op public repos

Blob

Date:: Sun Feb 12 14:10:01 2023 UTC
Message:: fix fallout; mostly struct got_object_id zeroing
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2022, 2023 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/queue.h>
19 #include <sys/tree.h>
20 #include <sys/socket.h>
21 #include <sys/stat.h>
22 #include <sys/uio.h>
23 
24 #include <errno.h>
25 #include <event.h>
26 #include <limits.h>
27 #include <sha1.h>
28 #include <sha2.h>
29 #include <signal.h>
30 #include <stdint.h>
31 #include <stdio.h>
32 #include <stdlib.h>
33 #include <string.h>
34 #include <imsg.h>
35 #include <unistd.h>
36 
37 #include "got_error.h"
38 #include "got_repository.h"
39 #include "got_object.h"
40 #include "got_path.h"
41 #include "got_reference.h"
42 #include "got_opentemp.h"
43 
44 #include "got_lib_hash.h"
45 #include "got_lib_delta.h"
46 #include "got_lib_object.h"
47 #include "got_lib_object_cache.h"
48 #include "got_lib_pack.h"
49 #include "got_lib_repository.h"
50 #include "got_lib_gitproto.h"
51 
52 #include "gotd.h"
53 #include "log.h"
54 #include "session.h"
55 
56 
57 static struct gotd_session {
58 	pid_t pid;
59 	const char *title;
60 	struct got_repository *repo;
61 	int *pack_fds;
62 	int *temp_fds;
63 	struct gotd_imsgev parent_iev;
64 	struct timeval request_timeout;
65 } gotd_session;
66 
67 static struct gotd_session_client {
68 	enum gotd_session_state		 state;
69 	int				 is_writing;
70 	struct gotd_client_capability	*capabilities;
71 	size_t				 ncapa_alloc;
72 	size_t				 ncapabilities;
73 	uint32_t			 id;
74 	int				 fd;
75 	int				 delta_cache_fd;
76 	struct gotd_imsgev		 iev;
77 	struct gotd_imsgev		 repo_child_iev;
78 	struct event			 tmo;
79 	uid_t				 euid;
80 	gid_t				 egid;
81 	char				*packfile_path;
82 	char				*packidx_path;
83 	int				 nref_updates;
84 	int				 accept_flush_pkt;
85 } gotd_session_client;
86 
87 void gotd_session_sighdlr(int sig, short event, void *arg);
88 static void gotd_session_shutdown(void);
89 
90 static void
91 disconnect(struct gotd_session_client *client)
92 {
93 	log_debug("uid %d: disconnecting", client->euid);
94 
95 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
96 	    GOTD_IMSG_DISCONNECT, PROC_SESSION, -1, NULL, 0) == -1)
97 		log_warn("imsg compose DISCONNECT");
98 
99 	imsg_clear(&client->repo_child_iev.ibuf);
100 	event_del(&client->repo_child_iev.ev);
101 	evtimer_del(&client->tmo);
102 	close(client->fd);
103 	if (client->delta_cache_fd != -1)
104 		close(client->delta_cache_fd);
105 	if (client->packfile_path) {
106 		if (unlink(client->packfile_path) == -1 && errno != ENOENT)
107 			log_warn("unlink %s: ", client->packfile_path);
108 		free(client->packfile_path);
109 	}
110 	if (client->packidx_path) {
111 		if (unlink(client->packidx_path) == -1 && errno != ENOENT)
112 			log_warn("unlink %s: ", client->packidx_path);
113 		free(client->packidx_path);
114 	}
115 	free(client->capabilities);
116 
117 	gotd_session_shutdown();
118 }
119 
120 static void
121 disconnect_on_error(struct gotd_session_client *client,
122     const struct got_error *err)
123 {
124 	struct imsgbuf ibuf;
125 
126 	log_warnx("uid %d: %s", client->euid, err->msg);
127 	if (err->code != GOT_ERR_EOF) {
128 		imsg_init(&ibuf, client->fd);
129 		gotd_imsg_send_error(&ibuf, 0, PROC_SESSION, err);
130 		imsg_clear(&ibuf);
131 	}
132 
133 	disconnect(client);
134 }
135 
136 static void
137 gotd_request_timeout(int fd, short events, void *arg)
138 {
139 	struct gotd_session_client *client = arg;
140 
141 	log_debug("disconnecting uid %d due to timeout", client->euid);
142 	disconnect(client);
143 }
144 
145 void
146 gotd_session_sighdlr(int sig, short event, void *arg)
147 {
148 	/*
149 	 * Normal signal handler rules don't apply because libevent
150 	 * decouples for us.
151 	 */
152 
153 	switch (sig) {
154 	case SIGHUP:
155 		log_info("%s: ignoring SIGHUP", __func__);
156 		break;
157 	case SIGUSR1:
158 		log_info("%s: ignoring SIGUSR1", __func__);
159 		break;
160 	case SIGTERM:
161 	case SIGINT:
162 		gotd_session_shutdown();
163 		/* NOTREACHED */
164 		break;
165 	default:
166 		fatalx("unexpected signal");
167 	}
168 }
169 
170 static const struct got_error *
171 recv_packfile_done(uint32_t *client_id, struct imsg *imsg)
172 {
173 	struct gotd_imsg_packfile_done idone;
174 	size_t datalen;
175 
176 	log_debug("packfile-done received");
177 
178 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
179 	if (datalen != sizeof(idone))
180 		return got_error(GOT_ERR_PRIVSEP_LEN);
181 	memcpy(&idone, imsg->data, sizeof(idone));
182 
183 	*client_id = idone.client_id;
184 	return NULL;
185 }
186 
187 static const struct got_error *
188 recv_packfile_install(uint32_t *client_id, struct imsg *imsg)
189 {
190 	struct gotd_imsg_packfile_install inst;
191 	size_t datalen;
192 
193 	log_debug("packfile-install received");
194 
195 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
196 	if (datalen != sizeof(inst))
197 		return got_error(GOT_ERR_PRIVSEP_LEN);
198 	memcpy(&inst, imsg->data, sizeof(inst));
199 
200 	*client_id = inst.client_id;
201 	return NULL;
202 }
203 
204 static const struct got_error *
205 recv_ref_updates_start(uint32_t *client_id, struct imsg *imsg)
206 {
207 	struct gotd_imsg_ref_updates_start istart;
208 	size_t datalen;
209 
210 	log_debug("ref-updates-start received");
211 
212 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
213 	if (datalen != sizeof(istart))
214 		return got_error(GOT_ERR_PRIVSEP_LEN);
215 	memcpy(&istart, imsg->data, sizeof(istart));
216 
217 	*client_id = istart.client_id;
218 	return NULL;
219 }
220 
221 static const struct got_error *
222 recv_ref_update(uint32_t *client_id, struct imsg *imsg)
223 {
224 	struct gotd_imsg_ref_update iref;
225 	size_t datalen;
226 
227 	log_debug("ref-update received");
228 
