1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/queue.h>
18 #include <sys/tree.h>
19 #include <sys/time.h>
20 #include <sys/types.h>
21 #include <sys/stat.h>
22 #include <sys/socket.h>
23 #include <sys/un.h>
24 #include <sys/wait.h>
25 
26 #include <fcntl.h>
27 #include <err.h>
28 #include <errno.h>
29 #include <event.h>
30 #include <limits.h>
31 #include <pwd.h>
32 #include <imsg.h>
33 #include <sha1.h>
34 #include <signal.h>
35 #include <siphash.h>
36 #include <stdarg.h>
37 #include <stdio.h>
38 #include <stdlib.h>
39 #include <string.h>
40 #include <syslog.h>
41 #include <unistd.h>
42 
43 #include "got_error.h"
44 #include "got_opentemp.h"
45 #include "got_path.h"
46 #include "got_repository.h"
47 #include "got_object.h"
48 #include "got_reference.h"
49 
50 #include "got_lib_delta.h"
51 #include "got_lib_object.h"
52 #include "got_lib_object_cache.h"
53 #include "got_lib_sha1.h"
54 #include "got_lib_gitproto.h"
55 #include "got_lib_pack.h"
56 #include "got_lib_repository.h"
57 
58 #include "gotd.h"
59 #include "log.h"
60 #include "listen.h"
61 #include "auth.h"
62 #include "session.h"
63 #include "repo_read.h"
64 #include "repo_write.h"
65 
66 #ifndef nitems
67 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
68 #endif
69 
70 enum gotd_client_state {
71 	GOTD_CLIENT_STATE_NEW,
72 	GOTD_CLIENT_STATE_ACCESS_GRANTED,
73 };
74 
75 struct gotd_client {
76 	STAILQ_ENTRY(gotd_client)	 entry;
77 	enum gotd_client_state		 state;
78 	uint32_t			 id;
79 	int				 fd;
80 	struct gotd_imsgev		 iev;
81 	struct event			 tmo;
82 	uid_t				 euid;
83 	gid_t				 egid;
84 	struct gotd_child_proc		*repo;
85 	struct gotd_child_proc		*auth;
86 	struct gotd_child_proc		*session;
87 	int				 required_auth;
88 };
89 STAILQ_HEAD(gotd_clients, gotd_client);
90 
91 static struct gotd_clients gotd_clients[GOTD_CLIENT_TABLE_SIZE];
92 static SIPHASH_KEY clients_hash_key;
93 volatile int client_cnt;
94 static struct timeval auth_timeout = { 5, 0 };
95 static struct gotd gotd;
96 
97 void gotd_sighdlr(int sig, short event, void *arg);
98 static void gotd_shutdown(void);
99 static const struct got_error *start_session_child(struct gotd_client *,
100     struct gotd_repo *, char *, const char *, int, int);
101 static const struct got_error *start_repo_child(struct gotd_client *,
102     enum gotd_procid, struct gotd_repo *, char *, const char *, int, int);
103 static const struct got_error *start_auth_child(struct gotd_client *, int,
104     struct gotd_repo *, char *, const char *, int, int);
105 static void kill_proc(struct gotd_child_proc *, int);
106 
107 __dead static void
108 usage(void)
109 {
110 	fprintf(stderr, "usage: %s [-dnv] [-f config-file]\n", getprogname());
111 	exit(1);
112 }
113 
114 static int
115 unix_socket_listen(const char *unix_socket_path, uid_t uid, gid_t gid)
116 {
117 	struct sockaddr_un sun;
118 	int fd = -1;
119 	mode_t old_umask, mode;
120 
121 	fd = socket(AF_UNIX, SOCK_STREAM | SOCK_NONBLOCK| SOCK_CLOEXEC, 0);
122 	if (fd == -1) {
123 		log_warn("socket");
124 		return -1;
125 	}
126 
127 	sun.sun_family = AF_UNIX;
128 	if (strlcpy(sun.sun_path, unix_socket_path,
129 	    sizeof(sun.sun_path)) >= sizeof(sun.sun_path)) {
130 		log_warnx("%s: name too long", unix_socket_path);
131 		close(fd);
132 		return -1;
133 	}
134 
135 	if (unlink(unix_socket_path) == -1) {
136 		if (errno != ENOENT) {
137 			log_warn("unlink %s", unix_socket_path);
138 			close(fd);
139 			return -1;
140 		}
141 	}
142 
143 	old_umask = umask(S_IXUSR|S_IXGRP|S_IWOTH|S_IROTH|S_IXOTH);
144 	mode = S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH;
145 
146 	if (bind(fd, (struct sockaddr *)&sun, sizeof(sun)) == -1) {
147 		log_warn("bind: %s", unix_socket_path);
148 		close(fd);
149 		umask(old_umask);
150 		return -1;
151 	}
152 
153 	umask(old_umask);
154 
155 	if (chmod(unix_socket_path, mode) == -1) {
156 		log_warn("chmod %o %s", mode, unix_socket_path);
157 		close(fd);
158 		unlink(unix_socket_path);
159 		return -1;
160 	}
161 
162 	if (chown(unix_socket_path, uid, gid) == -1) {
163 		log_warn("chown %s uid=%d gid=%d", unix_socket_path, uid, gid);
164 		close(fd);
165 		unlink(unix_socket_path);
166 		return -1;
167 	}
168 
169 	if (listen(fd, GOTD_UNIX_SOCKET_BACKLOG) == -1) {
170 		log_warn("listen");
171 		close(fd);
172 		unlink(unix_socket_path);
173 		return -1;
174 	}
175 
176 	return fd;
177 }
178 
179 static uint64_t
180 client_hash(uint32_t client_id)
181 {
182 	return SipHash24(&clients_hash_key, &client_id, sizeof(client_id));
183 }
184 
185 static void
186 add_client(struct gotd_client *client)
187 {
188 	uint64_t slot = client_hash(client->id) % nitems(gotd_clients);
189 	STAILQ_INSERT_HEAD(&gotd_clients[slot], client, entry);
190 	client_cnt++;
191 }
192 
193 static struct gotd_client *
194 find_client(uint32_t client_id)
195 {
196 	uint64_t slot;
197 	struct gotd_client *c;
198 
199 	slot = client_hash(client_id) % nitems(gotd_clients);
200 	STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
201 		if (c->id == client_id)
202 			return c;
203 	}
204 
205 	return NULL;
206 }
207 
208 static struct gotd_client *
209 find_client_by_proc_fd(int fd)
210 {
211 	uint64_t slot;
212 
213 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
214 		struct gotd_client *c;
215 
216 		STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
217 			if (c->repo && c->repo->iev.ibuf.fd == fd)
218 				return c;
219 			if (c->auth && c->auth->iev.ibuf.fd == fd)
220 				return c;
221 			if (c->session && c->session->iev.ibuf.fd == fd)
222 				return c;
223 		}
224 	}
225 
226 	return NULL;
227 }
228 
229 static int
230 client_is_reading(struct gotd_client *client)
231 {
232 	return (client->required_auth &
233 	    (GOTD_AUTH_READ | GOTD_AUTH_WRITE)) == GOTD_AUTH_READ;
234 }
235 
236 static int
237 client_is_writing(struct gotd_client *client)
238 {
239 	return (client->required_auth &
240 	    (GOTD_AUTH_READ | GOTD_AUTH_WRITE)) ==
241 	    (GOTD_AUTH_READ | GOTD_AUTH_WRITE);
242 }
243 
244 static const struct got_error *
245 ensure_client_is_not_writing(struct gotd_client *client)
246 {
247 	if (client_is_writing(client)) {
248 		return got_error_fmt(GOT_ERR_BAD_PACKET,
249 		    "uid %d made a read-request but is writing to "
250 		    "a repository", client->euid);
251 	}
252 
253 	return NULL;
254 }
255 
256 static const struct got_error *
257 ensure_client_is_not_reading(struct gotd_client *client)
258 {
259 	if (client_is_reading(client)) {
260 		return got_error_fmt(GOT_ERR_BAD_PACKET,
261 		    "uid %d made a write-request but is reading from "
262 		    "a repository", client->euid);
263 	}
264 
265 	return NULL;
266 }
267 
268 static void
269 wait_for_child(pid_t child_pid)
270 {
271 	pid_t pid;
272 	int status;
273 
274 	log_debug("waiting for child PID %ld to terminate",
275 	    (long)child_pid);
276 
277 	do {
278 		pid = waitpid(child_pid, &status, WNOHANG);
279 		if (pid == -1) {
280 			if (errno != EINTR && errno != ECHILD)
281 				fatal("wait");
282 		} else if (WIFSIGNALED(status)) {
283 			log_warnx("child PID %ld terminated; signal %d",
284 			    (long)pid, WTERMSIG(status));
285 		}
286 	} while (pid != -1 || (pid == -1 && errno == EINTR));
287 }
288 
289 static void
290 proc_done(struct gotd_child_proc *proc)
291 {
292 	event_del(&proc->iev.ev);
293 	msgbuf_clear(&proc->iev.ibuf.w);
294 	close(proc->iev.ibuf.fd);
295 	kill_proc(proc, 0);
296 	wait_for_child(proc->pid);
297 	free(proc);
298 }
299 
300 static void
301 kill_auth_proc(struct gotd_client *client)
302 {
303 	struct gotd_child_proc *proc;
304 
305 	if (client->auth == NULL)
306 		return;
307 
308 	proc = client->auth;
309 	client->auth = NULL;
310 
311 	proc_done(proc);
312 }
313 
314 static void
315 kill_session_proc(struct gotd_client *client)
