
765 	return err;
766 }
767 
768 static const struct got_error *
769 forward_have(struct gotd_session_client *client, struct imsg *imsg)
770 {
771 	struct gotd_imsg_have ireq;
772 	struct gotd_imsg_have ihave;
773 	size_t datalen;
774 
775 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
776 	if (datalen != sizeof(ireq))
777 		return got_error(GOT_ERR_PRIVSEP_LEN);
778 
779 	memcpy(&ireq, imsg->data, datalen);
780 
781 	memset(&ihave, 0, sizeof(ihave));
782 	memcpy(ihave.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
783 	ihave.client_id = client->id;
784 
785 	if (gotd_imsg_compose_event(&client->repo_child_iev, GOTD_IMSG_HAVE,
786 	    PROC_SESSION, -1, &ihave, sizeof(ihave)) == -1)
787 		return got_error_from_errno("imsg compose HAVE");
788 
789 	return NULL;
790 }
791 
792 static int
793 client_has_capability(struct gotd_session_client *client, const char *capastr)
794 {
795 	struct gotd_client_capability *capa;
796 	size_t i;
797 
798 	if (client->ncapabilities == 0)
799 		return 0;
800 
801 	for (i = 0; i < client->ncapabilities; i++) {
802 		capa = &client->capabilities[i];
803 		if (strcmp(capa->key, capastr) == 0)
804 			return 1;
805 	}
806 
807 	return 0;
808 }
809 
810 static const struct got_error *
811 recv_packfile(struct gotd_session_client *client)
812 {
813 	const struct got_error *err = NULL;
814 	struct gotd_imsg_recv_packfile ipack;
815 	struct gotd_imsg_packfile_pipe ipipe;
816 	struct gotd_imsg_packidx_file ifile;
817 	char *basepath = NULL, *pack_path = NULL, *idx_path = NULL;
818 	int packfd = -1, idxfd = -1;
819 	int pipe[2] = { -1, -1 };
820 
821 	if (client->packfile_path) {
822 		return got_error_fmt(GOT_ERR_PRIVSEP_MSG,
823 		    "uid %d already has a pack file", client->euid);
824 	}
825 
826 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
827 		return got_error_from_errno("socketpair");
828 
829 	memset(&ipipe, 0, sizeof(ipipe));
830 	ipipe.client_id = client->id;
831 
832 	/* Send pack pipe end 0 to repo child process. */
833 	if (gotd_imsg_compose_event(&client->repo_child_iev,
834 	    GOTD_IMSG_PACKFILE_PIPE, PROC_SESSION, pipe[0],
835 	        &ipipe, sizeof(ipipe)) == -1) {
836 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
837 		pipe[0] = -1;
838 		goto done;
839 	}
840 	pipe[0] = -1;
841 
842 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
843 	if (gotd_imsg_compose_event(&client->iev,
844 	    GOTD_IMSG_PACKFILE_PIPE, PROC_SESSION, pipe[1], NULL, 0) == -1)
845 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
846 	pipe[1] = -1;
847 
848 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.pack",
849 	    got_repo_get_path(gotd_session.repo), GOT_OBJECTS_PACK_DIR,
850 	    client->euid) == -1) {
851 		err = got_error_from_errno("asprintf");
852 		goto done;
853 	}
854 
855 	err = got_opentemp_named_fd(&pack_path, &packfd, basepath, "");
856 	if (err)
857 		goto done;
858 
859 	free(basepath);
860 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.idx",
861 	    got_repo_get_path(gotd_session.repo), GOT_OBJECTS_PACK_DIR,
862 	    client->euid) == -1) {
863 		err = got_error_from_errno("asprintf");
864 		basepath = NULL;
865 		goto done;
866 	}
867 	err = got_opentemp_named_fd(&idx_path, &idxfd, basepath, "");
868 	if (err)
869 		goto done;
870 
871 	memset(&ifile, 0, sizeof(ifile));
872 	ifile.client_id = client->id;
873 	if (gotd_imsg_compose_event(&client->repo_child_iev,
874 	    GOTD_IMSG_PACKIDX_FILE, PROC_SESSION,
875 	    idxfd, &ifile, sizeof(ifile)) == -1) {
