gotd/gotd.c

   1 /*
   2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
   3  *
   4  * Permission to use, copy, modify, and distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include "got_compat.h"
  18
  19 #include <sys/queue.h>
  20 #include <sys/time.h>
  21 #include <sys/types.h>
  22 #include <sys/stat.h>
  23 #include <sys/socket.h>
  24 #include <sys/un.h>
  25 #include <sys/wait.h>
  26 #include <sys/resource.h>
  27
  28 #include <fcntl.h>
  29 #include <err.h>
  30 #include <errno.h>
  31 #include <event.h>
  32 #include <limits.h>
  33 #include <pwd.h>
  34 #include <imsg.h>
  35 #include <signal.h>
  36 #include <stdarg.h>
  37 #include <stdio.h>
  38 #include <stdlib.h>
  39 #include <string.h>
  40 #include <syslog.h>
  41 #include <unistd.h>
  42
  43 #include "got_error.h"
  44 #include "got_opentemp.h"
  45 #include "got_path.h"
  46 #include "got_repository.h"
  47 #include "got_object.h"
  48 #include "got_reference.h"
  49
  50 #include "got_lib_delta.h"
  51 #include "got_lib_object.h"
  52 #include "got_lib_object_cache.h"
  53 #include "got_lib_hash.h"
  54 #include "got_lib_gitproto.h"
  55 #include "got_lib_pack.h"
  56 #include "got_lib_repository.h"
  57
  58 #include "gotd.h"
  59 #include "log.h"
  60 #include "listen.h"
  61 #include "auth.h"
  62 #include "session.h"
  63 #include "repo_read.h"
  64 #include "repo_write.h"
  65
  66 #ifndef nitems
  67 #define nitems(_a)      (sizeof((_a)) / sizeof((_a)[0]))
  68 #endif
  69
  70 enum gotd_client_state {
  71         GOTD_CLIENT_STATE_NEW,
  72         GOTD_CLIENT_STATE_ACCESS_GRANTED,
  73 };
  74
  75 struct gotd_child_proc {
  76         pid_t                            pid;
  77         enum gotd_procid                 type;
  78         char                             repo_name[NAME_MAX];
  79         char                             repo_path[PATH_MAX];
  80         int                              pipe[2];
  81         struct gotd_imsgev               iev;
  82         struct event                     tmo;
  83
  84         TAILQ_ENTRY(gotd_child_proc)     entry;
  85 };
  86 TAILQ_HEAD(gotd_procs, gotd_child_proc) procs;
  87
  88 struct gotd_client {
  89         STAILQ_ENTRY(gotd_client)        entry;
  90         enum gotd_client_state           state;
  91         uint32_t                         id;
  92         int                              fd;
  93         struct gotd_imsgev               iev;
  94         struct event                     tmo;
  95         uid_t                            euid;
  96         gid_t                            egid;
  97         struct gotd_child_proc          *repo;
  98         struct gotd_child_proc          *auth;
  99         struct gotd_child_proc          *session;
 100         int                              required_auth;
 101 };
 102 STAILQ_HEAD(gotd_clients, gotd_client);
 103
 104 static struct gotd_clients gotd_clients[GOTD_CLIENT_TABLE_SIZE];
 105 static SIPHASH_KEY clients_hash_key;
 106 volatile int client_cnt;
 107 static struct timeval auth_timeout = { 5, 0 };
 108 static struct gotd gotd;
 109
 110 void gotd_sighdlr(int sig, short event, void *arg);
 111 static void gotd_shutdown(void);
 112 static const struct got_error *start_session_child(struct gotd_client *,
 113     struct gotd_repo *, char *, const char *, int, int);
 114 static const struct got_error *start_repo_child(struct gotd_client *,
 115     enum gotd_procid, struct gotd_repo *, char *, const char *, int, int);
 116 static const struct got_error *start_auth_child(struct gotd_client *, int,
 117     struct gotd_repo *, char *, const char *, int, int);
 118 static void kill_proc(struct gotd_child_proc *, int);
 119 static void disconnect(struct gotd_client *);
 120 static void drop_privs(struct passwd *);
 121
 122 __dead static void
 123 usage(void)
 124 {
 125         fprintf(stderr, "usage: %s [-dnv] [-f config-file]\n", getprogname());
 126         exit(1);
 127 }
 128
 129 static void
 130 drop_privs(struct passwd *pw)
 131 {
 132         /* Drop root privileges. */
 133         if (setgid(pw->pw_gid) == -1)
 134                 fatal("setgid %d failed", pw->pw_gid);
 135         if (setuid(pw->pw_uid) == -1)
 136                 fatal("setuid %d failed", pw->pw_uid);
 137 }
 138
 139 static int
 140 unix_socket_listen(const char *unix_socket_path, uid_t uid, gid_t gid)
 141 {
 142         struct sockaddr_un sun;