229 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
230 	if (datalen < sizeof(iref))
231 		return got_error(GOT_ERR_PRIVSEP_LEN);
232 	memcpy(&iref, imsg->data, sizeof(iref));
233 
234 	*client_id = iref.client_id;
235 	return NULL;
236 }
237 
238 static const struct got_error *
239 send_ref_update_ok(struct gotd_session_client *client,
240     struct gotd_imsg_ref_update *iref, const char *refname)
241 {
242 	struct gotd_imsg_ref_update_ok iok;
243 	struct gotd_imsgev *iev = &client->iev;
244 	struct ibuf *wbuf;
245 	size_t len;
246 
247 	memset(&iok, 0, sizeof(iok));
248 	iok.client_id = client->id;
249 	memcpy(iok.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
250 	memcpy(iok.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
251 	iok.name_len = strlen(refname);
252 
253 	len = sizeof(iok) + iok.name_len;
254 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE_OK,
255 	    PROC_SESSION, gotd_session.pid, len);
256 	if (wbuf == NULL)
257 		return got_error_from_errno("imsg_create REF_UPDATE_OK");
258 
259 	if (imsg_add(wbuf, &iok, sizeof(iok)) == -1)
260 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
261 	if (imsg_add(wbuf, refname, iok.name_len) == -1)
262 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
263 
264 	wbuf->fd = -1;
265 	imsg_close(&iev->ibuf, wbuf);
266 	gotd_imsg_event_add(iev);
267 	return NULL;
268 }
269 
270 static void
271 send_refs_updated(struct gotd_session_client *client)
272 {
273 	if (gotd_imsg_compose_event(&client->iev, GOTD_IMSG_REFS_UPDATED,
274 	    PROC_SESSION, -1, NULL, 0) == -1)
275 		log_warn("imsg compose REFS_UPDATED");
276 }
277 
278 static const struct got_error *
279 send_ref_update_ng(struct gotd_session_client *client,
280     struct gotd_imsg_ref_update *iref, const char *refname,
281     const char *reason)
282 {
283 	const struct got_error *ng_err;
284 	struct gotd_imsg_ref_update_ng ing;
285 	struct gotd_imsgev *iev = &client->iev;
286 	struct ibuf *wbuf;
287 	size_t len;
288 
289 	memset(&ing, 0, sizeof(ing));
290 	ing.client_id = client->id;
291 	memcpy(ing.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
292 	memcpy(ing.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
293 	ing.name_len = strlen(refname);
294 
295 	ng_err = got_error_fmt(GOT_ERR_REF_BUSY, "%s", reason);
296 	ing.reason_len = strlen(ng_err->msg);
297 
298 	len = sizeof(ing) + ing.name_len + ing.reason_len;
299 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE_NG,
300 	    PROC_SESSION, gotd_session.pid, len);
301 	if (wbuf == NULL)
302 		return got_error_from_errno("imsg_create REF_UPDATE_NG");
303 
304 	if (imsg_add(wbuf, &ing, sizeof(ing)) == -1)
305 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
306 	if (imsg_add(wbuf, refname, ing.name_len) == -1)
307 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
308 	if (imsg_add(wbuf, ng_err->msg, ing.reason_len) == -1)
309 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
310 
311 	wbuf->fd = -1;
312 	imsg_close(&iev->ibuf, wbuf);
313 	gotd_imsg_event_add(iev);
314 	return NULL;
315 }
316 
317 static const struct got_error *
318 install_pack(struct gotd_session_client *client, const char *repo_path,
319     struct imsg *imsg)
320 {
321 	const struct got_error *err = NULL;
322 	struct gotd_imsg_packfile_install inst;
323 	char hex[SHA1_DIGEST_STRING_LENGTH];
324 	size_t datalen;
325 	char *packfile_path = NULL, *packidx_path = NULL;
326 
327 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
328 	if (datalen != sizeof(inst))
329 		return got_error(GOT_ERR_PRIVSEP_LEN);
330 	memcpy(&inst, imsg->data, sizeof(inst));
331 
332 	if (client->packfile_path == NULL)
333 		return got_error_msg(GOT_ERR_BAD_REQUEST,
334 		    "client has no pack file");
335 	if (client->packidx_path == NULL)
336 		return got_error_msg(GOT_ERR_BAD_REQUEST,
337 		    "client has no pack file index");
338 
339 	if (got_sha1_digest_to_str(inst.pack_sha1, hex, sizeof(hex)) == NULL)
340 		return got_error_msg(GOT_ERR_NO_SPACE,
341 		    "could not convert pack file SHA1 to hex");
342 
343 	if (asprintf(&packfile_path, "/%s/%s/pack-%s.pack",
344 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
345 		err = got_error_from_errno("asprintf");
346 		goto done;
347 	}
348 
349 	if (asprintf(&packidx_path, "/%s/%s/pack-%s.idx",
350 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
351 		err = got_error_from_errno("asprintf");
352 		goto done;
353 	}
354 
355 	if (rename(client->packfile_path, packfile_path) == -1) {
356 		err = got_error_from_errno3("rename", client->packfile_path,
357 		    packfile_path);
358 		goto done;
359 	}
360 
361 	free(client->packfile_path);
362 	client->packfile_path = NULL;
363 
364 	if (rename(client->packidx_path, packidx_path) == -1) {
365 		err = got_error_from_errno3("rename", client->packidx_path,
366 		    packidx_path);
367 		goto done;
368 	}
369 
370 	free(client->packidx_path);
371 	client->packidx_path = NULL;
372 done:
373 	free(packfile_path);
374 	free(packidx_path);
375 	return err;
376 }
377 
378 static const struct got_error *
379 begin_ref_updates(struct gotd_session_client *client, struct imsg *imsg)
380 {
381 	struct gotd_imsg_ref_updates_start istart;
382 	size_t datalen;
383 
384 	if (client->nref_updates != -1)
385 		return got_error(GOT_ERR_PRIVSEP_MSG);
386 
387 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
388 	if (datalen != sizeof(istart))
389 		return got_error(GOT_ERR_PRIVSEP_LEN);
390 	memcpy(&istart, imsg->data, sizeof(istart));
391 
392 	if (istart.nref_updates <= 0)
393 		return got_error(GOT_ERR_PRIVSEP_MSG);
394 
395 	client->nref_updates = istart.nref_updates;
396 	return NULL;
397 }
398 
399 static const struct got_error *
400 update_ref(int *shut, struct gotd_session_client *client,
401     const char *repo_path, struct imsg *imsg)
402 {
403 	const struct got_error *err = NULL;