316 {
317 	struct gotd_child_proc *proc;
318 
319 	if (client->session == NULL)
320 		return;
321 
322 	proc = client->session;
323 	client->session = NULL;
324 
325 	proc_done(proc);
326 }
327 
328 static void
329 disconnect(struct gotd_client *client)
330 {
331 	struct gotd_imsg_disconnect idisconnect;
332 	struct gotd_child_proc *proc = client->repo;
333 	struct gotd_child_proc *listen_proc = &gotd.listen_proc;
334 	uint64_t slot;
335 
336 	log_debug("uid %d: disconnecting", client->euid);
337 
338 	kill_auth_proc(client);
339 	kill_session_proc(client);
340 
341 	if (proc) {
342 		event_del(&proc->iev.ev);
343 		msgbuf_clear(&proc->iev.ibuf.w);
344 		close(proc->iev.ibuf.fd);
345 		kill_proc(proc, 0);
346 		wait_for_child(proc->pid);
347 		free(proc);
348 		proc = NULL;
349 	}
350 
351 	idisconnect.client_id = client->id;
352 	if (gotd_imsg_compose_event(&listen_proc->iev,
353 	    GOTD_IMSG_DISCONNECT, PROC_GOTD, -1,
354 	    &idisconnect, sizeof(idisconnect)) == -1)
355 		log_warn("imsg compose DISCONNECT");
356 
357 	slot = client_hash(client->id) % nitems(gotd_clients);
358 	STAILQ_REMOVE(&gotd_clients[slot], client, gotd_client, entry);
359 	imsg_clear(&client->iev.ibuf);
360 	event_del(&client->iev.ev);
361 	evtimer_del(&client->tmo);
362 	if (client->fd != -1)
363 		close(client->fd);
364 	else if (client->iev.ibuf.fd != -1)
365 		close(client->iev.ibuf.fd);
366 	free(client);
367 	client_cnt--;
368 }
369 
370 static void
371 disconnect_on_error(struct gotd_client *client, const struct got_error *err)
372 {
373 	struct imsgbuf ibuf;
374 
375 	log_warnx("uid %d: %s", client->euid, err->msg);
376 	if (err->code != GOT_ERR_EOF && client->fd != -1) {
377 		imsg_init(&ibuf, client->fd);
378 		gotd_imsg_send_error(&ibuf, 0, PROC_GOTD, err);
379 		imsg_clear(&ibuf);
380 	}
381 	disconnect(client);
382 }
383 
384 static const struct got_error *
385 send_repo_info(struct gotd_imsgev *iev, struct gotd_repo *repo)
386 {
387 	const struct got_error *err = NULL;
388 	struct gotd_imsg_info_repo irepo;
389 
390 	memset(&irepo, 0, sizeof(irepo));
391 
392 	if (strlcpy(irepo.repo_name, repo->name, sizeof(irepo.repo_name))
393 	    >= sizeof(irepo.repo_name))
394 		return got_error_msg(GOT_ERR_NO_SPACE, "repo name too long");
395 	if (strlcpy(irepo.repo_path, repo->path, sizeof(irepo.repo_path))
396 	    >= sizeof(irepo.repo_path))
397 		return got_error_msg(GOT_ERR_NO_SPACE, "repo path too long");
398 
399 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_INFO_REPO, PROC_GOTD, -1,
400 	    &irepo, sizeof(irepo)) == -1) {
401 		err = got_error_from_errno("imsg compose INFO_REPO");
402 		if (err)
403 			return err;
404 	}
405 
406 	return NULL;
407 }
408 
409 static const struct got_error *
410 send_client_info(struct gotd_imsgev *iev, struct gotd_client *client)
411 {
412 	const struct got_error *err = NULL;
413 	struct gotd_imsg_info_client iclient;
414 	struct gotd_child_proc *proc;
415 
416 	memset(&iclient, 0, sizeof(iclient));
417 	iclient.euid = client->euid;
418 	iclient.egid = client->egid;
419 
420 	proc = client->repo;
421 	if (proc) {
422 		if (strlcpy(iclient.repo_name, proc->repo_path,
423 		    sizeof(iclient.repo_name)) >= sizeof(iclient.repo_name)) {
424 			return got_error_msg(GOT_ERR_NO_SPACE,
425 			    "repo name too long");
426 		}
427 		if (client_is_writing(client))
428 			iclient.is_writing = 1;
429 
430 		iclient.repo_child_pid = proc->pid;
431 	}
432 
433 	if (client->session)
434 		iclient.session_child_pid = client->session->pid;
435 
436 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_INFO_CLIENT, PROC_GOTD, -1,
437 	    &iclient, sizeof(iclient)) == -1) {
438 		err = got_error_from_errno("imsg compose INFO_CLIENT");
439 		if (err)
440 			return err;
441 	}
442 
443 	return NULL;
444 }
445 
446 static const struct got_error *
447 send_info(struct gotd_client *client)
448 {
449 	const struct got_error *err = NULL;
450 	struct gotd_imsg_info info;
451 	uint64_t slot;
452 	struct gotd_repo *repo;
453 
454 	if (client->euid != 0)
455 		return got_error_set_errno(EPERM, "info");
456 
457 	info.pid = gotd.pid;
458 	info.verbosity = gotd.verbosity;
459 	info.nrepos = gotd.nrepos;
460 	info.nclients = client_cnt - 1;
461 
462 	if (gotd_imsg_compose_event(&client->iev, GOTD_IMSG_INFO, PROC_GOTD, -1,
463 	    &info, sizeof(info)) == -1) {
464 		err = got_error_from_errno("imsg compose INFO");
465 		if (err)
466 			return err;
467 	}
468 
469 	TAILQ_FOREACH(repo, &gotd.repos, entry) {
470 		err = send_repo_info(&client->iev, repo);
471 		if (err)
472 			return err;
473 	}
474 
475 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
476 		struct gotd_client *c;
477 		STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
478 			if (c->id == client->id)
479 				continue;
480 			err = send_client_info(&client->iev, c);
481 			if (err)
482 				return err;
483 		}
484 	}
485 
486 	return NULL;
487 }
488 
489 static const struct got_error *
490 stop_gotd(struct gotd_client *client)
491 {
492 
493 	if (client->euid != 0)
494 		return got_error_set_errno(EPERM, "stop");
495 
496 	gotd_shutdown();
497 	/* NOTREACHED */
498 	return NULL;
499 }
500 
501 static struct gotd_repo *
502 find_repo_by_name(const char *repo_name)
503 {
504 	struct gotd_repo *repo;
505 	size_t namelen;
506 
507 	TAILQ_FOREACH(repo, &gotd.repos, entry) {
508 		namelen = strlen(repo->name);
509 		if (strncmp(repo->name, repo_name, namelen) != 0)
510 			continue;
511 		if (repo_name[namelen] == '\0' ||
512 		    strcmp(&repo_name[namelen], ".git") == 0)
513 			return repo;
514 	}
515 
516 	return NULL;
517 }
518 
519 static const struct got_error *
520 start_client_authentication(struct gotd_client *client, struct imsg *imsg)
521 {
522 	const struct got_error *err;
523 	struct gotd_imsg_list_refs ireq;
524 	struct gotd_repo *repo = NULL;
525 	size_t datalen;
526 
527 	log_debug("list-refs request from uid %d", client->euid);
528 
529 	if (client->state != GOTD_CLIENT_STATE_NEW)
530 		return got_error_msg(GOT_ERR_BAD_REQUEST,
531 		    "unexpected list-refs request received");
532 
533 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
534 	if (datalen != sizeof(ireq))
535 		return got_error(GOT_ERR_PRIVSEP_LEN);
536 
537 	memcpy(&ireq, imsg->data, datalen);
538 
539 	if (ireq.client_is_reading) {
540 		err = ensure_client_is_not_writing(client);
541 		if (err)
542 			return err;
543 		repo = find_repo_by_name(ireq.repo_name);
544 		if (repo == NULL)
545 			return got_error(GOT_ERR_NOT_GIT_REPO);
546 		err = start_auth_child(client, GOTD_AUTH_READ, repo,
547 		    gotd.argv0, gotd.confpath, gotd.daemonize,
548 		    gotd.verbosity);
549 		if (err)
550 			return err;
551 	} else {
552 		err = ensure_client_is_not_reading(client);
553 		if (err)
554 			return err;
555 		repo = find_repo_by_name(ireq.repo_name);
556 		if (repo == NULL)
557 			return got_error(GOT_ERR_NOT_GIT_REPO);
558 		err = start_auth_child(client,
559 		    GOTD_AUTH_READ | GOTD_AUTH_WRITE,
560 		    repo, gotd.argv0, gotd.confpath, gotd.daemonize,
561 		    gotd.verbosity);
562 		if (err)
563 			return err;
564 	}
565 
566 	evtimer_add(&client->tmo, &auth_timeout);
567 
568 	/* Flow continues upon authentication successs/failure or timeout. */
569 	return NULL;
570 }
571 
572 static void
573 gotd_request(int fd, short events, void *arg)
574 {
575 	struct gotd_imsgev *iev = arg;
576 	struct imsgbuf *ibuf = &iev->ibuf;
577 	struct gotd_client *client = iev->handler_arg;
578 	const struct got_error *err = NULL;
579 	struct imsg imsg;
580 	ssize_t n;
581 
582 	if (events & EV_WRITE) {
583 		while (ibuf->w.queued) {
584 			n = msgbuf_write(&ibuf->w);
585 			if (n == -1 && errno == EPIPE) {
586 				/*
587 				 * The client has closed its socket.