 143         int fd = -1;
 144         mode_t old_umask, mode;
 145         int sock_flags = SOCK_STREAM | SOCK_NONBLOCK;
 146
 147 #ifdef SOCK_CLOEXEC
 148         sock_flags |= SOCK_CLOEXEC;
 149 #endif
 150
 151         fd = socket(AF_UNIX, sock_flags, 0);
 152         if (fd == -1) {
 153                 log_warn("socket");
 154                 return -1;
 155         }
 156
 157         sun.sun_family = AF_UNIX;
 158         if (strlcpy(sun.sun_path, unix_socket_path,
 159             sizeof(sun.sun_path)) >= sizeof(sun.sun_path)) {
 160                 log_warnx("%s: name too long", unix_socket_path);
 161                 close(fd);
 162                 return -1;
 163         }
 164
 165         if (unlink(unix_socket_path) == -1) {
 166                 if (errno != ENOENT) {
 167                         log_warn("unlink %s", unix_socket_path);
 168                         close(fd);
 169                         return -1;
 170                 }
 171         }
 172
 173         old_umask = umask(S_IXUSR|S_IXGRP|S_IWOTH|S_IROTH|S_IXOTH);
 174         mode = S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH;
 175
 176         if (bind(fd, (struct sockaddr *)&sun, sizeof(sun)) == -1) {
 177                 log_warn("bind: %s", unix_socket_path);
 178                 close(fd);
 179                 umask(old_umask);
 180                 return -1;
 181         }
 182
 183         umask(old_umask);
 184
 185         if (chmod(unix_socket_path, mode) == -1) {
 186                 log_warn("chmod %o %s", mode, unix_socket_path);
 187                 close(fd);
 188                 unlink(unix_socket_path);
 189                 return -1;
 190         }
 191
 192         if (chown(unix_socket_path, uid, gid) == -1) {
 193                 log_warn("chown %s uid=%d gid=%d", unix_socket_path, uid, gid);
 194                 close(fd);
 195                 unlink(unix_socket_path);
 196                 return -1;
 197         }
 198
 199         if (listen(fd, GOTD_UNIX_SOCKET_BACKLOG) == -1) {
 200                 log_warn("listen");
 201                 close(fd);
 202                 unlink(unix_socket_path);
 203                 return -1;
 204         }
 205
 206         return fd;
 207 }
 208
 209 static uint64_t
 210 client_hash(uint32_t client_id)
 211 {
 212         return SipHash24(&clients_hash_key, &client_id, sizeof(client_id));
 213 }
 214
 215 static void
 216 add_client(struct gotd_client *client)
 217 {
 218         uint64_t slot = client_hash(client->id) % nitems(gotd_clients);
 219         STAILQ_INSERT_HEAD(&gotd_clients[slot], client, entry);
 220         client_cnt++;
 221 }
 222
 223 static struct gotd_client *
 224 find_client(uint32_t client_id)
 225 {
 226         uint64_t slot;
 227         struct gotd_client *c;
 228
 229         slot = client_hash(client_id) % nitems(gotd_clients);
 230         STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
 231                 if (c->id == client_id)
 232                         return c;
 233         }
 234
 235         return NULL;
 236 }
 237
 238 static struct gotd_client *
 239 find_client_by_proc_fd(int fd)
 240 {
 241         uint64_t slot;
 242
 243         for (slot = 0; slot < nitems(gotd_clients); slot++) {
 244                 struct gotd_client *c;
 245
 246                 STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
 247                         if (c->repo && c->repo->iev.ibuf.fd == fd)
 248                                 return c;
 249                         if (c->auth && c->auth->iev.ibuf.fd == fd)
 250                                 return c;
 251                         if (c->session && c->session->iev.ibuf.fd == fd)
 252                                 return c;
 253                 }
 254         }
 255
 256         return NULL;
 257 }
 258
 259 static int
 260 client_is_reading(struct gotd_client *client)
 261 {
 262         return (client->required_auth &
 263             (GOTD_AUTH_READ | GOTD_AUTH_WRITE)) == GOTD_AUTH_READ;
 264 }
 265
 266 static int
 267 client_is_writing(struct gotd_client *client)
 268 {
 269         return (client->required_auth &
 270             (GOTD_AUTH_READ | GOTD_AUTH_WRITE)) ==
 271             (GOTD_AUTH_READ | GOTD_AUTH_WRITE);
 272 }
 273
 274 static const struct got_error *
 275 ensure_client_is_not_writing(struct gotd_client *client)
 276 {