404 	struct got_repository *repo = NULL;
405 	struct got_reference *ref = NULL;
406 	struct gotd_imsg_ref_update iref;
407 	struct got_object_id old_id, new_id;
408 	struct got_object_id *id = NULL;
409 	struct got_object *obj = NULL;
410 	char *refname = NULL;
411 	size_t datalen;
412 	int locked = 0;
413 
414 	log_debug("update-ref from uid %d", client->euid);
415 
416 	if (client->nref_updates <= 0)
417 		return got_error(GOT_ERR_PRIVSEP_MSG);
418 
419 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
420 	if (datalen < sizeof(iref))
421 		return got_error(GOT_ERR_PRIVSEP_LEN);
422 	memcpy(&iref, imsg->data, sizeof(iref));
423 	if (datalen != sizeof(iref) + iref.name_len)
424 		return got_error(GOT_ERR_PRIVSEP_LEN);
425 	refname = strndup(imsg->data + sizeof(iref), iref.name_len);
426 	if (refname == NULL)
427 		return got_error_from_errno("strndup");
428 
429 	log_debug("updating ref %s for uid %d", refname, client->euid);
430 
431 	err = got_repo_open(&repo, repo_path, NULL, NULL);
432 	if (err)
433 		goto done;
434 
435 	memset(&old_id, 0, sizeof(old_id));
436 	memcpy(old_id.hash, iref.old_id, SHA1_DIGEST_LENGTH);
437 	memset(&new_id, 0, sizeof(new_id));
438 	memcpy(new_id.hash, iref.new_id, SHA1_DIGEST_LENGTH);
439 	err = got_object_open(&obj, repo,
440 	    iref.delete_ref ? &old_id : &new_id);
441 	if (err)
442 		goto done;
443 
444 	if (iref.ref_is_new) {
445 		err = got_ref_open(&ref, repo, refname, 0);
446 		if (err) {
447 			if (err->code != GOT_ERR_NOT_REF)
448 				goto done;
449 			err = got_ref_alloc(&ref, refname, &new_id);
450 			if (err)
451 				goto done;
452 			err = got_ref_write(ref, repo); /* will lock/unlock */
453 			if (err)
454 				goto done;
455 		} else {
456 			err = got_error_fmt(GOT_ERR_REF_BUSY,
457 			    "%s has been created by someone else "
458 			    "while transaction was in progress",
459 			    got_ref_get_name(ref));
460 			goto done;
461 		}
462 	} else if (iref.delete_ref) {
463 		err = got_ref_open(&ref, repo, refname, 1 /* lock */);
464 		if (err)
465 			goto done;
466 		locked = 1;
467 
468 		err = got_ref_resolve(&id, repo, ref);
469 		if (err)
470 			goto done;
471 
472 		if (got_object_id_cmp(id, &old_id) != 0) {
473 			err = got_error_fmt(GOT_ERR_REF_BUSY,
474 			    "%s has been modified by someone else "
475 			    "while transaction was in progress",
476 			    got_ref_get_name(ref));
477 			goto done;
478 		}
479 
480 		err = got_ref_delete(ref, repo);
481 		if (err)
482 			goto done;
483 
484 		free(id);
485 		id = NULL;
486 	} else {
487 		err = got_ref_open(&ref, repo, refname, 1 /* lock */);
488 		if (err)
489 			goto done;
490 		locked = 1;
491 
492 		err = got_ref_resolve(&id, repo, ref);
493 		if (err)
494 			goto done;
495 
496 		if (got_object_id_cmp(id, &old_id) != 0) {
497 			err = got_error_fmt(GOT_ERR_REF_BUSY,
498 			    "%s has been modified by someone else "
499 			    "while transaction was in progress",
500 			    got_ref_get_name(ref));
501 			goto done;
502 		}
503 
504 		err = got_ref_change_ref(ref, &new_id);
505 		if (err)
506 			goto done;
507 
508 		err = got_ref_write(ref, repo);
509 		if (err)
510 			goto done;
511 
512 		free(id);
513 		id = NULL;
514 	}
515 done:
516 	if (err) {
517 		if (err->code == GOT_ERR_LOCKFILE_TIMEOUT) {
518 			err = got_error_fmt(GOT_ERR_LOCKFILE_TIMEOUT,
519 			    "could not acquire exclusive file lock for %s",
520 			    refname);
521 		}
522 		send_ref_update_ng(client, &iref, refname, err->msg);
523 	} else
524 		send_ref_update_ok(client, &iref, refname);
525 
526 	if (client->nref_updates > 0) {
527 		client->nref_updates--;
528 		if (client->nref_updates == 0) {
529 			send_refs_updated(client);
530 			*shut = 1;
531 		}
532 
533 	}
534 	if (locked) {
535 		const struct got_error *unlock_err;
536 		unlock_err = got_ref_unlock(ref);
537 		if (unlock_err && err == NULL)
538 			err = unlock_err;
539 	}
540 	if (ref)
541 		got_ref_close(ref);
542 	if (obj)
543 		got_object_close(obj);
544 	if (repo)
545 		got_repo_close(repo);
546 	free(refname);
547 	free(id);
548 	return err;
549 }
550 
551 static void
552 session_dispatch_repo_child(int fd, short event, void *arg)
553 {
554 	struct gotd_imsgev *iev = arg;
555 	struct imsgbuf *ibuf = &iev->ibuf;
556 	struct gotd_session_client *client = &gotd_session_client;
557 	ssize_t n;
558 	int shut = 0;
559 	struct imsg imsg;
560 
561 	if (event & EV_READ) {
562 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
563 			fatal("imsg_read error");
564 		if (n == 0) {
565 			/* Connection closed. */
566 			shut = 1;
567 			goto done;
568 		}
569 	}
570 
571 	if (event & EV_WRITE) {
572 		n = msgbuf_write(&ibuf->w);
573 		if (n == -1 && errno != EAGAIN)
574 			fatal("msgbuf_write");
575 		if (n == 0) {
576 			/* Connection closed. */
577 			shut = 1;
578 			goto done;
579 		}
580 	}
581 
582 	for (;;) {
583 		const struct got_error *err = NULL;
584 		uint32_t client_id = 0;
585 		int do_disconnect = 0;
586 		int do_ref_updates = 0, do_ref_update = 0;
587 		int do_packfile_install = 0;
588 
589 		if ((n = imsg_get(ibuf, &imsg)) == -1)
590 			fatal("%s: imsg_get error", __func__);
591 		if (n == 0)	/* No more messages. */
592 			break;
593 
594 		switch (imsg.hdr.type) {
595 		case GOTD_IMSG_ERROR:
596 			do_disconnect = 1;
597 			err = gotd_imsg_recv_error(&client_id, &imsg);
598 			break;
599 		case GOTD_IMSG_PACKFILE_DONE:
600 			do_disconnect = 1;
601 			err = recv_packfile_done(&client_id, &imsg);
602 			break;
603 		case GOTD_IMSG_PACKFILE_INSTALL:
604 			err = recv_packfile_install(&client_id, &imsg);
605 			if (err == NULL)
606 				do_packfile_install = 1;
607 			break;
608 		case GOTD_IMSG_REF_UPDATES_START:
609 			err = recv_ref_updates_start(&client_id, &imsg);
610 			if (err == NULL)
611 				do_ref_updates = 1;
612 			break;