588 				 * This can happen when Git clients are
589 				 * done sending pack file data.
590 				 */
591 				msgbuf_clear(&ibuf->w);
592 				continue;
593 			} else if (n == -1 && errno != EAGAIN) {
594 				err = got_error_from_errno("imsg_flush");
595 				disconnect_on_error(client, err);
596 				return;
597 			}
598 			if (n == 0) {
599 				/* Connection closed. */
600 				err = got_error(GOT_ERR_EOF);
601 				disconnect_on_error(client, err);
602 				return;
603 			}
604 		}
605 
606 		/* Disconnect gotctl(8) now that messages have been sent. */
607 		if (!client_is_reading(client) && !client_is_writing(client)) {
608 			disconnect(client);
609 			return;
610 		}
611 	}
612 
613 	if ((events & EV_READ) == 0)
614 		return;
615 
616 	memset(&imsg, 0, sizeof(imsg));
617 
618 	while (err == NULL) {
619 		err = gotd_imsg_recv(&imsg, ibuf, 0);
620 		if (err) {
621 			if (err->code == GOT_ERR_PRIVSEP_READ)
622 				err = NULL;
623 			break;
624 		}
625 
626 		evtimer_del(&client->tmo);
627 
628 		switch (imsg.hdr.type) {
629 		case GOTD_IMSG_INFO:
630 			err = send_info(client);
631 			break;
632 		case GOTD_IMSG_STOP:
633 			err = stop_gotd(client);
634 			break;
635 		case GOTD_IMSG_LIST_REFS:
636 			err = start_client_authentication(client, &imsg);
637 			break;
638 		default:
639 			log_debug("unexpected imsg %d", imsg.hdr.type);
640 			err = got_error(GOT_ERR_PRIVSEP_MSG);
641 			break;
642 		}
643 
644 		imsg_free(&imsg);
645 	}
646 
647 	if (err) {
648 		disconnect_on_error(client, err);
649 	} else {
650 		gotd_imsg_event_add(&client->iev);
651 	}
652 }
653 
654 static void
655 gotd_auth_timeout(int fd, short events, void *arg)
656 {
657 	struct gotd_client *client = arg;
658 
659 	log_debug("disconnecting uid %d due to authentication timeout",
660 	    client->euid);
661 	disconnect(client);
662 }
663 
664 static const struct got_error *
665 recv_connect(uint32_t *client_id, struct imsg *imsg)
666 {
667 	const struct got_error *err = NULL;
668 	struct gotd_imsg_connect iconnect;
669 	size_t datalen;
670 	int s = -1;
671 	struct gotd_client *client = NULL;
672 
673 	*client_id = 0;
674 
675 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
676 	if (datalen != sizeof(iconnect))
677 		return got_error(GOT_ERR_PRIVSEP_LEN);
678 	memcpy(&iconnect, imsg->data, sizeof(iconnect));
679 
680 	s = imsg->fd;
681 	if (s == -1) {
682 		err = got_error(GOT_ERR_PRIVSEP_NO_FD);
683 		goto done;
684 	}
685 
686 	if (find_client(iconnect.client_id)) {
687 		err = got_error_msg(GOT_ERR_CLIENT_ID, "duplicate client ID");
688 		goto done;
689 	}
690 
691 	client = calloc(1, sizeof(*client));
692 	if (client == NULL) {
693 		err = got_error_from_errno("calloc");
694 		goto done;
695 	}
696 
697 	*client_id = iconnect.client_id;
698 
699 	client->state = GOTD_CLIENT_STATE_NEW;
700 	client->id = iconnect.client_id;
701 	client->fd = s;
702 	s = -1;
703 	/* The auth process will verify UID/GID for us. */
704 	client->euid = iconnect.euid;
705 	client->egid = iconnect.egid;
706 
707 	imsg_init(&client->iev.ibuf, client->fd);
708 	client->iev.handler = gotd_request;
709 	client->iev.events = EV_READ;
710 	client->iev.handler_arg = client;
711 
712 	event_set(&client->iev.ev, client->fd, EV_READ, gotd_request,
713 	    &client->iev);
714 	gotd_imsg_event_add(&client->iev);
715 
716 	evtimer_set(&client->tmo, gotd_auth_timeout, client);
717 
718 	add_client(client);
719 	log_debug("%s: new client uid %d connected on fd %d", __func__,
720 	    client->euid, client->fd);
721 done:
722 	if (err) {
723 		struct gotd_child_proc *listen_proc = &gotd.listen_proc;
724 		struct gotd_imsg_disconnect idisconnect;
725 
726 		idisconnect.client_id = client->id;
727 		if (gotd_imsg_compose_event(&listen_proc->iev,
728 		    GOTD_IMSG_DISCONNECT, PROC_GOTD, -1,
729 		    &idisconnect, sizeof(idisconnect)) == -1)
730 			log_warn("imsg compose DISCONNECT");
731 
732 		if (s != -1)
733 			close(s);
734 	}
735 
736 	return err;
737 }
738 
739 static const char *gotd_proc_names[PROC_MAX] = {
740 	"parent",
741 	"listen",
742 	"auth",
743 	"session",
744 	"repo_read",
745 	"repo_write"
746 };
747 
748 static void
749 kill_proc(struct gotd_child_proc *proc, int fatal)
750 {
751 	if (fatal) {
752 		log_warnx("sending SIGKILL to PID %d", proc->pid);
753 		kill(proc->pid, SIGKILL);
754 	} else
755 		kill(proc->pid, SIGTERM);
756 }
757 
758 static void
759 gotd_shutdown(void)
760 {
761 	struct gotd_child_proc *proc;
762 	uint64_t slot;
763 
764 	log_debug("shutting down");
765 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
766 		struct gotd_client *c, *tmp;
767 
768 		STAILQ_FOREACH_SAFE(c, &gotd_clients[slot], entry, tmp)
769 			disconnect(c);
770 	}
771 
772 	proc = &gotd.listen_proc;
773 	msgbuf_clear(&proc->iev.ibuf.w);
774 	close(proc->iev.ibuf.fd);
775 	kill_proc(proc, 0);
776 	wait_for_child(proc->pid);
777 
778 	log_info("terminating");
779 	exit(0);
780 }
781 
782 void
783 gotd_sighdlr(int sig, short event, void *arg)
784 {
785 	/*
786 	 * Normal signal handler rules don't apply because libevent
787 	 * decouples for us.
