op public repos

Blob

Date:: Sat Jan 21 09:15:14 2023 UTC
Message:: make gotd session process accept just one flush packet at a time ok jamsek
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2022, 2023 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/queue.h>
19 #include <sys/tree.h>
20 #include <sys/socket.h>
21 #include <sys/uio.h>
22 
23 #include <errno.h>
24 #include <event.h>
25 #include <limits.h>
26 #include <sha1.h>
27 #include <signal.h>
28 #include <stdint.h>
29 #include <stdio.h>
30 #include <stdlib.h>
31 #include <string.h>
32 #include <imsg.h>
33 #include <unistd.h>
34 
35 #include "got_error.h"
36 #include "got_repository.h"
37 #include "got_object.h"
38 #include "got_path.h"
39 #include "got_reference.h"
40 #include "got_opentemp.h"
41 
42 #include "got_lib_sha1.h"
43 #include "got_lib_delta.h"
44 #include "got_lib_object.h"
45 #include "got_lib_object_cache.h"
46 #include "got_lib_pack.h"
47 #include "got_lib_repository.h"
48 #include "got_lib_gitproto.h"
49 
50 #include "gotd.h"
51 #include "log.h"
52 #include "session.h"
53 
54 
55 static struct gotd_session {
56 	pid_t pid;
57 	const char *title;
58 	struct got_repository *repo;
59 	int *pack_fds;
60 	int *temp_fds;
61 	struct gotd_imsgev parent_iev;
62 	struct timeval request_timeout;
63 } gotd_session;
64 
65 static struct gotd_session_client {
66 	enum gotd_session_state		 state;
67 	int				 is_writing;
68 	struct gotd_client_capability	*capabilities;
69 	size_t				 ncapa_alloc;
70 	size_t				 ncapabilities;
71 	uint32_t			 id;
72 	int				 fd;
73 	int				 delta_cache_fd;
74 	struct gotd_imsgev		 iev;
75 	struct gotd_imsgev		 repo_child_iev;
76 	struct event			 tmo;
77 	uid_t				 euid;
78 	gid_t				 egid;
79 	char				*packfile_path;
80 	char				*packidx_path;
81 	int				 nref_updates;
82 	int				 accept_flush_pkt;
83 } gotd_session_client;
84 
85 void gotd_session_sighdlr(int sig, short event, void *arg);
86 static void gotd_session_shutdown(void);
87 
88 static void
89 disconnect(struct gotd_session_client *client)
90 {
91 	log_debug("uid %d: disconnecting", client->euid);
92 
93 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
94 	    GOTD_IMSG_DISCONNECT, PROC_SESSION, -1, NULL, 0) == -1)
95 		log_warn("imsg compose DISCONNECT");
96 
97 	imsg_clear(&client->repo_child_iev.ibuf);
98 	event_del(&client->repo_child_iev.ev);
99 	evtimer_del(&client->tmo);
100 	close(client->fd);
101 	if (client->delta_cache_fd != -1)
102 		close(client->delta_cache_fd);
103 	if (client->packfile_path) {
104 		if (unlink(client->packfile_path) == -1 && errno != ENOENT)
105 			log_warn("unlink %s: ", client->packfile_path);
106 		free(client->packfile_path);
107 	}
108 	if (client->packidx_path) {
109 		if (unlink(client->packidx_path) == -1 && errno != ENOENT)
110 			log_warn("unlink %s: ", client->packidx_path);
111 		free(client->packidx_path);
112 	}
113 	free(client->capabilities);
114 
115 	gotd_session_shutdown();
116 }
117 
118 static void
119 disconnect_on_error(struct gotd_session_client *client,
120     const struct got_error *err)
121 {
122 	struct imsgbuf ibuf;
123 
124 	log_warnx("uid %d: %s", client->euid, err->msg);
125 	if (err->code != GOT_ERR_EOF) {
126 		imsg_init(&ibuf, client->fd);
127 		gotd_imsg_send_error(&ibuf, 0, PROC_SESSION, err);
128 		imsg_clear(&ibuf);
129 	}
130 
131 	disconnect(client);
132 }
133 
134 static void
135 gotd_request_timeout(int fd, short events, void *arg)
136 {
137 	struct gotd_session_client *client = arg;
138 
139 	log_debug("disconnecting uid %d due to timeout", client->euid);
140 	disconnect(client);
141 }
142 
143 void
144 gotd_session_sighdlr(int sig, short event, void *arg)
145 {
146 	/*
147 	 * Normal signal handler rules don't apply because libevent
148 	 * decouples for us.
149 	 */
150 
151 	switch (sig) {
152 	case SIGHUP:
153 		log_info("%s: ignoring SIGHUP", __func__);
154 		break;
155 	case SIGUSR1:
156 		log_info("%s: ignoring SIGUSR1", __func__);
157 		break;
158 	case SIGTERM:
159 	case SIGINT:
160 		gotd_session_shutdown();
161 		/* NOTREACHED */
162 		break;
163 	default:
164 		fatalx("unexpected signal");
165 	}
166 }
167 
168 static const struct got_error *
169 recv_packfile_done(uint32_t *client_id, struct imsg *imsg)
170 {
171 	struct gotd_imsg_packfile_done idone;
172 	size_t datalen;
173 
174 	log_debug("packfile-done received");
175 
176 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
177 	if (datalen != sizeof(idone))
178 		return got_error(GOT_ERR_PRIVSEP_LEN);
179 	memcpy(&idone, imsg->data, sizeof(idone));
180 
181 	*client_id = idone.client_id;
182 	return NULL;
183 }
184 
185 static const struct got_error *
186 recv_packfile_install(uint32_t *client_id, struct imsg *imsg)
187 {
188 	struct gotd_imsg_packfile_install inst;
189 	size_t datalen;
190 
191 	log_debug("packfile-install received");
192 
193 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
194 	if (datalen != sizeof(inst))
195 		return got_error(GOT_ERR_PRIVSEP_LEN);
196 	memcpy(&inst, imsg->data, sizeof(inst));
197 
198 	*client_id = inst.client_id;
199 	return NULL;
200 }
201 
202 static const struct got_error *
203 recv_ref_updates_start(uint32_t *client_id, struct imsg *imsg)
204 {
205 	struct gotd_imsg_ref_updates_start istart;
206 	size_t datalen;
207 
208 	log_debug("ref-updates-start received");
209 
210 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
211 	if (datalen != sizeof(istart))
212 		return got_error(GOT_ERR_PRIVSEP_LEN);
213 	memcpy(&istart, imsg->data, sizeof(istart));
214 
215 	*client_id = istart.client_id;
216 	return NULL;
217 }
218 
219 static const struct got_error *
220 recv_ref_update(uint32_t *client_id, struct imsg *imsg)
221 {
222 	struct gotd_imsg_ref_update iref;
223 	size_t datalen;
224 
225 	log_debug("ref-update received");
226 
227 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