613 		case GOTD_IMSG_REF_UPDATE:
614 			err = recv_ref_update(&client_id, &imsg);
615 			if (err == NULL)
616 				do_ref_update = 1;
617 			break;
618 		default:
619 			log_debug("unexpected imsg %d", imsg.hdr.type);
620 			break;
621 		}
622 
623 		if (do_disconnect) {
624 			if (err)
625 				disconnect_on_error(client, err);
626 			else
627 				disconnect(client);
628 		} else {
629 			if (do_packfile_install)
630 				err = install_pack(client,
631 				    gotd_session.repo->path, &imsg);
632 			else if (do_ref_updates)
633 				err = begin_ref_updates(client, &imsg);
634 			else if (do_ref_update)
635 				err = update_ref(&shut, client,
636 				    gotd_session.repo->path, &imsg);
637 			if (err)
638 				log_warnx("uid %d: %s", client->euid, err->msg);
639 		}
640 		imsg_free(&imsg);
641 	}
642 done:
643 	if (!shut) {
644 		gotd_imsg_event_add(iev);
645 	} else {
646 		/* This pipe is dead. Remove its event handler */
647 		event_del(&iev->ev);
648 		event_loopexit(NULL);
649 	}
650 }
651 
652 static const struct got_error *
653 recv_capabilities(struct gotd_session_client *client, struct imsg *imsg)
654 {
655 	struct gotd_imsg_capabilities icapas;
656 	size_t datalen;
657 
658 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
659 	if (datalen != sizeof(icapas))
660 		return got_error(GOT_ERR_PRIVSEP_LEN);
661 	memcpy(&icapas, imsg->data, sizeof(icapas));
662 
663 	client->ncapa_alloc = icapas.ncapabilities;
664 	client->capabilities = calloc(client->ncapa_alloc,
665 	    sizeof(*client->capabilities));
666 	if (client->capabilities == NULL) {
667 		client->ncapa_alloc = 0;
668 		return got_error_from_errno("calloc");
669 	}
670 
671 	log_debug("expecting %zu capabilities from uid %d",
672 	    client->ncapa_alloc, client->euid);
673 	return NULL;
674 }
675 
676 static const struct got_error *
677 recv_capability(struct gotd_session_client *client, struct imsg *imsg)
678 {
679 	struct gotd_imsg_capability icapa;
680 	struct gotd_client_capability *capa;
681 	size_t datalen;
682 	char *key, *value = NULL;
683 
684 	if (client->capabilities == NULL ||
685 	    client->ncapabilities >= client->ncapa_alloc) {
686 		return got_error_msg(GOT_ERR_BAD_REQUEST,
687 		    "unexpected capability received");
688 	}
689 
690 	memset(&icapa, 0, sizeof(icapa));
691 
692 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
693 	if (datalen < sizeof(icapa))
694 		return got_error(GOT_ERR_PRIVSEP_LEN);
695 	memcpy(&icapa, imsg->data, sizeof(icapa));
696 
697 	if (datalen != sizeof(icapa) + icapa.key_len + icapa.value_len)
698 		return got_error(GOT_ERR_PRIVSEP_LEN);
699 
700 	key = strndup(imsg->data + sizeof(icapa), icapa.key_len);
701 	if (key == NULL)
702 		return got_error_from_errno("strndup");
703 	if (icapa.value_len > 0) {
704 		value = strndup(imsg->data + sizeof(icapa) + icapa.key_len,
705 		    icapa.value_len);
706 		if (value == NULL) {
707 			free(key);
708 			return got_error_from_errno("strndup");
709 		}
710 	}
711 
712 	capa = &client->capabilities[client->ncapabilities++];
713 	capa->key = key;
714 	capa->value = value;
715 
716 	if (value)
717 		log_debug("uid %d: capability %s=%s", client->euid, key, value);
718 	else
719 		log_debug("uid %d: capability %s", client->euid, key);
720 
721 	return NULL;
722 }
723 
724 static const struct got_error *
725 ensure_client_is_reading(struct gotd_session_client *client)
726 {
727 	if (client->is_writing) {
728 		return got_error_fmt(GOT_ERR_BAD_PACKET,
729 		    "uid %d made a read-request but is not reading from "
730 		    "a repository", client->euid);
731 	}
732 
733 	return NULL;
734 }
735 
736 static const struct got_error *
737 ensure_client_is_writing(struct gotd_session_client *client)
738 {
739 	if (!client->is_writing) {
740 		return got_error_fmt(GOT_ERR_BAD_PACKET,
741 		    "uid %d made a write-request but is not writing to "
742 		    "a repository", client->euid);
743 	}
744 
745 	return NULL;
746 }
747 
748 static const struct got_error *
749 forward_want(struct gotd_session_client *client, struct imsg *imsg)
750 {
751 	struct gotd_imsg_want ireq;
752 	struct gotd_imsg_want iwant;
753 	size_t datalen;
754 
755 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
756 	if (datalen != sizeof(ireq))
757 		return got_error(GOT_ERR_PRIVSEP_LEN);
758 
759 	memcpy(&ireq, imsg->data, datalen);
760 
761 	memset(&iwant, 0, sizeof(iwant));
762 	memcpy(iwant.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
763 	iwant.client_id = client->id;
764 
765 	if (gotd_imsg_compose_event(&client->repo_child_iev, GOTD_IMSG_WANT,
766 	    PROC_SESSION, -1, &iwant, sizeof(iwant)) == -1)
767 		return got_error_from_errno("imsg compose WANT");
768 
769 	return NULL;
770 }
771 
772 static const struct got_error *
773 forward_ref_update(struct gotd_session_client *client, struct imsg *imsg)
774 {
775 	const struct got_error *err = NULL;
776 	struct gotd_imsg_ref_update ireq;
777 	struct gotd_imsg_ref_update *iref = NULL;
778 	size_t datalen;
779 
780 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
781 	if (datalen < sizeof(ireq))
782 		return got_error(GOT_ERR_PRIVSEP_LEN);
783 	memcpy(&ireq, imsg->data, sizeof(ireq));
784 	if (datalen != sizeof(ireq) + ireq.name_len)
785 		return got_error(GOT_ERR_PRIVSEP_LEN);
786 
787 	iref = malloc(datalen);
788 	if (iref == NULL)
789 		return got_error_from_errno("malloc");
790 	memcpy(iref, imsg->data, datalen);
791 
792 	iref->client_id = client->id;
793 	if (gotd_imsg_compose_event(&client->repo_child_iev,
794 	    GOTD_IMSG_REF_UPDATE, PROC_SESSION, -1, iref, datalen) == -1)
795 		err = got_error_from_errno("imsg compose REF_UPDATE");
796 	free(iref);
797 	return err;
798 }
799 
800 static const struct got_error *
801 forward_have(struct gotd_session_client *client, struct imsg *imsg)
802 {
803 	struct gotd_imsg_have ireq;