876 		err = got_error_from_errno("imsg compose PACKIDX_FILE");
877 		idxfd = -1;
878 		goto done;
879 	}
880 	idxfd = -1;
881 
882 	memset(&ipack, 0, sizeof(ipack));
883 	ipack.client_id = client->id;
884 	if (client_has_capability(client, GOT_CAPA_REPORT_STATUS))
885 		ipack.report_status = 1;
886 
887 	if (gotd_imsg_compose_event(&client->repo_child_iev,
888 	    GOTD_IMSG_RECV_PACKFILE, PROC_SESSION, packfd,
889 	    &ipack, sizeof(ipack)) == -1) {
890 		err = got_error_from_errno("imsg compose RECV_PACKFILE");
891 		packfd = -1;
892 		goto done;
893 	}
894 	packfd = -1;
895 
896 done:
897 	free(basepath);
898 	if (pipe[0] != -1 && close(pipe[0]) == -1 && err == NULL)
899 		err = got_error_from_errno("close");
900 	if (pipe[1] != -1 && close(pipe[1]) == -1 && err == NULL)
901 		err = got_error_from_errno("close");
902 	if (packfd != -1 && close(packfd) == -1 && err == NULL)
903 		err = got_error_from_errno("close");
904 	if (idxfd != -1 && close(idxfd) == -1 && err == NULL)
905 		err = got_error_from_errno("close");
906 	if (err) {
907 		free(pack_path);
908 		free(idx_path);
909 	} else {
910 		client->packfile_path = pack_path;
911 		client->packidx_path = idx_path;
912 	}
913 	return err;
914 }
915 
916 static const struct got_error *
917 send_packfile(struct gotd_session_client *client)
918 {
919 	const struct got_error *err = NULL;
920 	struct gotd_imsg_send_packfile ipack;
921 	struct gotd_imsg_packfile_pipe ipipe;
922 	int pipe[2];
923 
924 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
925 		return got_error_from_errno("socketpair");
926 
927 	memset(&ipack, 0, sizeof(ipack));
928 	memset(&ipipe, 0, sizeof(ipipe));
929 
930 	ipack.client_id = client->id;
931 	if (client_has_capability(client, GOT_CAPA_SIDE_BAND_64K))
932 		ipack.report_progress = 1;
933 
934 	client->delta_cache_fd = got_opentempfd();
935 	if (client->delta_cache_fd == -1)
936 		return got_error_from_errno("got_opentempfd");
937 
938 	if (gotd_imsg_compose_event(&client->repo_child_iev,
939 	    GOTD_IMSG_SEND_PACKFILE, PROC_GOTD, client->delta_cache_fd,
940 	    &ipack, sizeof(ipack)) == -1) {
941 		err = got_error_from_errno("imsg compose SEND_PACKFILE");
942 		close(pipe[0]);
943 		close(pipe[1]);
944 		return err;
945 	}
946 
947 	ipipe.client_id = client->id;
948 
949 	/* Send pack pipe end 0 to repo child process. */
950 	if (gotd_imsg_compose_event(&client->repo_child_iev,
951 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD,
952 	    pipe[0], &ipipe, sizeof(ipipe)) == -1) {
953 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
954 		close(pipe[1]);
955 		return err;
956 	}
957 
958 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
959 	if (gotd_imsg_compose_event(&client->iev,
960 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD, pipe[1], NULL, 0) == -1)
961 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
962 
963 	return err;
964 }
965 
966 static void
967 session_dispatch_listener(int fd, short events, void *arg)
968 {
969 	struct gotd_imsgev *iev = arg;
970 	struct imsgbuf *ibuf = &iev->ibuf;
971 	struct gotd_session_client *client = &gotd_session_client;
972 	const struct got_error *err = NULL;
973 	struct imsg imsg;
974 	ssize_t n;
975 
976 	if (events & EV_WRITE) {
977 		while (ibuf->w.queued) {
978 			n = msgbuf_write(&ibuf->w);
979 			if (n == -1 && errno == EPIPE) {
980 				/*
981 				 * The client has closed its socket.
982 				 * This can happen when Git clients are
983 				 * done sending pack file data.
