Got Mirror

Blob

Date:: Fri Mar 22 10:17:03 2024 UTC
Message:: display process title in syslog when a gotd child process exits
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2022, 2023 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/queue.h>
19 #include <sys/tree.h>
20 #include <sys/socket.h>
21 #include <sys/stat.h>
22 #include <sys/uio.h>
23 
24 #include <errno.h>
25 #include <event.h>
26 #include <limits.h>
27 #include <sha1.h>
28 #include <sha2.h>
29 #include <signal.h>
30 #include <stdint.h>
31 #include <stdio.h>
32 #include <stdlib.h>
33 #include <string.h>
34 #include <imsg.h>
35 #include <unistd.h>
36 
37 #include "got_error.h"
38 #include "got_repository.h"
39 #include "got_object.h"
40 #include "got_path.h"
41 #include "got_reference.h"
42 #include "got_opentemp.h"
43 
44 #include "got_lib_hash.h"
45 #include "got_lib_delta.h"
46 #include "got_lib_object.h"
47 #include "got_lib_object_cache.h"
48 #include "got_lib_pack.h"
49 #include "got_lib_repository.h"
50 #include "got_lib_gitproto.h"
51 
52 #include "gotd.h"
53 #include "log.h"
54 #include "session_read.h"
55 
56 enum gotd_session_read_state {
57 	GOTD_STATE_EXPECT_LIST_REFS,
58 	GOTD_STATE_EXPECT_CAPABILITIES,
59 	GOTD_STATE_EXPECT_WANT,
60 	GOTD_STATE_EXPECT_HAVE,
61 	GOTD_STATE_EXPECT_DONE,
62 	GOTD_STATE_DONE,
63 };
64 
65 static struct gotd_session_read {
66 	pid_t pid;
67 	const char *title;
68 	struct got_repository *repo;
69 	struct gotd_repo *repo_cfg;
70 	int *pack_fds;
71 	int *temp_fds;
72 	struct gotd_imsgev parent_iev;
73 	struct gotd_imsgev notifier_iev;
74 	struct timeval request_timeout;
75 	enum gotd_session_read_state state;
76 	struct gotd_imsgev repo_child_iev;
77 } gotd_session;
78 
79 static struct gotd_session_client {
80 	struct gotd_client_capability	*capabilities;
81 	size_t				 ncapa_alloc;
82 	size_t				 ncapabilities;
83 	uint32_t			 id;
84 	int				 fd;
85 	int				 delta_cache_fd;
86 	struct gotd_imsgev		 iev;
87 	struct event			 tmo;
88 	uid_t				 euid;
89 	gid_t				 egid;
90 	char				*username;
91 	char				*packfile_path;
92 	char				*packidx_path;
93 	int				 nref_updates;
94 	int				 accept_flush_pkt;
95 	int				 flush_disconnect;
96 } gotd_session_client;
97 
98 static void session_read_shutdown(void);
99 
100 static void
101 disconnect(struct gotd_session_client *client)
102 {
103 	log_debug("uid %d: disconnecting", client->euid);
104 
105 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
106 	    GOTD_IMSG_DISCONNECT, PROC_SESSION_READ, -1, NULL, 0) == -1)
107 		log_warn("imsg compose DISCONNECT");
108 
109 	imsg_clear(&gotd_session.repo_child_iev.ibuf);
110 	event_del(&gotd_session.repo_child_iev.ev);
111 	evtimer_del(&client->tmo);
112 	close(client->fd);
113 	if (client->delta_cache_fd != -1)
114 		close(client->delta_cache_fd);
115 	if (client->packfile_path) {
116 		if (unlink(client->packfile_path) == -1 && errno != ENOENT)
117 			log_warn("unlink %s: ", client->packfile_path);
118 		free(client->packfile_path);
119 	}
120 	if (client->packidx_path) {
121 		if (unlink(client->packidx_path) == -1 && errno != ENOENT)
122 			log_warn("unlink %s: ", client->packidx_path);
123 		free(client->packidx_path);
124 	}
125 	free(client->capabilities);
126 
127 	session_read_shutdown();
128 }
129 
130 static void
131 disconnect_on_error(struct gotd_session_client *client,
132     const struct got_error *err)
133 {
134 	struct imsgbuf ibuf;
135 
136 	if (err->code != GOT_ERR_EOF) {
137 		log_warnx("uid %d: %s", client->euid, err->msg);
138 		imsg_init(&ibuf, client->fd);
139 		gotd_imsg_send_error(&ibuf, 0, PROC_SESSION_READ, err);
140 		imsg_clear(&ibuf);
141 	}
142 
143 	disconnect(client);
144 }
145 
146 static void
147 gotd_request_timeout(int fd, short events, void *arg)
148 {
149 	struct gotd_session_client *client = arg;
150 
151 	log_debug("disconnecting uid %d due to timeout", client->euid);
152 	disconnect(client);
153 }
154 
155 static void
156 session_read_sighdlr(int sig, short event, void *arg)
157 {
158 	/*
159 	 * Normal signal handler rules don't apply because libevent
160 	 * decouples for us.