788 	 */
789 
790 	switch (sig) {
791 	case SIGHUP:
792 		log_info("%s: ignoring SIGHUP", __func__);
793 		break;
794 	case SIGUSR1:
795 		log_info("%s: ignoring SIGUSR1", __func__);
796 		break;
797 	case SIGTERM:
798 	case SIGINT:
799 		gotd_shutdown();
800 		break;
801 	default:
802 		fatalx("unexpected signal");
803 	}
804 }
805 
806 static const struct got_error *
807 ensure_proc_is_reading(struct gotd_client *client,
808     struct gotd_child_proc *proc)
809 {
810 	if (!client_is_reading(client)) {
811 		kill_proc(proc, 1);
812 		return got_error_fmt(GOT_ERR_BAD_PACKET,
813 		    "PID %d handled a read-request for uid %d but this "
814 		    "user is not reading from a repository", proc->pid,
815 		    client->euid);
816 	}
817 
818 	return NULL;
819 }
820 
821 static const struct got_error *
822 ensure_proc_is_writing(struct gotd_client *client,
823     struct gotd_child_proc *proc)
824 {
825 	if (!client_is_writing(client)) {
826 		kill_proc(proc, 1);
827 		return got_error_fmt(GOT_ERR_BAD_PACKET,
828 		    "PID %d handled a write-request for uid %d but this "
829 		    "user is not writing to a repository", proc->pid,
830 		    client->euid);
831 	}
832 
833 	return NULL;
834 }
835 
836 static int
837 verify_imsg_src(struct gotd_client *client, struct gotd_child_proc *proc,
838     struct imsg *imsg)
839 {
840 	const struct got_error *err;
841 	int ret = 0;
842 
843 	if (proc->type == PROC_REPO_READ || proc->type == PROC_REPO_WRITE) {
844 		if (client->repo == NULL)
845 			fatalx("no process found for uid %d", client->euid);
846 		if (proc->pid != client->repo->pid) {
847 			kill_proc(proc, 1);
848 			log_warnx("received message from PID %d for uid %d, "
849 			    "while PID %d is the process serving this user",
850 			    proc->pid, client->euid, client->repo->pid);
851 			return 0;
852 		}
853 	}
854 	if (proc->type == PROC_SESSION) {
855 		if (client->session == NULL) {
856 			log_warnx("no session found for uid %d", client->euid);
857 			return 0;
858 		}
859 		if (proc->pid != client->session->pid) {
860 			kill_proc(proc, 1);
861 			log_warnx("received message from PID %d for uid %d, "
862 			    "while PID %d is the process serving this user",
863 			    proc->pid, client->euid, client->session->pid);
864 			return 0;
865 		}
866 	}
867 
868 	switch (imsg->hdr.type) {
869 	case GOTD_IMSG_ERROR:
870 		ret = 1;
871 		break;
872 	case GOTD_IMSG_CONNECT:
873 		if (proc->type != PROC_LISTEN) {
874 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
875 			    "new connection for uid %d from PID %d "
876 			    "which is not the listen process",
877 			    proc->pid, client->euid);
878 		} else
879 			ret = 1;
880 		break;
881 	case GOTD_IMSG_ACCESS_GRANTED:
882 		if (proc->type != PROC_AUTH) {
883 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
884 			    "authentication of uid %d from PID %d "
885 			    "which is not the auth process",
886 			    proc->pid, client->euid);
887 		} else
888 			ret = 1;
889 		break;
890 	case GOTD_IMSG_CLIENT_SESSION_READY:
891 		if (proc->type != PROC_SESSION) {
892 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
893 			    "unexpected \"ready\" signal from PID %d",
894 			    proc->pid);
895 		} else
896 			ret = 1;
897 		break;
898 	case GOTD_IMSG_REPO_CHILD_READY:
899 		if (proc->type != PROC_REPO_READ &&
900 		    proc->type != PROC_REPO_WRITE) {
901 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
902 			    "unexpected \"ready\" signal from PID %d",
903 			    proc->pid);
904 		} else
905 			ret = 1;
906 		break;
907 	case GOTD_IMSG_PACKFILE_DONE:
908 		err = ensure_proc_is_reading(client, proc);
909 		if (err)
910 			log_warnx("uid %d: %s", client->euid, err->msg);
911 		else
912 			ret = 1;
913 		break;
914 	case GOTD_IMSG_PACKFILE_INSTALL:
915 	case GOTD_IMSG_REF_UPDATES_START:
916 	case GOTD_IMSG_REF_UPDATE:
917 		err = ensure_proc_is_writing(client, proc);
918 		if (err)
919 			log_warnx("uid %d: %s", client->euid, err->msg);
920 		else
921 			ret = 1;
922 		break;
923 	default:
924 		log_debug("%s: unexpected imsg %d", __func__, imsg->hdr.type);
925 		break;
926 	}
927 
928 	return ret;
929 }
930 
931 static const struct got_error *
932 connect_repo_child(struct gotd_client *client,
933     struct gotd_child_proc *repo_proc)
934 {
935 	static const struct got_error *err;
936 	struct gotd_imsgev *session_iev = &client->session->iev;
937 	struct gotd_imsg_connect_repo_child ireq;
938 	int pipe[2];
939 
940 	if (client->state != GOTD_CLIENT_STATE_ACCESS_GRANTED)
941 		return got_error_msg(GOT_ERR_BAD_REQUEST,
942 		    "unexpected repo child ready signal received");
943 
944 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
945 	    PF_UNSPEC, pipe) == -1)
946 		fatal("socketpair");
947 
948 	memset(&ireq, 0, sizeof(ireq));
949 	ireq.client_id = client->id;
950 	ireq.proc_id = repo_proc->type;
951 
952 	/* Pass repo child pipe to session child process. */
953 	if (gotd_imsg_compose_event(session_iev, GOTD_IMSG_CONNECT_REPO_CHILD,
954 	    PROC_GOTD, pipe[0], &ireq, sizeof(ireq)) == -1) {
955 		err = got_error_from_errno("imsg compose CONNECT_REPO_CHILD");
956 		close(pipe[0]);
957 		close(pipe[1]);
958 		return err;
959 	}
960 
961 	/* Pass session child pipe to repo child process. */
962 	if (gotd_imsg_compose_event(&repo_proc->iev,
963 	    GOTD_IMSG_CONNECT_REPO_CHILD, PROC_GOTD, pipe[1], NULL, 0) == -1) {
964 		err = got_error_from_errno("imsg compose CONNECT_REPO_CHILD");
965 		close(pipe[1]);
966 		return err;
967 	}
968 
969 	return NULL;
970 }
971 
972 static void
973 gotd_dispatch_listener(int fd, short event, void *arg)
974 {
975 	struct gotd_imsgev *iev = arg;
976 	struct imsgbuf *ibuf = &iev->ibuf;
977 	struct gotd_child_proc *proc = &gotd.listen_proc;
978 	ssize_t n;
979 	int shut = 0;
980 	struct imsg imsg;
981 
982 	if (proc->iev.ibuf.fd != fd)
983 		fatalx("%s: unexpected fd %d", __func__, fd);
984 
985 	if (event & EV_READ) {
986 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
987 			fatal("imsg_read error");
988 		if (n == 0) {
989 			/* Connection closed. */
990 			shut = 1;
991 			goto done;
992 		}
993 	}
994 
995 	if (event & EV_WRITE) {
996 		n = msgbuf_write(&ibuf->w);
997 		if (n == -1 && errno != EAGAIN)
998 			fatal("msgbuf_write");
999 		if (n == 0) {
1000 			/* Connection closed. */
1001 			shut = 1;
1002 			goto done;
1003 		}
1004 	}
1005 
1006 	for (;;) {
1007 		const struct got_error *err = NULL;
1008 		struct gotd_client *client = NULL;
1009 		uint32_t client_id = 0;
1010 		int do_disconnect = 0;
1011 
1012 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1013 			fatal("%s: imsg_get error", __func__);
1014 		if (n == 0)	/* No more messages. */
1015 			break;
1016 
1017 		switch (imsg.hdr.type) {
1018 		case GOTD_IMSG_ERROR:
1019 			do_disconnect = 1;
1020 			err = gotd_imsg_recv_error(&client_id, &imsg);
