op public repos

Blob

Date:: Fri Jan 27 08:52:25 2023 UTC
Message:: remove \n from log message
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/queue.h>
18 #include <sys/tree.h>
19 #include <sys/time.h>
20 #include <sys/types.h>
21 #include <sys/stat.h>
22 #include <sys/socket.h>
23 #include <sys/un.h>
24 #include <sys/wait.h>
25 
26 #include <fcntl.h>
27 #include <err.h>
28 #include <errno.h>
29 #include <event.h>
30 #include <limits.h>
31 #include <pwd.h>
32 #include <imsg.h>
33 #include <sha1.h>
34 #include <signal.h>
35 #include <siphash.h>
36 #include <stdarg.h>
37 #include <stdio.h>
38 #include <stdlib.h>
39 #include <string.h>
40 #include <syslog.h>
41 #include <unistd.h>
42 
43 #include "got_error.h"
44 #include "got_opentemp.h"
45 #include "got_path.h"
46 #include "got_repository.h"
47 #include "got_object.h"
48 #include "got_reference.h"
49 
50 #include "got_lib_delta.h"
51 #include "got_lib_object.h"
52 #include "got_lib_object_cache.h"
53 #include "got_lib_sha1.h"
54 #include "got_lib_gitproto.h"
55 #include "got_lib_pack.h"
56 #include "got_lib_repository.h"
57 
58 #include "gotd.h"
59 #include "log.h"
60 #include "listen.h"
61 #include "auth.h"
62 #include "session.h"
63 #include "repo_read.h"
64 #include "repo_write.h"
65 
66 #ifndef nitems
67 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
68 #endif
69 
70 enum gotd_client_state {
71 	GOTD_CLIENT_STATE_NEW,
72 	GOTD_CLIENT_STATE_ACCESS_GRANTED,
73 };
74 
75 struct gotd_client {
76 	STAILQ_ENTRY(gotd_client)	 entry;
77 	enum gotd_client_state		 state;
78 	uint32_t			 id;
79 	int				 fd;
80 	struct gotd_imsgev		 iev;
81 	struct event			 tmo;
82 	uid_t				 euid;
83 	gid_t				 egid;
84 	struct gotd_child_proc		*repo;
85 	struct gotd_child_proc		*auth;
86 	struct gotd_child_proc		*session;
87 	int				 required_auth;
88 };
89 STAILQ_HEAD(gotd_clients, gotd_client);
90 
91 static struct gotd_clients gotd_clients[GOTD_CLIENT_TABLE_SIZE];
92 static SIPHASH_KEY clients_hash_key;
93 volatile int client_cnt;
94 static struct timeval auth_timeout = { 5, 0 };
95 static struct gotd gotd;
96 
97 void gotd_sighdlr(int sig, short event, void *arg);
98 static void gotd_shutdown(void);
99 static const struct got_error *start_session_child(struct gotd_client *,
100     struct gotd_repo *, char *, const char *, int, int);
101 static const struct got_error *start_repo_child(struct gotd_client *,
102     enum gotd_procid, struct gotd_repo *, char *, const char *, int, int);
103 static const struct got_error *start_auth_child(struct gotd_client *, int,
104     struct gotd_repo *, char *, const char *, int, int);
105 static void kill_proc(struct gotd_child_proc *, int);
106 
107 __dead static void
108 usage()
109 {
110 	fprintf(stderr, "usage: %s [-dnv] [-f config-file]\n", getprogname());
111 	exit(1);
112 }
113 
114 static int
115 unix_socket_listen(const char *unix_socket_path, uid_t uid, gid_t gid)
116 {
117 	struct sockaddr_un sun;
118 	int fd = -1;
119 	mode_t old_umask, mode;
120 
121 	fd = socket(AF_UNIX, SOCK_STREAM | SOCK_NONBLOCK| SOCK_CLOEXEC, 0);
122 	if (fd == -1) {
123 		log_warn("socket");
124 		return -1;
125 	}
126 
127 	sun.sun_family = AF_UNIX;
128 	if (strlcpy(sun.sun_path, unix_socket_path,
129 	    sizeof(sun.sun_path)) >= sizeof(sun.sun_path)) {
130 		log_warnx("%s: name too long", unix_socket_path);
131 		close(fd);
132 		return -1;
133 	}
134 
135 	if (unlink(unix_socket_path) == -1) {
136 		if (errno != ENOENT) {
137 			log_warn("unlink %s", unix_socket_path);
138 			close(fd);
139 			return -1;
140 		}
141 	}
142 
143 	old_umask = umask(S_IXUSR|S_IXGRP|S_IWOTH|S_IROTH|S_IXOTH);
144 	mode = S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH;
145 
146 	if (bind(fd, (struct sockaddr *)&sun, sizeof(sun)) == -1) {
147 		log_warn("bind: %s", unix_socket_path);
148 		close(fd);
149 		umask(old_umask);
150 		return -1;
151 	}
152 
153 	umask(old_umask);
154 
155 	if (chmod(unix_socket_path, mode) == -1) {
156 		log_warn("chmod %o %s", mode, unix_socket_path);
157 		close(fd);
158 		unlink(unix_socket_path);
159 		return -1;
160 	}
161 
162 	if (chown(unix_socket_path, uid, gid) == -1) {
163 		log_warn("chown %s uid=%d gid=%d", unix_socket_path, uid, gid);
164 		close(fd);
165 		unlink(unix_socket_path);
166 		return -1;
167 	}
168 
169 	if (listen(fd, GOTD_UNIX_SOCKET_BACKLOG) == -1) {
170 		log_warn("listen");
171 		close(fd);
172 		unlink(unix_socket_path);
173 		return -1;
174 	}
175 
176 	return fd;
177 }
178 
179 static uint64_t
180 client_hash(uint32_t client_id)
181 {
182 	return SipHash24(&clients_hash_key, &client_id, sizeof(client_id));
183 }
184 
185 static void
186 add_client(struct gotd_client *client)
187 {
188 	uint64_t slot = client_hash(client->id) % nitems(gotd_clients);
189 	STAILQ_INSERT_HEAD(&gotd_clients[slot], client, entry);
190 	client_cnt++;
191 }
192 
193 static struct gotd_client *
194 find_client(uint32_t client_id)
195 {
196 	uint64_t slot;
197 	struct gotd_client *c;
198 
199 	slot = client_hash(client_id) % nitems(gotd_clients);
200 	STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
201 		if (c->id == client_id)
202 			return c;
203 	}
204 
205 	return NULL;
206 }
207 
208 static struct gotd_client *
209 find_client_by_proc_fd(int fd)
210 {
211 	uint64_t slot;
212 
213 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
214 		struct gotd_client *c;
215 
216 		STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
217 			if (c->repo && c->repo->iev.ibuf.fd == fd)
218 				return c;
219 			if (c->auth && c->auth->iev.ibuf.fd == fd)
220 				return c;
221 			if (c->session && c->session->iev.ibuf.fd == fd)
222 				return c;
223 		}
224 	}
225 
226 	return NULL;
227 }
228 
229 static int
230 client_is_reading(struct gotd_client *client)
231 {
232 	return (client->required_auth &
233 	    (GOTD_AUTH_READ | GOTD_AUTH_WRITE)) == GOTD_AUTH_READ;
234 }
235 
236 static int
237 client_is_writing(struct gotd_client *client)
238 {
239 	return (client->required_auth &
240 	    (GOTD_AUTH_READ | GOTD_AUTH_WRITE)) ==
241 	    (GOTD_AUTH_READ | GOTD_AUTH_WRITE);
242 }
243 
244 static const struct got_error *
245 ensure_client_is_not_writing(struct gotd_client *client)
246 {
247 	if (client_is_writing(client)) {
248 		return got_error_fmt(GOT_ERR_BAD_PACKET,
249 		    "uid %d made a read-request but is writing to "
250 		    "a repository", client->euid);
251 	}
252 
253 	return NULL;
254 }
255 
256 static const struct got_error *
257 ensure_client_is_not_reading(struct gotd_client *client)
258 {
259 	if (client_is_reading(client)) {
260 		return got_error_fmt(GOT_ERR_BAD_PACKET,
261 		    "uid %d made a write-request but is reading from "
262 		    "a repository", client->euid);
263 	}
264 
265 	return NULL;
266 }
267 
268 static void
269 wait_for_child(pid_t child_pid)
270 {
271 	pid_t pid;
272 	int status;
273 
274 	log_debug("waiting for child PID %ld to terminate",
275 	    (long)child_pid);
276 
277 	do {
278 		pid = waitpid(child_pid, &status, WNOHANG);
279 		if (pid == -1) {
280 			if (errno != EINTR && errno != ECHILD)
281 				fatal("wait");
282 		} else if (WIFSIGNALED(status)) {
283 			log_warnx("child PID %ld terminated; signal %d",
284 			    (long)pid, WTERMSIG(status));
285 		}
286 	} while (pid != -1 || (pid == -1 && errno == EINTR));
287 }
288 
289 static void
290 proc_done(struct gotd_child_proc *proc)
291 {
292 	event_del(&proc->iev.ev);
293 	msgbuf_clear(&proc->iev.ibuf.w);
294 	close(proc->iev.ibuf.fd);
295 	kill_proc(proc, 0);
296 	wait_for_child(proc->pid);
297 	free(proc);
298 }
299 
300 static void
301 kill_auth_proc(struct gotd_client *client)
302 {
303 	struct gotd_child_proc *proc;
304 
305 	if (client->auth == NULL)
306 		return;
307 
308 	proc = client->auth;
309 	client->auth = NULL;
310 
311 	proc_done(proc);
312 }
313 
314 static void
315 kill_session_proc(struct gotd_client *client)
316 {