984 				 */
985 				msgbuf_clear(&ibuf->w);
986 				continue;
987 			} else if (n == -1 && errno != EAGAIN) {
988 				err = got_error_from_errno("imsg_flush");
989 				disconnect_on_error(client, err);
990 				return;
991 			}
992 			if (n == 0) {
993 				/* Connection closed. */
994 				err = got_error(GOT_ERR_EOF);
995 				disconnect_on_error(client, err);
996 				return;
997 			}
998 		}
999 	}
1000 
1001 	if ((events & EV_READ) == 0)
1002 		return;
1003 
1004 	memset(&imsg, 0, sizeof(imsg));
1005 
1006 	while (err == NULL) {
1007 		err = gotd_imsg_recv(&imsg, ibuf, 0);
1008 		if (err) {
1009 			if (err->code == GOT_ERR_PRIVSEP_READ)
1010 				err = NULL;
1011 			break;
1012 		}
1013 
1014 		evtimer_del(&client->tmo);
1015 
1016 		switch (imsg.hdr.type) {
1017 		case GOTD_IMSG_CAPABILITIES:
1018 			if (client->state != GOTD_STATE_EXPECT_CAPABILITIES) {
1019 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1020 				    "unexpected capabilities received");
1021 				break;
1022 			}
1023 			log_debug("receiving capabilities from uid %d",
1024 			    client->euid);
1025 			err = recv_capabilities(client, &imsg);
1026 			break;
1027 		case GOTD_IMSG_CAPABILITY:
1028 			if (client->state != GOTD_STATE_EXPECT_CAPABILITIES) {
1029 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1030 				    "unexpected capability received");
1031 				break;
1032 			}
1033 			err = recv_capability(client, &imsg);
1034 			if (err || client->ncapabilities < client->ncapa_alloc)
1035 				break;
1036 			if (!client->is_writing) {
1037 				client->state = GOTD_STATE_EXPECT_WANT;
1038 				log_debug("uid %d: expecting want-lines",
1039 				    client->euid);
1040 			} else if (client->is_writing) {
1041 				client->state = GOTD_STATE_EXPECT_REF_UPDATE;
1042 				log_debug("uid %d: expecting ref-update-lines",
1043 				    client->euid);
1044 			} else
1045 				fatalx("client %d is both reading and writing",
1046 				    client->euid);
1047 			break;
1048 		case GOTD_IMSG_WANT:
1049 			if (client->state != GOTD_STATE_EXPECT_WANT) {
1050 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1051 				    "unexpected want-line received");
1052 				break;
1053 			}
1054 			log_debug("received want-line from uid %d",
1055 			    client->euid);
1056 			err = ensure_client_is_reading(client);
1057 			if (err)
1058 				break;
1059 			err = forward_want(client, &imsg);
1060 			break;
1061 		case GOTD_IMSG_REF_UPDATE:
1062 			if (client->state != GOTD_STATE_EXPECT_REF_UPDATE) {
1063 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1064 				    "unexpected ref-update-line received");
1065 				break;
1066 			}
1067 			log_debug("received ref-update-line from uid %d",
1068 			    client->euid);
1069 			err = ensure_client_is_writing(client);
1070 			if (err)
1071 				break;
1072 			err = forward_ref_update(client, &imsg);
1073 			if (err)
1074 				break;
1075 			client->state = GOTD_STATE_EXPECT_MORE_REF_UPDATES;
1076 			break;
1077 		case GOTD_IMSG_HAVE:
1078 			if (client->state != GOTD_STATE_EXPECT_HAVE) {
1079 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1080 				    "unexpected have-line received");
1081 				break;
1082 			}
1083 			log_debug("received have-line from uid %d",
1084 			    client->euid);
1085 			err = ensure_client_is_reading(client);
1086 			if (err)
1087 				break;
1088 			err = forward_have(client, &imsg);
1089 			if (err)
1090 				break;
1091 			break;
1092 		case GOTD_IMSG_FLUSH:
1093 			if (client->state == GOTD_STATE_EXPECT_WANT ||
1094 			    client->state == GOTD_STATE_EXPECT_HAVE) {
1095 				err = ensure_client_is_reading(client);
1096 				if (err)