1021 			break;
1022 		case GOTD_IMSG_CONNECT:
1023 			err = recv_connect(&client_id, &imsg);
1024 			break;
1025 		default:
1026 			log_debug("unexpected imsg %d", imsg.hdr.type);
1027 			break;
1028 		}
1029 
1030 		client = find_client(client_id);
1031 		if (client == NULL) {
1032 			log_warnx("%s: client not found", __func__);
1033 			imsg_free(&imsg);
1034 			continue;
1035 		}
1036 
1037 		if (err)
1038 			log_warnx("uid %d: %s", client->euid, err->msg);
1039 
1040 		if (do_disconnect) {
1041 			if (err)
1042 				disconnect_on_error(client, err);
1043 			else
1044 				disconnect(client);
1045 		}
1046 
1047 		imsg_free(&imsg);
1048 	}
1049 done:
1050 	if (!shut) {
1051 		gotd_imsg_event_add(iev);
1052 	} else {
1053 		/* This pipe is dead. Remove its event handler */
1054 		event_del(&iev->ev);
1055 		event_loopexit(NULL);
1056 	}
1057 }
1058 
1059 static void
1060 gotd_dispatch_auth_child(int fd, short event, void *arg)
1061 {
1062 	const struct got_error *err = NULL;
1063 	struct gotd_imsgev *iev = arg;
1064 	struct imsgbuf *ibuf = &iev->ibuf;
1065 	struct gotd_client *client;
1066 	struct gotd_repo *repo = NULL;
1067 	ssize_t n;
1068 	int shut = 0;
1069 	struct imsg imsg;
1070 	uint32_t client_id = 0;
1071 	int do_disconnect = 0;
1072 
1073 	client = find_client_by_proc_fd(fd);
1074 	if (client == NULL) {
1075 		/* Can happen during process teardown. */
1076 		warnx("cannot find client for fd %d", fd);
1077 		shut = 1;
1078 		goto done;
1079 	}
1080 
1081 	if (client->auth == NULL)
1082 		fatalx("cannot find auth child process for fd %d", fd);
1083 
1084 	if (event & EV_READ) {
1085 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1086 			fatal("imsg_read error");
1087 		if (n == 0) {
1088 			/* Connection closed. */
1089 			shut = 1;
1090 			goto done;
1091 		}
1092 	}
1093 
1094 	if (event & EV_WRITE) {
1095 		n = msgbuf_write(&ibuf->w);
1096 		if (n == -1 && errno != EAGAIN)
1097 			fatal("msgbuf_write");
1098 		if (n == 0) {
1099 			/* Connection closed. */
1100 			shut = 1;
1101 		}
1102 		goto done;
1103 	}
1104 
1105 	if (client->auth->iev.ibuf.fd != fd)
1106 		fatalx("%s: unexpected fd %d", __func__, fd);
1107 
1108 	if ((n = imsg_get(ibuf, &imsg)) == -1)
1109 		fatal("%s: imsg_get error", __func__);
1110 	if (n == 0)	/* No more messages. */
1111 		return;
1112 
1113 	evtimer_del(&client->tmo);
1114 
1115 	switch (imsg.hdr.type) {
1116 	case GOTD_IMSG_ERROR:
1117 		do_disconnect = 1;
1118 		err = gotd_imsg_recv_error(&client_id, &imsg);
1119 		break;
1120 	case GOTD_IMSG_ACCESS_GRANTED:
1121 		client->state = GOTD_CLIENT_STATE_ACCESS_GRANTED;
1122 		break;
1123 	default:
1124 		do_disconnect = 1;
1125 		log_debug("unexpected imsg %d", imsg.hdr.type);
1126 		break;
1127 	}
1128 
1129 	if (!verify_imsg_src(client, client->auth, &imsg)) {
1130 		do_disconnect = 1;
1131 		log_debug("dropping imsg type %d from PID %d",
1132 		    imsg.hdr.type, client->auth->pid);
1133 	}
1134 	imsg_free(&imsg);
1135 
1136 	if (do_disconnect) {
1137 		if (err)
1138 			disconnect_on_error(client, err);
1139 		else
1140 			disconnect(client);
1141 		goto done;
1142 	}
1143 
1144 	repo = find_repo_by_name(client->auth->repo_name);
1145 	if (repo == NULL) {
1146 		err = got_error(GOT_ERR_NOT_GIT_REPO);
1147 		goto done;
1148 	}
1149 	kill_auth_proc(client);
1150 
1151 	log_info("authenticated uid %d for repository %s",
1152 	    client->euid, repo->name);
1153 
1154 	err = start_session_child(client, repo, gotd.argv0,
1155 	    gotd.confpath, gotd.daemonize, gotd.verbosity);
1156 	if (err)
1157 		goto done;
1158 done:
1159 	if (err)
1160 		log_warnx("uid %d: %s", client->euid, err->msg);
1161 
1162 	/* We might have killed the auth process by now. */
1163 	if (client->auth != NULL) {
1164 		if (!shut) {
1165 			gotd_imsg_event_add(iev);
1166 		} else {
1167 			/* This pipe is dead. Remove its event handler */
1168 			event_del(&iev->ev);
1169 		}
1170 	}
1171 }
1172 
1173 static const struct got_error *
1174 connect_session(struct gotd_client *client)
1175 {
1176 	const struct got_error *err = NULL;
1177 	struct gotd_imsg_connect iconnect;
1178 	int s;
1179 
1180 	memset(&iconnect, 0, sizeof(iconnect));
1181 
1182 	s = dup(client->fd);
1183 	if (s == -1)
1184 		return got_error_from_errno("dup");
1185 
1186 	iconnect.client_id = client->id;
1187 	iconnect.euid = client->euid;
1188 	iconnect.egid = client->egid;
1189 
1190 	if (gotd_imsg_compose_event(&client->session->iev, GOTD_IMSG_CONNECT,
1191 	    PROC_GOTD, s, &iconnect, sizeof(iconnect)) == -1) {
1192 		err = got_error_from_errno("imsg compose CONNECT");
1193 		close(s);
1194 		return err;
1195 	}
1196 
1197 	/*
1198 	 * We are no longer interested in messages from this client.
1199 	 * Further client requests will be handled by the session process.
1200 	 */
1201 	msgbuf_clear(&client->iev.ibuf.w);
1202 	imsg_clear(&client->iev.ibuf);
1203 	event_del(&client->iev.ev);
1204 	client->fd = -1; /* will be closed via copy in client->iev.ibuf.fd */
1205 
1206 	return NULL;
1207 }
1208 
1209 static void
1210 gotd_dispatch_client_session(int fd, short event, void *arg)
1211 {
1212 	struct gotd_imsgev *iev = arg;
1213 	struct imsgbuf *ibuf = &iev->ibuf;
1214 	struct gotd_child_proc *proc = NULL;
1215 	struct gotd_client *client = NULL;
1216 	ssize_t n;
1217 	int shut = 0;
1218 	struct imsg imsg;
1219 
1220 	client = find_client_by_proc_fd(fd);
1221 	if (client == NULL) {
1222 		/* Can happen during process teardown. */
1223 		warnx("cannot find client for fd %d", fd);
1224 		shut = 1;
1225 		goto done;
1226 	}
1227 
1228 	if (event & EV_READ) {
1229 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1230 			fatal("imsg_read error");
1231 		if (n == 0) {
1232 			/* Connection closed. */
1233 			shut = 1;
1234 			goto done;
1235 		}
1236 	}
1237 
1238 	if (event & EV_WRITE) {
1239 		n = msgbuf_write(&ibuf->w);
1240 		if (n == -1 && errno != EAGAIN)
1241 			fatal("msgbuf_write");
1242 		if (n == 0) {
1243 			/* Connection closed. */
1244 			shut = 1;
1245 			goto done;
1246 		}
1247 	}
1248 
1249 	proc = client->session;
1250 	if (proc == NULL)
1251 		fatalx("cannot find session child process for fd %d", fd);
1252 
1253 	for (;;) {
1254 		const struct got_error *err = NULL;
1255 		uint32_t client_id = 0;
1256 		int do_disconnect = 0, do_start_repo_child = 0;
1257 
1258 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1259 			fatal("%s: imsg_get error", __func__);
1260 		if (n == 0)	/* No more messages. */
1261 			break;
1262 
1263 		switch (imsg.hdr.type) {
1264 		case GOTD_IMSG_ERROR:
1265 			do_disconnect = 1;
1266 			err = gotd_imsg_recv_error(&client_id, &imsg);
1267 			break;
1268 		case GOTD_IMSG_CLIENT_SESSION_READY:
1269 			if (client->state != GOTD_CLIENT_STATE_ACCESS_GRANTED) {
1270 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1271 				break;