161 	 */
162 
163 	switch (sig) {
164 	case SIGHUP:
165 		log_info("%s: ignoring SIGHUP", __func__);
166 		break;
167 	case SIGUSR1:
168 		log_info("%s: ignoring SIGUSR1", __func__);
169 		break;
170 	case SIGTERM:
171 	case SIGINT:
172 		session_read_shutdown();
173 		/* NOTREACHED */
174 		break;
175 	default:
176 		fatalx("unexpected signal");
177 	}
178 }
179 
180 static const struct got_error *
181 recv_packfile_done(struct imsg *imsg)
182 {
183 	size_t datalen;
184 
185 	log_debug("packfile-done received");
186 
187 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
188 	if (datalen != 0)
189 		return got_error(GOT_ERR_PRIVSEP_LEN);
190 
191 	return NULL;
192 }
193 
194 static void
195 session_dispatch_repo_child(int fd, short event, void *arg)
196 {
197 	struct gotd_imsgev *iev = arg;
198 	struct imsgbuf *ibuf = &iev->ibuf;
199 	struct gotd_session_client *client = &gotd_session_client;
200 	ssize_t n;
201 	int shut = 0;
202 	struct imsg imsg;
203 
204 	if (event & EV_READ) {
205 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
206 			fatal("imsg_read error");
207 		if (n == 0) {
208 			/* Connection closed. */
209 			shut = 1;
210 			goto done;
211 		}
212 	}
213 
214 	if (event & EV_WRITE) {
215 		n = msgbuf_write(&ibuf->w);
216 		if (n == -1 && errno != EAGAIN)
217 			fatal("msgbuf_write");
218 		if (n == 0) {
219 			/* Connection closed. */
220 			shut = 1;
221 			goto done;
222 		}
223 	}
224 
225 	for (;;) {
226 		const struct got_error *err = NULL;
227 		uint32_t client_id = 0;
228 		int do_disconnect = 0;
229 
230 		if ((n = imsg_get(ibuf, &imsg)) == -1)
231 			fatal("%s: imsg_get error", __func__);
232 		if (n == 0)	/* No more messages. */
233 			break;
234 
235 		switch (imsg.hdr.type) {
236 		case GOTD_IMSG_ERROR:
237 			do_disconnect = 1;
238 			err = gotd_imsg_recv_error(&client_id, &imsg);
239 			break;
240 		case GOTD_IMSG_PACKFILE_DONE:
241 			do_disconnect = 1;
242 			err = recv_packfile_done(&imsg);
243 			break;
244 		default:
245 			log_debug("unexpected imsg %d", imsg.hdr.type);
246 			break;
247 		}
248 
249 		if (do_disconnect) {
250 			if (err)
251 				disconnect_on_error(client, err);
252 			else
253 				disconnect(client);
254 		} else {
255 			if (err)
256 				log_warnx("uid %d: %s", client->euid, err->msg);
257 		}
258 		imsg_free(&imsg);
259 	}
260 done:
261 	if (!shut) {
262 		gotd_imsg_event_add(iev);
263 	} else {
264 		/* This pipe is dead. Remove its event handler */
265 		event_del(&iev->ev);
266 		event_loopexit(NULL);
267 	}
268 }
269 
270 static const struct got_error *
271 recv_capabilities(struct gotd_session_client *client, struct imsg *imsg)
272 {
273 	struct gotd_imsg_capabilities icapas;
274 	size_t datalen;
275 
276 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
277 	if (datalen != sizeof(icapas))
278 		return got_error(GOT_ERR_PRIVSEP_LEN);
279 	memcpy(&icapas, imsg->data, sizeof(icapas));
280 
281 	client->ncapa_alloc = icapas.ncapabilities;
282 	client->capabilities = calloc(client->ncapa_alloc,
283 	    sizeof(*client->capabilities));
284 	if (client->capabilities == NULL) {
285 		client->ncapa_alloc = 0;
286 		return got_error_from_errno("calloc");
287 	}
288 
289 	log_debug("expecting %zu capabilities from uid %d",
290 	    client->ncapa_alloc, client->euid);
