Got Mirror

Blob

Date:: Thu Jun 22 13:45:28 2023 UTC
Message:: missing semicolon... sigh I can't assume I can blindly add one simple line.
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/queue.h>
18 #include <sys/tree.h>
19 #include <sys/time.h>
20 #include <sys/types.h>
21 #include <sys/stat.h>
22 #include <sys/socket.h>
23 #include <sys/un.h>
24 #include <sys/wait.h>
25 
26 #include <fcntl.h>
27 #include <err.h>
28 #include <errno.h>
29 #include <event.h>
30 #include <limits.h>
31 #include <pwd.h>
32 #include <imsg.h>
33 #include <sha1.h>
34 #include <sha2.h>
35 #include <signal.h>
36 #include <siphash.h>
37 #include <stdarg.h>
38 #include <stdio.h>
39 #include <stdlib.h>
40 #include <string.h>
41 #include <syslog.h>
42 #include <unistd.h>
43 
44 #include "got_error.h"
45 #include "got_opentemp.h"
46 #include "got_path.h"
47 #include "got_repository.h"
48 #include "got_object.h"
49 #include "got_reference.h"
50 
51 #include "got_lib_delta.h"
52 #include "got_lib_object.h"
53 #include "got_lib_object_cache.h"
54 #include "got_lib_hash.h"
55 #include "got_lib_gitproto.h"
56 #include "got_lib_pack.h"
57 #include "got_lib_repository.h"
58 
59 #include "gotd.h"
60 #include "log.h"
61 #include "listen.h"
62 #include "auth.h"
63 #include "session.h"
64 #include "repo_read.h"
65 #include "repo_write.h"
66 
67 #ifndef nitems
68 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
69 #endif
70 
71 enum gotd_client_state {
72 	GOTD_CLIENT_STATE_NEW,
73 	GOTD_CLIENT_STATE_ACCESS_GRANTED,
74 };
75 
76 struct gotd_child_proc {
77 	pid_t				 pid;
78 	enum gotd_procid		 type;
79 	char				 repo_name[NAME_MAX];
80 	char				 repo_path[PATH_MAX];
81 	int				 pipe[2];
82 	struct gotd_imsgev		 iev;
83 };
84 
85 struct gotd_client {
86 	STAILQ_ENTRY(gotd_client)	 entry;
87 	enum gotd_client_state		 state;
88 	uint32_t			 id;
89 	int				 fd;
90 	struct gotd_imsgev		 iev;
91 	struct event			 tmo;
92 	uid_t				 euid;
93 	gid_t				 egid;
94 	struct gotd_child_proc		*repo;
95 	struct gotd_child_proc		*auth;
96 	struct gotd_child_proc		*session;
97 	int				 required_auth;
98 };
99 STAILQ_HEAD(gotd_clients, gotd_client);
100 
101 static struct gotd_clients gotd_clients[GOTD_CLIENT_TABLE_SIZE];
102 static SIPHASH_KEY clients_hash_key;
103 volatile int client_cnt;
104 static struct timeval auth_timeout = { 5, 0 };
105 static struct gotd gotd;
106 
107 void gotd_sighdlr(int sig, short event, void *arg);
108 static void gotd_shutdown(void);
109 static const struct got_error *start_session_child(struct gotd_client *,
110     struct gotd_repo *, char *, const char *, int, int);
111 static const struct got_error *start_repo_child(struct gotd_client *,
112     enum gotd_procid, struct gotd_repo *, char *, const char *, int, int);
113 static const struct got_error *start_auth_child(struct gotd_client *, int,
114     struct gotd_repo *, char *, const char *, int, int);
115 static void kill_proc(struct gotd_child_proc *, int);
116 
117 __dead static void
118 usage(void)
119 {
120 	fprintf(stderr, "usage: %s [-dnv] [-f config-file]\n", getprogname());
121 	exit(1);
122 }
123 
124 static int
125 unix_socket_listen(const char *unix_socket_path, uid_t uid, gid_t gid)
126 {
127 	struct sockaddr_un sun;
128 	int fd = -1;
129 	mode_t old_umask, mode;
130 
131 	fd = socket(AF_UNIX, SOCK_STREAM | SOCK_NONBLOCK| SOCK_CLOEXEC, 0);
132 	if (fd == -1) {
133 		log_warn("socket");
134 		return -1;
135 	}
136 
137 	sun.sun_family = AF_UNIX;
138 	if (strlcpy(sun.sun_path, unix_socket_path,
139 	    sizeof(sun.sun_path)) >= sizeof(sun.sun_path)) {
140 		log_warnx("%s: name too long", unix_socket_path);
141 		close(fd);
142 		return -1;
143 	}
144 
145 	if (unlink(unix_socket_path) == -1) {
146 		if (errno != ENOENT) {
147 			log_warn("unlink %s", unix_socket_path);
148 			close(fd);
149 			return -1;
150 		}
151 	}
152 
153 	old_umask = umask(S_IXUSR|S_IXGRP|S_IWOTH|S_IROTH|S_IXOTH);
154 	mode = S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH;
155 
156 	if (bind(fd, (struct sockaddr *)&sun, sizeof(sun)) == -1) {
157 		log_warn("bind: %s", unix_socket_path);
158 		close(fd);
159 		umask(old_umask);
160 		return -1;
161 	}
162 
163 	umask(old_umask);
164 
165 	if (chmod(unix_socket_path, mode) == -1) {
166 		log_warn("chmod %o %s", mode, unix_socket_path);
167 		close(fd);
168 		unlink(unix_socket_path);
169 		return -1;
170 	}
171 
172 	if (chown(unix_socket_path, uid, gid) == -1) {
173 		log_warn("chown %s uid=%d gid=%d", unix_socket_path, uid, gid);
174 		close(fd);
175 		unlink(unix_socket_path);
176 		return -1;
177 	}
178 
179 	if (listen(fd, GOTD_UNIX_SOCKET_BACKLOG) == -1) {
180 		log_warn("listen");
181 		close(fd);
182 		unlink(unix_socket_path);
183 		return -1;
184 	}
185 
186 	return fd;
187 }
188 
189 static uint64_t
190 client_hash(uint32_t client_id)
191 {
192 	return SipHash24(&clients_hash_key, &client_id, sizeof(client_id));
193 }
194 
195 static void
196 add_client(struct gotd_client *client)
197 {
198 	uint64_t slot = client_hash(client->id) % nitems(gotd_clients);
199 	STAILQ_INSERT_HEAD(&gotd_clients[slot], client, entry);
200 	client_cnt++;
201 }
202 
203 static struct gotd_client *
204 find_client(uint32_t client_id)
205 {
206 	uint64_t slot;
207 	struct gotd_client *c;
208 
209 	slot = client_hash(client_id) % nitems(gotd_clients);
210 	STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
211 		if (c->id == client_id)
212 			return c;
213 	}
214 
215 	return NULL;
216 }
217 
218 static struct gotd_client *
219 find_client_by_proc_fd(int fd)
220 {
221 	uint64_t slot;
222 
223 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
224 		struct gotd_client *c;
225 
226 		STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
227 			if (c->repo && c->repo->iev.ibuf.fd == fd)
228 				return c;
229 			if (c->auth && c->auth->iev.ibuf.fd == fd)
230 				return c;
231 			if (c->session && c->session->iev.ibuf.fd == fd)
232 				return c;
233 		}
234 	}
235 
236 	return NULL;
237 }
238 
239 static int
240 client_is_reading(struct gotd_client *client)
241 {
242 	return (client->required_auth &
243 	    (GOTD_AUTH_READ | GOTD_AUTH_WRITE)) == GOTD_AUTH_READ;
244 }
245 
246 static int
247 client_is_writing(struct gotd_client *client)
248 {
249 	return (client->required_auth &
250 	    (GOTD_AUTH_READ | GOTD_AUTH_WRITE)) ==
251 	    (GOTD_AUTH_READ | GOTD_AUTH_WRITE);
252 }
253 
254 static const struct got_error *
255 ensure_client_is_not_writing(struct gotd_client *client)
256 {
257 	if (client_is_writing(client)) {
258 		return got_error_fmt(GOT_ERR_BAD_PACKET,
259 		    "uid %d made a read-request but is writing to "
260 		    "a repository", client->euid);
261 	}
262 
263 	return NULL;
264 }
265 
266 static const struct got_error *
267 ensure_client_is_not_reading(struct gotd_client *client)
268 {
269 	if (client_is_reading(client)) {
270 		return got_error_fmt(GOT_ERR_BAD_PACKET,
271 		    "uid %d made a write-request but is reading from "
272 		    "a repository", client->euid);
273 	}
274 
275 	return NULL;
276 }
277 
278 static void
279 wait_for_child(pid_t child_pid)
280 {
281 	pid_t pid;
282 	int status;
283 
284 	log_debug("waiting for child PID %ld to terminate",
285 	    (long)child_pid);
286 
287 	do {
288 		pid = waitpid(child_pid, &status, WNOHANG);
289 		if (pid == -1) {
290 			if (errno != EINTR && errno != ECHILD)
291 				fatal("wait");
292 		} else if (WIFSIGNALED(status)) {
293 			log_warnx("child PID %ld terminated; signal %d",
294 			    (long)pid, WTERMSIG(status));
295 		}
296 	} while (pid != -1 || (pid == -1 && errno == EINTR));
297 }
298 
299 static void
300 proc_done(struct gotd_child_proc *proc)
301 {
302 	event_del(&proc->iev.ev);
303 	msgbuf_clear(&proc->iev.ibuf.w);
304 	close(proc->iev.ibuf.fd);