1272 			}
1273 			do_start_repo_child = 1;
1274 			break;
1275 		case GOTD_IMSG_DISCONNECT:
1276 			do_disconnect = 1;
1277 			break;
1278 		default:
1279 			log_debug("unexpected imsg %d", imsg.hdr.type);
1280 			break;
1281 		}
1282 
1283 		if (!verify_imsg_src(client, proc, &imsg)) {
1284 			log_debug("dropping imsg type %d from PID %d",
1285 			    imsg.hdr.type, proc->pid);
1286 			imsg_free(&imsg);
1287 			continue;
1288 		}
1289 		if (err)
1290 			log_warnx("uid %d: %s", client->euid, err->msg);
1291 
1292 		if (do_start_repo_child) {
1293 			struct gotd_repo *repo;
1294 
1295 			repo = find_repo_by_name(client->session->repo_name);
1296 			if (repo != NULL) {
1297 				enum gotd_procid proc_type;
1298 
1299 				if (client->required_auth & GOTD_AUTH_WRITE)
1300 					proc_type = PROC_REPO_WRITE;
1301 				else
1302 					proc_type = PROC_REPO_READ;
1303 
1304 				err = start_repo_child(client, proc_type, repo,
1305 				    gotd.argv0, gotd.confpath, gotd.daemonize,
1306 				    gotd.verbosity);
1307 			} else
1308 				err = got_error(GOT_ERR_NOT_GIT_REPO);
1309 
1310 			if (err) {
1311 				log_warnx("uid %d: %s", client->euid, err->msg);
1312 				do_disconnect = 1;
1313 			}
1314 		}
1315 
1316 		if (do_disconnect) {
1317 			if (err)
1318 				disconnect_on_error(client, err);
1319 			else
1320 				disconnect(client);
1321 		}
1322 
1323 		imsg_free(&imsg);
1324 	}
1325 done:
1326 	if (!shut) {
1327 		gotd_imsg_event_add(iev);
1328 	} else {
1329 		/* This pipe is dead. Remove its event handler */
1330 		event_del(&iev->ev);
1331 		disconnect(client);
1332 	}
1333 }
1334 
1335 static void
1336 gotd_dispatch_repo_child(int fd, short event, void *arg)
1337 {
1338 	struct gotd_imsgev *iev = arg;
1339 	struct imsgbuf *ibuf = &iev->ibuf;
1340 	struct gotd_child_proc *proc = NULL;
1341 	struct gotd_client *client;
1342 	ssize_t n;
1343 	int shut = 0;
1344 	struct imsg imsg;
1345 
1346 	client = find_client_by_proc_fd(fd);
1347 	if (client == NULL) {
1348 		/* Can happen during process teardown. */
1349 		warnx("cannot find client for fd %d", fd);
1350 		shut = 1;
1351 		goto done;
1352 	}
1353 
1354 	if (event & EV_READ) {
1355 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1356 			fatal("imsg_read error");
1357 		if (n == 0) {
1358 			/* Connection closed. */
1359 			shut = 1;
1360 			goto done;
1361 		}
1362 	}
1363 
1364 	if (event & EV_WRITE) {
1365 		n = msgbuf_write(&ibuf->w);
1366 		if (n == -1 && errno != EAGAIN)
1367 			fatal("msgbuf_write");
1368 		if (n == 0) {
1369 			/* Connection closed. */
1370 			shut = 1;
1371 			goto done;
1372 		}
1373 	}
1374 
1375 	proc = client->repo;
1376 	if (proc == NULL)
1377 		fatalx("cannot find child process for fd %d", fd);
1378 
1379 	for (;;) {
1380 		const struct got_error *err = NULL;
1381 		uint32_t client_id = 0;
1382 		int do_disconnect = 0;
1383 
1384 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1385 			fatal("%s: imsg_get error", __func__);
1386 		if (n == 0)	/* No more messages. */
1387 			break;
1388 
1389 		switch (imsg.hdr.type) {
1390 		case GOTD_IMSG_ERROR:
1391 			do_disconnect = 1;
1392 			err = gotd_imsg_recv_error(&client_id, &imsg);
1393 			break;
1394 		case GOTD_IMSG_REPO_CHILD_READY:
1395 			err = connect_session(client);
1396 			if (err)
1397 				break;
1398 			err = connect_repo_child(client, proc);
1399 			break;
1400 		default:
1401 			log_debug("unexpected imsg %d", imsg.hdr.type);
1402 			break;
1403 		}
1404 
1405 		if (!verify_imsg_src(client, proc, &imsg)) {
1406 			log_debug("dropping imsg type %d from PID %d",
1407 			    imsg.hdr.type, proc->pid);
1408 			imsg_free(&imsg);
1409 			continue;
1410 		}
1411 		if (err)
1412 			log_warnx("uid %d: %s", client->euid, err->msg);
1413 
1414 		if (do_disconnect) {
1415 			if (err)
1416 				disconnect_on_error(client, err);
1417 			else
1418 				disconnect(client);
1419 		}
1420 
1421 		imsg_free(&imsg);
1422 	}
1423 done:
1424 	if (!shut) {
1425 		gotd_imsg_event_add(iev);
1426 	} else {
1427 		/* This pipe is dead. Remove its event handler */
1428 		event_del(&iev->ev);
1429 		disconnect(client);
1430 	}
1431 }
1432 
1433 static pid_t
1434 start_child(enum gotd_procid proc_id, const char *repo_path,
1435     char *argv0, const char *confpath, int fd, int daemonize, int verbosity)
1436 {
1437 	char	*argv[11];
1438 	int	 argc = 0;
1439 	pid_t	 pid;
1440 
1441 	switch (pid = fork()) {
1442 	case -1:
1443 		fatal("cannot fork");
1444 	case 0:
1445 		break;
1446 	default:
1447 		close(fd);
1448 		return pid;
1449 	}
1450 
1451 	if (fd != GOTD_FILENO_MSG_PIPE) {
1452 		if (dup2(fd, GOTD_FILENO_MSG_PIPE) == -1)
1453 			fatal("cannot setup imsg fd");
1454 	} else if (fcntl(fd, F_SETFD, 0) == -1)
1455 		fatal("cannot setup imsg fd");
1456 
1457 	argv[argc++] = argv0;
1458 	switch (proc_id) {
1459 	case PROC_LISTEN:
1460 		argv[argc++] = (char *)"-L";
1461 		break;
1462 	case PROC_AUTH:
1463 		argv[argc++] = (char *)"-A";
1464 		break;
1465 	case PROC_SESSION:
1466 		argv[argc++] = (char *)"-S";
1467 		break;
1468 	case PROC_REPO_READ:
1469 		argv[argc++] = (char *)"-R";
1470 		break;
1471 	case PROC_REPO_WRITE:
1472 		argv[argc++] = (char *)"-W";
1473 		break;
1474 	default:
1475 		fatalx("invalid process id %d", proc_id);
1476 	}
1477 
1478 	argv[argc++] = (char *)"-f";
1479 	argv[argc++] = (char *)confpath;
1480 
1481 	if (repo_path) {
1482 		argv[argc++] = (char *)"-P";
1483 		argv[argc++] = (char *)repo_path;
1484 	}
1485 
1486 	if (!daemonize)
1487 		argv[argc++] = (char *)"-d";
1488 	if (verbosity > 0)
1489 		argv[argc++] = (char *)"-v";
1490 	if (verbosity > 1)
1491 		argv[argc++] = (char *)"-v";
1492 	argv[argc++] = NULL;
1493 
1494 	execvp(argv0, argv);
1495 	fatal("execvp");
1496 }
1497 
1498 static void
1499 start_listener(char *argv0, const char *confpath, int daemonize, int verbosity)
1500 {
1501 	struct gotd_child_proc *proc = &gotd.listen_proc;
1502 
1503 	proc->type = PROC_LISTEN;
1504 
1505 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1506 	    PF_UNSPEC, proc->pipe) == -1)
1507 		fatal("socketpair");
1508 
1509 	proc->pid = start_child(proc->type, NULL, argv0, confpath,
1510 	    proc->pipe[1], daemonize, verbosity);
1511 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1512 	proc->iev.handler = gotd_dispatch_listener;
1513 	proc->iev.events = EV_READ;
1514 	proc->iev.handler_arg = NULL;
1515 }
1516 
1517 static const struct got_error *
1518 start_session_child(struct gotd_client *client, struct gotd_repo *repo,
1519     char *argv0, const char *confpath, int daemonize, int verbosity)
1520 {
1521 	struct gotd_child_proc *proc;
1522 
1523 	proc = calloc(1, sizeof(*proc));
1524 	if (proc == NULL)
1525 		return got_error_from_errno("calloc");
1526 
1527 	proc->type = PROC_SESSION;
1528 	if (strlcpy(proc->repo_name, repo->name,