317 	struct gotd_child_proc *proc;
318 
319 	if (client->session == NULL)
320 		return;
321 
322 	proc = client->session;
323 	client->session = NULL;
324 
325 	proc_done(proc);
326 }
327 
328 static void
329 disconnect(struct gotd_client *client)
330 {
331 	struct gotd_imsg_disconnect idisconnect;
332 	struct gotd_child_proc *proc = client->repo;
333 	struct gotd_child_proc *listen_proc = &gotd.listen_proc;
334 	uint64_t slot;
335 
336 	log_debug("uid %d: disconnecting", client->euid);
337 
338 	kill_auth_proc(client);
339 	kill_session_proc(client);
340 
341 	idisconnect.client_id = client->id;
342 	if (proc) {
343 		if (gotd_imsg_compose_event(&proc->iev,
344 		    GOTD_IMSG_DISCONNECT, PROC_GOTD, -1,
345 		    &idisconnect, sizeof(idisconnect)) == -1)
346 			log_warn("imsg compose DISCONNECT");
347 
348 		msgbuf_clear(&proc->iev.ibuf.w);
349 		close(proc->iev.ibuf.fd);
350 		kill_proc(proc, 0);
351 		wait_for_child(proc->pid);
352 		free(proc);
353 		proc = NULL;
354 	}
355 
356 	if (gotd_imsg_compose_event(&listen_proc->iev,
357 	    GOTD_IMSG_DISCONNECT, PROC_GOTD, -1,
358 	    &idisconnect, sizeof(idisconnect)) == -1)
359 		log_warn("imsg compose DISCONNECT");
360 
361 	slot = client_hash(client->id) % nitems(gotd_clients);
362 	STAILQ_REMOVE(&gotd_clients[slot], client, gotd_client, entry);
363 	imsg_clear(&client->iev.ibuf);
364 	event_del(&client->iev.ev);
365 	evtimer_del(&client->tmo);
366 	if (client->fd != -1)
367 		close(client->fd);
368 	else if (client->iev.ibuf.fd != -1)
369 		close(client->iev.ibuf.fd);
370 	free(client);
371 	client_cnt--;
372 }
373 
374 static void
375 disconnect_on_error(struct gotd_client *client, const struct got_error *err)
376 {
377 	struct imsgbuf ibuf;
378 
379 	log_warnx("uid %d: %s", client->euid, err->msg);
380 	if (err->code != GOT_ERR_EOF && client->fd != -1) {
381 		imsg_init(&ibuf, client->fd);
382 		gotd_imsg_send_error(&ibuf, 0, PROC_GOTD, err);
383 		imsg_clear(&ibuf);
384 	}
385 	disconnect(client);
386 }
387 
388 static const struct got_error *
389 send_repo_info(struct gotd_imsgev *iev, struct gotd_repo *repo)
390 {
391 	const struct got_error *err = NULL;
392 	struct gotd_imsg_info_repo irepo;
393 
394 	memset(&irepo, 0, sizeof(irepo));
395 
396 	if (strlcpy(irepo.repo_name, repo->name, sizeof(irepo.repo_name))
397 	    >= sizeof(irepo.repo_name))
398 		return got_error_msg(GOT_ERR_NO_SPACE, "repo name too long");
399 	if (strlcpy(irepo.repo_path, repo->path, sizeof(irepo.repo_path))
400 	    >= sizeof(irepo.repo_path))
401 		return got_error_msg(GOT_ERR_NO_SPACE, "repo path too long");
402 
403 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_INFO_REPO, PROC_GOTD, -1,
404 	    &irepo, sizeof(irepo)) == -1) {
405 		err = got_error_from_errno("imsg compose INFO_REPO");
406 		if (err)
407 			return err;
408 	}
409 
410 	return NULL;
411 }
412 
413 static const struct got_error *
414 send_client_info(struct gotd_imsgev *iev, struct gotd_client *client)
415 {
416 	const struct got_error *err = NULL;
417 	struct gotd_imsg_info_client iclient;
418 	struct gotd_child_proc *proc;
419 
420 	memset(&iclient, 0, sizeof(iclient));
421 	iclient.euid = client->euid;
422 	iclient.egid = client->egid;
423 
424 	proc = client->repo;
425 	if (proc) {
426 		if (strlcpy(iclient.repo_name, proc->repo_path,
427 		    sizeof(iclient.repo_name)) >= sizeof(iclient.repo_name)) {
428 			return got_error_msg(GOT_ERR_NO_SPACE,
429 			    "repo name too long");
430 		}
431 		if (client_is_writing(client))
432 			iclient.is_writing = 1;
433 
434 		iclient.repo_child_pid = proc->pid;
435 	}
436 
437 	if (client->session)
438 		iclient.session_child_pid = client->session->pid;
439 
440 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_INFO_CLIENT, PROC_GOTD, -1,
441 	    &iclient, sizeof(iclient)) == -1) {
442 		err = got_error_from_errno("imsg compose INFO_CLIENT");
443 		if (err)
444 			return err;
445 	}
446 
447 	return NULL;
448 }
449 
450 static const struct got_error *
451 send_info(struct gotd_client *client)
452 {
453 	const struct got_error *err = NULL;
454 	struct gotd_imsg_info info;
455 	uint64_t slot;
456 	struct gotd_repo *repo;
457 
458 	if (client->euid != 0)
459 		return got_error_set_errno(EPERM, "info");
460 
461 	info.pid = gotd.pid;
462 	info.verbosity = gotd.verbosity;
463 	info.nrepos = gotd.nrepos;
464 	info.nclients = client_cnt - 1;
465 
466 	if (gotd_imsg_compose_event(&client->iev, GOTD_IMSG_INFO, PROC_GOTD, -1,
467 	    &info, sizeof(info)) == -1) {
468 		err = got_error_from_errno("imsg compose INFO");
469 		if (err)
470 			return err;
471 	}
472 
473 	TAILQ_FOREACH(repo, &gotd.repos, entry) {
474 		err = send_repo_info(&client->iev, repo);
475 		if (err)
476 			return err;
477 	}
478 
479 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
480 		struct gotd_client *c;
481 		STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
482 			if (c->id == client->id)
483 				continue;
484 			err = send_client_info(&client->iev, c);
485 			if (err)
486 				return err;
487 		}
488 	}
489 
490 	return NULL;
491 }
492 
493 static const struct got_error *
494 stop_gotd(struct gotd_client *client)
495 {
496 
497 	if (client->euid != 0)
498 		return got_error_set_errno(EPERM, "stop");
499 
500 	gotd_shutdown();
501 	/* NOTREACHED */
502 	return NULL;
503 }
504 
505 static struct gotd_repo *
506 find_repo_by_name(const char *repo_name)
507 {
508 	struct gotd_repo *repo;
509 	size_t namelen;
510 
511 	TAILQ_FOREACH(repo, &gotd.repos, entry) {
512 		namelen = strlen(repo->name);
513 		if (strncmp(repo->name, repo_name, namelen) != 0)
514 			continue;
515 		if (repo_name[namelen] == '\0' ||
516 		    strcmp(&repo_name[namelen], ".git") == 0)
517 			return repo;
518 	}
519 
520 	return NULL;
521 }
522 
523 static const struct got_error *
524 start_client_authentication(struct gotd_client *client, struct imsg *imsg)
525 {
526 	const struct got_error *err;
527 	struct gotd_imsg_list_refs ireq;
528 	struct gotd_repo *repo = NULL;
529 	size_t datalen;
530 
531 	log_debug("list-refs request from uid %d", client->euid);
532 
533 	if (client->state != GOTD_CLIENT_STATE_NEW)
534 		return got_error_msg(GOT_ERR_BAD_REQUEST,
535 		    "unexpected list-refs request received");
536 
537 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
538 	if (datalen != sizeof(ireq))
539 		return got_error(GOT_ERR_PRIVSEP_LEN);
540 
541 	memcpy(&ireq, imsg->data, datalen);
542 
543 	if (ireq.client_is_reading) {
544 		err = ensure_client_is_not_writing(client);
545 		if (err)
546 			return err;
547 		repo = find_repo_by_name(ireq.repo_name);
548 		if (repo == NULL)
549 			return got_error(GOT_ERR_NOT_GIT_REPO);
550 		err = start_auth_child(client, GOTD_AUTH_READ, repo,
551 		    gotd.argv0, gotd.confpath, gotd.daemonize,
552 		    gotd.verbosity);
553 		if (err)
554 			return err;
555 	} else {
556 		err = ensure_client_is_not_reading(client);
557 		if (err)
558 			return err;
559 		repo = find_repo_by_name(ireq.repo_name);
560 		if (repo == NULL)
561 			return got_error(GOT_ERR_NOT_GIT_REPO);
562 		err = start_auth_child(client,
563 		    GOTD_AUTH_READ | GOTD_AUTH_WRITE,
564 		    repo, gotd.argv0, gotd.confpath, gotd.daemonize,
565 		    gotd.verbosity);
566 		if (err)
567 			return err;
568 	}
569 
570 	evtimer_add(&client->tmo, &auth_timeout);
571 
572 	/* Flow continues upon authentication successs/failure or timeout. */
573 	return NULL;
574 }
575 
576 static void
577 gotd_request(int fd, short events, void *arg)
578 {
579 	struct gotd_imsgev *iev = arg;
580 	struct imsgbuf *ibuf = &iev->ibuf;
581 	struct gotd_client *client = iev->handler_arg;
582 	const struct got_error *err = NULL;
583 	struct imsg imsg;
584 	ssize_t n;
585 
586 	if (events & EV_WRITE) {
587 		while (ibuf->w.queued) {
588 			n = msgbuf_write(&ibuf->w);
589 			if (n == -1 && errno == EPIPE) {
590 				/*
591 				 * The client has closed its socket.