305 	kill_proc(proc, 0);
306 	wait_for_child(proc->pid);
307 	free(proc);
308 }
309 
310 static void
311 kill_auth_proc(struct gotd_client *client)
312 {
313 	struct gotd_child_proc *proc;
314 
315 	if (client->auth == NULL)
316 		return;
317 
318 	proc = client->auth;
319 	client->auth = NULL;
320 
321 	proc_done(proc);
322 }
323 
324 static void
325 kill_session_proc(struct gotd_client *client)
326 {
327 	struct gotd_child_proc *proc;
328 
329 	if (client->session == NULL)
330 		return;
331 
332 	proc = client->session;
333 	client->session = NULL;
334 
335 	proc_done(proc);
336 }
337 
338 static void
339 disconnect(struct gotd_client *client)
340 {
341 	struct gotd_imsg_disconnect idisconnect;
342 	struct gotd_child_proc *proc = client->repo;
343 	struct gotd_child_proc *listen_proc = gotd.listen_proc;
344 	uint64_t slot;
345 
346 	log_debug("uid %d: disconnecting", client->euid);
347 
348 	kill_auth_proc(client);
349 	kill_session_proc(client);
350 
351 	if (proc) {
352 		event_del(&proc->iev.ev);
353 		msgbuf_clear(&proc->iev.ibuf.w);
354 		close(proc->iev.ibuf.fd);
355 		kill_proc(proc, 0);
356 		wait_for_child(proc->pid);
357 		free(proc);
358 		proc = NULL;
359 	}
360 
361 	idisconnect.client_id = client->id;
362 	if (gotd_imsg_compose_event(&listen_proc->iev,
363 	    GOTD_IMSG_DISCONNECT, PROC_GOTD, -1,
364 	    &idisconnect, sizeof(idisconnect)) == -1)
365 		log_warn("imsg compose DISCONNECT");
366 
367 	slot = client_hash(client->id) % nitems(gotd_clients);
368 	STAILQ_REMOVE(&gotd_clients[slot], client, gotd_client, entry);
369 	imsg_clear(&client->iev.ibuf);
370 	event_del(&client->iev.ev);
371 	evtimer_del(&client->tmo);
372 	if (client->fd != -1)
373 		close(client->fd);
374 	else if (client->iev.ibuf.fd != -1)
375 		close(client->iev.ibuf.fd);
376 	free(client);
377 	client_cnt--;
378 }
379 
380 static void
381 disconnect_on_error(struct gotd_client *client, const struct got_error *err)
382 {
383 	struct imsgbuf ibuf;
384 
385 	log_warnx("uid %d: %s", client->euid, err->msg);
386 	if (err->code != GOT_ERR_EOF && client->fd != -1) {
387 		imsg_init(&ibuf, client->fd);
388 		gotd_imsg_send_error(&ibuf, 0, PROC_GOTD, err);
389 		imsg_clear(&ibuf);
390 	}
391 	disconnect(client);
392 }
393 
394 static const struct got_error *
395 send_repo_info(struct gotd_imsgev *iev, struct gotd_repo *repo)
396 {
397 	const struct got_error *err = NULL;
398 	struct gotd_imsg_info_repo irepo;
399 
400 	memset(&irepo, 0, sizeof(irepo));
401 
402 	if (strlcpy(irepo.repo_name, repo->name, sizeof(irepo.repo_name))
403 	    >= sizeof(irepo.repo_name))
404 		return got_error_msg(GOT_ERR_NO_SPACE, "repo name too long");
405 	if (strlcpy(irepo.repo_path, repo->path, sizeof(irepo.repo_path))
406 	    >= sizeof(irepo.repo_path))
407 		return got_error_msg(GOT_ERR_NO_SPACE, "repo path too long");
408 
409 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_INFO_REPO, PROC_GOTD, -1,
410 	    &irepo, sizeof(irepo)) == -1) {
411 		err = got_error_from_errno("imsg compose INFO_REPO");
412 		if (err)
413 			return err;
414 	}
415 
416 	return NULL;
417 }
418 
419 static const struct got_error *
420 send_client_info(struct gotd_imsgev *iev, struct gotd_client *client)
421 {
422 	const struct got_error *err = NULL;
423 	struct gotd_imsg_info_client iclient;
424 	struct gotd_child_proc *proc;
425 
426 	memset(&iclient, 0, sizeof(iclient));
427 	iclient.euid = client->euid;
428 	iclient.egid = client->egid;
429 
430 	proc = client->repo;
431 	if (proc) {
432 		if (strlcpy(iclient.repo_name, proc->repo_path,
433 		    sizeof(iclient.repo_name)) >= sizeof(iclient.repo_name)) {
434 			return got_error_msg(GOT_ERR_NO_SPACE,
435 			    "repo name too long");
436 		}
437 		if (client_is_writing(client))
438 			iclient.is_writing = 1;
439 
440 		iclient.repo_child_pid = proc->pid;
441 	}
442 
443 	if (client->session)
444 		iclient.session_child_pid = client->session->pid;
445 
446 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_INFO_CLIENT, PROC_GOTD, -1,
447 	    &iclient, sizeof(iclient)) == -1) {
448 		err = got_error_from_errno("imsg compose INFO_CLIENT");
449 		if (err)
450 			return err;
451 	}
452 
453 	return NULL;
454 }
455 
456 static const struct got_error *
457 send_info(struct gotd_client *client)
458 {
459 	const struct got_error *err = NULL;
460 	struct gotd_imsg_info info;
461 	uint64_t slot;
462 	struct gotd_repo *repo;
463 
464 	if (client->euid != 0)
465 		return got_error_set_errno(EPERM, "info");
466 
467 	info.pid = gotd.pid;
468 	info.verbosity = gotd.verbosity;
469 	info.nrepos = gotd.nrepos;
470 	info.nclients = client_cnt - 1;
471 
472 	if (gotd_imsg_compose_event(&client->iev, GOTD_IMSG_INFO, PROC_GOTD, -1,
473 	    &info, sizeof(info)) == -1) {
474 		err = got_error_from_errno("imsg compose INFO");
475 		if (err)
476 			return err;
477 	}
478 
479 	TAILQ_FOREACH(repo, &gotd.repos, entry) {
480 		err = send_repo_info(&client->iev, repo);
481 		if (err)
482 			return err;
483 	}
484 
485 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
486 		struct gotd_client *c;
487 		STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
488 			if (c->id == client->id)
489 				continue;
490 			err = send_client_info(&client->iev, c);
491 			if (err)
492 				return err;
493 		}
494 	}
495 
496 	return NULL;
497 }
498 
499 static const struct got_error *
500 stop_gotd(struct gotd_client *client)
501 {
502 
503 	if (client->euid != 0)
504 		return got_error_set_errno(EPERM, "stop");
505 
506 	gotd_shutdown();
507 	/* NOTREACHED */
508 	return NULL;
509 }
510 
511 static const struct got_error *
512 start_client_authentication(struct gotd_client *client, struct imsg *imsg)
513 {
514 	const struct got_error *err;
515 	struct gotd_imsg_list_refs ireq;
516 	struct gotd_repo *repo = NULL;
517 	size_t datalen;
518 
519 	log_debug("list-refs request from uid %d", client->euid);
520 
521 	if (client->state != GOTD_CLIENT_STATE_NEW)
522 		return got_error_msg(GOT_ERR_BAD_REQUEST,
523 		    "unexpected list-refs request received");
524 
525 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
526 	if (datalen != sizeof(ireq))
527 		return got_error(GOT_ERR_PRIVSEP_LEN);
528 
529 	memcpy(&ireq, imsg->data, datalen);
530 
531 	if (ireq.client_is_reading) {
532 		err = ensure_client_is_not_writing(client);
533 		if (err)
534 			return err;
535 		repo = gotd_find_repo_by_name(ireq.repo_name, &gotd);
536 		if (repo == NULL)
537 			return got_error(GOT_ERR_NOT_GIT_REPO);
538 		err = start_auth_child(client, GOTD_AUTH_READ, repo,
539 		    gotd.argv0, gotd.confpath, gotd.daemonize,
540 		    gotd.verbosity);
541 		if (err)
542 			return err;
543 	} else {
544 		err = ensure_client_is_not_reading(client);
545 		if (err)
546 			return err;
547 		repo = gotd_find_repo_by_name(ireq.repo_name, &gotd);
548 		if (repo == NULL)
549 			return got_error(GOT_ERR_NOT_GIT_REPO);
550 		err = start_auth_child(client,
551 		    GOTD_AUTH_READ | GOTD_AUTH_WRITE,
552 		    repo, gotd.argv0, gotd.confpath, gotd.daemonize,
553 		    gotd.verbosity);
554 		if (err)
555 			return err;
556 	}
557 
558 	evtimer_add(&client->tmo, &auth_timeout);
559 
560 	/* Flow continues upon authentication successs/failure or timeout. */
561 	return NULL;
562 }
563 
564 static void
565 gotd_request(int fd, short events, void *arg)
566 {
567 	struct gotd_imsgev *iev = arg;
568 	struct imsgbuf *ibuf = &iev->ibuf;
569 	struct gotd_client *client = iev->handler_arg;
570 	const struct got_error *err = NULL;
571 	struct imsg imsg;
572 	ssize_t n;
573 
574 	if (events & EV_WRITE) {
575 		while (ibuf->w.queued) {
576 			n = msgbuf_write(&ibuf->w);
577 			if (n == -1 && errno == EPIPE) {
578 				/*
579 				 * The client has closed its socket.