1097 					break;
1098 			} else if (client->state ==
1099 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1100 				err = ensure_client_is_writing(client);
1101 				if (err)
1102 					break;
1103 			} else {
1104 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1105 				    "unexpected flush-pkt received");
1106 				break;
1107 			}
1108 			log_debug("received flush-pkt from uid %d",
1109 			    client->euid);
1110 			if (client->state == GOTD_STATE_EXPECT_WANT) {
1111 				client->state = GOTD_STATE_EXPECT_HAVE;
1112 				log_debug("uid %d: expecting have-lines",
1113 				    client->euid);
1114 			} else if (client->state == GOTD_STATE_EXPECT_HAVE) {
1115 				client->state = GOTD_STATE_EXPECT_DONE;
1116 				log_debug("uid %d: expecting 'done'",
1117 				    client->euid);
1118 			} else if (client->state ==
1119 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1120 				client->state = GOTD_STATE_EXPECT_PACKFILE;
1121 				log_debug("uid %d: expecting packfile",
1122 				    client->euid);
1123 				err = recv_packfile(client);
1124 			} else {
1125 				/* should not happen, see above */
1126 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1127 				    "unexpected client state");
1128 				break;
1129 			}
1130 			break;
1131 		case GOTD_IMSG_DONE:
1132 			if (client->state != GOTD_STATE_EXPECT_HAVE &&
1133 			    client->state != GOTD_STATE_EXPECT_DONE) {
1134 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1135 				    "unexpected flush-pkt received");
1136 				break;
1137 			}
1138 			log_debug("received 'done' from uid %d", client->euid);
1139 			err = ensure_client_is_reading(client);
1140 			if (err)
1141 				break;
1142 			client->state = GOTD_STATE_DONE;
1143 			err = send_packfile(client);
1144 			break;
1145 		default:
1146 			log_debug("unexpected imsg %d", imsg.hdr.type);
1147 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1148 			break;
1149 		}
1150 
1151 		imsg_free(&imsg);
1152 	}
1153 
1154 	if (err) {
1155 		if (err->code != GOT_ERR_EOF ||
1156 		    client->state != GOTD_STATE_EXPECT_PACKFILE)
1157 			disconnect_on_error(client, err);
1158 	} else {
1159 		gotd_imsg_event_add(iev);
1160 		evtimer_add(&client->tmo, &gotd_session.request_timeout);
1161 	}
1162 }
1163 
1164 static const struct got_error *
1165 list_refs_request(void)
1166 {
1167 	static const struct got_error *err;
1168 	struct gotd_session_client *client = &gotd_session_client;
1169 	struct gotd_imsgev *iev = &client->repo_child_iev;
1170 	struct gotd_imsg_list_refs_internal ilref;
1171 	int fd;
1172 
1173 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1174 		return got_error(GOT_ERR_PRIVSEP_MSG);
1175 
1176 	memset(&ilref, 0, sizeof(ilref));
1177 	ilref.client_id = client->id;
1178 
1179 	fd = dup(client->fd);
1180 	if (fd == -1)
1181 		return got_error_from_errno("dup");
1182 
1183 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_LIST_REFS_INTERNAL,
1184 	    PROC_SESSION, fd, &ilref, sizeof(ilref)) == -1) {
1185 		err = got_error_from_errno("imsg compose LIST_REFS_INTERNAL");
1186 		close(fd);
1187 		return err;
1188 	}
1189 
1190 	client->state = GOTD_STATE_EXPECT_CAPABILITIES;
1191 	log_debug("uid %d: expecting capabilities", client->euid);
1192 	return NULL;
1193 }
1194 
1195 static const struct got_error *
1196 recv_connect(struct imsg *imsg)
1197 {
1198 	struct gotd_session_client *client = &gotd_session_client;
1199 	struct gotd_imsg_connect iconnect;
1200 	size_t datalen;
1201 
1202 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1203 		return got_error(GOT_ERR_PRIVSEP_MSG);
1204 
1205 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1206 	if (datalen != sizeof(iconnect))