592 				 * This can happen when Git clients are
593 				 * done sending pack file data.
594 				 */
595 				msgbuf_clear(&ibuf->w);
596 				continue;
597 			} else if (n == -1 && errno != EAGAIN) {
598 				err = got_error_from_errno("imsg_flush");
599 				disconnect_on_error(client, err);
600 				return;
601 			}
602 			if (n == 0) {
603 				/* Connection closed. */
604 				err = got_error(GOT_ERR_EOF);
605 				disconnect_on_error(client, err);
606 				return;
607 			}
608 		}
609 
610 		/* Disconnect gotctl(8) now that messages have been sent. */
611 		if (!client_is_reading(client) && !client_is_writing(client)) {
612 			disconnect(client);
613 			return;
614 		}
615 	}
616 
617 	if ((events & EV_READ) == 0)
618 		return;
619 
620 	memset(&imsg, 0, sizeof(imsg));
621 
622 	while (err == NULL) {
623 		err = gotd_imsg_recv(&imsg, ibuf, 0);
624 		if (err) {
625 			if (err->code == GOT_ERR_PRIVSEP_READ)
626 				err = NULL;
627 			break;
628 		}
629 
630 		evtimer_del(&client->tmo);
631 
632 		switch (imsg.hdr.type) {
633 		case GOTD_IMSG_INFO:
634 			err = send_info(client);
635 			break;
636 		case GOTD_IMSG_STOP:
637 			err = stop_gotd(client);
638 			break;
639 		case GOTD_IMSG_LIST_REFS:
640 			err = start_client_authentication(client, &imsg);
641 			break;
642 		default:
643 			log_debug("unexpected imsg %d", imsg.hdr.type);
644 			err = got_error(GOT_ERR_PRIVSEP_MSG);
645 			break;
646 		}
647 
648 		imsg_free(&imsg);
649 	}
650 
651 	if (err) {
652 		disconnect_on_error(client, err);
653 	} else {
654 		gotd_imsg_event_add(&client->iev);
655 	}
656 }
657 
658 static void
659 gotd_auth_timeout(int fd, short events, void *arg)
660 {
661 	struct gotd_client *client = arg;
662 
663 	log_debug("disconnecting uid %d due to authentication timeout",
664 	    client->euid);
665 	disconnect(client);
666 }
667 
668 static const struct got_error *
669 recv_connect(uint32_t *client_id, struct imsg *imsg)
670 {
671 	const struct got_error *err = NULL;
672 	struct gotd_imsg_connect iconnect;
673 	size_t datalen;
674 	int s = -1;
675 	struct gotd_client *client = NULL;
676 
677 	*client_id = 0;
678 
679 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
680 	if (datalen != sizeof(iconnect))
681 		return got_error(GOT_ERR_PRIVSEP_LEN);
682 	memcpy(&iconnect, imsg->data, sizeof(iconnect));
683 
684 	s = imsg->fd;
685 	if (s == -1) {
686 		err = got_error(GOT_ERR_PRIVSEP_NO_FD);
687 		goto done;
688 	}
689 
690 	if (find_client(iconnect.client_id)) {
691 		err = got_error_msg(GOT_ERR_CLIENT_ID, "duplicate client ID");
692 		goto done;
693 	}
694 
695 	client = calloc(1, sizeof(*client));
696 	if (client == NULL) {
697 		err = got_error_from_errno("calloc");
698 		goto done;
699 	}
700 
701 	*client_id = iconnect.client_id;
702 
703 	client->state = GOTD_CLIENT_STATE_NEW;
704 	client->id = iconnect.client_id;
705 	client->fd = s;
706 	s = -1;
707 	/* The auth process will verify UID/GID for us. */
708 	client->euid = iconnect.euid;
709 	client->egid = iconnect.egid;
710 
711 	imsg_init(&client->iev.ibuf, client->fd);
712 	client->iev.handler = gotd_request;
713 	client->iev.events = EV_READ;
714 	client->iev.handler_arg = client;
715 
716 	event_set(&client->iev.ev, client->fd, EV_READ, gotd_request,
717 	    &client->iev);
718 	gotd_imsg_event_add(&client->iev);
719 
720 	evtimer_set(&client->tmo, gotd_auth_timeout, client);
721 
722 	add_client(client);
723 	log_debug("%s: new client uid %d connected on fd %d", __func__,
724 	    client->euid, client->fd);
725 done:
726 	if (err) {
727 		struct gotd_child_proc *listen_proc = &gotd.listen_proc;
728 		struct gotd_imsg_disconnect idisconnect;
729 
730 		idisconnect.client_id = client->id;
731 		if (gotd_imsg_compose_event(&listen_proc->iev,
732 		    GOTD_IMSG_DISCONNECT, PROC_GOTD, -1,
733 		    &idisconnect, sizeof(idisconnect)) == -1)
734 			log_warn("imsg compose DISCONNECT");
735 
736 		if (s != -1)
737 			close(s);
738 	}
739 
740 	return err;
741 }
742 
743 static const char *gotd_proc_names[PROC_MAX] = {
744 	"parent",
745 	"listen",
746 	"auth",
747 	"session",
748 	"repo_read",
749 	"repo_write"
750 };
751 
752 static void
753 kill_proc(struct gotd_child_proc *proc, int fatal)
754 {
755 	if (fatal) {
756 		log_warnx("sending SIGKILL to PID %d", proc->pid);
757 		kill(proc->pid, SIGKILL);
758 	} else
759 		kill(proc->pid, SIGTERM);
760 }
761 
762 static void
763 gotd_shutdown(void)
764 {
765 	struct gotd_child_proc *proc;
766 	uint64_t slot;
767 
768 	log_debug("shutting down");
769 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
770 		struct gotd_client *c, *tmp;
771 
772 		STAILQ_FOREACH_SAFE(c, &gotd_clients[slot], entry, tmp)
773 			disconnect(c);
774 	}
775 
776 	proc = &gotd.listen_proc;
777 	msgbuf_clear(&proc->iev.ibuf.w);
778 	close(proc->iev.ibuf.fd);
779 	kill_proc(proc, 0);
780 	wait_for_child(proc->pid);
781 
782 	log_info("terminating");
783 	exit(0);
784 }
785 
786 void
787 gotd_sighdlr(int sig, short event, void *arg)
788 {
789 	/*
790 	 * Normal signal handler rules don't apply because libevent
791 	 * decouples for us.