580 				 * This can happen when Git clients are
581 				 * done sending pack file data.
582 				 */
583 				msgbuf_clear(&ibuf->w);
584 				continue;
585 			} else if (n == -1 && errno != EAGAIN) {
586 				err = got_error_from_errno("imsg_flush");
587 				disconnect_on_error(client, err);
588 				return;
589 			}
590 			if (n == 0) {
591 				/* Connection closed. */
592 				err = got_error(GOT_ERR_EOF);
593 				disconnect_on_error(client, err);
594 				return;
595 			}
596 		}
597 
598 		/* Disconnect gotctl(8) now that messages have been sent. */
599 		if (!client_is_reading(client) && !client_is_writing(client)) {
600 			disconnect(client);
601 			return;
602 		}
603 	}
604 
605 	if ((events & EV_READ) == 0)
606 		return;
607 
608 	memset(&imsg, 0, sizeof(imsg));
609 
610 	while (err == NULL) {
611 		err = gotd_imsg_recv(&imsg, ibuf, 0);
612 		if (err) {
613 			if (err->code == GOT_ERR_PRIVSEP_READ)
614 				err = NULL;
615 			break;
616 		}
617 
618 		evtimer_del(&client->tmo);
619 
620 		switch (imsg.hdr.type) {
621 		case GOTD_IMSG_INFO:
622 			err = send_info(client);
623 			break;
624 		case GOTD_IMSG_STOP:
625 			err = stop_gotd(client);
626 			break;
627 		case GOTD_IMSG_LIST_REFS:
628 			err = start_client_authentication(client, &imsg);
629 			break;
630 		default:
631 			log_debug("unexpected imsg %d", imsg.hdr.type);
632 			err = got_error(GOT_ERR_PRIVSEP_MSG);
633 			break;
634 		}
635 
636 		imsg_free(&imsg);
637 	}
638 
639 	if (err) {
640 		disconnect_on_error(client, err);
641 	} else {
642 		gotd_imsg_event_add(&client->iev);
643 	}
644 }
645 
646 static void
647 gotd_auth_timeout(int fd, short events, void *arg)
648 {
649 	struct gotd_client *client = arg;
650 
651 	log_debug("disconnecting uid %d due to authentication timeout",
652 	    client->euid);
653 	disconnect(client);
654 }
655 
656 static const struct got_error *
657 recv_connect(uint32_t *client_id, struct imsg *imsg)
658 {
659 	const struct got_error *err = NULL;
660 	struct gotd_imsg_connect iconnect;
661 	size_t datalen;
662 	int s = -1;
663 	struct gotd_client *client = NULL;
664 
665 	*client_id = 0;
666 
667 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
668 	if (datalen != sizeof(iconnect))
669 		return got_error(GOT_ERR_PRIVSEP_LEN);
670 	memcpy(&iconnect, imsg->data, sizeof(iconnect));
671 
672 	s = imsg->fd;
673 	if (s == -1) {
674 		err = got_error(GOT_ERR_PRIVSEP_NO_FD);
675 		goto done;
676 	}
677 
678 	if (find_client(iconnect.client_id)) {
679 		err = got_error_msg(GOT_ERR_CLIENT_ID, "duplicate client ID");
680 		goto done;
681 	}
682 
683 	client = calloc(1, sizeof(*client));
684 	if (client == NULL) {
685 		err = got_error_from_errno("calloc");
686 		goto done;
687 	}
688 
689 	*client_id = iconnect.client_id;
690 
691 	client->state = GOTD_CLIENT_STATE_NEW;
692 	client->id = iconnect.client_id;
693 	client->fd = s;
694 	s = -1;
695 	/* The auth process will verify UID/GID for us. */
696 	client->euid = iconnect.euid;
697 	client->egid = iconnect.egid;
698 
699 	imsg_init(&client->iev.ibuf, client->fd);
700 	client->iev.handler = gotd_request;
701 	client->iev.events = EV_READ;
702 	client->iev.handler_arg = client;
703 
704 	event_set(&client->iev.ev, client->fd, EV_READ, gotd_request,
705 	    &client->iev);
706 	gotd_imsg_event_add(&client->iev);
707 
708 	evtimer_set(&client->tmo, gotd_auth_timeout, client);
709 
710 	add_client(client);
711 	log_debug("%s: new client uid %d connected on fd %d", __func__,
712 	    client->euid, client->fd);
713 done:
714 	if (err) {
715 		struct gotd_child_proc *listen_proc = gotd.listen_proc;
716 		struct gotd_imsg_disconnect idisconnect;
717 
718 		idisconnect.client_id = client->id;
719 		if (gotd_imsg_compose_event(&listen_proc->iev,
720 		    GOTD_IMSG_DISCONNECT, PROC_GOTD, -1,
721 		    &idisconnect, sizeof(idisconnect)) == -1)
722 			log_warn("imsg compose DISCONNECT");
723 
724 		if (s != -1)
725 			close(s);
726 	}
727 
728 	return err;
729 }
730 
731 static const char *gotd_proc_names[PROC_MAX] = {
732 	"parent",
733 	"listen",
734 	"auth",
735 	"session_read",
736 	"session_write",
737 	"repo_read",
738 	"repo_write"
739 };
740 
741 static void
742 kill_proc(struct gotd_child_proc *proc, int fatal)
743 {
744 	if (fatal) {
745 		log_warnx("sending SIGKILL to PID %d", proc->pid);
746 		kill(proc->pid, SIGKILL);
747 	} else
748 		kill(proc->pid, SIGTERM);
749 }
750 
751 static void
752 gotd_shutdown(void)
753 {
754 	struct gotd_child_proc *proc;
755 	uint64_t slot;
756 
757 	log_debug("shutting down");
758 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
759 		struct gotd_client *c, *tmp;
760 
761 		STAILQ_FOREACH_SAFE(c, &gotd_clients[slot], entry, tmp)
762 			disconnect(c);
763 	}
764 
765 	proc = gotd.listen_proc;
766 	msgbuf_clear(&proc->iev.ibuf.w);
767 	close(proc->iev.ibuf.fd);
768 	kill_proc(proc, 0);
769 	wait_for_child(proc->pid);
770 	free(proc);
771 
772 	log_info("terminating");
773 	exit(0);
774 }
775 
776 void
777 gotd_sighdlr(int sig, short event, void *arg)
778 {
779 	/*
780 	 * Normal signal handler rules don't apply because libevent
781 	 * decouples for us.