1529 	    sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
1530 		fatalx("repository name too long: %s", repo->name);
1531 	log_debug("starting client uid %d session for repository %s",
1532 	    client->euid, repo->name);
1533 	if (strlcpy(proc->repo_path, repo->path, sizeof(proc->repo_path)) >=
1534 	    sizeof(proc->repo_path))
1535 		fatalx("repository path too long: %s", repo->path);
1536 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1537 	    PF_UNSPEC, proc->pipe) == -1)
1538 		fatal("socketpair");
1539 	proc->pid = start_child(proc->type, proc->repo_path, argv0,
1540 	    confpath, proc->pipe[1], daemonize, verbosity);
1541 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1542 	log_debug("proc %s %s is on fd %d",
1543 	    gotd_proc_names[proc->type], proc->repo_path,
1544 	    proc->pipe[0]);
1545 	proc->iev.handler = gotd_dispatch_client_session;
1546 	proc->iev.events = EV_READ;
1547 	proc->iev.handler_arg = NULL;
1548 	event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
1549 	    gotd_dispatch_client_session, &proc->iev);
1550 	gotd_imsg_event_add(&proc->iev);
1551 
1552 	client->session = proc;
1553 	return NULL;
1554 }
1555 
1556 static const struct got_error *
1557 start_repo_child(struct gotd_client *client, enum gotd_procid proc_type,
1558     struct gotd_repo *repo, char *argv0, const char *confpath,
1559     int daemonize, int verbosity)
1560 {
1561 	struct gotd_child_proc *proc;
1562 
1563 	if (proc_type != PROC_REPO_READ && proc_type != PROC_REPO_WRITE)
1564 		return got_error_msg(GOT_ERR_NOT_IMPL, "bad process type");
1565 
1566 	proc = calloc(1, sizeof(*proc));
1567 	if (proc == NULL)
1568 		return got_error_from_errno("calloc");
1569 
1570 	proc->type = proc_type;
1571 	if (strlcpy(proc->repo_name, repo->name,
1572 	    sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
1573 		fatalx("repository name too long: %s", repo->name);
1574 	log_debug("starting %s for repository %s",
1575 	    proc->type == PROC_REPO_READ ? "reader" : "writer", repo->name);
1576 	if (strlcpy(proc->repo_path, repo->path, sizeof(proc->repo_path)) >=
1577 	    sizeof(proc->repo_path))
1578 		fatalx("repository path too long: %s", repo->path);
1579 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1580 	    PF_UNSPEC, proc->pipe) == -1)
1581 		fatal("socketpair");
1582 	proc->pid = start_child(proc->type, proc->repo_path, argv0,
1583 	    confpath, proc->pipe[1], daemonize, verbosity);
1584 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1585 	log_debug("proc %s %s is on fd %d",
1586 	    gotd_proc_names[proc->type], proc->repo_path,
1587 	    proc->pipe[0]);
1588 	proc->iev.handler = gotd_dispatch_repo_child;
1589 	proc->iev.events = EV_READ;
1590 	proc->iev.handler_arg = NULL;
1591 	event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
1592 	    gotd_dispatch_repo_child, &proc->iev);
1593 	gotd_imsg_event_add(&proc->iev);
1594 
1595 	client->repo = proc;
1596 	return NULL;
1597 }
1598 
1599 static const struct got_error *
1600 start_auth_child(struct gotd_client *client, int required_auth,
1601     struct gotd_repo *repo, char *argv0, const char *confpath,
1602     int daemonize, int verbosity)
1603 {
1604 	const struct got_error *err = NULL;
1605 	struct gotd_child_proc *proc;
1606 	struct gotd_imsg_auth iauth;
1607 	int fd;
1608 
1609 	memset(&iauth, 0, sizeof(iauth));
1610 
1611 	fd = dup(client->fd);
1612 	if (fd == -1)
1613 		return got_error_from_errno("dup");
1614 
1615 	proc = calloc(1, sizeof(*proc));
1616 	if (proc == NULL) {
1617 		err = got_error_from_errno("calloc");
1618 		close(fd);
1619 		return err;
1620 	}
1621 
1622 	proc->type = PROC_AUTH;
1623 	if (strlcpy(proc->repo_name, repo->name,
1624 	    sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
1625 		fatalx("repository name too long: %s", repo->name);
1626 	log_debug("starting auth for uid %d repository %s",
1627 	    client->euid, repo->name);
1628 	if (strlcpy(proc->repo_path, repo->path, sizeof(proc->repo_path)) >=
1629 	    sizeof(proc->repo_path))
1630 		fatalx("repository path too long: %s", repo->path);
1631 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1632 	    PF_UNSPEC, proc->pipe) == -1)
1633 		fatal("socketpair");
1634 	proc->pid = start_child(proc->type, proc->repo_path, argv0,
1635 	    confpath, proc->pipe[1], daemonize, verbosity);
1636 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1637 	log_debug("proc %s %s is on fd %d",
1638 	    gotd_proc_names[proc->type], proc->repo_path,
1639 	    proc->pipe[0]);
1640 	proc->iev.handler = gotd_dispatch_auth_child;
1641 	proc->iev.events = EV_READ;
1642 	proc->iev.handler_arg = NULL;
1643 	event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
1644 	    gotd_dispatch_auth_child, &proc->iev);
1645 	gotd_imsg_event_add(&proc->iev);
1646 
1647 	iauth.euid = client->euid;
1648 	iauth.egid = client->egid;
1649 	iauth.required_auth = required_auth;
1650 	iauth.client_id = client->id;
1651 	if (gotd_imsg_compose_event(&proc->iev, GOTD_IMSG_AUTHENTICATE,
1652 	    PROC_GOTD, fd, &iauth, sizeof(iauth)) == -1) {
1653 		log_warn("imsg compose AUTHENTICATE");
1654 		close(fd);
1655 		/* Let the auth_timeout handler tidy up. */
1656 	}
1657 
1658 	client->auth = proc;
1659 	client->required_auth = required_auth;
1660 	return NULL;
1661 }
1662 
1663 static void
1664 apply_unveil_repo_readonly(const char *repo_path)
1665 {
1666 	if (unveil(repo_path, "r") == -1)
1667 		fatal("unveil %s", repo_path);
1668 
1669 	if (unveil(NULL, NULL) == -1)
1670 		fatal("unveil");
1671 }
1672 
1673 static void
1674 apply_unveil_repo_readwrite(const char *repo_path)
1675 {
1676 	if (unveil(repo_path, "rwc") == -1)
1677 		fatal("unveil %s", repo_path);
1678 
1679 	if (unveil(GOT_TMPDIR_STR, "rwc") == -1)
1680 		fatal("unveil %s", GOT_TMPDIR_STR);
1681 
1682 	if (unveil(NULL, NULL) == -1)
1683 		fatal("unveil");
1684 }
1685 
1686 static void
1687 apply_unveil_none(void)
1688 {
1689 	if (unveil("/", "") == -1)
1690 		fatal("unveil");
1691 
1692 	if (unveil(NULL, NULL) == -1)
1693 		fatal("unveil");
1694 }
1695 
1696 static void
1697 apply_unveil_selfexec(void)
1698 {
1699 	if (unveil(gotd.argv0, "x") == -1)
1700 		fatal("unveil %s", gotd.argv0);
1701 
1702 	if (unveil(NULL, NULL) == -1)
1703 		fatal("unveil");
1704 }
1705 
1706 int
1707 main(int argc, char **argv)
1708 {
1709 	const struct got_error *error = NULL;
1710 	int ch, fd = -1, daemonize = 1, verbosity = 0, noaction = 0;
1711 	const char *confpath = GOTD_CONF_PATH;
1712 	char *argv0 = argv[0];
1713 	char title[2048];
1714 	struct passwd *pw = NULL;
1715 	char *repo_path = NULL;
1716 	enum gotd_procid proc_id = PROC_GOTD;
1717 	struct event evsigint, evsigterm, evsighup, evsigusr1;
1718 	int *pack_fds = NULL, *temp_fds = NULL;
1719 
1720 	log_init(1, LOG_DAEMON); /* Log to stderr until daemonized. */
1721 