228 	if (datalen < sizeof(iref))
229 		return got_error(GOT_ERR_PRIVSEP_LEN);
230 	memcpy(&iref, imsg->data, sizeof(iref));
231 
232 	*client_id = iref.client_id;
233 	return NULL;
234 }
235 
236 static const struct got_error *
237 send_ref_update_ok(struct gotd_session_client *client,
238     struct gotd_imsg_ref_update *iref, const char *refname)
239 {
240 	struct gotd_imsg_ref_update_ok iok;
241 	struct gotd_imsgev *iev = &client->iev;
242 	struct ibuf *wbuf;
243 	size_t len;
244 
245 	memset(&iok, 0, sizeof(iok));
246 	iok.client_id = client->id;
247 	memcpy(iok.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
248 	memcpy(iok.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
249 	iok.name_len = strlen(refname);
250 
251 	len = sizeof(iok) + iok.name_len;
252 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE_OK,
253 	    PROC_SESSION, gotd_session.pid, len);
254 	if (wbuf == NULL)
255 		return got_error_from_errno("imsg_create REF_UPDATE_OK");
256 
257 	if (imsg_add(wbuf, &iok, sizeof(iok)) == -1)
258 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
259 	if (imsg_add(wbuf, refname, iok.name_len) == -1)
260 		return got_error_from_errno("imsg_add REF_UPDATE_OK");
261 
262 	wbuf->fd = -1;
263 	imsg_close(&iev->ibuf, wbuf);
264 	gotd_imsg_event_add(iev);
265 	return NULL;
266 }
267 
268 static void
269 send_refs_updated(struct gotd_session_client *client)
270 {
271 	if (gotd_imsg_compose_event(&client->iev, GOTD_IMSG_REFS_UPDATED,
272 	    PROC_SESSION, -1, NULL, 0) == -1)
273 		log_warn("imsg compose REFS_UPDATED");
274 }
275 
276 static const struct got_error *
277 send_ref_update_ng(struct gotd_session_client *client,
278     struct gotd_imsg_ref_update *iref, const char *refname,
279     const char *reason)
280 {
281 	const struct got_error *ng_err;
282 	struct gotd_imsg_ref_update_ng ing;
283 	struct gotd_imsgev *iev = &client->iev;
284 	struct ibuf *wbuf;
285 	size_t len;
286 
287 	memset(&ing, 0, sizeof(ing));
288 	ing.client_id = client->id;
289 	memcpy(ing.old_id, iref->old_id, SHA1_DIGEST_LENGTH);
290 	memcpy(ing.new_id, iref->new_id, SHA1_DIGEST_LENGTH);
291 	ing.name_len = strlen(refname);
292 
293 	ng_err = got_error_fmt(GOT_ERR_REF_BUSY, "%s", reason);
294 	ing.reason_len = strlen(ng_err->msg);
295 
296 	len = sizeof(ing) + ing.name_len + ing.reason_len;
297 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_REF_UPDATE_NG,
298 	    PROC_SESSION, gotd_session.pid, len);
299 	if (wbuf == NULL)
300 		return got_error_from_errno("imsg_create REF_UPDATE_NG");
301 
302 	if (imsg_add(wbuf, &ing, sizeof(ing)) == -1)
303 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
304 	if (imsg_add(wbuf, refname, ing.name_len) == -1)
305 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
306 	if (imsg_add(wbuf, ng_err->msg, ing.reason_len) == -1)
307 		return got_error_from_errno("imsg_add REF_UPDATE_NG");
308 
309 	wbuf->fd = -1;
310 	imsg_close(&iev->ibuf, wbuf);
311 	gotd_imsg_event_add(iev);
312 	return NULL;
313 }
314 
315 static const struct got_error *
316 install_pack(struct gotd_session_client *client, const char *repo_path,
317     struct imsg *imsg)
318 {
319 	const struct got_error *err = NULL;
320 	struct gotd_imsg_packfile_install inst;
321 	char hex[SHA1_DIGEST_STRING_LENGTH];
322 	size_t datalen;
323 	char *packfile_path = NULL, *packidx_path = NULL;
324 
325 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
326 	if (datalen != sizeof(inst))
327 		return got_error(GOT_ERR_PRIVSEP_LEN);
328 	memcpy(&inst, imsg->data, sizeof(inst));
329 
330 	if (client->packfile_path == NULL)
331 		return got_error_msg(GOT_ERR_BAD_REQUEST,
332 		    "client has no pack file");
333 	if (client->packidx_path == NULL)
334 		return got_error_msg(GOT_ERR_BAD_REQUEST,
335 		    "client has no pack file index");
336 
337 	if (got_sha1_digest_to_str(inst.pack_sha1, hex, sizeof(hex)) == NULL)
338 		return got_error_msg(GOT_ERR_NO_SPACE,
339 		    "could not convert pack file SHA1 to hex");
340 
341 	if (asprintf(&packfile_path, "/%s/%s/pack-%s.pack",
342 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
343 		err = got_error_from_errno("asprintf");
344 		goto done;
345 	}
346 
347 	if (asprintf(&packidx_path, "/%s/%s/pack-%s.idx",
348 	    repo_path, GOT_OBJECTS_PACK_DIR, hex) == -1) {
349 		err = got_error_from_errno("asprintf");
350 		goto done;
351 	}
352 
353 	if (rename(client->packfile_path, packfile_path) == -1) {
354 		err = got_error_from_errno3("rename", client->packfile_path,
355 		    packfile_path);
356 		goto done;
357 	}
358 
359 	free(client->packfile_path);
360 	client->packfile_path = NULL;
361 
362 	if (rename(client->packidx_path, packidx_path) == -1) {
363 		err = got_error_from_errno3("rename", client->packidx_path,
364 		    packidx_path);
365 		goto done;
366 	}
367 
368 	free(client->packidx_path);
369 	client->packidx_path = NULL;
370 done:
371 	free(packfile_path);
372 	free(packidx_path);
373 	return err;
374 }
375 
376 static const struct got_error *
377 begin_ref_updates(struct gotd_session_client *client, struct imsg *imsg)
378 {
379 	struct gotd_imsg_ref_updates_start istart;
380 	size_t datalen;
381 
382 	if (client->nref_updates != -1)
383 		return got_error(GOT_ERR_PRIVSEP_MSG);
384 
385 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
386 	if (datalen != sizeof(istart))
387 		return got_error(GOT_ERR_PRIVSEP_LEN);
388 	memcpy(&istart, imsg->data, sizeof(istart));
389 
390 	if (istart.nref_updates <= 0)
391 		return got_error(GOT_ERR_PRIVSEP_MSG);
392 
393 	client->nref_updates = istart.nref_updates;
394 	return NULL;
395 }
396 
397 static const struct got_error *
398 update_ref(int *shut, struct gotd_session_client *client,
399     const char *repo_path, struct imsg *imsg)
400 {
401 	const struct got_error *err = NULL;
402 	struct got_repository *repo = NULL;
403 	struct got_reference *ref = NULL;