782 	 */
783 
784 	switch (sig) {
785 	case SIGHUP:
786 		log_info("%s: ignoring SIGHUP", __func__);
787 		break;
788 	case SIGUSR1:
789 		log_info("%s: ignoring SIGUSR1", __func__);
790 		break;
791 	case SIGTERM:
792 	case SIGINT:
793 		gotd_shutdown();
794 		break;
795 	default:
796 		fatalx("unexpected signal");
797 	}
798 }
799 
800 static const struct got_error *
801 ensure_proc_is_reading(struct gotd_client *client,
802     struct gotd_child_proc *proc)
803 {
804 	if (!client_is_reading(client)) {
805 		kill_proc(proc, 1);
806 		return got_error_fmt(GOT_ERR_BAD_PACKET,
807 		    "PID %d handled a read-request for uid %d but this "
808 		    "user is not reading from a repository", proc->pid,
809 		    client->euid);
810 	}
811 
812 	return NULL;
813 }
814 
815 static const struct got_error *
816 ensure_proc_is_writing(struct gotd_client *client,
817     struct gotd_child_proc *proc)
818 {
819 	if (!client_is_writing(client)) {
820 		kill_proc(proc, 1);
821 		return got_error_fmt(GOT_ERR_BAD_PACKET,
822 		    "PID %d handled a write-request for uid %d but this "
823 		    "user is not writing to a repository", proc->pid,
824 		    client->euid);
825 	}
826 
827 	return NULL;
828 }
829 
830 static int
831 verify_imsg_src(struct gotd_client *client, struct gotd_child_proc *proc,
832     struct imsg *imsg)
833 {
834 	const struct got_error *err;
835 	int ret = 0;
836 
837 	if (proc->type == PROC_REPO_READ || proc->type == PROC_REPO_WRITE) {
838 		if (client->repo == NULL)
839 			fatalx("no process found for uid %d", client->euid);
840 		if (proc->pid != client->repo->pid) {
841 			kill_proc(proc, 1);
842 			log_warnx("received message from PID %d for uid %d, "
843 			    "while PID %d is the process serving this user",
844 			    proc->pid, client->euid, client->repo->pid);
845 			return 0;
846 		}
847 	}
848 	if (proc->type == PROC_SESSION_READ ||
849 	    proc->type == PROC_SESSION_WRITE) {
850 		if (client->session == NULL) {
851 			log_warnx("no session found for uid %d", client->euid);
852 			return 0;
853 		}
854 		if (proc->pid != client->session->pid) {
855 			kill_proc(proc, 1);
856 			log_warnx("received message from PID %d for uid %d, "
857 			    "while PID %d is the process serving this user",
858 			    proc->pid, client->euid, client->session->pid);
859 			return 0;
860 		}
861 	}
862 
863 	switch (imsg->hdr.type) {
864 	case GOTD_IMSG_ERROR:
865 		ret = 1;
866 		break;
867 	case GOTD_IMSG_CONNECT:
868 		if (proc->type != PROC_LISTEN) {
869 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
870 			    "new connection for uid %d from PID %d "
871 			    "which is not the listen process",
872 			    proc->pid, client->euid);
873 		} else
874 			ret = 1;
875 		break;
876 	case GOTD_IMSG_ACCESS_GRANTED:
877 		if (proc->type != PROC_AUTH) {
878 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
879 			    "authentication of uid %d from PID %d "
880 			    "which is not the auth process",
881 			    proc->pid, client->euid);
882 		} else
883 			ret = 1;
884 		break;
885 	case GOTD_IMSG_CLIENT_SESSION_READY:
886 		if (proc->type != PROC_SESSION_READ &&
887 		    proc->type != PROC_SESSION_WRITE) {
888 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
889 			    "unexpected \"ready\" signal from PID %d",
890 			    proc->pid);
891 		} else
892 			ret = 1;
893 		break;
894 	case GOTD_IMSG_REPO_CHILD_READY:
895 		if (proc->type != PROC_REPO_READ &&
896 		    proc->type != PROC_REPO_WRITE) {
897 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
898 			    "unexpected \"ready\" signal from PID %d",
899 			    proc->pid);
900 		} else
901 			ret = 1;
902 		break;
903 	case GOTD_IMSG_PACKFILE_DONE:
904 		err = ensure_proc_is_reading(client, proc);
905 		if (err)
906 			log_warnx("uid %d: %s", client->euid, err->msg);
907 		else
908 			ret = 1;
909 		break;
910 	case GOTD_IMSG_PACKFILE_INSTALL:
911 	case GOTD_IMSG_REF_UPDATES_START:
912 	case GOTD_IMSG_REF_UPDATE:
913 		err = ensure_proc_is_writing(client, proc);
914 		if (err)
915 			log_warnx("uid %d: %s", client->euid, err->msg);
916 		else
917 			ret = 1;
918 		break;
919 	default:
920 		log_debug("%s: unexpected imsg %d", __func__, imsg->hdr.type);
921 		break;
922 	}
923 
924 	return ret;
925 }
926 
927 static const struct got_error *
928 connect_repo_child(struct gotd_client *client,
929     struct gotd_child_proc *repo_proc)
930 {
931 	static const struct got_error *err;
932 	struct gotd_imsgev *session_iev = &client->session->iev;
933 	struct gotd_imsg_connect_repo_child ireq;
934 	int pipe[2];
935 
936 	if (client->state != GOTD_CLIENT_STATE_ACCESS_GRANTED)
937 		return got_error_msg(GOT_ERR_BAD_REQUEST,
938 		    "unexpected repo child ready signal received");
939 
940 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
941 	    PF_UNSPEC, pipe) == -1)
942 		fatal("socketpair");
943 
944 	memset(&ireq, 0, sizeof(ireq));
945 	ireq.client_id = client->id;
946 	ireq.proc_id = repo_proc->type;
947 
948 	/* Pass repo child pipe to session child process. */
949 	if (gotd_imsg_compose_event(session_iev, GOTD_IMSG_CONNECT_REPO_CHILD,
950 	    PROC_GOTD, pipe[0], &ireq, sizeof(ireq)) == -1) {
951 		err = got_error_from_errno("imsg compose CONNECT_REPO_CHILD");
952 		close(pipe[0]);
953 		close(pipe[1]);
954 		return err;
955 	}
956 
957 	/* Pass session child pipe to repo child process. */
958 	if (gotd_imsg_compose_event(&repo_proc->iev,
959 	    GOTD_IMSG_CONNECT_REPO_CHILD, PROC_GOTD, pipe[1], NULL, 0) == -1) {
960 		err = got_error_from_errno("imsg compose CONNECT_REPO_CHILD");
961 		close(pipe[1]);
962 		return err;
963 	}
964 
965 	return NULL;
966 }
967 
968 static void
969 gotd_dispatch_listener(int fd, short event, void *arg)
970 {
971 	struct gotd_imsgev *iev = arg;
972 	struct imsgbuf *ibuf = &iev->ibuf;
973 	struct gotd_child_proc *proc = gotd.listen_proc;
974 	ssize_t n;
975 	int shut = 0;
976 	struct imsg imsg;
977 
978 	if (proc->iev.ibuf.fd != fd)
979 		fatalx("%s: unexpected fd %d", __func__, fd);
980 
981 	if (event & EV_READ) {
982 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
983 			fatal("imsg_read error");
984 		if (n == 0) {
985 			/* Connection closed. */
986 			shut = 1;
987 			goto done;
988 		}
989 	}
990 
991 	if (event & EV_WRITE) {
992 		n = msgbuf_write(&ibuf->w);
993 		if (n == -1 && errno != EAGAIN)
994 			fatal("msgbuf_write");
995 		if (n == 0) {
996 			/* Connection closed. */
997 			shut = 1;
998 			goto done;
999 		}
1000 	}
1001 
1002 	for (;;) {
1003 		const struct got_error *err = NULL;
1004 		struct gotd_client *client = NULL;
1005 		uint32_t client_id = 0;
1006 		int do_disconnect = 0;
1007 
1008 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1009 			fatal("%s: imsg_get error", __func__);
1010 		if (n == 0)	/* No more messages. */
1011 			break;
1012 
1013 		switch (imsg.hdr.type) {
1014 		case GOTD_IMSG_ERROR:
1015 			do_disconnect = 1;
1016 			err = gotd_imsg_recv_error(&client_id, &imsg);
1017 			break;
1018 		case GOTD_IMSG_CONNECT:
1019 			err = recv_connect(&client_id, &imsg);
1020 			break;
1021 		default:
1022 			log_debug("unexpected imsg %d", imsg.hdr.type);
1023 			break;
1024 		}
1025 
1026 		client = find_client(client_id);
1027 		if (client == NULL) {
1028 			log_warnx("%s: client not found", __func__);
1029 			imsg_free(&imsg);
1030 			continue;
1031 		}
1032 
1033 		if (err)
1034 			log_warnx("uid %d: %s", client->euid, err->msg);
1035 
1036 		if (do_disconnect) {
1037 			if (err)
1038 				disconnect_on_error(client, err);
1039 			else
1040 				disconnect(client);
1041 		}
1042 
1043 		imsg_free(&imsg);
1044 	}
1045 done:
1046 	if (!shut) {
1047 		gotd_imsg_event_add(iev);
1048 	} else {
1049 		/* This pipe is dead. Remove its event handler */
1050 		event_del(&iev->ev);
1051 		event_loopexit(NULL);
1052 	}
1053 }
1054 
1055 static void
1056 gotd_dispatch_auth_child(int fd, short event, void *arg)
1057 {
1058 	const struct got_error *err = NULL;
1059 	struct gotd_imsgev *iev = arg;
1060 	struct imsgbuf *ibuf = &iev->ibuf;
1061 	struct gotd_client *client;
1062 	struct gotd_repo *repo = NULL;
1063 	ssize_t n;
1064 	int shut = 0;
1065 	struct imsg imsg;
1066 	uint32_t client_id = 0;
1067 	int do_disconnect = 0;
1068 
1069 	client = find_client_by_proc_fd(fd);
1070 	if (client == NULL) {
1071 		/* Can happen during process teardown. */
1072 		warnx("cannot find client for fd %d", fd);
1073 		shut = 1;
1074 		goto done;
1075 	}
1076 
1077 	if (client->auth == NULL)
1078 		fatalx("cannot find auth child process for fd %d", fd);
1079 
1080 	if (event & EV_READ) {
1081 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1082 			fatal("imsg_read error");
1083 		if (n == 0) {
1084 			/* Connection closed. */
1085 			shut = 1;
1086 			goto done;
1087 		}
1088 	}
1089 
1090 	if (event & EV_WRITE) {
1091 		n = msgbuf_write(&ibuf->w);
1092 		if (n == -1 && errno != EAGAIN)
1093 			fatal("msgbuf_write");
1094 		if (n == 0) {
1095 			/* Connection closed. */
1096 			shut = 1;
1097 		}
1098 		goto done;
1099 	}
1100 
1101 	if (client->auth->iev.ibuf.fd != fd)
1102 		fatalx("%s: unexpected fd %d", __func__, fd);
1103 
1104 	if ((n = imsg_get(ibuf, &imsg)) == -1)
1105 		fatal("%s: imsg_get error", __func__);
1106 	if (n == 0)	/* No more messages. */
1107 		return;
1108 
1109 	evtimer_del(&client->tmo);
1110 
1111 	switch (imsg.hdr.type) {
1112 	case GOTD_IMSG_ERROR:
1113 		do_disconnect = 1;
1114 		err = gotd_imsg_recv_error(&client_id, &imsg);
1115 		break;
1116 	case GOTD_IMSG_ACCESS_GRANTED:
1117 		client->state = GOTD_CLIENT_STATE_ACCESS_GRANTED;
1118 		break;
1119 	default:
1120 		do_disconnect = 1;
1121 		log_debug("unexpected imsg %d", imsg.hdr.type);
1122 		break;
1123 	}
1124 
1125 	if (!verify_imsg_src(client, client->auth, &imsg)) {
1126 		do_disconnect = 1;
1127 		log_debug("dropping imsg type %d from PID %d",
1128 		    imsg.hdr.type, client->auth->pid);
1129 	}
1130 	imsg_free(&imsg);
1131 
1132 	if (do_disconnect) {
1133 		if (err)
1134 			disconnect_on_error(client, err);
1135 		else
1136 			disconnect(client);
1137 		return;
1138 	}
1139 
1140 	repo = gotd_find_repo_by_name(client->auth->repo_name, &gotd);
1141 	if (repo == NULL) {
1142 		err = got_error(GOT_ERR_NOT_GIT_REPO);
1143 		goto done;
1144 	}
1145 	kill_auth_proc(client);
1146 
1147 	log_info("authenticated uid %d for repository %s",
1148 	    client->euid, repo->name);
1149 
1150 	err = start_session_child(client, repo, gotd.argv0,
1151 	    gotd.confpath, gotd.daemonize, gotd.verbosity);
1152 	if (err)
1153 		goto done;
1154 done:
1155 	if (err)
1156 		log_warnx("uid %d: %s", client->euid, err->msg);
1157 
1158 	/* We might have killed the auth process by now. */
1159 	if (client->auth != NULL) {
1160 		if (!shut) {
1161 			gotd_imsg_event_add(iev);
1162 		} else {
1163 			/* This pipe is dead. Remove its event handler */
1164 			event_del(&iev->ev);
1165 		}
1166 	}
1167 }
1168 
1169 static const struct got_error *
1170 connect_session(struct gotd_client *client)
1171 {
1172 	const struct got_error *err = NULL;
1173 	struct gotd_imsg_connect iconnect;
1174 	int s;
1175 
1176 	memset(&iconnect, 0, sizeof(iconnect));
1177 
1178 	s = dup(client->fd);
1179 	if (s == -1)
1180 		return got_error_from_errno("dup");
1181 
1182 	iconnect.client_id = client->id;
1183 	iconnect.euid = client->euid;
1184 	iconnect.egid = client->egid;
1185 
1186 	if (gotd_imsg_compose_event(&client->session->iev, GOTD_IMSG_CONNECT,
1187 	    PROC_GOTD, s, &iconnect, sizeof(iconnect)) == -1) {
1188 		err = got_error_from_errno("imsg compose CONNECT");
1189 		close(s);
1190 		return err;
1191 	}
1192 
1193 	/*
1194 	 * We are no longer interested in messages from this client.
1195 	 * Further client requests will be handled by the session process.
1196 	 */
1197 	msgbuf_clear(&client->iev.ibuf.w);
1198 	imsg_clear(&client->iev.ibuf);
1199 	event_del(&client->iev.ev);
1200 	client->fd = -1; /* will be closed via copy in client->iev.ibuf.fd */
1201 
1202 	return NULL;
1203 }
1204 
1205 static void
1206 gotd_dispatch_client_session(int fd, short event, void *arg)
1207 {
1208 	struct gotd_imsgev *iev = arg;
1209 	struct imsgbuf *ibuf = &iev->ibuf;
1210 	struct gotd_child_proc *proc = NULL;
1211 	struct gotd_client *client = NULL;
1212 	ssize_t n;
1213 	int shut = 0;
1214 	struct imsg imsg;
1215 
1216 	client = find_client_by_proc_fd(fd);
1217 	if (client == NULL) {
1218 		/* Can happen during process teardown. */
1219 		warnx("cannot find client for fd %d", fd);
1220 		shut = 1;
1221 		goto done;
1222 	}
1223 
1224 	if (event & EV_READ) {
1225 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1226 			fatal("imsg_read error");
1227 		if (n == 0) {
1228 			/* Connection closed. */
1229 			shut = 1;
1230 			goto done;
1231 		}
1232 	}
1233 
1234 	if (event & EV_WRITE) {
1235 		n = msgbuf_write(&ibuf->w);
1236 		if (n == -1 && errno != EAGAIN)
1237 			fatal("msgbuf_write");
1238 		if (n == 0) {
1239 			/* Connection closed. */
1240 			shut = 1;
1241 			goto done;
1242 		}
1243 	}
1244 
1245 	proc = client->session;
1246 	if (proc == NULL)
1247 		fatalx("cannot find session child process for fd %d", fd);
1248 
1249 	for (;;) {
1250 		const struct got_error *err = NULL;
1251 		uint32_t client_id = 0;
1252 		int do_disconnect = 0, do_start_repo_child = 0;
1253 
1254 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1255 			fatal("%s: imsg_get error", __func__);
1256 		if (n == 0)	/* No more messages. */
1257 			break;
1258 
1259 		switch (imsg.hdr.type) {
1260 		case GOTD_IMSG_ERROR:
1261 			do_disconnect = 1;
1262 			err = gotd_imsg_recv_error(&client_id, &imsg);
1263 			break;
1264 		case GOTD_IMSG_CLIENT_SESSION_READY:
1265 			if (client->state != GOTD_CLIENT_STATE_ACCESS_GRANTED) {
1266 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1267 				break;
1268 			}
1269 			do_start_repo_child = 1;
1270 			break;
1271 		case GOTD_IMSG_DISCONNECT:
1272 			do_disconnect = 1;
1273 			break;
1274 		default:
1275 			log_debug("unexpected imsg %d", imsg.hdr.type);
1276 			break;
1277 		}
1278 
1279 		if (!verify_imsg_src(client, proc, &imsg)) {
1280 			log_debug("dropping imsg type %d from PID %d",