804 	struct gotd_imsg_have ihave;
805 	size_t datalen;
806 
807 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
808 	if (datalen != sizeof(ireq))
809 		return got_error(GOT_ERR_PRIVSEP_LEN);
810 
811 	memcpy(&ireq, imsg->data, datalen);
812 
813 	memset(&ihave, 0, sizeof(ihave));
814 	memcpy(ihave.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
815 	ihave.client_id = client->id;
816 
817 	if (gotd_imsg_compose_event(&client->repo_child_iev, GOTD_IMSG_HAVE,
818 	    PROC_SESSION, -1, &ihave, sizeof(ihave)) == -1)
819 		return got_error_from_errno("imsg compose HAVE");
820 
821 	return NULL;
822 }
823 
824 static int
825 client_has_capability(struct gotd_session_client *client, const char *capastr)
826 {
827 	struct gotd_client_capability *capa;
828 	size_t i;
829 
830 	if (client->ncapabilities == 0)
831 		return 0;
832 
833 	for (i = 0; i < client->ncapabilities; i++) {
834 		capa = &client->capabilities[i];
835 		if (strcmp(capa->key, capastr) == 0)
836 			return 1;
837 	}
838 
839 	return 0;
840 }
841 
842 static const struct got_error *
843 recv_packfile(struct gotd_session_client *client)
844 {
845 	const struct got_error *err = NULL;
846 	struct gotd_imsg_recv_packfile ipack;
847 	struct gotd_imsg_packfile_pipe ipipe;
848 	struct gotd_imsg_packidx_file ifile;
849 	char *basepath = NULL, *pack_path = NULL, *idx_path = NULL;
850 	int packfd = -1, idxfd = -1;
851 	int pipe[2] = { -1, -1 };
852 
853 	if (client->packfile_path) {
854 		return got_error_fmt(GOT_ERR_PRIVSEP_MSG,
855 		    "uid %d already has a pack file", client->euid);
856 	}
857 
858 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
859 		return got_error_from_errno("socketpair");
860 
861 	memset(&ipipe, 0, sizeof(ipipe));
862 	ipipe.client_id = client->id;
863 
864 	/* Send pack pipe end 0 to repo child process. */
865 	if (gotd_imsg_compose_event(&client->repo_child_iev,
866 	    GOTD_IMSG_PACKFILE_PIPE, PROC_SESSION, pipe[0],
867 	        &ipipe, sizeof(ipipe)) == -1) {
868 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
869 		pipe[0] = -1;
870 		goto done;
871 	}
872 	pipe[0] = -1;
873 
874 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
875 	if (gotd_imsg_compose_event(&client->iev,
876 	    GOTD_IMSG_PACKFILE_PIPE, PROC_SESSION, pipe[1], NULL, 0) == -1)
877 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
878 	pipe[1] = -1;
879 
880 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.pack",
881 	    got_repo_get_path(gotd_session.repo), GOT_OBJECTS_PACK_DIR,
882 	    client->euid) == -1) {
883 		err = got_error_from_errno("asprintf");
884 		goto done;
885 	}
886 
887 	err = got_opentemp_named_fd(&pack_path, &packfd, basepath, "");
888 	if (err)
889 		goto done;
890 	if (fchmod(packfd, GOT_DEFAULT_PACK_MODE) == -1) {
891 		err = got_error_from_errno2("fchmod", pack_path);
892 		goto done;
893 	}
894 
895 	free(basepath);
896 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.idx",
897 	    got_repo_get_path(gotd_session.repo), GOT_OBJECTS_PACK_DIR,
898 	    client->euid) == -1) {
899 		err = got_error_from_errno("asprintf");
900 		basepath = NULL;
901 		goto done;
902 	}
903 	err = got_opentemp_named_fd(&idx_path, &idxfd, basepath, "");
904 	if (err)
905 		goto done;
906 	if (fchmod(idxfd, GOT_DEFAULT_PACK_MODE) == -1) {
907 		err = got_error_from_errno2("fchmod", idx_path);
908 		goto done;
909 	}
910 
911 	memset(&ifile, 0, sizeof(ifile));
912 	ifile.client_id = client->id;
913 	if (gotd_imsg_compose_event(&client->repo_child_iev,
914 	    GOTD_IMSG_PACKIDX_FILE, PROC_SESSION,
915 	    idxfd, &ifile, sizeof(ifile)) == -1) {
916 		err = got_error_from_errno("imsg compose PACKIDX_FILE");
917 		idxfd = -1;
918 		goto done;
919 	}
920 	idxfd = -1;
921 
922 	memset(&ipack, 0, sizeof(ipack));
923 	ipack.client_id = client->id;
924 	if (client_has_capability(client, GOT_CAPA_REPORT_STATUS))
925 		ipack.report_status = 1;
926 
927 	if (gotd_imsg_compose_event(&client->repo_child_iev,
928 	    GOTD_IMSG_RECV_PACKFILE, PROC_SESSION, packfd,
929 	    &ipack, sizeof(ipack)) == -1) {
930 		err = got_error_from_errno("imsg compose RECV_PACKFILE");
931 		packfd = -1;
932 		goto done;
933 	}
934 	packfd = -1;
935 
936 done:
937 	free(basepath);
938 	if (pipe[0] != -1 && close(pipe[0]) == -1 && err == NULL)
939 		err = got_error_from_errno("close");
940 	if (pipe[1] != -1 && close(pipe[1]) == -1 && err == NULL)
941 		err = got_error_from_errno("close");
942 	if (packfd != -1 && close(packfd) == -1 && err == NULL)
943 		err = got_error_from_errno("close");
944 	if (idxfd != -1 && close(idxfd) == -1 && err == NULL)
945 		err = got_error_from_errno("close");
946 	if (err) {
947 		free(pack_path);
948 		free(idx_path);
949 	} else {
950 		client->packfile_path = pack_path;
951 		client->packidx_path = idx_path;
952 	}
953 	return err;
954 }
955 
956 static const struct got_error *
957 send_packfile(struct gotd_session_client *client)
958 {
959 	const struct got_error *err = NULL;
960 	struct gotd_imsg_send_packfile ipack;
961 	struct gotd_imsg_packfile_pipe ipipe;
962 	int pipe[2];
963 
964 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
965 		return got_error_from_errno("socketpair");
966 
967 	memset(&ipack, 0, sizeof(ipack));
968 	memset(&ipipe, 0, sizeof(ipipe));
969 
970 	ipack.client_id = client->id;
971 	if (client_has_capability(client, GOT_CAPA_SIDE_BAND_64K))
972 		ipack.report_progress = 1;
973 
974 	client->delta_cache_fd = got_opentempfd();
975 	if (client->delta_cache_fd == -1)
976 		return got_error_from_errno("got_opentempfd");
977 
978 	if (gotd_imsg_compose_event(&client->repo_child_iev,
979 	    GOTD_IMSG_SEND_PACKFILE, PROC_GOTD, client->delta_cache_fd,
980 	    &ipack, sizeof(ipack)) == -1) {
981 		err = got_error_from_errno("imsg compose SEND_PACKFILE");
982 		close(pipe[0]);
983 		close(pipe[1]);
984 		return err;