404 	struct gotd_imsg_ref_update iref;
405 	struct got_object_id old_id, new_id;
406 	struct got_object_id *id = NULL;
407 	struct got_object *obj = NULL;
408 	char *refname = NULL;
409 	size_t datalen;
410 	int locked = 0;
411 
412 	log_debug("update-ref from uid %d", client->euid);
413 
414 	if (client->nref_updates <= 0)
415 		return got_error(GOT_ERR_PRIVSEP_MSG);
416 
417 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
418 	if (datalen < sizeof(iref))
419 		return got_error(GOT_ERR_PRIVSEP_LEN);
420 	memcpy(&iref, imsg->data, sizeof(iref));
421 	if (datalen != sizeof(iref) + iref.name_len)
422 		return got_error(GOT_ERR_PRIVSEP_LEN);
423 	refname = strndup(imsg->data + sizeof(iref), iref.name_len);
424 	if (refname == NULL)
425 		return got_error_from_errno("strndup");
426 
427 	log_debug("updating ref %s for uid %d", refname, client->euid);
428 
429 	err = got_repo_open(&repo, repo_path, NULL, NULL);
430 	if (err)
431 		goto done;
432 
433 	memcpy(old_id.sha1, iref.old_id, SHA1_DIGEST_LENGTH);
434 	memcpy(new_id.sha1, iref.new_id, SHA1_DIGEST_LENGTH);
435 	err = got_object_open(&obj, repo, &new_id);
436 	if (err)
437 		goto done;
438 
439 	if (iref.ref_is_new) {
440 		err = got_ref_open(&ref, repo, refname, 0);
441 		if (err) {
442 			if (err->code != GOT_ERR_NOT_REF)
443 				goto done;
444 			err = got_ref_alloc(&ref, refname, &new_id);
445 			if (err)
446 				goto done;
447 			err = got_ref_write(ref, repo); /* will lock/unlock */
448 			if (err)
449 				goto done;
450 		} else {
451 			err = got_error_fmt(GOT_ERR_REF_BUSY,
452 			    "%s has been created by someone else "
453 			    "while transaction was in progress",
454 			    got_ref_get_name(ref));
455 			goto done;
456 		}
457 	} else {
458 		err = got_ref_open(&ref, repo, refname, 1 /* lock */);
459 		if (err)
460 			goto done;
461 		locked = 1;
462 
463 		err = got_ref_resolve(&id, repo, ref);
464 		if (err)
465 			goto done;
466 
467 		if (got_object_id_cmp(id, &old_id) != 0) {
468 			err = got_error_fmt(GOT_ERR_REF_BUSY,
469 			    "%s has been modified by someone else "
470 			    "while transaction was in progress",
471 			    got_ref_get_name(ref));
472 			goto done;
473 		}
474 
475 		err = got_ref_change_ref(ref, &new_id);
476 		if (err)
477 			goto done;
478 
479 		err = got_ref_write(ref, repo);
480 		if (err)
481 			goto done;
482 
483 		free(id);
484 		id = NULL;
485 	}
486 done:
487 	if (err) {
488 		if (err->code == GOT_ERR_LOCKFILE_TIMEOUT) {
489 			err = got_error_fmt(GOT_ERR_LOCKFILE_TIMEOUT,
490 			    "could not acquire exclusive file lock for %s",
491 			    refname);
492 		}
493 		send_ref_update_ng(client, &iref, refname, err->msg);
494 	} else
495 		send_ref_update_ok(client, &iref, refname);
496 
497 	if (client->nref_updates > 0) {
498 		client->nref_updates--;
499 		if (client->nref_updates == 0) {
500 			send_refs_updated(client);
501 			*shut = 1;
502 		}
503 
504 	}
505 	if (locked) {
506 		const struct got_error *unlock_err;
507 		unlock_err = got_ref_unlock(ref);
508 		if (unlock_err && err == NULL)
509 			err = unlock_err;
510 	}
511 	if (ref)
512 		got_ref_close(ref);
513 	if (obj)
514 		got_object_close(obj);
515 	if (repo)
516 		got_repo_close(repo);
517 	free(refname);
518 	free(id);
519 	return err;
520 }
521 
522 static void
523 session_dispatch_repo_child(int fd, short event, void *arg)
524 {
525 	struct gotd_imsgev *iev = arg;
526 	struct imsgbuf *ibuf = &iev->ibuf;
527 	struct gotd_session_client *client = &gotd_session_client;
528 	ssize_t n;
529 	int shut = 0;
530 	struct imsg imsg;
531 
532 	if (event & EV_READ) {
533 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
534 			fatal("imsg_read error");
535 		if (n == 0) {
536 			/* Connection closed. */
537 			shut = 1;
538 			goto done;
539 		}
540 	}
541 
542 	if (event & EV_WRITE) {
543 		n = msgbuf_write(&ibuf->w);
544 		if (n == -1 && errno != EAGAIN)
545 			fatal("msgbuf_write");
546 		if (n == 0) {
547 			/* Connection closed. */
548 			shut = 1;
549 			goto done;
550 		}
551 	}
552 
553 	for (;;) {
554 		const struct got_error *err = NULL;
555 		uint32_t client_id = 0;
556 		int do_disconnect = 0;
557 		int do_ref_updates = 0, do_ref_update = 0;
558 		int do_packfile_install = 0;
559 
560 		if ((n = imsg_get(ibuf, &imsg)) == -1)
561 			fatal("%s: imsg_get error", __func__);
562 		if (n == 0)	/* No more messages. */
563 			break;
564 
565 		switch (imsg.hdr.type) {
566 		case GOTD_IMSG_ERROR:
567 			do_disconnect = 1;
568 			err = gotd_imsg_recv_error(&client_id, &imsg);
569 			break;
570 		case GOTD_IMSG_PACKFILE_DONE:
571 			do_disconnect = 1;
572 			err = recv_packfile_done(&client_id, &imsg);
573 			break;
574 		case GOTD_IMSG_PACKFILE_INSTALL:
575 			err = recv_packfile_install(&client_id, &imsg);
576 			if (err == NULL)
577 				do_packfile_install = 1;
578 			break;
579 		case GOTD_IMSG_REF_UPDATES_START:
580 			err = recv_ref_updates_start(&client_id, &imsg);
581 			if (err == NULL)
582 				do_ref_updates = 1;
583 			break;
584 		case GOTD_IMSG_REF_UPDATE:
585 			err = recv_ref_update(&client_id, &imsg);
586 			if (err == NULL)
587 				do_ref_update = 1;
588 			break;
589 		default:
590 			log_debug("unexpected imsg %d", imsg.hdr.type);
591 			break;
592 		}
593 
594 		if (do_disconnect) {
595 			if (err)
596 				disconnect_on_error(client, err);
597 			else
598 				disconnect(client);
599 		} else {
600 			if (do_packfile_install)
601 				err = install_pack(client,
602 				    gotd_session.repo->path, &imsg);
603 			else if (do_ref_updates)
604 				err = begin_ref_updates(client, &imsg);
605 			else if (do_ref_update)
606 				err = update_ref(&shut, client,
607 				    gotd_session.repo->path, &imsg);
608 			if (err)
609 				log_warnx("uid %d: %s", client->euid, err->msg);
610 		}
611 		imsg_free(&imsg);
612 	}
613 done:
614 	if (!shut) {
615 		gotd_imsg_event_add(iev);