291 	return NULL;
292 }
293 
294 static const struct got_error *
295 recv_capability(struct gotd_session_client *client, struct imsg *imsg)
296 {
297 	struct gotd_imsg_capability icapa;
298 	struct gotd_client_capability *capa;
299 	size_t datalen;
300 	char *key, *value = NULL;
301 
302 	if (client->capabilities == NULL ||
303 	    client->ncapabilities >= client->ncapa_alloc) {
304 		return got_error_msg(GOT_ERR_BAD_REQUEST,
305 		    "unexpected capability received");
306 	}
307 
308 	memset(&icapa, 0, sizeof(icapa));
309 
310 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
311 	if (datalen < sizeof(icapa))
312 		return got_error(GOT_ERR_PRIVSEP_LEN);
313 	memcpy(&icapa, imsg->data, sizeof(icapa));
314 
315 	if (datalen != sizeof(icapa) + icapa.key_len + icapa.value_len)
316 		return got_error(GOT_ERR_PRIVSEP_LEN);
317 
318 	key = strndup(imsg->data + sizeof(icapa), icapa.key_len);
319 	if (key == NULL)
320 		return got_error_from_errno("strndup");
321 	if (icapa.value_len > 0) {
322 		value = strndup(imsg->data + sizeof(icapa) + icapa.key_len,
323 		    icapa.value_len);
324 		if (value == NULL) {
325 			free(key);
326 			return got_error_from_errno("strndup");
327 		}
328 	}
329 
330 	capa = &client->capabilities[client->ncapabilities++];
331 	capa->key = key;
332 	capa->value = value;
333 
334 	if (value)
335 		log_debug("uid %d: capability %s=%s", client->euid, key, value);
336 	else
337 		log_debug("uid %d: capability %s", client->euid, key);
338 
339 	return NULL;
340 }
341 
342 static const struct got_error *
343 forward_want(struct gotd_session_client *client, struct imsg *imsg)
344 {
345 	struct gotd_imsg_want ireq;
346 	struct gotd_imsg_want iwant;
347 	size_t datalen;
348 
349 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
350 	if (datalen != sizeof(ireq))
351 		return got_error(GOT_ERR_PRIVSEP_LEN);
352 
353 	memcpy(&ireq, imsg->data, datalen);
354 
355 	memset(&iwant, 0, sizeof(iwant));
356 	memcpy(iwant.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
357 
358 	if (gotd_imsg_compose_event(&gotd_session.repo_child_iev,
359 	    GOTD_IMSG_WANT, PROC_SESSION_READ, -1,
360 	    &iwant, sizeof(iwant)) == -1)
361 		return got_error_from_errno("imsg compose WANT");
362 
363 	return NULL;
364 }
365 
366 static const struct got_error *
367 forward_have(struct gotd_session_client *client, struct imsg *imsg)
368 {
369 	struct gotd_imsg_have ireq;
370 	struct gotd_imsg_have ihave;
371 	size_t datalen;
372 
373 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
374 	if (datalen != sizeof(ireq))
375 		return got_error(GOT_ERR_PRIVSEP_LEN);
376 
377 	memcpy(&ireq, imsg->data, datalen);
378 
379 	memset(&ihave, 0, sizeof(ihave));
380 	memcpy(ihave.object_id, ireq.object_id, SHA1_DIGEST_LENGTH);
381 
382 	if (gotd_imsg_compose_event(&gotd_session.repo_child_iev,
383 	    GOTD_IMSG_HAVE, PROC_SESSION_READ, -1,
384 	    &ihave, sizeof(ihave)) == -1)
385 		return got_error_from_errno("imsg compose HAVE");
386 
387 	return NULL;
388 }
389 
390 static int
391 client_has_capability(struct gotd_session_client *client, const char *capastr)
392 {
393 	struct gotd_client_capability *capa;
394 	size_t i;
395 
396 	if (client->ncapabilities == 0)
397 		return 0;
398 