1722 	while ((ch = getopt(argc, argv, "Adf:LnP:RSvW")) != -1) {
1723 		switch (ch) {
1724 		case 'A':
1725 			proc_id = PROC_AUTH;
1726 			break;
1727 		case 'd':
1728 			daemonize = 0;
1729 			break;
1730 		case 'f':
1731 			confpath = optarg;
1732 			break;
1733 		case 'L':
1734 			proc_id = PROC_LISTEN;
1735 			break;
1736 		case 'n':
1737 			noaction = 1;
1738 			break;
1739 		case 'P':
1740 			repo_path = realpath(optarg, NULL);
1741 			if (repo_path == NULL)
1742 				fatal("realpath '%s'", optarg);
1743 			break;
1744 		case 'R':
1745 			proc_id = PROC_REPO_READ;
1746 			break;
1747 		case 'S':
1748 			proc_id = PROC_SESSION;
1749 			break;
1750 		case 'v':
1751 			if (verbosity < 3)
1752 				verbosity++;
1753 			break;
1754 		case 'W':
1755 			proc_id = PROC_REPO_WRITE;
1756 			break;
1757 		default:
1758 			usage();
1759 		}
1760 	}
1761 
1762 	argc -= optind;
1763 	argv += optind;
1764 
1765 	if (argc != 0)
1766 		usage();
1767 
1768 	if (geteuid() && (proc_id == PROC_GOTD || proc_id == PROC_LISTEN))
1769 		fatalx("need root privileges");
1770 
1771 	if (parse_config(confpath, proc_id, &gotd) != 0)
1772 		return 1;
1773 
1774 	pw = getpwnam(gotd.user_name);
1775 	if (pw == NULL)
1776 		fatalx("user %s not found", gotd.user_name);
1777 
1778 	if (pw->pw_uid == 0)
1779 		fatalx("cannot run %s as the superuser", getprogname());
1780 
1781 	if (noaction) {
1782 		fprintf(stderr, "configuration OK\n");
1783 		return 0;
1784 	}
1785 
1786 	gotd.argv0 = argv0;
1787 	gotd.daemonize = daemonize;
1788 	gotd.verbosity = verbosity;
1789 	gotd.confpath = confpath;
1790 
1791 	/* Require an absolute path in argv[0] for reliable re-exec. */
1792 	if (!got_path_is_absolute(argv0))
1793 		fatalx("bad path \"%s\": must be an absolute path", argv0);
1794 
1795 	log_init(daemonize ? 0 : 1, LOG_DAEMON);
1796 	log_setverbose(verbosity);
1797 
1798 	if (proc_id == PROC_GOTD) {
1799 		snprintf(title, sizeof(title), "%s", gotd_proc_names[proc_id]);
1800 		arc4random_buf(&clients_hash_key, sizeof(clients_hash_key));
1801 		if (daemonize && daemon(1, 0) == -1)
1802 			fatal("daemon");
1803 		gotd.pid = getpid();
1804 		start_listener(argv0, confpath, daemonize, verbosity);
1805 	} else if (proc_id == PROC_LISTEN) {
1806 		snprintf(title, sizeof(title), "%s", gotd_proc_names[proc_id]);
1807 		if (verbosity) {
1808 			log_info("socket: %s", gotd.unix_socket_path);
1809 			log_info("user: %s", pw->pw_name);
1810 		}
1811 
1812 		fd = unix_socket_listen(gotd.unix_socket_path, pw->pw_uid,
1813 		    pw->pw_gid);
1814 		if (fd == -1) {
1815 			fatal("cannot listen on unix socket %s",
1816 			    gotd.unix_socket_path);
1817 		}
1818 	} else if (proc_id == PROC_AUTH) {
1819 		snprintf(title, sizeof(title), "%s %s",
1820 		    gotd_proc_names[proc_id], repo_path);
1821 	} else if (proc_id == PROC_REPO_READ || proc_id == PROC_REPO_WRITE ||
1822 	    proc_id == PROC_SESSION) {
1823 		error = got_repo_pack_fds_open(&pack_fds);
1824 		if (error != NULL)
1825 			fatalx("cannot open pack tempfiles: %s", error->msg);
1826 		error = got_repo_temp_fds_open(&temp_fds);
1827 		if (error != NULL)
1828 			fatalx("cannot open pack tempfiles: %s", error->msg);
1829 		if (repo_path == NULL)
1830 			fatalx("repository path not specified");
1831 		snprintf(title, sizeof(title), "%s %s",
1832 		    gotd_proc_names[proc_id], repo_path);
1833 	} else
1834 		fatal("invalid process id %d", proc_id);
1835 
1836 	setproctitle("%s", title);
1837 	log_procinit(title);
1838 
1839 	/* Drop root privileges. */
1840 	if (setgid(pw->pw_gid) == -1)
1841 		fatal("setgid %d failed", pw->pw_gid);
1842 	if (setuid(pw->pw_uid) == -1)
1843 		fatal("setuid %d failed", pw->pw_uid);
1844 
1845 	event_init();
1846 
1847 	switch (proc_id) {
1848 	case PROC_GOTD:
1849 #ifndef PROFILE
1850 		/* "exec" promise will be limited to argv[0] via unveil(2). */
1851 		if (pledge("stdio proc exec sendfd recvfd unveil", NULL) == -1)
1852 			err(1, "pledge");
1853 #endif
1854 		break;
1855 	case PROC_LISTEN:
1856 #ifndef PROFILE
1857 		if (pledge("stdio sendfd unix unveil", NULL) == -1)
1858 			err(1, "pledge");
1859 #endif
1860 		/*
1861 		 * Ensure that AF_UNIX bind(2) cannot be used with any other
1862 		 * sockets by revoking all filesystem access via unveil(2).
1863 		 */
1864 		apply_unveil_none();
1865 
1866 		listen_main(title, fd, gotd.connection_limits,
1867 		    gotd.nconnection_limits);
1868 		/* NOTREACHED */
1869 		break;
1870 	case PROC_AUTH:
1871 #ifndef PROFILE
1872 		if (pledge("stdio getpw recvfd unix unveil", NULL) == -1)
1873 			err(1, "pledge");
1874 #endif
1875 		/*
1876 		 * We need the "unix" pledge promise for getpeername(2) only.
1877 		 * Ensure that AF_UNIX bind(2) cannot be used by revoking all
1878 		 * filesystem access via unveil(2). Access to password database
1879 		 * files will still work since "getpw" bypasses unveil(2).
1880 		 */
1881 		apply_unveil_none();
1882 
1883 		auth_main(title, &gotd.repos, repo_path);
1884 		/* NOTREACHED */
1885 		break;
1886 	case PROC_SESSION:
1887 #ifndef PROFILE
1888 		/*
1889 		 * The "recvfd" promise is only needed during setup and
1890 		 * will be removed in a later pledge(2) call.
1891 		 */
1892 		if (pledge("stdio rpath wpath cpath recvfd sendfd fattr flock "
1893 		    "unveil", NULL) == -1)
1894 			err(1, "pledge");
1895 #endif
1896 		apply_unveil_repo_readwrite(repo_path);
1897 		session_main(title, repo_path, pack_fds, temp_fds,
1898 		    &gotd.request_timeout);
1899 		/* NOTREACHED */
1900 		break;
1901 	case PROC_REPO_READ:
1902 #ifndef PROFILE
1903 		if (pledge("stdio rpath recvfd unveil", NULL) == -1)
1904 			err(1, "pledge");
1905 #endif
1906 		apply_unveil_repo_readonly(repo_path);
1907 		repo_read_main(title, repo_path, pack_fds, temp_fds);
1908 		/* NOTREACHED */
1909 		exit(0);
1910 	case PROC_REPO_WRITE:
1911 #ifndef PROFILE
1912 		if (pledge("stdio rpath recvfd unveil", NULL) == -1)
1913 			err(1, "pledge");
1914 #endif
1915 		apply_unveil_repo_readonly(repo_path);
1916 		repo_write_main(title, repo_path, pack_fds, temp_fds);
1917 		/* NOTREACHED */
1918 		exit(0);
1919 	default:
1920 		fatal("invalid process id %d", proc_id);
1921 	}
1922 
1923 	if (proc_id != PROC_GOTD)
1924 		fatal("invalid process id %d", proc_id);
1925 
1926 	apply_unveil_selfexec();
1927 
1928 	signal_set(&evsigint, SIGINT, gotd_sighdlr, NULL);
1929 	signal_set(&evsigterm, SIGTERM, gotd_sighdlr, NULL);
1930 	signal_set(&evsighup, SIGHUP, gotd_sighdlr, NULL);
1931 	signal_set(&evsigusr1, SIGUSR1, gotd_sighdlr, NULL);
1932 	signal(SIGPIPE, SIG_IGN);
1933 
1934 	signal_add(&evsigint, NULL);
1935 	signal_add(&evsigterm, NULL);
1936 	signal_add(&evsighup, NULL);
1937 	signal_add(&evsigusr1, NULL);
1938 
1939 	gotd_imsg_event_add(&gotd.listen_proc.iev);
1940 
1941 	event_dispatch();
1942 
1943 	free(repo_path);
1944 	gotd_shutdown();
1945 
1946 	return 0;
1947 }