616 	} else {
617 		/* This pipe is dead. Remove its event handler */
618 		event_del(&iev->ev);
619 		event_loopexit(NULL);
620 	}
621 }
622 
623 static const struct got_error *
624 recv_capabilities(struct gotd_session_client *client, struct imsg *imsg)
625 {
626 	struct gotd_imsg_capabilities icapas;
627 	size_t datalen;
628 
629 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
630 	if (datalen != sizeof(icapas))
631 		return got_error(GOT_ERR_PRIVSEP_LEN);
632 	memcpy(&icapas, imsg->data, sizeof(icapas));
633 
634 	client->ncapa_alloc = icapas.ncapabilities;
635 	client->capabilities = calloc(client->ncapa_alloc,
636 	    sizeof(*client->capabilities));
637 	if (client->capabilities == NULL) {
638 		client->ncapa_alloc = 0;
639 		return got_error_from_errno("calloc");
640 	}
641 
642 	log_debug("expecting %zu capabilities from uid %d",
643 	    client->ncapa_alloc, client->euid);
644 	return NULL;
645 }
646 
647 static const struct got_error *
648 recv_capability(struct gotd_session_client *client, struct imsg *imsg)
649 {
650 	struct gotd_imsg_capability icapa;
651 	struct gotd_client_capability *capa;
652 	size_t datalen;
653 	char *key, *value = NULL;
654 
655 	if (client->capabilities == NULL ||
656 	    client->ncapabilities >= client->ncapa_alloc) {
657 		return got_error_msg(GOT_ERR_BAD_REQUEST,
658 		    "unexpected capability received");
659 	}
660 
661 	memset(&icapa, 0, sizeof(icapa));
662 
663 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
664 	if (datalen < sizeof(icapa))
665 		return got_error(GOT_ERR_PRIVSEP_LEN);
666 	memcpy(&icapa, imsg->data, sizeof(icapa));
667 
668 	if (datalen != sizeof(icapa) + icapa.key_len + icapa.value_len)
669 		return got_error(GOT_ERR_PRIVSEP_LEN);
670 
671 	key = strndup(imsg->data + sizeof(icapa), icapa.key_len);
672 	if (key == NULL)
673 		return got_error_from_errno("strndup");
674 	if (icapa.value_len > 0) {
675 		value = strndup(imsg->data + sizeof(icapa) + icapa.key_len,
676 		    icapa.value_len);
677 		if (value == NULL) {
678 			free(key);
679 			return got_error_from_errno("strndup");
680 		}
681 	}
682 
683 	capa = &client->capabilities[client->ncapabilities++];
684 	capa->key = key;
685 	capa->value = value;
686 
687 	if (value)
688 		log_debug("uid %d: capability %s=%s", client->euid, key, value);
689 	else
690 		log_debug("uid %d: capability %s", client->euid, key);
691 
692 	return NULL;
693 }
694 
695 static const struct got_error *
696 ensure_client_is_reading(struct gotd_session_client *client)
697 {
698 	if (client->is_writing) {
699 		return got_error_fmt(GOT_ERR_BAD_PACKET,
700 		    "uid %d made a read-request but is not reading from "
701 		    "a repository", client->euid);
702 	}
703 
704 	return NULL;
705 }
706 
707 static const struct got_error *
708 ensure_client_is_writing(struct gotd_session_client *client)
709 {
710 	if (!client->is_writing) {
711 		return got_error_fmt(GOT_ERR_BAD_PACKET,
712 		    "uid %d made a write-request but is not writing to "
713 		    "a repository", client->euid);
714 	}
715 
716 	return NULL;
717 }
718 
719 static const struct got_error *
720 forward_want(struct gotd_session_client *client, struct imsg *imsg)
721 {
722 	struct gotd_imsg_want ireq;
723 	struct gotd_imsg_want iwant;
724 	size_t datalen;
725 
726 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
727 	if (datalen != sizeof(ireq))
728 		return got_error(GOT_ERR_PRIVSEP_LEN);
729 
730 	memcpy(&ireq, imsg->data, datalen);
731 
732 	memset(&iwant, 0, sizeof(iwant));
733 	memcpy(iwant.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
734 	iwant.client_id = client->id;
735 
736 	if (gotd_imsg_compose_event(&client->repo_child_iev, GOTD_IMSG_WANT,
737 	    PROC_SESSION, -1, &iwant, sizeof(iwant)) == -1)
738 		return got_error_from_errno("imsg compose WANT");
739 
740 	return NULL;
741 }
742 
743 static const struct got_error *
744 forward_ref_update(struct gotd_session_client *client, struct imsg *imsg)
745 {
746 	const struct got_error *err = NULL;
747 	struct gotd_imsg_ref_update ireq;
748 	struct gotd_imsg_ref_update *iref = NULL;
749 	size_t datalen;
750 
751 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
752 	if (datalen < sizeof(ireq))
753 		return got_error(GOT_ERR_PRIVSEP_LEN);
754 	memcpy(&ireq, imsg->data, sizeof(ireq));
755 	if (datalen != sizeof(ireq) + ireq.name_len)
756 		return got_error(GOT_ERR_PRIVSEP_LEN);
757 
758 	iref = malloc(datalen);
759 	if (iref == NULL)
760 		return got_error_from_errno("malloc");
761 	memcpy(iref, imsg->data, datalen);
762 
763 	iref->client_id = client->id;
764 	if (gotd_imsg_compose_event(&client->repo_child_iev,
765 	    GOTD_IMSG_REF_UPDATE, PROC_SESSION, -1, iref, datalen) == -1)
766 		err = got_error_from_errno("imsg compose REF_UPDATE");
767 	free(iref);
768 	return err;
769 }
770 
771 static const struct got_error *
772 forward_have(struct gotd_session_client *client, struct imsg *imsg)
773 {
774 	struct gotd_imsg_have ireq;
775 	struct gotd_imsg_have ihave;
776 	size_t datalen;
777 
778 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
779 	if (datalen != sizeof(ireq))
780 		return got_error(GOT_ERR_PRIVSEP_LEN);
781 
782 	memcpy(&ireq, imsg->data, datalen);
783 
784 	memset(&ihave, 0, sizeof(ihave));
785 	memcpy(ihave.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
786 	ihave.client_id = client->id;
787 
788 	if (gotd_imsg_compose_event(&client->repo_child_iev, GOTD_IMSG_HAVE,
789 	    PROC_SESSION, -1, &ihave, sizeof(ihave)) == -1)
790 		return got_error_from_errno("imsg compose HAVE");
791 
792 	return NULL;
793 }
794 
795 static int
796 client_has_capability(struct gotd_session_client *client, const char *capastr)
797 {
798 	struct gotd_client_capability *capa;
799 	size_t i;
800 
801 	if (client->ncapabilities == 0)
802 		return 0;
803 
804 	for (i = 0; i < client->ncapabilities; i++) {