399 	for (i = 0; i < client->ncapabilities; i++) {
400 		capa = &client->capabilities[i];
401 		if (strcmp(capa->key, capastr) == 0)
402 			return 1;
403 	}
404 
405 	return 0;
406 }
407 
408 static const struct got_error *
409 send_packfile(struct gotd_session_client *client)
410 {
411 	const struct got_error *err = NULL;
412 	struct gotd_imsg_send_packfile ipack;
413 	int pipe[2];
414 
415 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pipe) == -1)
416 		return got_error_from_errno("socketpair");
417 
418 	memset(&ipack, 0, sizeof(ipack));
419 
420 	if (client_has_capability(client, GOT_CAPA_SIDE_BAND_64K))
421 		ipack.report_progress = 1;
422 
423 	client->delta_cache_fd = got_opentempfd();
424 	if (client->delta_cache_fd == -1)
425 		return got_error_from_errno("got_opentempfd");
426 
427 	if (gotd_imsg_compose_event(&gotd_session.repo_child_iev,
428 	    GOTD_IMSG_SEND_PACKFILE, PROC_GOTD, client->delta_cache_fd,
429 	    &ipack, sizeof(ipack)) == -1) {
430 		err = got_error_from_errno("imsg compose SEND_PACKFILE");
431 		close(pipe[0]);
432 		close(pipe[1]);
433 		return err;
434 	}
435 
436 	/* Send pack pipe end 0 to repo child process. */
437 	if (gotd_imsg_compose_event(&gotd_session.repo_child_iev,
438 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD, pipe[0], NULL, 0) == -1) {
439 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
440 		close(pipe[1]);
441 		return err;
442 	}
443 
444 	/* Send pack pipe end 1 to gotsh(1) (expects just an fd, no data). */
445 	if (gotd_imsg_compose_event(&client->iev,
446 	    GOTD_IMSG_PACKFILE_PIPE, PROC_GOTD, pipe[1], NULL, 0) == -1)
447 		err = got_error_from_errno("imsg compose PACKFILE_PIPE");
448 
449 	return err;
450 }
451 
452 static void
453 session_dispatch_client(int fd, short events, void *arg)
454 {
455 	struct gotd_imsgev *iev = arg;
456 	struct imsgbuf *ibuf = &iev->ibuf;
457 	struct gotd_session_client *client = &gotd_session_client;
458 	const struct got_error *err = NULL;
459 	struct imsg imsg;
460 	ssize_t n;
461 
462 	if (events & EV_WRITE) {
463 		while (ibuf->w.queued) {
464 			n = msgbuf_write(&ibuf->w);
465 			if (n == -1 && errno == EPIPE) {
466 				/*
467 				 * The client has closed its socket.
468 				 * This can happen when Git clients are
469 				 * done sending pack file data.
470 				 */
471 				msgbuf_clear(&ibuf->w);
472 				continue;
473 			} else if (n == -1 && errno != EAGAIN) {
474 				err = got_error_from_errno("imsg_flush");
475 				disconnect_on_error(client, err);
476 				return;
477 			}
478 			if (n == 0) {
479 				/* Connection closed. */
480 				err = got_error(GOT_ERR_EOF);
481 				disconnect_on_error(client, err);
482 				return;
483 			}
484 		}
485 
486 		if (client->flush_disconnect) {
487 			disconnect(client);
488 			return;
489 		}
490 	}
491 
492 	if ((events & EV_READ) == 0)
493 		return;
494 
495 	memset(&imsg, 0, sizeof(imsg));
496 
497 	while (err == NULL) {
498 		err = gotd_imsg_recv(&imsg, ibuf, 0);
499 		if (err) {
500 			if (err->code == GOT_ERR_PRIVSEP_READ)
501 				err = NULL;
502 			else if (err->code == GOT_ERR_EOF &&
503 			    gotd_session.state ==
504 			    GOTD_STATE_EXPECT_CAPABILITIES) {
505 				/*
506 				 * The client has closed its socket before
507 				 * sending its capability announcement.