 277         if (client_is_writing(client)) {
 278                 return got_error_fmt(GOT_ERR_BAD_PACKET,
 279                     "uid %d made a read-request but is writing to "
 280                     "a repository", client->euid);
 281         }
 282
 283         return NULL;
 284 }
 285
 286 static const struct got_error *
 287 ensure_client_is_not_reading(struct gotd_client *client)
 288 {
 289         if (client_is_reading(client)) {
 290                 return got_error_fmt(GOT_ERR_BAD_PACKET,
 291                     "uid %d made a write-request but is reading from "
 292                     "a repository", client->euid);
 293         }
 294
 295         return NULL;
 296 }
 297
 298 static void
 299 proc_done(struct gotd_child_proc *proc)
 300 {
 301         struct gotd_client *client;
 302
 303         TAILQ_REMOVE(&procs, proc, entry);
 304
 305         client = find_client_by_proc_fd(proc->iev.ibuf.fd);
 306         if (client != NULL) {
 307                 if (proc == client->repo)
 308                         client->repo = NULL;
 309                 if (proc == client->auth)
 310                         client->auth = NULL;
 311                 if (proc == client->session)
 312                         client->session = NULL;
 313                 disconnect(client);
 314         }
 315
 316         evtimer_del(&proc->tmo);
 317
 318         if (proc->iev.ibuf.fd != -1) {
 319                 event_del(&proc->iev.ev);
 320                 msgbuf_clear(&proc->iev.ibuf.w);
 321                 close(proc->iev.ibuf.fd);
 322         }
 323
 324         free(proc);
 325 }
 326
 327 static void
 328 kill_repo_proc(struct gotd_client *client)
 329 {
 330         if (client->repo == NULL)
 331                 return;
 332
 333         kill_proc(client->repo, 0);
 334         client->repo = NULL;
 335 }
 336
 337 static void
 338 kill_auth_proc(struct gotd_client *client)
 339 {
 340         if (client->auth == NULL)
 341                 return;
 342
 343         kill_proc(client->auth, 0);
 344         client->auth = NULL;
 345 }
 346
 347 static void
 348 kill_session_proc(struct gotd_client *client)
 349 {
 350         if (client->session == NULL)
 351                 return;
 352
 353         kill_proc(client->session, 0);
 354         client->session = NULL;
 355 }
 356
 357 static void
 358 disconnect(struct gotd_client *client)
 359 {
 360         struct gotd_imsg_disconnect idisconnect;
 361         struct gotd_child_proc *listen_proc = gotd.listen_proc;
 362         uint64_t slot;
 363
 364         log_debug("uid %d: disconnecting", client->euid);
 365
 366         kill_auth_proc(client);
 367         kill_session_proc(client);
 368         kill_repo_proc(client);
 369
 370         idisconnect.client_id = client->id;
 371         if (gotd_imsg_compose_event(&listen_proc->iev,
 372             GOTD_IMSG_DISCONNECT, PROC_GOTD, -1,
 373             &idisconnect, sizeof(idisconnect)) == -1)
 374                 log_warn("imsg compose DISCONNECT");
 375
 376         slot = client_hash(client->id) % nitems(gotd_clients);
 377         STAILQ_REMOVE(&gotd_clients[slot], client, gotd_client, entry);
 378         imsg_clear(&client->iev.ibuf);
 379         event_del(&client->iev.ev);
 380         evtimer_del(&client->tmo);
 381         if (client->fd != -1)
 382                 close(client->fd);
 383         else if (client->iev.ibuf.fd != -1)
 384                 close(client->iev.ibuf.fd);
 385         free(client);
 386         client_cnt--;
 387 }
 388
 389 static void
 390 disconnect_on_error(struct gotd_client *client, const struct got_error *err)
 391 {
 392         struct imsgbuf ibuf;
 393
 394         if (err->code != GOT_ERR_EOF) {
 395                 log_warnx("uid %d: %s", client->euid, err->msg);
 396                 if (client->fd != -1) {
 397                         imsg_init(&ibuf, client->fd);
 398                         gotd_imsg_send_error(&ibuf, 0, PROC_GOTD, err);
 399                         imsg_clear(&ibuf);
 400                 }
 401         }
 402         disconnect(client);
 403 }
 404
 405 static const struct got_error *
 406 send_repo_info(struct gotd_imsgev *iev, struct gotd_repo *repo)
 407 {
 408         const struct got_error *err = NULL;
 409         struct gotd_imsg_info_repo irepo;
 410
 411         memset(&irepo, 0, sizeof(irepo));
 412
 413         if (strlcpy(irepo.repo_name, repo->name, sizeof(irepo.repo_name))