805 		capa = &client->capabilities[i];
806 		if (strcmp(capa->key, capastr) == 0)
807 			return 1;
808 	}
809 
810 	return 0;
811 }
812 
813 static const struct got_error *
814 recv_packfile(struct gotd_session_client *client)
815 {
816 	const struct got_error *err = NULL;
817 	struct gotd_imsg_recv_packfile ipack;
818 	struct gotd_imsg_packfile_pipe ipipe;
819 	struct gotd_imsg_packidx_file ifile;
820 	char *basepath = NULL, *pack_path = NULL, *idx_path = NULL;
821 	int packfd = -1, idxfd = -1;
822 	int pipe[2] = { -1, -1 };
823 
824 	if (client->packfile_path) {
825 		return got_error_fmt(GOT_ERR_PRIVSEP_MSG,
826 		    "uid %d already has a pack file", client->euid);
827 	}
828 
829 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
830 		return got_error_from_errno("socketpair");
831 
832 	memset(&ipipe, 0, sizeof(ipipe));
833 	ipipe.client_id = client->id;
834 
835 	/* Send pack pipe end 0 to repo child process. */
836 	if (gotd_imsg_compose_event(&client->repo_child_iev,
837 	    GOTD_IMSG_PACKFILE_PIPE, PROC_SESSION, pipe[0],
838 	        &ipipe, sizeof(ipipe)) == -1) {
839 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
840 		pipe[0] = -1;
841 		goto done;
842 	}
843 	pipe[0] = -1;
844 
845 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
846 	if (gotd_imsg_compose_event(&client->iev,
847 	    GOTD_IMSG_PACKFILE_PIPE, PROC_SESSION, pipe[1], NULL, 0) == -1)
848 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
849 	pipe[1] = -1;
850 
851 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.pack",
852 	    got_repo_get_path(gotd_session.repo), GOT_OBJECTS_PACK_DIR,
853 	    client->euid) == -1) {
854 		err = got_error_from_errno("asprintf");
855 		goto done;
856 	}
857 
858 	err = got_opentemp_named_fd(&pack_path, &packfd, basepath, "");
859 	if (err)
860 		goto done;
861 
862 	free(basepath);
863 	if (asprintf(&basepath, "%s/%s/receiving-from-uid-%d.idx",
864 	    got_repo_get_path(gotd_session.repo), GOT_OBJECTS_PACK_DIR,
865 	    client->euid) == -1) {
866 		err = got_error_from_errno("asprintf");
867 		basepath = NULL;
868 		goto done;
869 	}
870 	err = got_opentemp_named_fd(&idx_path, &idxfd, basepath, "");
871 	if (err)
872 		goto done;
873 
874 	memset(&ifile, 0, sizeof(ifile));
875 	ifile.client_id = client->id;
876 	if (gotd_imsg_compose_event(&client->repo_child_iev,
877 	    GOTD_IMSG_PACKIDX_FILE, PROC_SESSION,
878 	    idxfd, &ifile, sizeof(ifile)) == -1) {
879 		err = got_error_from_errno("imsg compose PACKIDX_FILE");
880 		idxfd = -1;
881 		goto done;
882 	}
883 	idxfd = -1;
884 
885 	memset(&ipack, 0, sizeof(ipack));
886 	ipack.client_id = client->id;
887 	if (client_has_capability(client, GOT_CAPA_REPORT_STATUS))
888 		ipack.report_status = 1;
889 
890 	if (gotd_imsg_compose_event(&client->repo_child_iev,
891 	    GOTD_IMSG_RECV_PACKFILE, PROC_SESSION, packfd,
892 	    &ipack, sizeof(ipack)) == -1) {
893 		err = got_error_from_errno("imsg compose RECV_PACKFILE");
894 		packfd = -1;
895 		goto done;
896 	}
897 	packfd = -1;
898 
899 done:
900 	free(basepath);
901 	if (pipe[0] != -1 && close(pipe[0]) == -1 && err == NULL)
902 		err = got_error_from_errno("close");
903 	if (pipe[1] != -1 && close(pipe[1]) == -1 && err == NULL)
904 		err = got_error_from_errno("close");
905 	if (packfd != -1 && close(packfd) == -1 && err == NULL)
906 		err = got_error_from_errno("close");
907 	if (idxfd != -1 && close(idxfd) == -1 && err == NULL)
908 		err = got_error_from_errno("close");
909 	if (err) {
910 		free(pack_path);
911 		free(idx_path);
912 	} else {
913 		client->packfile_path = pack_path;
914 		client->packidx_path = idx_path;
915 	}
916 	return err;
917 }
918 
919 static const struct got_error *
920 send_packfile(struct gotd_session_client *client)
921 {
922 	const struct got_error *err = NULL;
923 	struct gotd_imsg_send_packfile ipack;
924 	struct gotd_imsg_packfile_pipe ipipe;
925 	int pipe[2];
926 
927 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
928 		return got_error_from_errno("socketpair");
929 
930 	memset(&ipack, 0, sizeof(ipack));
931 	memset(&ipipe, 0, sizeof(ipipe));
932 
933 	ipack.client_id = client->id;
934 	if (client_has_capability(client, GOT_CAPA_SIDE_BAND_64K))
935 		ipack.report_progress = 1;
936 
937 	client->delta_cache_fd = got_opentempfd();
938 	if (client->delta_cache_fd == -1)
939 		return got_error_from_errno("got_opentempfd");
940 
941 	if (gotd_imsg_compose_event(&client->repo_child_iev,
942 	    GOTD_IMSG_SEND_PACKFILE, PROC_GOTD, client->delta_cache_fd,
943 	    &ipack, sizeof(ipack)) == -1) {
944 		err = got_error_from_errno("imsg compose SEND_PACKFILE");
945 		close(pipe[0]);
946 		close(pipe[1]);
947 		return err;
948 	}
949 
950 	ipipe.client_id = client->id;
951 
952 	/* Send pack pipe end 0 to repo child process. */
953 	if (gotd_imsg_compose_event(&client->repo_child_iev,
954 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD,
955 	    pipe[0], &ipipe, sizeof(ipipe)) == -1) {
956 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
957 		close(pipe[1]);
958 		return err;
959 	}
960 
961 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
962 	if (gotd_imsg_compose_event(&client->iev,
963 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD, pipe[1], NULL, 0) == -1)
964 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
965 
966 	return err;
967 }
968 
969 static void
970 session_dispatch_listener(int fd, short events, void *arg)
971 {
972 	struct gotd_imsgev *iev = arg;
973 	struct imsgbuf *ibuf = &iev->ibuf;
974 	struct gotd_session_client *client = &gotd_session_client;
975 	const struct got_error *err = NULL;
976 	struct imsg imsg;
977 	ssize_t n;
978 
979 	if (events & EV_WRITE) {
980 		while (ibuf->w.queued) {
981 			n = msgbuf_write(&ibuf->w);
982 			if (n == -1 && errno == EPIPE) {
983 				/*
984 				 * The client has closed its socket.