508 				 * This can happen when Git clients have
509 				 * no ref-updates to send.
510 				 */
511 				disconnect_on_error(client, err);
512 				return;
513 			}
514 			break;
515 		}
516 
517 		evtimer_del(&client->tmo);
518 
519 		switch (imsg.hdr.type) {
520 		case GOTD_IMSG_CAPABILITIES:
521 			if (gotd_session.state !=
522 			    GOTD_STATE_EXPECT_CAPABILITIES) {
523 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
524 				    "unexpected capabilities received");
525 				break;
526 			}
527 			log_debug("receiving capabilities from uid %d",
528 			    client->euid);
529 			err = recv_capabilities(client, &imsg);
530 			break;
531 		case GOTD_IMSG_CAPABILITY:
532 			if (gotd_session.state != GOTD_STATE_EXPECT_CAPABILITIES) {
533 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
534 				    "unexpected capability received");
535 				break;
536 			}
537 			err = recv_capability(client, &imsg);
538 			if (err || client->ncapabilities < client->ncapa_alloc)
539 				break;
540 			gotd_session.state = GOTD_STATE_EXPECT_WANT;
541 			client->accept_flush_pkt = 1;
542 			log_debug("uid %d: expecting want-lines", client->euid);
543 			break;
544 		case GOTD_IMSG_WANT:
545 			if (gotd_session.state != GOTD_STATE_EXPECT_WANT) {
546 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
547 				    "unexpected want-line received");
548 				break;
549 			}
550 			log_debug("received want-line from uid %d",
551 			    client->euid);
552 			client->accept_flush_pkt = 1;
553 			err = forward_want(client, &imsg);
554 			break;
555 		case GOTD_IMSG_HAVE:
556 			if (gotd_session.state != GOTD_STATE_EXPECT_HAVE) {
557 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
558 				    "unexpected have-line received");
559 				break;
560 			}
561 			log_debug("received have-line from uid %d",
562 			    client->euid);
563 			err = forward_have(client, &imsg);
564 			if (err)
565 				break;
566 			client->accept_flush_pkt = 1;
567 			break;
568 		case GOTD_IMSG_FLUSH:
569 			if (gotd_session.state != GOTD_STATE_EXPECT_WANT && 
570 			    gotd_session.state != GOTD_STATE_EXPECT_HAVE &&
571 			    gotd_session.state != GOTD_STATE_EXPECT_DONE) {
572 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
573 				    "unexpected flush-pkt received");
574 				break;
575 			}
576 			if (!client->accept_flush_pkt) {
577 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
578 				    "unexpected flush-pkt received");
579 				break;
580 			}
581 
582 			/*
583 			 * Accept just one flush packet at a time.
584 			 * Future client state transitions will set this flag
585 			 * again if another flush packet is expected.