985 	}
986 
987 	ipipe.client_id = client->id;
988 
989 	/* Send pack pipe end 0 to repo child process. */
990 	if (gotd_imsg_compose_event(&client->repo_child_iev,
991 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD,
992 	    pipe[0], &ipipe, sizeof(ipipe)) == -1) {
993 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
994 		close(pipe[1]);
995 		return err;
996 	}
997 
998 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
999 	if (gotd_imsg_compose_event(&client->iev,
1000 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD, pipe[1], NULL, 0) == -1)
1001 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
1002 
1003 	return err;
1004 }
1005 
1006 static void
1007 session_dispatch_client(int fd, short events, void *arg)
1008 {
1009 	struct gotd_imsgev *iev = arg;
1010 	struct imsgbuf *ibuf = &iev->ibuf;
1011 	struct gotd_session_client *client = &gotd_session_client;
1012 	const struct got_error *err = NULL;
1013 	struct imsg imsg;
1014 	ssize_t n;
1015 
1016 	if (events & EV_WRITE) {
1017 		while (ibuf->w.queued) {
1018 			n = msgbuf_write(&ibuf->w);
1019 			if (n == -1 && errno == EPIPE) {
1020 				/*
1021 				 * The client has closed its socket.
1022 				 * This can happen when Git clients are
1023 				 * done sending pack file data.
1024 				 */
1025 				msgbuf_clear(&ibuf->w);
1026 				continue;
1027 			} else if (n == -1 && errno != EAGAIN) {
1028 				err = got_error_from_errno("imsg_flush");
1029 				disconnect_on_error(client, err);
1030 				return;
1031 			}
1032 			if (n == 0) {
1033 				/* Connection closed. */
1034 				err = got_error(GOT_ERR_EOF);
1035 				disconnect_on_error(client, err);
1036 				return;
1037 			}
1038 		}
1039 	}
1040 
1041 	if ((events & EV_READ) == 0)
1042 		return;
1043 
1044 	memset(&imsg, 0, sizeof(imsg));
1045 
1046 	while (err == NULL) {
1047 		err = gotd_imsg_recv(&imsg, ibuf, 0);
1048 		if (err) {
1049 			if (err->code == GOT_ERR_PRIVSEP_READ)
1050 				err = NULL;
1051 			break;
1052 		}
1053 
1054 		evtimer_del(&client->tmo);
1055 
1056 		switch (imsg.hdr.type) {
1057 		case GOTD_IMSG_CAPABILITIES:
1058 			if (client->state != GOTD_STATE_EXPECT_CAPABILITIES) {
1059 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1060 				    "unexpected capabilities received");
1061 				break;
1062 			}
1063 			log_debug("receiving capabilities from uid %d",
1064 			    client->euid);
1065 			err = recv_capabilities(client, &imsg);
1066 			break;
1067 		case GOTD_IMSG_CAPABILITY:
1068 			if (client->state != GOTD_STATE_EXPECT_CAPABILITIES) {
1069 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1070 				    "unexpected capability received");
1071 				break;
1072 			}
1073 			err = recv_capability(client, &imsg);
1074 			if (err || client->ncapabilities < client->ncapa_alloc)
1075 				break;
1076 			if (!client->is_writing) {
1077 				client->state = GOTD_STATE_EXPECT_WANT;
1078 				client->accept_flush_pkt = 1;
1079 				log_debug("uid %d: expecting want-lines",
1080 				    client->euid);
1081 			} else if (client->is_writing) {
1082 				client->state = GOTD_STATE_EXPECT_REF_UPDATE;
1083 				client->accept_flush_pkt = 1;
1084 				log_debug("uid %d: expecting ref-update-lines",
1085 				    client->euid);
1086 			} else
1087 				fatalx("client %d is both reading and writing",
1088 				    client->euid);
1089 			break;
1090 		case GOTD_IMSG_WANT:
1091 			if (client->state != GOTD_STATE_EXPECT_WANT) {
1092 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1093 				    "unexpected want-line received");
1094 				break;
1095 			}
1096 			log_debug("received want-line from uid %d",
1097 			    client->euid);
1098 			err = ensure_client_is_reading(client);
1099 			if (err)
1100 				break;
1101 			client->accept_flush_pkt = 1;
1102 			err = forward_want(client, &imsg);
1103 			break;
1104 		case GOTD_IMSG_REF_UPDATE:
1105 			if (client->state != GOTD_STATE_EXPECT_REF_UPDATE &&
1106 			    client->state !=
1107 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1108 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1109 				    "unexpected ref-update-line received");
1110 				break;
1111 			}
1112 			log_debug("received ref-update-line from uid %d",
1113 			    client->euid);
1114 			err = ensure_client_is_writing(client);
1115 			if (err)
1116 				break;
1117 			err = forward_ref_update(client, &imsg);
1118 			if (err)
1119 				break;
1120 			client->state = GOTD_STATE_EXPECT_MORE_REF_UPDATES;
1121 			client->accept_flush_pkt = 1;
1122 			break;
1123 		case GOTD_IMSG_HAVE:
1124 			if (client->state != GOTD_STATE_EXPECT_HAVE) {
1125 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1126 				    "unexpected have-line received");
1127 				break;
1128 			}
1129 			log_debug("received have-line from uid %d",
1130 			    client->euid);
1131 			err = ensure_client_is_reading(client);
1132 			if (err)
1133 				break;
1134 			err = forward_have(client, &imsg);
1135 			if (err)
1136 				break;
1137 			client->accept_flush_pkt = 1;
1138 			break;
1139 		case GOTD_IMSG_FLUSH:
1140 			if (client->state == GOTD_STATE_EXPECT_WANT ||
1141 			    client->state == GOTD_STATE_EXPECT_HAVE) {
1142 				err = ensure_client_is_reading(client);
1143 				if (err)
1144 					break;
1145 			} else if (client->state ==
1146 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1147 				err = ensure_client_is_writing(client);
1148 				if (err)
1149 					break;
1150 			} else if (client->state != GOTD_STATE_EXPECT_DONE) {
1151 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1152 				    "unexpected flush-pkt received");
1153 				break;
1154 			}
1155 			if (!client->accept_flush_pkt) {
1156 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1157 				    "unexpected flush-pkt received");
1158 				break;
1159 			}
1160 
1161 			/*
1162 			 * Accept just one flush packet at a time.