1207 		return got_error(GOT_ERR_PRIVSEP_LEN);
1208 	memcpy(&iconnect, imsg->data, sizeof(iconnect));
1209 
1210 	if (imsg->fd == -1)
1211 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1212 
1213 	client->fd = imsg->fd;
1214 	client->euid = iconnect.euid;
1215 	client->egid = iconnect.egid;
1216 
1217 	imsg_init(&client->iev.ibuf, client->fd);
1218 	client->iev.handler = session_dispatch_listener;
1219 	client->iev.events = EV_READ;
1220 	client->iev.handler_arg = NULL;
1221 	event_set(&client->iev.ev, client->iev.ibuf.fd, EV_READ,
1222 	    session_dispatch_listener, &client->iev);
1223 	gotd_imsg_event_add(&client->iev);
1224 	evtimer_set(&client->tmo, gotd_request_timeout, client);
1225 
1226 	return NULL;
1227 }
1228 
1229 static const struct got_error *
1230 recv_repo_child(struct imsg *imsg)
1231 {
1232 	struct gotd_imsg_connect_repo_child ichild;
1233 	struct gotd_session_client *client = &gotd_session_client;
1234 	size_t datalen;
1235 
1236 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1237 		return got_error(GOT_ERR_PRIVSEP_MSG);
1238 
1239 	/* We should already have received a pipe to the listener. */
1240 	if (client->fd == -1)
1241 		return got_error(GOT_ERR_PRIVSEP_MSG);
1242 
1243 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1244 	if (datalen != sizeof(ichild))
1245 		return got_error(GOT_ERR_PRIVSEP_LEN);
1246 
1247 	memcpy(&ichild, imsg->data, sizeof(ichild));
1248 
1249 	client->id = ichild.client_id;
1250 	if (ichild.proc_id == PROC_REPO_WRITE)
1251 		client->is_writing = 1;
1252 	else if (ichild.proc_id == PROC_REPO_READ)
1253 		client->is_writing = 0;
1254 	else
1255 		return got_error_msg(GOT_ERR_PRIVSEP_MSG,
1256 		    "bad child process type");
1257 		
1258 	if (imsg->fd == -1)
1259 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1260 
1261 	imsg_init(&client->repo_child_iev.ibuf, imsg->fd);
1262 	client->repo_child_iev.handler = session_dispatch_repo_child;
1263 	client->repo_child_iev.events = EV_READ;
1264 	client->repo_child_iev.handler_arg = NULL;
1265 	event_set(&client->repo_child_iev.ev, client->repo_child_iev.ibuf.fd,
1266 	    EV_READ, session_dispatch_repo_child, &client->repo_child_iev);
1267 	gotd_imsg_event_add(&client->repo_child_iev);
1268 
1269 	/* The "recvfd" pledge promise is no longer needed. */
1270 	if (pledge("stdio rpath wpath cpath sendfd fattr flock", NULL) == -1)
1271 		fatal("pledge");
1272 
1273 	return NULL;
1274 }
1275 
1276 static void
1277 session_dispatch(int fd, short event, void *arg)
1278 {
1279 	struct gotd_imsgev *iev = arg;
1280 	struct imsgbuf *ibuf = &iev->ibuf;
1281 	struct gotd_session_client *client = &gotd_session_client;
1282 	ssize_t n;
1283 	int shut = 0;
1284 	struct imsg imsg;
1285 
1286 	if (event & EV_READ) {
1287 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1288 			fatal("imsg_read error");
1289 		if (n == 0) {
1290 			/* Connection closed. */
1291 			shut = 1;
1292 			goto done;
1293 		}
1294 	}
1295 
1296 	if (event & EV_WRITE) {
1297 		n = msgbuf_write(&ibuf->w);
1298 		if (n == -1 && errno != EAGAIN)
1299 			fatal("msgbuf_write");
1300 		if (n == 0) {
1301 			/* Connection closed. */
1302 			shut = 1;
1303 			goto done;
1304 		}
1305 	}
1306 
1307 	for (;;) {
1308 		const struct got_error *err = NULL;
1309 		uint32_t client_id = 0;
1310 		int do_disconnect = 0, do_list_refs = 0;
1311 
1312 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1313 			fatal("%s: imsg_get error", __func__);
1314 		if (n == 0)	/* No more messages. */
1315 			break;
1316 
1317 		switch (imsg.hdr.type) {
1318 		case GOTD_IMSG_ERROR:
1319 			do_disconnect = 1;
1320 			err = gotd_imsg_recv_error(&client_id, &imsg);
1321 			break;
1322 		case GOTD_IMSG_CONNECT:
1323 			err = recv_connect(&imsg);
1324 			break;
1325 		case GOTD_IMSG_DISCONNECT:
1326 			do_disconnect = 1;
1327 			break;
1328 		case GOTD_IMSG_CONNECT_REPO_CHILD:
1329 			err = recv_repo_child(&imsg);
1330 			if (err)
1331 				break;
1332 			do_list_refs = 1;
1333 			break;
1334 		default:
1335 			log_debug("unexpected imsg %d", imsg.hdr.type);
1336 			break;
1337 		}
1338 		imsg_free(&imsg);
1339 
1340 		if (do_disconnect) {
1341 			if (err)
1342 				disconnect_on_error(client, err);
1343 			else
1344 				disconnect(client);
1345 		} else if (do_list_refs)
1346 			err = list_refs_request();
1347 
1348 		if (err)
1349 			log_warnx("uid %d: %s", client->euid, err->msg);
1350 	}
1351 done:
1352 	if (!shut) {
1353 		gotd_imsg_event_add(iev);
1354 	} else {
1355 		/* This pipe is dead. Remove its event handler */
1356 		event_del(&iev->ev);
1357 		event_loopexit(NULL);
1358 	}	
1359 }
1360 
1361 void
1362 session_main(const char *title, const char *repo_path,
1363     int *pack_fds, int *temp_fds, struct timeval *request_timeout)
1364 {
1365 	const struct got_error *err = NULL;
1366 	struct event evsigint, evsigterm, evsighup, evsigusr1;
1367 
1368 	gotd_session.title = title;
1369 	gotd_session.pid = getpid();
1370 	gotd_session.pack_fds = pack_fds;
1371 	gotd_session.temp_fds = temp_fds;
1372 	memcpy(&gotd_session.request_timeout, request_timeout,
1373 	    sizeof(gotd_session.request_timeout));
1374 
1375 	err = got_repo_open(&gotd_session.repo, repo_path, NULL, pack_fds);
1376 	if (err)
1377 		goto done;
1378 	if (!got_repo_is_bare(gotd_session.repo)) {
1379 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
1380 		    "bare git repository required");
1381 		goto done;
1382 	}
1383 
1384 	got_repo_temp_fds_set(gotd_session.repo, temp_fds);
1385 
1386 	signal_set(&evsigint, SIGINT, gotd_session_sighdlr, NULL);
1387 	signal_set(&evsigterm, SIGTERM, gotd_session_sighdlr, NULL);
1388 	signal_set(&evsighup, SIGHUP, gotd_session_sighdlr, NULL);
1389 	signal_set(&evsigusr1, SIGUSR1, gotd_session_sighdlr, NULL);
1390 	signal(SIGPIPE, SIG_IGN);
1391 
1392 	signal_add(&evsigint, NULL);
1393 	signal_add(&evsigterm, NULL);
1394 	signal_add(&evsighup, NULL);
1395 	signal_add(&evsigusr1, NULL);
1396 
1397 	gotd_session_client.state = GOTD_STATE_EXPECT_LIST_REFS;
1398 	gotd_session_client.fd = -1;
1399 	gotd_session_client.nref_updates = -1;
1400 	gotd_session_client.delta_cache_fd = -1;
1401 
1402 	imsg_init(&gotd_session.parent_iev.ibuf, GOTD_FILENO_MSG_PIPE);
1403 	gotd_session.parent_iev.handler = session_dispatch;
1404 	gotd_session.parent_iev.events = EV_READ;
1405 	gotd_session.parent_iev.handler_arg = NULL;
1406 	event_set(&gotd_session.parent_iev.ev, gotd_session.parent_iev.ibuf.fd,
1407 	    EV_READ, session_dispatch, &gotd_session.parent_iev);
1408 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
1409 	    GOTD_IMSG_CLIENT_SESSION_READY, PROC_SESSION, -1, NULL, 0) == -1) {
1410 		err = got_error_from_errno("imsg compose CLIENT_SESSION_READY");
1411 		goto done;
1412 	}
1413 
1414 	event_dispatch();
1415 done:
1416 	if (err)
1417 		log_warnx("%s: %s", title, err->msg);
1418 	gotd_session_shutdown();
1419 }
1420 
1421 void
1422 gotd_session_shutdown(void)
1423 {
1424 	log_debug("%s: shutting down", gotd_session.title);
1425 	if (gotd_session.repo)
1426 		got_repo_close(gotd_session.repo);
1427 	got_repo_pack_fds_close(gotd_session.pack_fds);
1428 	got_repo_temp_fds_close(gotd_session.temp_fds);
1429 	exit(0);
1430 }