586 			 */
587 			client->accept_flush_pkt = 0;
588 
589 			log_debug("received flush-pkt from uid %d",
590 			    client->euid);
591 			if (gotd_session.state == GOTD_STATE_EXPECT_WANT) {
592 				gotd_session.state = GOTD_STATE_EXPECT_HAVE;
593 				log_debug("uid %d: expecting have-lines",
594 				    client->euid);
595 			} else if (gotd_session.state == GOTD_STATE_EXPECT_HAVE) {
596 				gotd_session.state = GOTD_STATE_EXPECT_DONE;
597 				client->accept_flush_pkt = 1;
598 				log_debug("uid %d: expecting 'done'",
599 				    client->euid);
600 			} else if (gotd_session.state != GOTD_STATE_EXPECT_DONE) {
601 				/* should not happen, see above */
602 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
603 				    "unexpected client state");
604 				break;
605 			}
606 			break;
607 		case GOTD_IMSG_DONE:
608 			if (gotd_session.state != GOTD_STATE_EXPECT_HAVE &&
609 			    gotd_session.state != GOTD_STATE_EXPECT_DONE) {
610 				err = got_error_msg(GOT_ERR_BAD_REQUEST,
611 				    "unexpected flush-pkt received");
612 				break;
613 			}
614 			log_debug("received 'done' from uid %d", client->euid);
615 			gotd_session.state = GOTD_STATE_DONE;
616 			client->accept_flush_pkt = 1;
617 			err = send_packfile(client);
618 			break;
619 		default:
620 			log_debug("unexpected imsg %d", imsg.hdr.type);
621 			err = got_error(GOT_ERR_PRIVSEP_MSG);
622 			break;
623 		}
624 
625 		imsg_free(&imsg);
626 	}
627 
628 	if (err) {
629 		if (err->code != GOT_ERR_EOF)
630 			disconnect_on_error(client, err);
631 	} else {
632 		gotd_imsg_event_add(iev);
633 		evtimer_add(&client->tmo, &gotd_session.request_timeout);
634 	}
635 }
636 
637 static const struct got_error *
638 list_refs_request(void)
639 {
640 	static const struct got_error *err;
641 	struct gotd_session_client *client = &gotd_session_client;
642 	struct gotd_imsgev *iev = &gotd_session.repo_child_iev;
643 	int fd;
644 
645 	if (gotd_session.state != GOTD_STATE_EXPECT_LIST_REFS)
646 		return got_error(GOT_ERR_PRIVSEP_MSG);
647 
648 	fd = dup(client->fd);
649 	if (fd == -1)
650 		return got_error_from_errno("dup");
651 
652 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_LIST_REFS_INTERNAL,
653 	    PROC_SESSION_READ, fd, NULL, 0) == -1) {
654 		err = got_error_from_errno("imsg compose LIST_REFS_INTERNAL");
655 		close(fd);
656 		return err;
657 	}
658 
659 	gotd_session.state = GOTD_STATE_EXPECT_CAPABILITIES;
660 	log_debug("uid %d: expecting capabilities", client->euid);
661 	return NULL;
662 }
663 
664 static const struct got_error *
665 recv_connect(struct imsg *imsg)
666 {
667 	struct gotd_session_client *client = &gotd_session_client;
668 	struct gotd_imsg_connect iconnect;
669 	size_t datalen;
670 
671 	if (gotd_session.state != GOTD_STATE_EXPECT_LIST_REFS)
672 		return got_error(GOT_ERR_PRIVSEP_MSG);
673 
674 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
675 	if (datalen < sizeof(iconnect))
676 		return got_error(GOT_ERR_PRIVSEP_LEN);
677 	memcpy(&iconnect, imsg->data, sizeof(iconnect));
678 	if (iconnect.username_len == 0 ||
679 	    datalen != sizeof(iconnect) + iconnect.username_len)
680 		return got_error(GOT_ERR_PRIVSEP_LEN);
681 
682 	client->euid = iconnect.euid;
683 	client->egid = iconnect.egid;
684 	client->fd = imsg_get_fd(imsg);
685 	if (client->fd == -1)
686 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
687 
688 	client->username = strndup(imsg->data + sizeof(iconnect),
689 	    iconnect.username_len);