985 				 * This can happen when Git clients are
986 				 * done sending pack file data.
987 				 */
988 				msgbuf_clear(&ibuf->w);
989 				continue;
990 			} else if (n == -1 && errno != EAGAIN) {
991 				err = got_error_from_errno("imsg_flush");
992 				disconnect_on_error(client, err);
993 				return;
994 			}
995 			if (n == 0) {
996 				/* Connection closed. */
997 				err = got_error(GOT_ERR_EOF);
998 				disconnect_on_error(client, err);
999 				return;
1000 			}
1001 		}
1002 	}
1003 
1004 	if ((events & EV_READ) == 0)
1005 		return;
1006 
1007 	memset(&imsg, 0, sizeof(imsg));
1008 
1009 	while (err == NULL) {
1010 		err = gotd_imsg_recv(&imsg, ibuf, 0);
1011 		if (err) {
1012 			if (err->code == GOT_ERR_PRIVSEP_READ)
1013 				err = NULL;
1014 			break;
1015 		}
1016 
1017 		evtimer_del(&client->tmo);
1018 
1019 		switch (imsg.hdr.type) {
1020 		case GOTD_IMSG_CAPABILITIES:
1021 			if (client->state != GOTD_STATE_EXPECT_CAPABILITIES) {
1022 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1023 				    "unexpected capabilities received");
1024 				break;
1025 			}
1026 			log_debug("receiving capabilities from uid %d",
1027 			    client->euid);
1028 			err = recv_capabilities(client, &imsg);
1029 			break;
1030 		case GOTD_IMSG_CAPABILITY:
1031 			if (client->state != GOTD_STATE_EXPECT_CAPABILITIES) {
1032 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1033 				    "unexpected capability received");
1034 				break;
1035 			}
1036 			err = recv_capability(client, &imsg);
1037 			if (err || client->ncapabilities < client->ncapa_alloc)
1038 				break;
1039 			if (!client->is_writing) {
1040 				client->state = GOTD_STATE_EXPECT_WANT;
1041 				client->accept_flush_pkt = 1;
1042 				log_debug("uid %d: expecting want-lines",
1043 				    client->euid);
1044 			} else if (client->is_writing) {
1045 				client->state = GOTD_STATE_EXPECT_REF_UPDATE;
1046 				client->accept_flush_pkt = 1;
1047 				log_debug("uid %d: expecting ref-update-lines",
1048 				    client->euid);
1049 			} else
1050 				fatalx("client %d is both reading and writing",
1051 				    client->euid);
1052 			break;
1053 		case GOTD_IMSG_WANT:
1054 			if (client->state != GOTD_STATE_EXPECT_WANT) {
1055 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1056 				    "unexpected want-line received");
1057 				break;
1058 			}
1059 			log_debug("received want-line from uid %d",
1060 			    client->euid);
1061 			err = ensure_client_is_reading(client);
1062 			if (err)
1063 				break;
1064 			client->accept_flush_pkt = 1;
1065 			err = forward_want(client, &imsg);
1066 			break;
1067 		case GOTD_IMSG_REF_UPDATE:
1068 			if (client->state != GOTD_STATE_EXPECT_REF_UPDATE &&
1069 			    client->state !=
1070 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1071 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1072 				    "unexpected ref-update-line received");
1073 				break;
1074 			}
1075 			log_debug("received ref-update-line from uid %d",
1076 			    client->euid);
1077 			err = ensure_client_is_writing(client);
1078 			if (err)
1079 				break;
1080 			err = forward_ref_update(client, &imsg);
1081 			if (err)
1082 				break;
1083 			client->state = GOTD_STATE_EXPECT_MORE_REF_UPDATES;
1084 			client->accept_flush_pkt = 1;
1085 			break;
1086 		case GOTD_IMSG_HAVE:
1087 			if (client->state != GOTD_STATE_EXPECT_HAVE) {
1088 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1089 				    "unexpected have-line received");
1090 				break;
1091 			}
1092 			log_debug("received have-line from uid %d",
1093 			    client->euid);
1094 			err = ensure_client_is_reading(client);
1095 			if (err)
1096 				break;
1097 			err = forward_have(client, &imsg);
1098 			if (err)
1099 				break;
1100 			client->accept_flush_pkt = 1;
1101 			break;
1102 		case GOTD_IMSG_FLUSH:
1103 			if (client->state == GOTD_STATE_EXPECT_WANT ||
1104 			    client->state == GOTD_STATE_EXPECT_HAVE) {
1105 				err = ensure_client_is_reading(client);
1106 				if (err)
1107 					break;
1108 			} else if (client->state ==
1109 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1110 				err = ensure_client_is_writing(client);
1111 				if (err)
1112 					break;
1113 			} else if (client->state != GOTD_STATE_EXPECT_DONE) {
1114 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1115 				    "unexpected flush-pkt received");
1116 				break;
1117 			}
1118 			if (!client->accept_flush_pkt) {
1119 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1120 				    "unexpected flush-pkt received");
1121 				break;
1122 			}
1123 
1124 			/*
1125 			 * Accept just one flush packet at a time.