792 	 */
793 
794 	switch (sig) {
795 	case SIGHUP:
796 		log_info("%s: ignoring SIGHUP", __func__);
797 		break;
798 	case SIGUSR1:
799 		log_info("%s: ignoring SIGUSR1", __func__);
800 		break;
801 	case SIGTERM:
802 	case SIGINT:
803 		gotd_shutdown();
804 		break;
805 	default:
806 		fatalx("unexpected signal");
807 	}
808 }
809 
810 static const struct got_error *
811 ensure_proc_is_reading(struct gotd_client *client,
812     struct gotd_child_proc *proc)
813 {
814 	if (!client_is_reading(client)) {
815 		kill_proc(proc, 1);
816 		return got_error_fmt(GOT_ERR_BAD_PACKET,
817 		    "PID %d handled a read-request for uid %d but this "
818 		    "user is not reading from a repository", proc->pid,
819 		    client->euid);
820 	}
821 
822 	return NULL;
823 }
824 
825 static const struct got_error *
826 ensure_proc_is_writing(struct gotd_client *client,
827     struct gotd_child_proc *proc)
828 {
829 	if (!client_is_writing(client)) {
830 		kill_proc(proc, 1);
831 		return got_error_fmt(GOT_ERR_BAD_PACKET,
832 		    "PID %d handled a write-request for uid %d but this "
833 		    "user is not writing to a repository", proc->pid,
834 		    client->euid);
835 	}
836 
837 	return NULL;
838 }
839 
840 static int
841 verify_imsg_src(struct gotd_client *client, struct gotd_child_proc *proc,
842     struct imsg *imsg)
843 {
844 	const struct got_error *err;
845 	int ret = 0;
846 
847 	if (proc->type == PROC_REPO_READ || proc->type == PROC_REPO_WRITE) {
848 		if (client->repo == NULL)
849 			fatalx("no process found for uid %d", client->euid);
850 		if (proc->pid != client->repo->pid) {
851 			kill_proc(proc, 1);
852 			log_warnx("received message from PID %d for uid %d, "
853 			    "while PID %d is the process serving this user",
854 			    proc->pid, client->euid, client->repo->pid);
855 			return 0;
856 		}
857 	}
858 	if (proc->type == PROC_SESSION) {
859 		if (client->session == NULL) {
860 			log_warnx("no session found for uid %d", client->euid);
861 			return 0;
862 		}
863 		if (proc->pid != client->session->pid) {
864 			kill_proc(proc, 1);
865 			log_warnx("received message from PID %d for uid %d, "
866 			    "while PID %d is the process serving this user",
867 			    proc->pid, client->euid, client->session->pid);
868 			return 0;
869 		}
870 	}
871 
872 	switch (imsg->hdr.type) {
873 	case GOTD_IMSG_ERROR:
874 		ret = 1;
875 		break;
876 	case GOTD_IMSG_CONNECT:
877 		if (proc->type != PROC_LISTEN) {
878 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
879 			    "new connection for uid %d from PID %d "
880 			    "which is not the listen process",
881 			    proc->pid, client->euid);
882 		} else
883 			ret = 1;
884 		break;
885 	case GOTD_IMSG_ACCESS_GRANTED:
886 		if (proc->type != PROC_AUTH) {
887 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
888 			    "authentication of uid %d from PID %d "
889 			    "which is not the auth process",
890 			    proc->pid, client->euid);
891 		} else
892 			ret = 1;
893 		break;
894 	case GOTD_IMSG_CLIENT_SESSION_READY:
895 		if (proc->type != PROC_SESSION) {
896 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
897 			    "unexpected \"ready\" signal from PID %d",
898 			    proc->pid);
899 		} else
900 			ret = 1;
901 		break;
902 	case GOTD_IMSG_REPO_CHILD_READY:
903 		if (proc->type != PROC_REPO_READ &&
904 		    proc->type != PROC_REPO_WRITE) {
905 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
906 			    "unexpected \"ready\" signal from PID %d",
907 			    proc->pid);
908 		} else
909 			ret = 1;
910 		break;
911 	case GOTD_IMSG_PACKFILE_DONE:
912 		err = ensure_proc_is_reading(client, proc);
913 		if (err)
914 			log_warnx("uid %d: %s", client->euid, err->msg);
915 		else
916 			ret = 1;
917 		break;
918 	case GOTD_IMSG_PACKFILE_INSTALL:
919 	case GOTD_IMSG_REF_UPDATES_START:
920 	case GOTD_IMSG_REF_UPDATE:
921 		err = ensure_proc_is_writing(client, proc);
922 		if (err)
923 			log_warnx("uid %d: %s", client->euid, err->msg);
924 		else
925 			ret = 1;
926 		break;
927 	default:
928 		log_debug("%s: unexpected imsg %d", __func__, imsg->hdr.type);
929 		break;
930 	}
931 
932 	return ret;
933 }
934 
935 static const struct got_error *
936 connect_repo_child(struct gotd_client *client,
937     struct gotd_child_proc *repo_proc)
938 {
939 	static const struct got_error *err;
940 	struct gotd_imsgev *session_iev = &client->session->iev;
941 	struct gotd_imsg_connect_repo_child ireq;
942 	int pipe[2];
943 
944 	if (client->state != GOTD_CLIENT_STATE_ACCESS_GRANTED)
945 		return got_error_msg(GOT_ERR_BAD_REQUEST,
946 		    "unexpected repo child ready signal received");
947 
948 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
949 	    PF_UNSPEC, pipe) == -1)
950 		fatal("socketpair");
951 
952 	memset(&ireq, 0, sizeof(ireq));
953 	ireq.client_id = client->id;
954 	ireq.proc_id = repo_proc->type;
955 
956 	/* Pass repo child pipe to session child process. */
957 	if (gotd_imsg_compose_event(session_iev, GOTD_IMSG_CONNECT_REPO_CHILD,
958 	    PROC_GOTD, pipe[0], &ireq, sizeof(ireq)) == -1) {
959 		err = got_error_from_errno("imsg compose CONNECT_REPO_CHILD");
960 		close(pipe[0]);
961 		close(pipe[1]);
962 		return err;
963 	}
964 
965 	/* Pass session child pipe to repo child process. */
966 	if (gotd_imsg_compose_event(&repo_proc->iev,
967 	    GOTD_IMSG_CONNECT_REPO_CHILD, PROC_GOTD, pipe[1], NULL, 0) == -1) {
968 		err = got_error_from_errno("imsg compose CONNECT_REPO_CHILD");
969 		close(pipe[1]);
970 		return err;
971 	}
972 
973 	return NULL;
974 }
975 
976 static void
977 gotd_dispatch_listener(int fd, short event, void *arg)
978 {
979 	struct gotd_imsgev *iev = arg;
980 	struct imsgbuf *ibuf = &iev->ibuf;
981 	struct gotd_child_proc *proc = &gotd.listen_proc;
982 	ssize_t n;
983 	int shut = 0;
984 	struct imsg imsg;
985 
986 	if (proc->iev.ibuf.fd != fd)
987 		fatalx("%s: unexpected fd %d", __func__, fd);
988 
989 	if (event & EV_READ) {
990 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
991 			fatal("imsg_read error");
992 		if (n == 0) {
993 			/* Connection closed. */
994 			shut = 1;
995 			goto done;
996 		}
997 	}
998 
999 	if (event & EV_WRITE) {
1000 		n = msgbuf_write(&ibuf->w);
1001 		if (n == -1 && errno != EAGAIN)
1002 			fatal("msgbuf_write");
1003 		if (n == 0) {
1004 			/* Connection closed. */
1005 			shut = 1;
1006 			goto done;
1007 		}
1008 	}
1009 
1010 	for (;;) {
1011 		const struct got_error *err = NULL;
1012 		struct gotd_client *client = NULL;
1013 		uint32_t client_id = 0;
1014 		int do_disconnect = 0;
1015 
1016 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1017 			fatal("%s: imsg_get error", __func__);
1018 		if (n == 0)	/* No more messages. */
1019 			break;
1020 
1021 		switch (imsg.hdr.type) {
1022 		case GOTD_IMSG_ERROR:
1023 			do_disconnect = 1;
1024 			err = gotd_imsg_recv_error(&client_id, &imsg);
1025 			break;
1026 		case GOTD_IMSG_CONNECT:
1027 			err = recv_connect(&client_id, &imsg);
1028 			break;
1029 		default:
1030 			log_debug("unexpected imsg %d", imsg.hdr.type);
1031 			break;
1032 		}
1033 
1034 		client = find_client(client_id);
1035 		if (client == NULL) {
1036 			log_warnx("%s: client not found", __func__);
1037 			imsg_free(&imsg);
1038 			continue;
1039 		}
1040 
1041 		if (err)
1042 			log_warnx("uid %d: %s", client->euid, err->msg);
1043 
1044 		if (do_disconnect) {
1045 			if (err)
1046 				disconnect_on_error(client, err);
1047 			else
1048 				disconnect(client);
1049 		}
1050 
1051 		imsg_free(&imsg);
1052 	}
1053 done:
1054 	if (!shut) {
1055 		gotd_imsg_event_add(iev);
1056 	} else {
1057 		/* This pipe is dead. Remove its event handler */
1058 		event_del(&iev->ev);
1059 		event_loopexit(NULL);
1060 	}
1061 }
1062 
1063 static void
1064 gotd_dispatch_auth_child(int fd, short event, void *arg)
1065 {
1066 	const struct got_error *err = NULL;
1067 	struct gotd_imsgev *iev = arg;
1068 	struct imsgbuf *ibuf = &iev->ibuf;
1069 	struct gotd_client *client;
1070 	struct gotd_repo *repo = NULL;
1071 	ssize_t n;
1072 	int shut = 0;
1073 	struct imsg imsg;
1074 	uint32_t client_id = 0;
1075 	int do_disconnect = 0;
1076 
1077 	client = find_client_by_proc_fd(fd);
1078 	if (client == NULL)
1079 		fatalx("cannot find client for fd %d", fd);
1080 
1081 	if (client->auth == NULL)
1082 		fatalx("cannot find auth child process for fd %d", fd);
1083 
1084 	if (event & EV_READ) {
1085 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1086 			fatal("imsg_read error");
1087 		if (n == 0) {
1088 			/* Connection closed. */
1089 			shut = 1;
1090 			goto done;
1091 		}
1092 	}
1093 
1094 	if (event & EV_WRITE) {
1095 		n = msgbuf_write(&ibuf->w);
1096 		if (n == -1 && errno != EAGAIN)
1097 			fatal("msgbuf_write");
1098 		if (n == 0) {
1099 			/* Connection closed. */
1100 			shut = 1;
1101 		}
1102 		goto done;
1103 	}
1104 
1105 	if (client->auth->iev.ibuf.fd != fd)
1106 		fatalx("%s: unexpected fd %d", __func__, fd);
1107 
1108 	if ((n = imsg_get(ibuf, &imsg)) == -1)
1109 		fatal("%s: imsg_get error", __func__);
1110 	if (n == 0)	/* No more messages. */
1111 		return;
1112 
1113 	evtimer_del(&client->tmo);
1114 
1115 	switch (imsg.hdr.type) {
1116 	case GOTD_IMSG_ERROR:
1117 		do_disconnect = 1;
1118 		err = gotd_imsg_recv_error(&client_id, &imsg);
1119 		break;
1120 	case GOTD_IMSG_ACCESS_GRANTED:
1121 		client->state = GOTD_CLIENT_STATE_ACCESS_GRANTED;
1122 		break;
1123 	default:
1124 		do_disconnect = 1;
1125 		log_debug("unexpected imsg %d", imsg.hdr.type);
1126 		break;
1127 	}
1128 
1129 	if (!verify_imsg_src(client, client->auth, &imsg)) {
1130 		do_disconnect = 1;
1131 		log_debug("dropping imsg type %d from PID %d",
1132 		    imsg.hdr.type, client->auth->pid);
1133 	}
1134 	imsg_free(&imsg);
1135 
1136 	if (do_disconnect) {
1137 		if (err)
1138 			disconnect_on_error(client, err);
1139 		else
1140 			disconnect(client);
1141 		goto done;
1142 	}
1143 
1144 	repo = find_repo_by_name(client->auth->repo_name);
1145 	if (repo == NULL) {
1146 		err = got_error(GOT_ERR_NOT_GIT_REPO);
1147 		goto done;
1148 	}
1149 	kill_auth_proc(client);
1150 
1151 	log_info("authenticated uid %d for repository %s",
1152 	    client->euid, repo->name);
1153 
1154 	err = start_session_child(client, repo, gotd.argv0,
1155 	    gotd.confpath, gotd.daemonize, gotd.verbosity);
1156 	if (err)
1157 		goto done;
1158 done:
1159 	if (err)
1160 		log_warnx("uid %d: %s", client->euid, err->msg);
1161 
1162 	/* We might have killed the auth process by now. */
1163 	if (client->auth != NULL) {
1164 		if (!shut) {
1165 			gotd_imsg_event_add(iev);
1166 		} else {
1167 			/* This pipe is dead. Remove its event handler */
1168 			event_del(&iev->ev);
1169 		}
1170 	}
1171 }
1172 
1173 static const struct got_error *
1174 connect_session(struct gotd_client *client)
1175 {
1176 	const struct got_error *err = NULL;
1177 	struct gotd_imsg_connect iconnect;
1178 	int s;
1179 
1180 	memset(&iconnect, 0, sizeof(iconnect));
1181 
1182 	s = dup(client->fd);
1183 	if (s == -1)
1184 		return got_error_from_errno("dup");
1185 
1186 	iconnect.client_id = client->id;
1187 	iconnect.euid = client->euid;
1188 	iconnect.egid = client->egid;
1189 
1190 	if (gotd_imsg_compose_event(&client->session->iev, GOTD_IMSG_CONNECT,
1191 	    PROC_GOTD, s, &iconnect, sizeof(iconnect)) == -1) {
1192 		err = got_error_from_errno("imsg compose CONNECT");
1193 		close(s);
1194 		return err;
1195 	}
1196 
1197 	/*
1198 	 * We are no longer interested in messages from this client.
1199 	 * Further client requests will be handled by the session process.
1200 	 */
1201 	msgbuf_clear(&client->iev.ibuf.w);
1202 	imsg_clear(&client->iev.ibuf);
1203 	event_del(&client->iev.ev);
1204 	client->fd = -1; /* will be closed via copy in client->iev.ibuf.fd */
1205 
1206 	return NULL;
1207 }
1208 
1209 static void
1210 gotd_dispatch_client_session(int fd, short event, void *arg)
1211 {
1212 	struct gotd_imsgev *iev = arg;
1213 	struct imsgbuf *ibuf = &iev->ibuf;
1214 	struct gotd_child_proc *proc = NULL;
1215 	struct gotd_client *client = NULL;
1216 	ssize_t n;
1217 	int shut = 0;
1218 	struct imsg imsg;
1219 
1220 	client = find_client_by_proc_fd(fd);
1221 	if (client == NULL)
1222 		fatalx("cannot find client for fd %d", fd);
1223 
1224 	if (event & EV_READ) {
1225 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1226 			fatal("imsg_read error");
1227 		if (n == 0) {
1228 			/* Connection closed. */
1229 			shut = 1;
1230 			goto done;
1231 		}
1232 	}
1233 
1234 	if (event & EV_WRITE) {
1235 		n = msgbuf_write(&ibuf->w);
1236 		if (n == -1 && errno != EAGAIN)
1237 			fatal("msgbuf_write");
1238 		if (n == 0) {
1239 			/* Connection closed. */
1240 			shut = 1;
1241 			goto done;
1242 		}
1243 	}
1244 
1245 	proc = client->session;
1246 	if (proc == NULL)
1247 		fatalx("cannot find session child process for fd %d", fd);
1248 
1249 	for (;;) {
1250 		const struct got_error *err = NULL;
1251 		uint32_t client_id = 0;
1252 		int do_disconnect = 0, do_start_repo_child = 0;
1253 
1254 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1255 			fatal("%s: imsg_get error", __func__);
1256 		if (n == 0)	/* No more messages. */
1257 			break;
1258 
1259 		switch (imsg.hdr.type) {
1260 		case GOTD_IMSG_ERROR:
1261 			do_disconnect = 1;
1262 			err = gotd_imsg_recv_error(&client_id, &imsg);
1263 			break;
1264 		case GOTD_IMSG_CLIENT_SESSION_READY:
1265 			if (client->state != GOTD_CLIENT_STATE_ACCESS_GRANTED) {
1266 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1267 				break;
1268 			}
1269 			do_start_repo_child = 1;
1270 			break;