1281 			    imsg.hdr.type, proc->pid);
1282 			imsg_free(&imsg);
1283 			continue;
1284 		}
1285 		if (err)
1286 			log_warnx("uid %d: %s", client->euid, err->msg);
1287 
1288 		if (do_start_repo_child) {
1289 			struct gotd_repo *repo;
1290 			const char *name = client->session->repo_name;
1291 
1292 			repo = gotd_find_repo_by_name(name, &gotd);
1293 			if (repo != NULL) {
1294 				enum gotd_procid proc_type;
1295 
1296 				if (client->required_auth & GOTD_AUTH_WRITE)
1297 					proc_type = PROC_REPO_WRITE;
1298 				else
1299 					proc_type = PROC_REPO_READ;
1300 
1301 				err = start_repo_child(client, proc_type, repo,
1302 				    gotd.argv0, gotd.confpath, gotd.daemonize,
1303 				    gotd.verbosity);
1304 			} else
1305 				err = got_error(GOT_ERR_NOT_GIT_REPO);
1306 
1307 			if (err) {
1308 				log_warnx("uid %d: %s", client->euid, err->msg);
1309 				do_disconnect = 1;
1310 			}
1311 		}
1312 
1313 		if (do_disconnect) {
1314 			if (err)
1315 				disconnect_on_error(client, err);
1316 			else
1317 				disconnect(client);
1318 		}
1319 
1320 		imsg_free(&imsg);
1321 	}
1322 done:
1323 	if (!shut) {
1324 		gotd_imsg_event_add(iev);
1325 	} else {
1326 		/* This pipe is dead. Remove its event handler */
1327 		event_del(&iev->ev);
1328 		disconnect(client);
1329 	}
1330 }
1331 
1332 static void
1333 gotd_dispatch_repo_child(int fd, short event, void *arg)
1334 {
1335 	struct gotd_imsgev *iev = arg;
1336 	struct imsgbuf *ibuf = &iev->ibuf;
1337 	struct gotd_child_proc *proc = NULL;
1338 	struct gotd_client *client;
1339 	ssize_t n;
1340 	int shut = 0;
1341 	struct imsg imsg;
1342 
1343 	client = find_client_by_proc_fd(fd);
1344 	if (client == NULL) {
1345 		/* Can happen during process teardown. */
1346 		warnx("cannot find client for fd %d", fd);
1347 		shut = 1;
1348 		goto done;
1349 	}
1350 
1351 	if (event & EV_READ) {
1352 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1353 			fatal("imsg_read error");
1354 		if (n == 0) {
1355 			/* Connection closed. */
1356 			shut = 1;
1357 			goto done;
1358 		}
1359 	}
1360 
1361 	if (event & EV_WRITE) {
1362 		n = msgbuf_write(&ibuf->w);
1363 		if (n == -1 && errno != EAGAIN)
1364 			fatal("msgbuf_write");
1365 		if (n == 0) {
1366 			/* Connection closed. */
1367 			shut = 1;
1368 			goto done;
1369 		}
1370 	}
1371 
1372 	proc = client->repo;
1373 	if (proc == NULL)
1374 		fatalx("cannot find child process for fd %d", fd);
1375 
1376 	for (;;) {
1377 		const struct got_error *err = NULL;
1378 		uint32_t client_id = 0;
1379 		int do_disconnect = 0;
1380 
1381 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1382 			fatal("%s: imsg_get error", __func__);
1383 		if (n == 0)	/* No more messages. */
1384 			break;
1385 
1386 		switch (imsg.hdr.type) {
1387 		case GOTD_IMSG_ERROR:
1388 			do_disconnect = 1;
1389 			err = gotd_imsg_recv_error(&client_id, &imsg);
1390 			break;
1391 		case GOTD_IMSG_REPO_CHILD_READY:
1392 			err = connect_session(client);
1393 			if (err)
1394 				break;
1395 			err = connect_repo_child(client, proc);
1396 			break;
1397 		default:
1398 			log_debug("unexpected imsg %d", imsg.hdr.type);
1399 			break;
1400 		}
1401 
1402 		if (!verify_imsg_src(client, proc, &imsg)) {
1403 			log_debug("dropping imsg type %d from PID %d",
1404 			    imsg.hdr.type, proc->pid);
1405 			imsg_free(&imsg);
1406 			continue;
1407 		}
1408 		if (err)
1409 			log_warnx("uid %d: %s", client->euid, err->msg);
1410 
1411 		if (do_disconnect) {
1412 			if (err)
1413 				disconnect_on_error(client, err);
1414 			else
1415 				disconnect(client);
1416 		}
1417 
1418 		imsg_free(&imsg);
1419 	}
1420 done:
1421 	if (!shut) {
1422 		gotd_imsg_event_add(iev);
1423 	} else {
1424 		/* This pipe is dead. Remove its event handler */
1425 		event_del(&iev->ev);
1426 		disconnect(client);
1427 	}
1428 }
1429 
1430 static pid_t
1431 start_child(enum gotd_procid proc_id, const char *repo_path,
1432     char *argv0, const char *confpath, int fd, int daemonize, int verbosity)
1433 {
1434 	char	*argv[11];
1435 	int	 argc = 0;
1436 	pid_t	 pid;
1437 
1438 	switch (pid = fork()) {
1439 	case -1:
1440 		fatal("cannot fork");
1441 	case 0:
1442 		break;
1443 	default:
1444 		close(fd);
1445 		return pid;
1446 	}
1447 
1448 	if (fd != GOTD_FILENO_MSG_PIPE) {
1449 		if (dup2(fd, GOTD_FILENO_MSG_PIPE) == -1)
1450 			fatal("cannot setup imsg fd");
1451 	} else if (fcntl(fd, F_SETFD, 0) == -1)
1452 		fatal("cannot setup imsg fd");
1453 
1454 	argv[argc++] = argv0;
1455 	switch (proc_id) {
1456 	case PROC_LISTEN:
1457 		argv[argc++] = (char *)"-L";
1458 		break;
1459 	case PROC_AUTH:
1460 		argv[argc++] = (char *)"-A";
1461 		break;
1462 	case PROC_SESSION_READ:
1463 		argv[argc++] = (char *)"-s";
1464 		break;
1465 	case PROC_SESSION_WRITE:
1466 		argv[argc++] = (char *)"-S";
1467 		break;
1468 	case PROC_REPO_READ:
1469 		argv[argc++] = (char *)"-R";
1470 		break;
1471 	case PROC_REPO_WRITE:
1472 		argv[argc++] = (char *)"-W";
1473 		break;
1474 	default:
1475 		fatalx("invalid process id %d", proc_id);
1476 	}
1477 
1478 	argv[argc++] = (char *)"-f";
1479 	argv[argc++] = (char *)confpath;
1480 
1481 	if (repo_path) {
1482 		argv[argc++] = (char *)"-P";
1483 		argv[argc++] = (char *)repo_path;
1484 	}
1485 
1486 	if (!daemonize)
1487 		argv[argc++] = (char *)"-d";
1488 	if (verbosity > 0)
1489 		argv[argc++] = (char *)"-v";
1490 	if (verbosity > 1)
1491 		argv[argc++] = (char *)"-v";
1492 	argv[argc++] = NULL;
1493 
1494 	execvp(argv0, argv);
1495 	fatal("execvp");
1496 }
1497 
1498 static void
1499 start_listener(char *argv0, const char *confpath, int daemonize, int verbosity)
1500 {
1501 	struct gotd_child_proc *proc;
1502 
1503 	proc = calloc(1, sizeof(*proc));
1504 	if (proc == NULL)
1505 		fatal("calloc");
1506 
1507 	proc->type = PROC_LISTEN;
1508 
1509 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1510 	    PF_UNSPEC, proc->pipe) == -1)
1511 		fatal("socketpair");
1512 
1513 	proc->pid = start_child(proc->type, NULL, argv0, confpath,
1514 	    proc->pipe[1], daemonize, verbosity);
1515 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1516 	proc->iev.handler = gotd_dispatch_listener;
1517 	proc->iev.events = EV_READ;
1518 	proc->iev.handler_arg = NULL;
1519 
1520 	gotd.listen_proc = proc;
1521 }
1522 
1523 static const struct got_error *
1524 start_session_child(struct gotd_client *client, struct gotd_repo *repo,
1525     char *argv0, const char *confpath, int daemonize, int verbosity)
1526 {
1527 	struct gotd_child_proc *proc;
1528 
1529 	proc = calloc(1, sizeof(*proc));
1530 	if (proc == NULL)
1531 		return got_error_from_errno("calloc");
1532 
1533 	if (client_is_reading(client))
1534 		proc->type = PROC_SESSION_READ;
1535 	else
1536 		proc->type = PROC_SESSION_WRITE;
1537 	if (strlcpy(proc->repo_name, repo->name,
1538 	    sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
1539 		fatalx("repository name too long: %s", repo->name);
1540 	log_debug("starting client uid %d session for repository %s",
1541 	    client->euid, repo->name);
1542 	if (strlcpy(proc->repo_path, repo->path, sizeof(proc->repo_path)) >=