1163 			 * Future client state transitions will set this flag
1164 			 * again if another flush packet is expected.
1165 			 */
1166 			client->accept_flush_pkt = 0;
1167 
1168 			log_debug("received flush-pkt from uid %d",
1169 			    client->euid);
1170 			if (client->state == GOTD_STATE_EXPECT_WANT) {
1171 				client->state = GOTD_STATE_EXPECT_HAVE;
1172 				log_debug("uid %d: expecting have-lines",
1173 				    client->euid);
1174 			} else if (client->state == GOTD_STATE_EXPECT_HAVE) {
1175 				client->state = GOTD_STATE_EXPECT_DONE;
1176 				client->accept_flush_pkt = 1;
1177 				log_debug("uid %d: expecting 'done'",
1178 				    client->euid);
1179 			} else if (client->state ==
1180 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1181 				client->state = GOTD_STATE_EXPECT_PACKFILE;
1182 				log_debug("uid %d: expecting packfile",
1183 				    client->euid);
1184 				err = recv_packfile(client);
1185 			} else if (client->state != GOTD_STATE_EXPECT_DONE) {
1186 				/* should not happen, see above */
1187 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1188 				    "unexpected client state");
1189 				break;
1190 			}
1191 			break;
1192 		case GOTD_IMSG_DONE:
1193 			if (client->state != GOTD_STATE_EXPECT_HAVE &&
1194 			    client->state != GOTD_STATE_EXPECT_DONE) {
1195 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1196 				    "unexpected flush-pkt received");
1197 				break;
1198 			}
1199 			log_debug("received 'done' from uid %d", client->euid);
1200 			err = ensure_client_is_reading(client);
1201 			if (err)
1202 				break;
1203 			client->state = GOTD_STATE_DONE;
1204 			client->accept_flush_pkt = 1;
1205 			err = send_packfile(client);
1206 			break;
1207 		default:
1208 			log_debug("unexpected imsg %d", imsg.hdr.type);
1209 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1210 			break;
1211 		}
1212 
1213 		imsg_free(&imsg);
1214 	}
1215 
1216 	if (err) {
1217 		if (err->code != GOT_ERR_EOF ||
1218 		    client->state != GOTD_STATE_EXPECT_PACKFILE)
1219 			disconnect_on_error(client, err);
1220 	} else {
1221 		gotd_imsg_event_add(iev);
1222 		evtimer_add(&client->tmo, &gotd_session.request_timeout);
1223 	}
1224 }
1225 
1226 static const struct got_error *
1227 list_refs_request(void)
1228 {
1229 	static const struct got_error *err;
1230 	struct gotd_session_client *client = &gotd_session_client;
1231 	struct gotd_imsgev *iev = &client->repo_child_iev;
1232 	struct gotd_imsg_list_refs_internal ilref;
1233 	int fd;
1234 
1235 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1236 		return got_error(GOT_ERR_PRIVSEP_MSG);
1237 
1238 	memset(&ilref, 0, sizeof(ilref));
1239 	ilref.client_id = client->id;
1240 
1241 	fd = dup(client->fd);
1242 	if (fd == -1)
1243 		return got_error_from_errno("dup");
1244 
1245 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_LIST_REFS_INTERNAL,
1246 	    PROC_SESSION, fd, &ilref, sizeof(ilref)) == -1) {
1247 		err = got_error_from_errno("imsg compose LIST_REFS_INTERNAL");
1248 		close(fd);
1249 		return err;
1250 	}
1251 
1252 	client->state = GOTD_STATE_EXPECT_CAPABILITIES;
1253 	log_debug("uid %d: expecting capabilities", client->euid);
1254 	return NULL;
1255 }
1256 
1257 static const struct got_error *
1258 recv_connect(struct imsg *imsg)
1259 {
1260 	struct gotd_session_client *client = &gotd_session_client;
1261 	struct gotd_imsg_connect iconnect;
1262 	size_t datalen;
1263 
1264 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1265 		return got_error(GOT_ERR_PRIVSEP_MSG);
1266 
1267 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1268 	if (datalen != sizeof(iconnect))
1269 		return got_error(GOT_ERR_PRIVSEP_LEN);
1270 	memcpy(&iconnect, imsg->data, sizeof(iconnect));
1271 
1272 	if (imsg->fd == -1)
1273 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1274 
1275 	client->fd = imsg->fd;
1276 	client->euid = iconnect.euid;
1277 	client->egid = iconnect.egid;
1278 
1279 	imsg_init(&client->iev.ibuf, client->fd);
1280 	client->iev.handler = session_dispatch_client;
1281 	client->iev.events = EV_READ;
1282 	client->iev.handler_arg = NULL;
1283 	event_set(&client->iev.ev, client->iev.ibuf.fd, EV_READ,
1284 	    session_dispatch_client, &client->iev);
1285 	gotd_imsg_event_add(&client->iev);
1286 	evtimer_set(&client->tmo, gotd_request_timeout, client);
1287 
1288 	return NULL;
1289 }
1290 
1291 static const struct got_error *
1292 recv_repo_child(struct imsg *imsg)
1293 {
1294 	struct gotd_imsg_connect_repo_child ichild;
1295 	struct gotd_session_client *client = &gotd_session_client;
1296 	size_t datalen;
1297 
1298 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1299 		return got_error(GOT_ERR_PRIVSEP_MSG);
1300 
1301 	/* We should already have received a pipe to the listener. */
1302 	if (client->fd == -1)
1303 		return got_error(GOT_ERR_PRIVSEP_MSG);
1304 
1305 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1306 	if (datalen != sizeof(ichild))
1307 		return got_error(GOT_ERR_PRIVSEP_LEN);
1308 
1309 	memcpy(&ichild, imsg->data, sizeof(ichild));
1310 
1311 	client->id = ichild.client_id;
1312 	if (ichild.proc_id == PROC_REPO_WRITE)
1313 		client->is_writing = 1;
1314 	else if (ichild.proc_id == PROC_REPO_READ)
1315 		client->is_writing = 0;
1316 	else
1317 		return got_error_msg(GOT_ERR_PRIVSEP_MSG,
1318 		    "bad child process type");
1319 
1320 	if (imsg->fd == -1)
1321 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1322 