1271 		case GOTD_IMSG_DISCONNECT:
1272 			do_disconnect = 1;
1273 			break;
1274 		default:
1275 			log_debug("unexpected imsg %d", imsg.hdr.type);
1276 			break;
1277 		}
1278 
1279 		if (!verify_imsg_src(client, proc, &imsg)) {
1280 			log_debug("dropping imsg type %d from PID %d",
1281 			    imsg.hdr.type, proc->pid);
1282 			imsg_free(&imsg);
1283 			continue;
1284 		}
1285 		if (err)
1286 			log_warnx("uid %d: %s", client->euid, err->msg);
1287 
1288 		if (do_start_repo_child) {
1289 			struct gotd_repo *repo;
1290 
1291 			repo = find_repo_by_name(client->session->repo_name);
1292 			if (repo != NULL) {
1293 				enum gotd_procid proc_type;
1294 
1295 				if (client->required_auth & GOTD_AUTH_WRITE)
1296 					proc_type = PROC_REPO_WRITE;
1297 				else
1298 					proc_type = PROC_REPO_READ;
1299 
1300 				err = start_repo_child(client, proc_type, repo,
1301 				    gotd.argv0, gotd.confpath, gotd.daemonize,
1302 				    gotd.verbosity);
1303 			} else
1304 				err = got_error(GOT_ERR_NOT_GIT_REPO);
1305 
1306 			if (err) {
1307 				log_warnx("uid %d: %s", client->euid, err->msg);
1308 				do_disconnect = 1;
1309 			}
1310 		}
1311 
1312 		if (do_disconnect) {
1313 			if (err)
1314 				disconnect_on_error(client, err);
1315 			else
1316 				disconnect(client);
1317 		}
1318 
1319 		imsg_free(&imsg);
1320 	}
1321 done:
1322 	if (!shut) {
1323 		gotd_imsg_event_add(iev);
1324 	} else {
1325 		/* This pipe is dead. Remove its event handler */
1326 		event_del(&iev->ev);
1327 		disconnect(client);
1328 	}
1329 }
1330 
1331 static void
1332 gotd_dispatch_repo_child(int fd, short event, void *arg)
1333 {
1334 	struct gotd_imsgev *iev = arg;
1335 	struct imsgbuf *ibuf = &iev->ibuf;
1336 	struct gotd_child_proc *proc = NULL;
1337 	struct gotd_client *client;
1338 	ssize_t n;
1339 	int shut = 0;
1340 	struct imsg imsg;
1341 
1342 	client = find_client_by_proc_fd(fd);
1343 	if (client == NULL)
1344 		fatalx("cannot find client for fd %d", fd);
1345 
1346 	if (event & EV_READ) {
1347 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1348 			fatal("imsg_read error");
1349 		if (n == 0) {
1350 			/* Connection closed. */
1351 			shut = 1;
1352 			goto done;
1353 		}
1354 	}
1355 
1356 	if (event & EV_WRITE) {
1357 		n = msgbuf_write(&ibuf->w);
1358 		if (n == -1 && errno != EAGAIN)
1359 			fatal("msgbuf_write");
1360 		if (n == 0) {
1361 			/* Connection closed. */
1362 			shut = 1;
1363 			goto done;
1364 		}
1365 	}
1366 
1367 	proc = client->repo;
1368 	if (proc == NULL)
1369 		fatalx("cannot find child process for fd %d", fd);
1370 
1371 	for (;;) {
1372 		const struct got_error *err = NULL;
1373 		uint32_t client_id = 0;
1374 		int do_disconnect = 0;
1375 
1376 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1377 			fatal("%s: imsg_get error", __func__);
1378 		if (n == 0)	/* No more messages. */
1379 			break;
1380 
1381 		switch (imsg.hdr.type) {
1382 		case GOTD_IMSG_ERROR:
1383 			do_disconnect = 1;
1384 			err = gotd_imsg_recv_error(&client_id, &imsg);
1385 			break;
1386 		case GOTD_IMSG_REPO_CHILD_READY:
1387 			err = connect_session(client);
1388 			if (err)
1389 				break;
1390 			err = connect_repo_child(client, proc);
1391 			break;
1392 		default:
1393 			log_debug("unexpected imsg %d", imsg.hdr.type);
1394 			break;
1395 		}
1396 
1397 		if (!verify_imsg_src(client, proc, &imsg)) {
1398 			log_debug("dropping imsg type %d from PID %d",
1399 			    imsg.hdr.type, proc->pid);
1400 			imsg_free(&imsg);
1401 			continue;
1402 		}
1403 		if (err)
1404 			log_warnx("uid %d: %s", client->euid, err->msg);
1405 
1406 		if (do_disconnect) {
1407 			if (err)
1408 				disconnect_on_error(client, err);
1409 			else
1410 				disconnect(client);
1411 		}
1412 
1413 		imsg_free(&imsg);
1414 	}
1415 done:
1416 	if (!shut) {
1417 		gotd_imsg_event_add(iev);
1418 	} else {
1419 		/* This pipe is dead. Remove its event handler */
1420 		event_del(&iev->ev);
1421 		disconnect(client);
1422 	}
1423 }
1424 
1425 static pid_t
1426 start_child(enum gotd_procid proc_id, const char *repo_path,
1427     char *argv0, const char *confpath, int fd, int daemonize, int verbosity)
1428 {
1429 	char	*argv[11];
1430 	int	 argc = 0;
1431 	pid_t	 pid;
1432 
1433 	switch (pid = fork()) {
1434 	case -1:
1435 		fatal("cannot fork");
1436 	case 0:
1437 		break;
1438 	default:
1439 		close(fd);
1440 		return pid;
1441 	}
1442 
1443 	if (fd != GOTD_FILENO_MSG_PIPE) {
1444 		if (dup2(fd, GOTD_FILENO_MSG_PIPE) == -1)
1445 			fatal("cannot setup imsg fd");
1446 	} else if (fcntl(fd, F_SETFD, 0) == -1)
1447 		fatal("cannot setup imsg fd");
1448 
1449 	argv[argc++] = argv0;
1450 	switch (proc_id) {
1451 	case PROC_LISTEN:
1452 		argv[argc++] = (char *)"-L";
1453 		break;
1454 	case PROC_AUTH:
1455 		argv[argc++] = (char *)"-A";
1456 		break;
1457 	case PROC_SESSION:
1458 		argv[argc++] = (char *)"-S";
1459 		break;
1460 	case PROC_REPO_READ:
1461 		argv[argc++] = (char *)"-R";
1462 		break;
1463 	case PROC_REPO_WRITE:
1464 		argv[argc++] = (char *)"-W";
1465 		break;
1466 	default:
1467 		fatalx("invalid process id %d", proc_id);
1468 	}
1469 
1470 	argv[argc++] = (char *)"-f";
1471 	argv[argc++] = (char *)confpath;
1472 
1473 	if (repo_path) {
1474 		argv[argc++] = (char *)"-P";
1475 		argv[argc++] = (char *)repo_path;
1476 	}
1477 
1478 	if (!daemonize)
1479 		argv[argc++] = (char *)"-d";
1480 	if (verbosity > 0)
1481 		argv[argc++] = (char *)"-v";
1482 	if (verbosity > 1)
1483 		argv[argc++] = (char *)"-v";
1484 	argv[argc++] = NULL;
1485 
1486 	execvp(argv0, argv);
1487 	fatal("execvp");
1488 }
1489 
1490 static void
1491 start_listener(char *argv0, const char *confpath, int daemonize, int verbosity)
1492 {
1493 	struct gotd_child_proc *proc = &gotd.listen_proc;
1494 
1495 	proc->type = PROC_LISTEN;
1496 
1497 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1498 	    PF_UNSPEC, proc->pipe) == -1)
1499 		fatal("socketpair");
1500 
1501 	proc->pid = start_child(proc->type, NULL, argv0, confpath,
1502 	    proc->pipe[1], daemonize, verbosity);
1503 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1504 	proc->iev.handler = gotd_dispatch_listener;
1505 	proc->iev.events = EV_READ;
1506 	proc->iev.handler_arg = NULL;
1507 }
1508 
1509 static const struct got_error *
1510 start_session_child(struct gotd_client *client, struct gotd_repo *repo,
1511     char *argv0, const char *confpath, int daemonize, int verbosity)
1512 {
1513 	struct gotd_child_proc *proc;
1514 
1515 	proc = calloc(1, sizeof(*proc));
1516 	if (proc == NULL)
1517 		return got_error_from_errno("calloc");
1518 
1519 	proc->type = PROC_SESSION;
1520 	if (strlcpy(proc->repo_name, repo->name,
1521 	    sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
1522 		fatalx("repository name too long: %s", repo->name);