1543 	    sizeof(proc->repo_path))
1544 		fatalx("repository path too long: %s", repo->path);
1545 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1546 	    PF_UNSPEC, proc->pipe) == -1)
1547 		fatal("socketpair");
1548 	proc->pid = start_child(proc->type, proc->repo_path, argv0,
1549 	    confpath, proc->pipe[1], daemonize, verbosity);
1550 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1551 	log_debug("proc %s %s is on fd %d",
1552 	    gotd_proc_names[proc->type], proc->repo_path,
1553 	    proc->pipe[0]);
1554 	proc->iev.handler = gotd_dispatch_client_session;
1555 	proc->iev.events = EV_READ;
1556 	proc->iev.handler_arg = NULL;
1557 	event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
1558 	    gotd_dispatch_client_session, &proc->iev);
1559 	gotd_imsg_event_add(&proc->iev);
1560 
1561 	client->session = proc;
1562 	return NULL;
1563 }
1564 
1565 static const struct got_error *
1566 start_repo_child(struct gotd_client *client, enum gotd_procid proc_type,
1567     struct gotd_repo *repo, char *argv0, const char *confpath,
1568     int daemonize, int verbosity)
1569 {
1570 	struct gotd_child_proc *proc;
1571 
1572 	if (proc_type != PROC_REPO_READ && proc_type != PROC_REPO_WRITE)
1573 		return got_error_msg(GOT_ERR_NOT_IMPL, "bad process type");
1574 
1575 	proc = calloc(1, sizeof(*proc));
1576 	if (proc == NULL)
1577 		return got_error_from_errno("calloc");
1578 
1579 	proc->type = proc_type;
1580 	if (strlcpy(proc->repo_name, repo->name,
1581 	    sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
1582 		fatalx("repository name too long: %s", repo->name);
1583 	log_debug("starting %s for repository %s",
1584 	    proc->type == PROC_REPO_READ ? "reader" : "writer", repo->name);
1585 	if (strlcpy(proc->repo_path, repo->path, sizeof(proc->repo_path)) >=
1586 	    sizeof(proc->repo_path))
1587 		fatalx("repository path too long: %s", repo->path);
1588 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1589 	    PF_UNSPEC, proc->pipe) == -1)
1590 		fatal("socketpair");
1591 	proc->pid = start_child(proc->type, proc->repo_path, argv0,
1592 	    confpath, proc->pipe[1], daemonize, verbosity);
1593 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1594 	log_debug("proc %s %s is on fd %d",
1595 	    gotd_proc_names[proc->type], proc->repo_path,
1596 	    proc->pipe[0]);
1597 	proc->iev.handler = gotd_dispatch_repo_child;
1598 	proc->iev.events = EV_READ;
1599 	proc->iev.handler_arg = NULL;
1600 	event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
1601 	    gotd_dispatch_repo_child, &proc->iev);
1602 	gotd_imsg_event_add(&proc->iev);
1603 
1604 	client->repo = proc;
1605 	return NULL;
1606 }
1607 
1608 static const struct got_error *
1609 start_auth_child(struct gotd_client *client, int required_auth,
1610     struct gotd_repo *repo, char *argv0, const char *confpath,
1611     int daemonize, int verbosity)
1612 {
1613 	const struct got_error *err = NULL;
1614 	struct gotd_child_proc *proc;
1615 	struct gotd_imsg_auth iauth;
1616 	int fd;
1617 
1618 	memset(&iauth, 0, sizeof(iauth));
1619 
1620 	fd = dup(client->fd);
1621 	if (fd == -1)
1622 		return got_error_from_errno("dup");
1623 
1624 	proc = calloc(1, sizeof(*proc));
1625 	if (proc == NULL) {
1626 		err = got_error_from_errno("calloc");
1627 		close(fd);
1628 		return err;
1629 	}
1630 
1631 	proc->type = PROC_AUTH;
1632 	if (strlcpy(proc->repo_name, repo->name,
1633 	    sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
1634 		fatalx("repository name too long: %s", repo->name);
1635 	log_debug("starting auth for uid %d repository %s",
1636 	    client->euid, repo->name);
1637 	if (strlcpy(proc->repo_path, repo->path, sizeof(proc->repo_path)) >=
1638 	    sizeof(proc->repo_path))
1639 		fatalx("repository path too long: %s", repo->path);
1640 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1641 	    PF_UNSPEC, proc->pipe) == -1)
1642 		fatal("socketpair");
1643 	proc->pid = start_child(proc->type, proc->repo_path, argv0,
1644 	    confpath, proc->pipe[1], daemonize, verbosity);
1645 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1646 	log_debug("proc %s %s is on fd %d",
1647 	    gotd_proc_names[proc->type], proc->repo_path,
1648 	    proc->pipe[0]);
1649 	proc->iev.handler = gotd_dispatch_auth_child;
1650 	proc->iev.events = EV_READ;
1651 	proc->iev.handler_arg = NULL;
1652 	event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
1653 	    gotd_dispatch_auth_child, &proc->iev);
1654 	gotd_imsg_event_add(&proc->iev);
1655 
1656 	iauth.euid = client->euid;
1657 	iauth.egid = client->egid;
1658 	iauth.required_auth = required_auth;
1659 	iauth.client_id = client->id;
1660 	if (gotd_imsg_compose_event(&proc->iev, GOTD_IMSG_AUTHENTICATE,
1661 	    PROC_GOTD, fd, &iauth, sizeof(iauth)) == -1) {
1662 		log_warn("imsg compose AUTHENTICATE");
1663 		close(fd);
1664 		/* Let the auth_timeout handler tidy up. */
1665 	}
1666 
1667 	client->auth = proc;
1668 	client->required_auth = required_auth;
1669 	return NULL;
1670 }
1671 
1672 static void
1673 apply_unveil_repo_readonly(const char *repo_path, int need_tmpdir)
1674 {
1675 	if (need_tmpdir) {
1676 		if (unveil(GOT_TMPDIR_STR, "rwc") == -1)
1677 			fatal("unveil %s", GOT_TMPDIR_STR);
1678 	}
1679 
1680 	if (unveil(repo_path, "r") == -1)
1681 		fatal("unveil %s", repo_path);
1682 
1683 	if (unveil(NULL, NULL) == -1)
1684 		fatal("unveil");
1685 }
1686 
1687 static void
1688 apply_unveil_repo_readwrite(const char *repo_path)
1689 {
1690 	if (unveil(repo_path, "rwc") == -1)
1691 		fatal("unveil %s", repo_path);
1692 
1693 	if (unveil(GOT_TMPDIR_STR, "rwc") == -1)
1694 		fatal("unveil %s", GOT_TMPDIR_STR);
1695 
1696 	if (unveil(NULL, NULL) == -1)
1697 		fatal("unveil");
1698 }
1699 
1700 static void
1701 apply_unveil_none(void)
1702 {
1703 	if (unveil("/", "") == -1)
1704 		fatal("unveil");
1705 
1706 	if (unveil(NULL, NULL) == -1)
1707 		fatal("unveil");
1708 }
1709 
1710 static void
1711 apply_unveil_selfexec(void)
1712 {
1713 	if (unveil(gotd.argv0, "x") == -1)
1714 		fatal("unveil %s", gotd.argv0);
1715 
1716 	if (unveil(NULL, NULL) == -1)
1717 		fatal("unveil");
1718 }
1719 
1720 int
1721 main(int argc, char **argv)
1722 {
1723 	const struct got_error *error = NULL;
1724 	int ch, fd = -1, daemonize = 1, verbosity = 0, noaction = 0;
1725 	const char *confpath = GOTD_CONF_PATH;
1726 	char *argv0 = argv[0];
1727 	char title[2048];
1728 	struct passwd *pw = NULL;
1729 	char *repo_path = NULL;
1730 	enum gotd_procid proc_id = PROC_GOTD;
1731 	struct event evsigint, evsigterm, evsighup, evsigusr1;
1732 	int *pack_fds = NULL, *temp_fds = NULL;
1733 	struct gotd_repo *repo = NULL;
1734 
1735 	log_init(1, LOG_DAEMON); /* Log to stderr until daemonized. */
1736 
1737 	while ((ch = getopt(argc, argv, "Adf:LnP:RsSvW")) != -1) {
1738 		switch (ch) {
1739 		case 'A':
1740 			proc_id = PROC_AUTH;
1741 			break;
1742 		case 'd':
1743 			daemonize = 0;
1744 			break;
1745 		case 'f':
1746 			confpath = optarg;
1747 			break;
1748 		case 'L':
1749 			proc_id = PROC_LISTEN;
1750 			break;
1751 		case 'n':