1126 			 * Future client state transitions will set this flag
1127 			 * again if another flush packet is expected.
1128 			 */
1129 			client->accept_flush_pkt = 0;
1130 
1131 			log_debug("received flush-pkt from uid %d",
1132 			    client->euid);
1133 			if (client->state == GOTD_STATE_EXPECT_WANT) {
1134 				client->state = GOTD_STATE_EXPECT_HAVE;
1135 				log_debug("uid %d: expecting have-lines",
1136 				    client->euid);
1137 			} else if (client->state == GOTD_STATE_EXPECT_HAVE) {
1138 				client->state = GOTD_STATE_EXPECT_DONE;
1139 				client->accept_flush_pkt = 1;
1140 				log_debug("uid %d: expecting 'done'",
1141 				    client->euid);
1142 			} else if (client->state ==
1143 			    GOTD_STATE_EXPECT_MORE_REF_UPDATES) {
1144 				client->state = GOTD_STATE_EXPECT_PACKFILE;
1145 				log_debug("uid %d: expecting packfile",
1146 				    client->euid);
1147 				err = recv_packfile(client);
1148 			} else if (client->state != GOTD_STATE_EXPECT_DONE) {
1149 				/* should not happen, see above */
1150 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1151 				    "unexpected client state");
1152 				break;
1153 			}
1154 			break;
1155 		case GOTD_IMSG_DONE:
1156 			if (client->state != GOTD_STATE_EXPECT_HAVE &&
1157 			    client->state != GOTD_STATE_EXPECT_DONE) {
1158 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
1159 				    "unexpected flush-pkt received");
1160 				break;
1161 			}
1162 			log_debug("received 'done' from uid %d", client->euid);
1163 			err = ensure_client_is_reading(client);
1164 			if (err)
1165 				break;
1166 			client->state = GOTD_STATE_DONE;
1167 			client->accept_flush_pkt = 1;
1168 			err = send_packfile(client);
1169 			break;
1170 		default:
1171 			log_debug("unexpected imsg %d", imsg.hdr.type);
1172 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1173 			break;
1174 		}
1175 
1176 		imsg_free(&imsg);
1177 	}
1178 
1179 	if (err) {
1180 		if (err->code != GOT_ERR_EOF ||
1181 		    client->state != GOTD_STATE_EXPECT_PACKFILE)
1182 			disconnect_on_error(client, err);
1183 	} else {
1184 		gotd_imsg_event_add(iev);
1185 		evtimer_add(&client->tmo, &gotd_session.request_timeout);
1186 	}
1187 }
1188 
1189 static const struct got_error *
1190 list_refs_request(void)
1191 {
1192 	static const struct got_error *err;
1193 	struct gotd_session_client *client = &gotd_session_client;
1194 	struct gotd_imsgev *iev = &client->repo_child_iev;
1195 	struct gotd_imsg_list_refs_internal ilref;
1196 	int fd;
1197 
1198 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1199 		return got_error(GOT_ERR_PRIVSEP_MSG);
1200 
1201 	memset(&ilref, 0, sizeof(ilref));
1202 	ilref.client_id = client->id;
1203 
1204 	fd = dup(client->fd);
1205 	if (fd == -1)
1206 		return got_error_from_errno("dup");
1207 
1208 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_LIST_REFS_INTERNAL,
1209 	    PROC_SESSION, fd, &ilref, sizeof(ilref)) == -1) {
1210 		err = got_error_from_errno("imsg compose LIST_REFS_INTERNAL");
1211 		close(fd);
1212 		return err;
1213 	}
1214 
1215 	client->state = GOTD_STATE_EXPECT_CAPABILITIES;
1216 	log_debug("uid %d: expecting capabilities", client->euid);
1217 	return NULL;
1218 }
1219 
1220 static const struct got_error *
1221 recv_connect(struct imsg *imsg)
1222 {
1223 	struct gotd_session_client *client = &gotd_session_client;
1224 	struct gotd_imsg_connect iconnect;
1225 	size_t datalen;
1226 
1227 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1228 		return got_error(GOT_ERR_PRIVSEP_MSG);
1229 
1230 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1231 	if (datalen != sizeof(iconnect))
1232 		return got_error(GOT_ERR_PRIVSEP_LEN);
1233 	memcpy(&iconnect, imsg->data, sizeof(iconnect));
1234 
1235 	if (imsg->fd == -1)
1236 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1237 
1238 	client->fd = imsg->fd;
1239 	client->euid = iconnect.euid;
1240 	client->egid = iconnect.egid;
1241 
1242 	imsg_init(&client->iev.ibuf, client->fd);
1243 	client->iev.handler = session_dispatch_listener;
1244 	client->iev.events = EV_READ;
1245 	client->iev.handler_arg = NULL;
1246 	event_set(&client->iev.ev, client->iev.ibuf.fd, EV_READ,
1247 	    session_dispatch_listener, &client->iev);
1248 	gotd_imsg_event_add(&client->iev);
1249 	evtimer_set(&client->tmo, gotd_request_timeout, client);
1250 
1251 	return NULL;
1252 }
1253 
1254 static const struct got_error *
1255 recv_repo_child(struct imsg *imsg)
1256 {
1257 	struct gotd_imsg_connect_repo_child ichild;
1258 	struct gotd_session_client *client = &gotd_session_client;
1259 	size_t datalen;
1260 
1261 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1262 		return got_error(GOT_ERR_PRIVSEP_MSG);
1263 
1264 	/* We should already have received a pipe to the listener. */
1265 	if (client->fd == -1)
1266 		return got_error(GOT_ERR_PRIVSEP_MSG);
1267 
1268 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1269 	if (datalen != sizeof(ichild))
1270 		return got_error(GOT_ERR_PRIVSEP_LEN);
1271 
1272 	memcpy(&ichild, imsg->data, sizeof(ichild));
1273 
1274 	client->id = ichild.client_id;
1275 	if (ichild.proc_id == PROC_REPO_WRITE)
1276 		client->is_writing = 1;
1277 	else if (ichild.proc_id == PROC_REPO_READ)
1278 		client->is_writing = 0;
1279 	else
1280 		return got_error_msg(GOT_ERR_PRIVSEP_MSG,
1281 		    "bad child process type");
1282 		
1283 	if (imsg->fd == -1)
1284 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
1285 