1523 	log_debug("starting client uid %d session for repository %s",
1524 	    client->euid, repo->name);
1525 	if (strlcpy(proc->repo_path, repo->path, sizeof(proc->repo_path)) >=
1526 	    sizeof(proc->repo_path))
1527 		fatalx("repository path too long: %s", repo->path);
1528 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1529 	    PF_UNSPEC, proc->pipe) == -1)
1530 		fatal("socketpair");
1531 	proc->pid = start_child(proc->type, proc->repo_path, argv0,
1532 	    confpath, proc->pipe[1], daemonize, verbosity);
1533 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1534 	log_debug("proc %s %s is on fd %d",
1535 	    gotd_proc_names[proc->type], proc->repo_path,
1536 	    proc->pipe[0]);
1537 	proc->iev.handler = gotd_dispatch_client_session;
1538 	proc->iev.events = EV_READ;
1539 	proc->iev.handler_arg = NULL;
1540 	event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
1541 	    gotd_dispatch_client_session, &proc->iev);
1542 	gotd_imsg_event_add(&proc->iev);
1543 
1544 	client->session = proc;
1545 	return NULL;
1546 }
1547 
1548 static const struct got_error *
1549 start_repo_child(struct gotd_client *client, enum gotd_procid proc_type,
1550     struct gotd_repo *repo, char *argv0, const char *confpath,
1551     int daemonize, int verbosity)
1552 {
1553 	struct gotd_child_proc *proc;
1554 
1555 	if (proc_type != PROC_REPO_READ && proc_type != PROC_REPO_WRITE)
1556 		return got_error_msg(GOT_ERR_NOT_IMPL, "bad process type");
1557 
1558 	proc = calloc(1, sizeof(*proc));
1559 	if (proc == NULL)
1560 		return got_error_from_errno("calloc");
1561 
1562 	proc->type = proc_type;
1563 	if (strlcpy(proc->repo_name, repo->name,
1564 	    sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
1565 		fatalx("repository name too long: %s", repo->name);
1566 	log_debug("starting %s for repository %s",
1567 	    proc->type == PROC_REPO_READ ? "reader" : "writer", repo->name);
1568 	if (strlcpy(proc->repo_path, repo->path, sizeof(proc->repo_path)) >=
1569 	    sizeof(proc->repo_path))
1570 		fatalx("repository path too long: %s", repo->path);
1571 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1572 	    PF_UNSPEC, proc->pipe) == -1)
1573 		fatal("socketpair");
1574 	proc->pid = start_child(proc->type, proc->repo_path, argv0,
1575 	    confpath, proc->pipe[1], daemonize, verbosity);
1576 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1577 	log_debug("proc %s %s is on fd %d",
1578 	    gotd_proc_names[proc->type], proc->repo_path,
1579 	    proc->pipe[0]);
1580 	proc->iev.handler = gotd_dispatch_repo_child;
1581 	proc->iev.events = EV_READ;
1582 	proc->iev.handler_arg = NULL;
1583 	event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
1584 	    gotd_dispatch_repo_child, &proc->iev);
1585 	gotd_imsg_event_add(&proc->iev);
1586 
1587 	client->repo = proc;
1588 	return NULL;
1589 }
1590 
1591 static const struct got_error *
1592 start_auth_child(struct gotd_client *client, int required_auth,
1593     struct gotd_repo *repo, char *argv0, const char *confpath,
1594     int daemonize, int verbosity)
1595 {
1596 	const struct got_error *err = NULL;
1597 	struct gotd_child_proc *proc;
1598 	struct gotd_imsg_auth iauth;
1599 	int fd;
1600 
1601 	memset(&iauth, 0, sizeof(iauth));
1602 
1603 	fd = dup(client->fd);
1604 	if (fd == -1)
1605 		return got_error_from_errno("dup");
1606 
1607 	proc = calloc(1, sizeof(*proc));
1608 	if (proc == NULL) {
1609 		err = got_error_from_errno("calloc");
1610 		close(fd);
1611 		return err;
1612 	}
1613 
1614 	proc->type = PROC_AUTH;
1615 	if (strlcpy(proc->repo_name, repo->name,
1616 	    sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
1617 		fatalx("repository name too long: %s", repo->name);
1618 	log_debug("starting auth for uid %d repository %s",
1619 	    client->euid, repo->name);
1620 	if (strlcpy(proc->repo_path, repo->path, sizeof(proc->repo_path)) >=
1621 	    sizeof(proc->repo_path))
1622 		fatalx("repository path too long: %s", repo->path);
1623 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1624 	    PF_UNSPEC, proc->pipe) == -1)
1625 		fatal("socketpair");
1626 	proc->pid = start_child(proc->type, proc->repo_path, argv0,
1627 	    confpath, proc->pipe[1], daemonize, verbosity);
1628 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1629 	log_debug("proc %s %s is on fd %d",
1630 	    gotd_proc_names[proc->type], proc->repo_path,
1631 	    proc->pipe[0]);
1632 	proc->iev.handler = gotd_dispatch_auth_child;
1633 	proc->iev.events = EV_READ;
1634 	proc->iev.handler_arg = NULL;
1635 	event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
1636 	    gotd_dispatch_auth_child, &proc->iev);
1637 	gotd_imsg_event_add(&proc->iev);
1638 
1639 	iauth.euid = client->euid;
1640 	iauth.egid = client->egid;
1641 	iauth.required_auth = required_auth;
1642 	iauth.client_id = client->id;
1643 	if (gotd_imsg_compose_event(&proc->iev, GOTD_IMSG_AUTHENTICATE,
1644 	    PROC_GOTD, fd, &iauth, sizeof(iauth)) == -1) {
1645 		log_warn("imsg compose AUTHENTICATE");
1646 		close(fd);
1647 		/* Let the auth_timeout handler tidy up. */
1648 	}
1649 
1650 	client->auth = proc;
1651 	client->required_auth = required_auth;
1652 	return NULL;
1653 }
1654 
1655 static void
1656 apply_unveil_repo_readonly(const char *repo_path)
1657 {
1658 	if (unveil(repo_path, "r") == -1)
1659 		fatal("unveil %s", repo_path);
1660 
1661 	if (unveil(NULL, NULL) == -1)
1662 		fatal("unveil");
1663 }
1664 
1665 static void
1666 apply_unveil_repo_readwrite(const char *repo_path)
1667 {
1668 	if (unveil(repo_path, "rwc") == -1)
1669 		fatal("unveil %s", repo_path);
1670 
1671 	if (unveil(GOT_TMPDIR_STR, "rwc") == -1)
1672 		fatal("unveil %s", GOT_TMPDIR_STR);
1673 
1674 	if (unveil(NULL, NULL) == -1)
1675 		fatal("unveil");
1676 }
1677 
1678 static void
1679 apply_unveil_none(void)
1680 {
1681 	if (unveil("/", "") == -1)
1682 		fatal("unveil");
1683 
1684 	if (unveil(NULL, NULL) == -1)
1685 		fatal("unveil");
1686 }
1687 
1688 static void
1689 apply_unveil_selfexec(void)
1690 {
1691 	if (unveil(gotd.argv0, "x") == -1)
1692 		fatal("unveil %s", gotd.argv0);
1693 
1694 	if (unveil(NULL, NULL) == -1)
1695 		fatal("unveil");
1696 }
1697 
1698 int
1699 main(int argc, char **argv)
1700 {
1701 	const struct got_error *error = NULL;
1702 	int ch, fd = -1, daemonize = 1, verbosity = 0, noaction = 0;
1703 	const char *confpath = GOTD_CONF_PATH;
1704 	char *argv0 = argv[0];
1705 	char title[2048];
1706 	struct passwd *pw = NULL;
1707 	char *repo_path = NULL;
1708 	enum gotd_procid proc_id = PROC_GOTD;
1709 	struct event evsigint, evsigterm, evsighup, evsigusr1;
1710 	int *pack_fds = NULL, *temp_fds = NULL;
1711 
1712 	log_init(1, LOG_DAEMON); /* Log to stderr until daemonized. */
1713 
1714 	while ((ch = getopt(argc, argv, "Adf:LnP:RSvW")) != -1) {
1715 		switch (ch) {