1752 			noaction = 1;
1753 			break;
1754 		case 'P':
1755 			repo_path = realpath(optarg, NULL);
1756 			if (repo_path == NULL)
1757 				fatal("realpath '%s'", optarg);
1758 			break;
1759 		case 'R':
1760 			proc_id = PROC_REPO_READ;
1761 			break;
1762 		case 's':
1763 			proc_id = PROC_SESSION_READ;
1764 			break;
1765 		case 'S':
1766 			proc_id = PROC_SESSION_WRITE;
1767 			break;
1768 		case 'v':
1769 			if (verbosity < 3)
1770 				verbosity++;
1771 			break;
1772 		case 'W':
1773 			proc_id = PROC_REPO_WRITE;
1774 			break;
1775 		default:
1776 			usage();
1777 		}
1778 	}
1779 
1780 	argc -= optind;
1781 	argv += optind;
1782 
1783 	if (argc != 0)
1784 		usage();
1785 
1786 	if (geteuid() && (proc_id == PROC_GOTD || proc_id == PROC_LISTEN))
1787 		fatalx("need root privileges");
1788 
1789 	if (parse_config(confpath, proc_id, &gotd, 1) != 0)
1790 		return 1;
1791 
1792 	pw = getpwnam(gotd.user_name);
1793 	if (pw == NULL)
1794 		fatalx("user %s not found", gotd.user_name);
1795 
1796 	if (pw->pw_uid == 0)
1797 		fatalx("cannot run %s as the superuser", getprogname());
1798 
1799 	if (noaction) {
1800 		fprintf(stderr, "configuration OK\n");
1801 		return 0;
1802 	}
1803 
1804 	gotd.argv0 = argv0;
1805 	gotd.daemonize = daemonize;
1806 	gotd.verbosity = verbosity;
1807 	gotd.confpath = confpath;
1808 
1809 	/* Require an absolute path in argv[0] for reliable re-exec. */
1810 	if (!got_path_is_absolute(argv0))
1811 		fatalx("bad path \"%s\": must be an absolute path", argv0);
1812 
1813 	log_init(daemonize ? 0 : 1, LOG_DAEMON);
1814 	log_setverbose(verbosity);
1815 
1816 	if (proc_id == PROC_GOTD) {
1817 		snprintf(title, sizeof(title), "%s", gotd_proc_names[proc_id]);
1818 		arc4random_buf(&clients_hash_key, sizeof(clients_hash_key));
1819 		if (daemonize && daemon(1, 0) == -1)
1820 			fatal("daemon");
1821 		gotd.pid = getpid();
1822 		start_listener(argv0, confpath, daemonize, verbosity);
1823 	} else if (proc_id == PROC_LISTEN) {
1824 		snprintf(title, sizeof(title), "%s", gotd_proc_names[proc_id]);
1825 		if (verbosity) {
1826 			log_info("socket: %s", gotd.unix_socket_path);
1827 			log_info("user: %s", pw->pw_name);
1828 		}
1829 
1830 		fd = unix_socket_listen(gotd.unix_socket_path, pw->pw_uid,
1831 		    pw->pw_gid);
1832 		if (fd == -1) {
1833 			fatal("cannot listen on unix socket %s",
1834 			    gotd.unix_socket_path);
1835 		}
1836 	} else if (proc_id == PROC_AUTH) {
1837 		snprintf(title, sizeof(title), "%s %s",
1838 		    gotd_proc_names[proc_id], repo_path);
1839 	} else if (proc_id == PROC_REPO_READ || proc_id == PROC_REPO_WRITE ||
1840 	    proc_id == PROC_SESSION_READ || proc_id == PROC_SESSION_WRITE) {
1841 		error = got_repo_pack_fds_open(&pack_fds);
1842 		if (error != NULL)
1843 			fatalx("cannot open pack tempfiles: %s", error->msg);
1844 		error = got_repo_temp_fds_open(&temp_fds);
1845 		if (error != NULL)
1846 			fatalx("cannot open pack tempfiles: %s", error->msg);
1847 		if (repo_path == NULL)
1848 			fatalx("repository path not specified");
1849 		snprintf(title, sizeof(title), "%s %s",
1850 		    gotd_proc_names[proc_id], repo_path);
1851 	} else
1852 		fatal("invalid process id %d", proc_id);
1853 
1854 	setproctitle("%s", title);
1855 	log_procinit(title);
1856 
1857 	/* Drop root privileges. */
1858 	if (setgid(pw->pw_gid) == -1)
1859 		fatal("setgid %d failed", pw->pw_gid);
1860 	if (setuid(pw->pw_uid) == -1)
1861 		fatal("setuid %d failed", pw->pw_uid);
1862 
1863 	event_init();
1864 
1865 	switch (proc_id) {
1866 	case PROC_GOTD:
1867 #ifndef PROFILE
1868 		/* "exec" promise will be limited to argv[0] via unveil(2). */
1869 		if (pledge("stdio proc exec sendfd recvfd unveil", NULL) == -1)
1870 			err(1, "pledge");
1871 #endif
1872 		break;
1873 	case PROC_LISTEN:
1874 #ifndef PROFILE
1875 		if (pledge("stdio sendfd unix unveil", NULL) == -1)
1876 			err(1, "pledge");
1877 #endif
1878 		/*
1879 		 * Ensure that AF_UNIX bind(2) cannot be used with any other
1880 		 * sockets by revoking all filesystem access via unveil(2).
1881 		 */
1882 		apply_unveil_none();
1883 
1884 		listen_main(title, fd, gotd.connection_limits,
1885 		    gotd.nconnection_limits);
1886 		/* NOTREACHED */
1887 		break;
1888 	case PROC_AUTH:
1889 #ifndef PROFILE
1890 		if (pledge("stdio getpw recvfd unix unveil", NULL) == -1)
1891 			err(1, "pledge");
1892 #endif
1893 		/*
1894 		 * We need the "unix" pledge promise for getpeername(2) only.
1895 		 * Ensure that AF_UNIX bind(2) cannot be used by revoking all
1896 		 * filesystem access via unveil(2). Access to password database
1897 		 * files will still work since "getpw" bypasses unveil(2).
1898 		 */
1899 		apply_unveil_none();
1900 
1901 		auth_main(title, &gotd.repos, repo_path);
1902 		/* NOTREACHED */
1903 		break;
1904 	case PROC_SESSION_READ:
1905 	case PROC_SESSION_WRITE:
1906 #ifndef PROFILE
1907 		/*
1908 		 * The "recvfd" promise is only needed during setup and
1909 		 * will be removed in a later pledge(2) call.
1910 		 */
1911 		if (pledge("stdio rpath wpath cpath recvfd sendfd fattr flock "
1912 		    "unveil", NULL) == -1)
1913 			err(1, "pledge");
1914 #endif
1915 		if (proc_id == PROC_SESSION_READ)
1916 			apply_unveil_repo_readonly(repo_path, 1);
1917 		else
1918 			apply_unveil_repo_readwrite(repo_path);
1919 		session_main(title, repo_path, pack_fds, temp_fds,
1920 		    &gotd.request_timeout, proc_id);
1921 		/* NOTREACHED */
1922 		break;
1923 	case PROC_REPO_READ:
1924 #ifndef PROFILE
1925 		if (pledge("stdio rpath recvfd unveil", NULL) == -1)
1926 			err(1, "pledge");
1927 #endif
1928 		apply_unveil_repo_readonly(repo_path, 0);
1929 		repo_read_main(title, repo_path, pack_fds, temp_fds);
1930 		/* NOTREACHED */
1931 		exit(0);
1932 	case PROC_REPO_WRITE:
1933 #ifndef PROFILE
1934 		if (pledge("stdio rpath recvfd unveil", NULL) == -1)
1935 			err(1, "pledge");
1936 #endif
1937 		apply_unveil_repo_readonly(repo_path, 0);
1938 		repo = gotd_find_repo_by_path(repo_path, &gotd);
1939 		if (repo == NULL)
1940 			fatalx("no repository for path %s", repo_path);
1941 		repo_write_main(title, repo_path, pack_fds, temp_fds,
1942 		    &repo->protected_tag_namespaces,
1943 		    &repo->protected_branch_namespaces,
1944 		    &repo->protected_branches);
1945 		/* NOTREACHED */
1946 		exit(0);
1947 	default:
1948 		fatal("invalid process id %d", proc_id);
1949 	}
1950 
1951 	if (proc_id != PROC_GOTD)
1952 		fatal("invalid process id %d", proc_id);
1953 
1954 	apply_unveil_selfexec();
1955 
1956 	signal_set(&evsigint, SIGINT, gotd_sighdlr, NULL);
1957 	signal_set(&evsigterm, SIGTERM, gotd_sighdlr, NULL);
1958 	signal_set(&evsighup, SIGHUP, gotd_sighdlr, NULL);
1959 	signal_set(&evsigusr1, SIGUSR1, gotd_sighdlr, NULL);
1960 	signal(SIGPIPE, SIG_IGN);
1961 
1962 	signal_add(&evsigint, NULL);
1963 	signal_add(&evsigterm, NULL);
1964 	signal_add(&evsighup, NULL);
1965 	signal_add(&evsigusr1, NULL);
1966 
1967 	gotd_imsg_event_add(&gotd.listen_proc->iev);
1968 
1969 	event_dispatch();
1970 
1971 	free(repo_path);
1972 	gotd_shutdown();
1973 
1974 	return 0;
1975 }