690 	if (client->username == NULL)
691 		return got_error_from_errno("strndup");
692 
693 	imsg_init(&client->iev.ibuf, client->fd);
694 	client->iev.handler = session_dispatch_client;
695 	client->iev.events = EV_READ;
696 	client->iev.handler_arg = NULL;
697 	event_set(&client->iev.ev, client->iev.ibuf.fd, EV_READ,
698 	    session_dispatch_client, &client->iev);
699 	gotd_imsg_event_add(&client->iev);
700 	evtimer_set(&client->tmo, gotd_request_timeout, client);
701 
702 	return NULL;
703 }
704 
705 static const struct got_error *
706 recv_repo_child(struct imsg *imsg)
707 {
708 	struct gotd_imsg_connect_repo_child ichild;
709 	struct gotd_session_client *client = &gotd_session_client;
710 	size_t datalen;
711 	int fd;
712 
713 	if (gotd_session.state != GOTD_STATE_EXPECT_LIST_REFS)
714 		return got_error(GOT_ERR_PRIVSEP_MSG);
715 
716 	/* We should already have received a pipe to the listener. */
717 	if (client->fd == -1)
718 		return got_error(GOT_ERR_PRIVSEP_MSG);
719 
720 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
721 	if (datalen != sizeof(ichild))
722 		return got_error(GOT_ERR_PRIVSEP_LEN);
723 
724 	memcpy(&ichild, imsg->data, sizeof(ichild));
725 
726 	if (ichild.proc_id != PROC_REPO_READ)
727 		return got_error_msg(GOT_ERR_PRIVSEP_MSG,
728 		    "bad child process type");
729 
730 	fd = imsg_get_fd(imsg);
731 	if (fd == -1)
732 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
733 
734 	imsg_init(&gotd_session.repo_child_iev.ibuf, fd);
735 	gotd_session.repo_child_iev.handler = session_dispatch_repo_child;
736 	gotd_session.repo_child_iev.events = EV_READ;
737 	gotd_session.repo_child_iev.handler_arg = NULL;
738 	event_set(&gotd_session.repo_child_iev.ev,
739 	    gotd_session.repo_child_iev.ibuf.fd, EV_READ,
740 	    session_dispatch_repo_child, &gotd_session.repo_child_iev);
741 	gotd_imsg_event_add(&gotd_session.repo_child_iev);
742 
743 	/* The "recvfd" pledge promise is no longer needed. */
744 	if (pledge("stdio rpath wpath cpath sendfd fattr flock", NULL) == -1)
745 		fatal("pledge");
746 
747 	return NULL;
748 }
749 
750 static void
751 session_dispatch(int fd, short event, void *arg)
752 {
753 	struct gotd_imsgev *iev = arg;
754 	struct imsgbuf *ibuf = &iev->ibuf;
755 	struct gotd_session_client *client = &gotd_session_client;
756 	ssize_t n;
757 	int shut = 0;
758 	struct imsg imsg;
759 
760 	if (event & EV_READ) {
761 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
762 			fatal("imsg_read error");
763 		if (n == 0) {
764 			/* Connection closed. */
765 			shut = 1;
766 			goto done;
767 		}
768 	}
769 
770 	if (event & EV_WRITE) {
771 		n = msgbuf_write(&ibuf->w);
772 		if (n == -1 && errno != EAGAIN)
773 			fatal("msgbuf_write");
774 		if (n == 0) {
775 			/* Connection closed. */
776 			shut = 1;
777 			goto done;
778 		}
779 	}
780 
781 	for (;;) {
782 		const struct got_error *err = NULL;
783 		uint32_t client_id = 0;
784 		int do_disconnect = 0, do_list_refs = 0;
785 
786 		if ((n = imsg_get(ibuf, &imsg)) == -1)
787 			fatal("%s: imsg_get error", __func__);
788 		if (n == 0)	/* No more messages. */
789 			break;
790 
791 		switch (imsg.hdr.type) {
792 		case GOTD_IMSG_ERROR:
793 			do_disconnect = 1;
794 			err = gotd_imsg_recv_error(&client_id, &imsg);
795 			break;
796 		case GOTD_IMSG_CONNECT:
797 			err = recv_connect(&imsg);
798 			break;
799 		case GOTD_IMSG_DISCONNECT:
800 			do_disconnect = 1;
801 			break;
802 		case GOTD_IMSG_CONNECT_REPO_CHILD:
803 			err = recv_repo_child(&imsg);
804 			if (err)
805 				break;
806 			do_list_refs = 1;
807 			break;
808 		default:
809 			log_debug("unexpected imsg %d", imsg.hdr.type);
810 			break;
811 		}
812 		imsg_free(&imsg);
813 
814 		if (do_disconnect) {
815 			if (err)
816 				disconnect_on_error(client, err);
817 			else
818 				disconnect(client);
819 		} else if (do_list_refs)
820 			err = list_refs_request();
821 
822 		if (err)
823 			log_warnx("uid %d: %s", client->euid, err->msg);
824 	}
825 done:
826 	if (!shut) {
827 		gotd_imsg_event_add(iev);
828 	} else {
829 		/* This pipe is dead. Remove its event handler */
830 		event_del(&iev->ev);
831 		event_loopexit(NULL);
832 	}
833 }
834 
835 void
836 session_read_main(const char *title, const char *repo_path,
837     int *pack_fds, int *temp_fds, struct timeval *request_timeout,
838     struct gotd_repo *repo_cfg)
839 {
840 	const struct got_error *err = NULL;
841 	struct event evsigint, evsigterm, evsighup, evsigusr1;
842 
843 	gotd_session.title = title;
844 	gotd_session.pid = getpid();
845 	gotd_session.pack_fds = pack_fds;
846 	gotd_session.temp_fds = temp_fds;
847 	memcpy(&gotd_session.request_timeout, request_timeout,
848 	    sizeof(gotd_session.request_timeout));
849 	gotd_session.repo_cfg = repo_cfg;
850 
851 	imsg_init(&gotd_session.notifier_iev.ibuf, -1);
852 
853 	err = got_repo_open(&gotd_session.repo, repo_path, NULL, pack_fds);
854 	if (err)
855 		goto done;
856 	if (!got_repo_is_bare(gotd_session.repo)) {
857 		err = got_error_msg(GOT_ERR_NOT_GIT_REPO,
858 		    "bare git repository required");
859 		goto done;
860 	}
861 
862 	got_repo_temp_fds_set(gotd_session.repo, temp_fds);
863 
864 	signal_set(&evsigint, SIGINT, session_read_sighdlr, NULL);
865 	signal_set(&evsigterm, SIGTERM, session_read_sighdlr, NULL);
866 	signal_set(&evsighup, SIGHUP, session_read_sighdlr, NULL);
867 	signal_set(&evsigusr1, SIGUSR1, session_read_sighdlr, NULL);
868 	signal(SIGPIPE, SIG_IGN);
869 
870 	signal_add(&evsigint, NULL);
871 	signal_add(&evsigterm, NULL);
872 	signal_add(&evsighup, NULL);
873 	signal_add(&evsigusr1, NULL);
874 
875 	gotd_session.state = GOTD_STATE_EXPECT_LIST_REFS;
876 
877 	gotd_session_client.fd = -1;
878 	gotd_session_client.nref_updates = -1;
879 	gotd_session_client.delta_cache_fd = -1;
880 	gotd_session_client.accept_flush_pkt = 1;
881 
882 	imsg_init(&gotd_session.parent_iev.ibuf, GOTD_FILENO_MSG_PIPE);
883 	gotd_session.parent_iev.handler = session_dispatch;
884 	gotd_session.parent_iev.events = EV_READ;
885 	gotd_session.parent_iev.handler_arg = NULL;
886 	event_set(&gotd_session.parent_iev.ev, gotd_session.parent_iev.ibuf.fd,
887 	    EV_READ, session_dispatch, &gotd_session.parent_iev);
888 	if (gotd_imsg_compose_event(&gotd_session.parent_iev,
889 	    GOTD_IMSG_CLIENT_SESSION_READY, PROC_SESSION_READ,
890 	    -1, NULL, 0) == -1) {
891 		err = got_error_from_errno("imsg compose CLIENT_SESSION_READY");
892 		goto done;
893 	}
894 
895 	event_dispatch();
896 done:
897 	if (err)
898 		log_warnx("%s: %s", title, err->msg);
899 	session_read_shutdown();
900 }
901 
902 static void
903 session_read_shutdown(void)
904 {
905 	log_debug("%s: shutting down", gotd_session.title);
906 
907 	if (gotd_session.repo)
908 		got_repo_close(gotd_session.repo);
909 	got_repo_pack_fds_close(gotd_session.pack_fds);
910 	got_repo_temp_fds_close(gotd_session.temp_fds);
911 	free(gotd_session_client.username);
912 	exit(0);
913 }