1286 	imsg_init(&client->repo_child_iev.ibuf, imsg->fd);
1287 	client->repo_child_iev.handler = session_dispatch_repo_child;
1288 	client->repo_child_iev.events = EV_READ;
1289 	client->repo_child_iev.handler_arg = NULL;
1290 	event_set(&client->repo_child_iev.ev, client->repo_child_iev.ibuf.fd,
1291 	    EV_READ, session_dispatch_repo_child, &client->repo_child_iev);
1292 	gotd_imsg_event_add(&client->repo_child_iev);
1293 
1294 	/* The "recvfd" pledge promise is no longer needed. */
1295 	if (pledge("stdio rpath wpath cpath sendfd fattr flock", NULL) == -1)
1296 		fatal("pledge");
1297 
1298 	return NULL;
1299 }
1300 
1301 static void
1302 session_dispatch(int fd, short event, void *arg)
1303 {
1304 	struct gotd_imsgev *iev = arg;
1305 	struct imsgbuf *ibuf = &iev->ibuf;
1306 	struct gotd_session_client *client = &gotd_session_client;
1307 	ssize_t n;
1308 	int shut = 0;
1309 	struct imsg imsg;
1310 
1311 	if (event & EV_READ) {
1312 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1313 			fatal("imsg_read error");
1314 		if (n == 0) {
1315 			/* Connection closed. */
1316 			shut = 1;
1317 			goto done;
1318 		}
1319 	}
1320 
1321 	if (event & EV_WRITE) {
1322 		n = msgbuf_write(&ibuf->w);
1323 		if (n == -1 && errno != EAGAIN)
1324 			fatal("msgbuf_write");
1325 		if (n == 0) {
1326 			/* Connection closed. */
1327 			shut = 1;
1328 			goto done;
1329 		}
1330 	}
1331 
1332 	for (;;) {
1333 		const struct got_error *err = NULL;
1334 		uint32_t client_id = 0;
1335 		int do_disconnect = 0, do_list_refs = 0;
1336 
1337 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1338 			fatal("%s: imsg_get error", __func__);
1339 		if (n == 0)	/* No more messages. */
1340 			break;
1341 
1342 		switch (imsg.hdr.type) {
1343 		case GOTD_IMSG_ERROR:
1344 			do_disconnect = 1;
1345 			err = gotd_imsg_recv_error(&client_id, &imsg);
1346 			break;
1347 		case GOTD_IMSG_CONNECT:
1348 			err = recv_connect(&imsg);
1349 			break;
1350 		case GOTD_IMSG_DISCONNECT:
1351 			do_disconnect = 1;
1352 			break;
1353 		case GOTD_IMSG_CONNECT_REPO_CHILD:
1354 			err = recv_repo_child(&imsg);
1355 			if (err)
1356 				break;
1357 			do_list_refs = 1;
1358 			break;
1359 		default:
1360 			log_debug("unexpected imsg %d", imsg.hdr.type);
1361 			break;
1362 		}
1363 		imsg_free(&imsg);
1364 
1365 		if (do_disconnect) {
1366 			if (err)
1367 				disconnect_on_error(client, err);
1368 			else
1369 				disconnect(client);
1370 		} else if (do_list_refs)
1371 			err = list_refs_request();
1372 
1373 		if (err)
1374 			log_warnx("uid %d: %s", client->euid, err->msg);
1375 	}
1376 done:
1377 	if (!shut) {
1378 		gotd_imsg_event_add(iev);
1379 	} else {
1380 		/* This pipe is dead. Remove its event handler */
1381 		event_del(&iev->ev);
1382 		event_loopexit(NULL);
1383 	}	
1384 }
1385 
1386 void
1387 session_main(const char *title, const char *repo_path,
1388     int *pack_fds, int *temp_fds, struct timeval *request_timeout)
1389 {
1390 	const struct got_error *err = NULL;
1391 	struct event evsigint, evsigterm, evsighup, evsigusr1;
1392 
1393 	gotd_session.title = title;
1394 	gotd_session.pid = getpid();
1395 	gotd_session.pack_fds = pack_fds;
1396 	gotd_session.temp_fds = temp_fds;
1397 	memcpy(&gotd_session.request_timeout, request_timeout,
1398 	    sizeof(gotd_session.request_timeout));
1399 
1400 	err = got_repo_open(&gotd_session.repo, repo_path, NULL, pack_fds);
1401 	if (err)
1402 		goto done;
1403 	if (!got_repo_is_bare(gotd_session.repo)) {
1404 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
1405 		    "bare git repository required");
1406 		goto done;
1407 	}
1408 
1409 	got_repo_temp_fds_set(gotd_session.repo, temp_fds);
1410 
1411 	signal_set(&evsigint, SIGINT, gotd_session_sighdlr, NULL);
1412 	signal_set(&evsigterm, SIGTERM, gotd_session_sighdlr, NULL);
1413 	signal_set(&evsighup, SIGHUP, gotd_session_sighdlr, NULL);
1414 	signal_set(&evsigusr1, SIGUSR1, gotd_session_sighdlr, NULL);
1415 	signal(SIGPIPE, SIG_IGN);
1416 
1417 	signal_add(&evsigint, NULL);
1418 	signal_add(&evsigterm, NULL);
1419 	signal_add(&evsighup, NULL);
1420 	signal_add(&evsigusr1, NULL);
1421 
1422 	gotd_session_client.state = GOTD_STATE_EXPECT_LIST_REFS;
1423 	gotd_session_client.fd = -1;
1424 	gotd_session_client.nref_updates = -1;
1425 	gotd_session_client.delta_cache_fd = -1;
1426 	gotd_session_client.accept_flush_pkt = 1;
1427 
1428 	imsg_init(&gotd_session.parent_iev.ibuf, GOTD_FILENO_MSG_PIPE);
1429 	gotd_session.parent_iev.handler = session_dispatch;
1430 	gotd_session.parent_iev.events = EV_READ;
1431 	gotd_session.parent_iev.handler_arg = NULL;
1432 	event_set(&gotd_session.parent_iev.ev, gotd_session.parent_iev.ibuf.fd,
1433 	    EV_READ, session_dispatch, &gotd_session.parent_iev);
1434 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
1435 	    GOTD_IMSG_CLIENT_SESSION_READY, PROC_SESSION, -1, NULL, 0) == -1) {
1436 		err = got_error_from_errno("imsg compose CLIENT_SESSION_READY");
1437 		goto done;
1438 	}
1439 
1440 	event_dispatch();
1441 done:
1442 	if (err)
1443 		log_warnx("%s: %s", title, err->msg);
1444 	gotd_session_shutdown();
1445 }
1446 
1447 void
1448 gotd_session_shutdown(void)
1449 {
1450 	log_debug("%s: shutting down", gotd_session.title);
1451 	if (gotd_session.repo)
1452 		got_repo_close(gotd_session.repo);
1453 	got_repo_pack_fds_close(gotd_session.pack_fds);
1454 	got_repo_temp_fds_close(gotd_session.temp_fds);
1455 	exit(0);
1456 }