1323 	imsg_init(&client->repo_child_iev.ibuf, imsg->fd);
1324 	client->repo_child_iev.handler = session_dispatch_repo_child;
1325 	client->repo_child_iev.events = EV_READ;
1326 	client->repo_child_iev.handler_arg = NULL;
1327 	event_set(&client->repo_child_iev.ev, client->repo_child_iev.ibuf.fd,
1328 	    EV_READ, session_dispatch_repo_child, &client->repo_child_iev);
1329 	gotd_imsg_event_add(&client->repo_child_iev);
1330 
1331 	/* The "recvfd" pledge promise is no longer needed. */
1332 	if (pledge("stdio rpath wpath cpath sendfd fattr flock", NULL) == -1)
1333 		fatal("pledge");
1334 
1335 	return NULL;
1336 }
1337 
1338 static void
1339 session_dispatch(int fd, short event, void *arg)
1340 {
1341 	struct gotd_imsgev *iev = arg;
1342 	struct imsgbuf *ibuf = &iev->ibuf;
1343 	struct gotd_session_client *client = &gotd_session_client;
1344 	ssize_t n;
1345 	int shut = 0;
1346 	struct imsg imsg;
1347 
1348 	if (event & EV_READ) {
1349 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1350 			fatal("imsg_read error");
1351 		if (n == 0) {
1352 			/* Connection closed. */
1353 			shut = 1;
1354 			goto done;
1355 		}
1356 	}
1357 
1358 	if (event & EV_WRITE) {
1359 		n = msgbuf_write(&ibuf->w);
1360 		if (n == -1 && errno != EAGAIN)
1361 			fatal("msgbuf_write");
1362 		if (n == 0) {
1363 			/* Connection closed. */
1364 			shut = 1;
1365 			goto done;
1366 		}
1367 	}
1368 
1369 	for (;;) {
1370 		const struct got_error *err = NULL;
1371 		uint32_t client_id = 0;
1372 		int do_disconnect = 0, do_list_refs = 0;
1373 
1374 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1375 			fatal("%s: imsg_get error", __func__);
1376 		if (n == 0)	/* No more messages. */
1377 			break;
1378 
1379 		switch (imsg.hdr.type) {
1380 		case GOTD_IMSG_ERROR:
1381 			do_disconnect = 1;
1382 			err = gotd_imsg_recv_error(&client_id, &imsg);
1383 			break;
1384 		case GOTD_IMSG_CONNECT:
1385 			err = recv_connect(&imsg);
1386 			break;
1387 		case GOTD_IMSG_DISCONNECT:
1388 			do_disconnect = 1;
1389 			break;
1390 		case GOTD_IMSG_CONNECT_REPO_CHILD:
1391 			err = recv_repo_child(&imsg);
1392 			if (err)
1393 				break;
1394 			do_list_refs = 1;
1395 			break;
1396 		default:
1397 			log_debug("unexpected imsg %d", imsg.hdr.type);
1398 			break;
1399 		}
1400 		imsg_free(&imsg);
1401 
1402 		if (do_disconnect) {
1403 			if (err)
1404 				disconnect_on_error(client, err);
1405 			else
1406 				disconnect(client);
1407 		} else if (do_list_refs)
1408 			err = list_refs_request();
1409 
1410 		if (err)
1411 			log_warnx("uid %d: %s", client->euid, err->msg);
1412 	}
1413 done:
1414 	if (!shut) {
1415 		gotd_imsg_event_add(iev);
1416 	} else {
1417 		/* This pipe is dead. Remove its event handler */
1418 		event_del(&iev->ev);
1419 		event_loopexit(NULL);
1420 	}
1421 }
1422 
1423 void
1424 session_main(const char *title, const char *repo_path,
1425     int *pack_fds, int *temp_fds, struct timeval *request_timeout)
1426 {
1427 	const struct got_error *err = NULL;
1428 	struct event evsigint, evsigterm, evsighup, evsigusr1;
1429 
1430 	gotd_session.title = title;
1431 	gotd_session.pid = getpid();
1432 	gotd_session.pack_fds = pack_fds;
1433 	gotd_session.temp_fds = temp_fds;
1434 	memcpy(&gotd_session.request_timeout, request_timeout,
1435 	    sizeof(gotd_session.request_timeout));
1436 
1437 	err = got_repo_open(&gotd_session.repo, repo_path, NULL, pack_fds);
1438 	if (err)
1439 		goto done;
1440 	if (!got_repo_is_bare(gotd_session.repo)) {
1441 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
1442 		    "bare git repository required");
1443 		goto done;
1444 	}
1445 
1446 	got_repo_temp_fds_set(gotd_session.repo, temp_fds);
1447 
1448 	signal_set(&evsigint, SIGINT, gotd_session_sighdlr, NULL);
1449 	signal_set(&evsigterm, SIGTERM, gotd_session_sighdlr, NULL);
1450 	signal_set(&evsighup, SIGHUP, gotd_session_sighdlr, NULL);
1451 	signal_set(&evsigusr1, SIGUSR1, gotd_session_sighdlr, NULL);
1452 	signal(SIGPIPE, SIG_IGN);
1453 
1454 	signal_add(&evsigint, NULL);
1455 	signal_add(&evsigterm, NULL);
1456 	signal_add(&evsighup, NULL);
1457 	signal_add(&evsigusr1, NULL);
1458 
1459 	gotd_session_client.state = GOTD_STATE_EXPECT_LIST_REFS;
1460 	gotd_session_client.fd = -1;
1461 	gotd_session_client.nref_updates = -1;
1462 	gotd_session_client.delta_cache_fd = -1;
1463 	gotd_session_client.accept_flush_pkt = 1;
1464 
1465 	imsg_init(&gotd_session.parent_iev.ibuf, GOTD_FILENO_MSG_PIPE);
1466 	gotd_session.parent_iev.handler = session_dispatch;
1467 	gotd_session.parent_iev.events = EV_READ;
1468 	gotd_session.parent_iev.handler_arg = NULL;
1469 	event_set(&gotd_session.parent_iev.ev, gotd_session.parent_iev.ibuf.fd,
1470 	    EV_READ, session_dispatch, &gotd_session.parent_iev);
1471 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
1472 	    GOTD_IMSG_CLIENT_SESSION_READY, PROC_SESSION, -1, NULL, 0) == -1) {
1473 		err = got_error_from_errno("imsg compose CLIENT_SESSION_READY");
1474 		goto done;
1475 	}
1476 
1477 	event_dispatch();
1478 done:
1479 	if (err)
1480 		log_warnx("%s: %s", title, err->msg);
1481 	gotd_session_shutdown();
1482 }
1483 
1484 void
1485 gotd_session_shutdown(void)
1486 {
1487 	log_debug("shutting down");
1488 	if (gotd_session.repo)
1489 		got_repo_close(gotd_session.repo);
1490 	got_repo_pack_fds_close(gotd_session.pack_fds);
1491 	got_repo_temp_fds_close(gotd_session.temp_fds);
1492 	exit(0);
1493 }