1716 		case 'A':
1717 			proc_id = PROC_AUTH;
1718 			break;
1719 		case 'd':
1720 			daemonize = 0;
1721 			break;
1722 		case 'f':
1723 			confpath = optarg;
1724 			break;
1725 		case 'L':
1726 			proc_id = PROC_LISTEN;
1727 			break;
1728 		case 'n':
1729 			noaction = 1;
1730 			break;
1731 		case 'P':
1732 			repo_path = realpath(optarg, NULL);
1733 			if (repo_path == NULL)
1734 				fatal("realpath '%s'", optarg);
1735 			break;
1736 		case 'R':
1737 			proc_id = PROC_REPO_READ;
1738 			break;
1739 		case 'S':
1740 			proc_id = PROC_SESSION;
1741 			break;
1742 		case 'v':
1743 			if (verbosity < 3)
1744 				verbosity++;
1745 			break;
1746 		case 'W':
1747 			proc_id = PROC_REPO_WRITE;
1748 			break;
1749 		default:
1750 			usage();
1751 		}
1752 	}
1753 
1754 	argc -= optind;
1755 	argv += optind;
1756 
1757 	if (argc != 0)
1758 		usage();
1759 
1760 	if (geteuid() && (proc_id == PROC_GOTD || proc_id == PROC_LISTEN))
1761 		fatalx("need root privileges");
1762 
1763 	if (parse_config(confpath, proc_id, &gotd) != 0)
1764 		return 1;
1765 
1766 	pw = getpwnam(gotd.user_name);
1767 	if (pw == NULL)
1768 		fatalx("user %s not found", gotd.user_name);
1769 
1770 	if (pw->pw_uid == 0)
1771 		fatalx("cannot run %s as the superuser", getprogname());
1772 
1773 	if (noaction) {
1774 		fprintf(stderr, "configuration OK\n");
1775 		return 0;
1776 	}
1777 
1778 	gotd.argv0 = argv0;
1779 	gotd.daemonize = daemonize;
1780 	gotd.verbosity = verbosity;
1781 	gotd.confpath = confpath;
1782 
1783 	/* Require an absolute path in argv[0] for reliable re-exec. */
1784 	if (!got_path_is_absolute(argv0))
1785 		fatalx("bad path \"%s\": must be an absolute path", argv0);
1786 
1787 	log_init(daemonize ? 0 : 1, LOG_DAEMON);
1788 	log_setverbose(verbosity);
1789 
1790 	if (proc_id == PROC_GOTD) {
1791 		snprintf(title, sizeof(title), "%s", gotd_proc_names[proc_id]);
1792 		arc4random_buf(&clients_hash_key, sizeof(clients_hash_key));
1793 		if (daemonize && daemon(1, 0) == -1)
1794 			fatal("daemon");
1795 		gotd.pid = getpid();
1796 		start_listener(argv0, confpath, daemonize, verbosity);
1797 	} else if (proc_id == PROC_LISTEN) {
1798 		snprintf(title, sizeof(title), "%s", gotd_proc_names[proc_id]);
1799 		if (verbosity) {
1800 			log_info("socket: %s", gotd.unix_socket_path);
1801 			log_info("user: %s", pw->pw_name);
1802 		}
1803 
1804 		fd = unix_socket_listen(gotd.unix_socket_path, pw->pw_uid,
1805 		    pw->pw_gid);
1806 		if (fd == -1) {
1807 			fatal("cannot listen on unix socket %s",
1808 			    gotd.unix_socket_path);
1809 		}
1810 	} else if (proc_id == PROC_AUTH) {
1811 		snprintf(title, sizeof(title), "%s %s",
1812 		    gotd_proc_names[proc_id], repo_path);
1813 	} else if (proc_id == PROC_REPO_READ || proc_id == PROC_REPO_WRITE ||
1814 	    proc_id == PROC_SESSION) {
1815 		error = got_repo_pack_fds_open(&pack_fds);
1816 		if (error != NULL)
1817 			fatalx("cannot open pack tempfiles: %s", error->msg);
1818 		error = got_repo_temp_fds_open(&temp_fds);
1819 		if (error != NULL)
1820 			fatalx("cannot open pack tempfiles: %s", error->msg);
1821 		if (repo_path == NULL)
1822 			fatalx("repository path not specified");
1823 		snprintf(title, sizeof(title), "%s %s",
1824 		    gotd_proc_names[proc_id], repo_path);
1825 	} else
1826 		fatal("invalid process id %d", proc_id);
1827 
1828 	setproctitle("%s", title);
1829 	log_procinit(title);
1830 
1831 	/* Drop root privileges. */
1832 	if (setgid(pw->pw_gid) == -1)
1833 		fatal("setgid %d failed", pw->pw_gid);
1834 	if (setuid(pw->pw_uid) == -1)
1835 		fatal("setuid %d failed", pw->pw_uid);
1836 
1837 	event_init();
1838 
1839 	switch (proc_id) {
1840 	case PROC_GOTD:
1841 #ifndef PROFILE
1842 		/* "exec" promise will be limited to argv[0] via unveil(2). */
1843 		if (pledge("stdio proc exec sendfd recvfd unveil", NULL) == -1)
1844 			err(1, "pledge");
1845 #endif
1846 		break;
1847 	case PROC_LISTEN:
1848 #ifndef PROFILE
1849 		if (pledge("stdio sendfd unix unveil", NULL) == -1)
1850 			err(1, "pledge");
1851 #endif
1852 		/*
1853 		 * Ensure that AF_UNIX bind(2) cannot be used with any other
1854 		 * sockets by revoking all filesystem access via unveil(2).
1855 		 */
1856 		apply_unveil_none();
1857 
1858 		listen_main(title, fd, gotd.connection_limits,
1859 		    gotd.nconnection_limits);
1860 		/* NOTREACHED */
1861 		break;
1862 	case PROC_AUTH:
1863 #ifndef PROFILE
1864 		if (pledge("stdio getpw recvfd unix unveil", NULL) == -1)
1865 			err(1, "pledge");
1866 #endif
1867 		/*
1868 		 * We need the "unix" pledge promise for getpeername(2) only.
1869 		 * Ensure that AF_UNIX bind(2) cannot be used by revoking all
1870 		 * filesystem access via unveil(2). Access to password database
1871 		 * files will still work since "getpw" bypasses unveil(2).
1872 		 */
1873 		apply_unveil_none();
1874 
1875 		auth_main(title, &gotd.repos, repo_path);
1876 		/* NOTREACHED */
1877 		break;
1878 	case PROC_SESSION:
1879 #ifndef PROFILE
1880 		/*
1881 		 * The "recvfd" promise is only needed during setup and
1882 		 * will be removed in a later pledge(2) call.
1883 		 */
1884 		if (pledge("stdio rpath wpath cpath recvfd sendfd fattr flock "
1885 		    "unveil", NULL) == -1)
1886 			err(1, "pledge");
1887 #endif
1888 		apply_unveil_repo_readwrite(repo_path);
1889 		session_main(title, repo_path, pack_fds, temp_fds,
1890 		    &gotd.request_timeout);
1891 		/* NOTREACHED */
1892 		break;
1893 	case PROC_REPO_READ:
1894 #ifndef PROFILE
1895 		if (pledge("stdio rpath recvfd unveil", NULL) == -1)
1896 			err(1, "pledge");
1897 #endif
1898 		apply_unveil_repo_readonly(repo_path);
1899 		repo_read_main(title, repo_path, pack_fds, temp_fds);
1900 		/* NOTREACHED */
1901 		exit(0);
1902 	case PROC_REPO_WRITE:
1903 #ifndef PROFILE
1904 		if (pledge("stdio rpath recvfd unveil", NULL) == -1)
1905 			err(1, "pledge");
1906 #endif
1907 		apply_unveil_repo_readonly(repo_path);
1908 		repo_write_main(title, repo_path, pack_fds, temp_fds);
1909 		/* NOTREACHED */
1910 		exit(0);
1911 	default:
1912 		fatal("invalid process id %d", proc_id);
1913 	}
1914 
1915 	if (proc_id != PROC_GOTD)
1916 		fatal("invalid process id %d", proc_id);
1917 
1918 	apply_unveil_selfexec();
1919 
1920 	signal_set(&evsigint, SIGINT, gotd_sighdlr, NULL);
1921 	signal_set(&evsigterm, SIGTERM, gotd_sighdlr, NULL);
1922 	signal_set(&evsighup, SIGHUP, gotd_sighdlr, NULL);
1923 	signal_set(&evsigusr1, SIGUSR1, gotd_sighdlr, NULL);
1924 	signal(SIGPIPE, SIG_IGN);
1925 
1926 	signal_add(&evsigint, NULL);
1927 	signal_add(&evsigterm, NULL);
1928 	signal_add(&evsighup, NULL);
1929 	signal_add(&evsigusr1, NULL);
1930 
1931 	gotd_imsg_event_add(&gotd.listen_proc.iev);
1932 
1933 	event_dispatch();
1934 
1935 	free(repo_path);
1936 	gotd_shutdown();
1937 
1938 	return 0;
1939 }