 414             >= sizeof(irepo.repo_name))
 415                 return got_error_msg(GOT_ERR_NO_SPACE, "repo name too long");
 416         if (strlcpy(irepo.repo_path, repo->path, sizeof(irepo.repo_path))
 417             >= sizeof(irepo.repo_path))
 418                 return got_error_msg(GOT_ERR_NO_SPACE, "repo path too long");
 419
 420         if (gotd_imsg_compose_event(iev, GOTD_IMSG_INFO_REPO, PROC_GOTD, -1,
 421             &irepo, sizeof(irepo)) == -1) {
 422                 err = got_error_from_errno("imsg compose INFO_REPO");
 423                 if (err)
 424                         return err;
 425         }
 426
 427         return NULL;
 428 }
 429
 430 static const struct got_error *
 431 send_client_info(struct gotd_imsgev *iev, struct gotd_client *client)
 432 {
 433         const struct got_error *err = NULL;
 434         struct gotd_imsg_info_client iclient;
 435         struct gotd_child_proc *proc;
 436
 437         memset(&iclient, 0, sizeof(iclient));
 438         iclient.euid = client->euid;
 439         iclient.egid = client->egid;
 440
 441         proc = client->repo;
 442         if (proc) {
 443                 if (strlcpy(iclient.repo_name, proc->repo_path,
 444                     sizeof(iclient.repo_name)) >= sizeof(iclient.repo_name)) {
 445                         return got_error_msg(GOT_ERR_NO_SPACE,
 446                             "repo name too long");
 447                 }
 448                 if (client_is_writing(client))
 449                         iclient.is_writing = 1;
 450
 451                 iclient.repo_child_pid = proc->pid;
 452         }
 453
 454         if (client->session)
 455                 iclient.session_child_pid = client->session->pid;
 456
 457         if (gotd_imsg_compose_event(iev, GOTD_IMSG_INFO_CLIENT, PROC_GOTD, -1,
 458             &iclient, sizeof(iclient)) == -1) {
 459                 err = got_error_from_errno("imsg compose INFO_CLIENT");
 460                 if (err)
 461                         return err;
 462         }
 463
 464         return NULL;
 465 }
 466
 467 static const struct got_error *
 468 send_info(struct gotd_client *client)
 469 {
 470         const struct got_error *err = NULL;
 471         struct gotd_imsg_info info;
 472         uint64_t slot;
 473         struct gotd_repo *repo;
 474
 475         if (client->euid != 0)
 476                 return got_error_set_errno(EPERM, "info");
 477
 478         info.pid = gotd.pid;
 479         info.verbosity = gotd.verbosity;
 480         info.nrepos = gotd.nrepos;
 481         info.nclients = client_cnt - 1;
 482
 483         if (gotd_imsg_compose_event(&client->iev, GOTD_IMSG_INFO, PROC_GOTD, -1,
 484             &info, sizeof(info)) == -1) {
 485                 err = got_error_from_errno("imsg compose INFO");
 486                 if (err)
 487                         return err;
 488         }
 489
 490         TAILQ_FOREACH(repo, &gotd.repos, entry) {
 491                 err = send_repo_info(&client->iev, repo);
 492                 if (err)
 493                         return err;
 494         }
 495
 496         for (slot = 0; slot < nitems(gotd_clients); slot++) {
 497                 struct gotd_client *c;
 498                 STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
 499                         if (c->id == client->id)
 500                                 continue;
 501                         err = send_client_info(&client->iev, c);
 502                         if (err)
 503                                 return err;
 504                 }
 505         }
 506
 507         return NULL;
 508 }
 509
 510 static const struct got_error *
 511 stop_gotd(struct gotd_client *client)
 512 {
 513
 514         if (client->euid != 0)
 515                 return got_error_set_errno(EPERM, "stop");
 516
 517         gotd_shutdown();
 518         /* NOTREACHED */
 519         return NULL;
 520 }
 521
 522 static const struct got_error *
 523 start_client_authentication(struct gotd_client *client, struct imsg *imsg)
 524 {
 525         const struct got_error *err;
 526         struct gotd_imsg_list_refs ireq;
 527         struct gotd_repo *repo = NULL;
 528         size_t datalen;
 529
 530         log_debug("list-refs request from uid %d", client->euid);
 531
 532         if (client->state != GOTD_CLIENT_STATE_NEW)
 533                 return got_error_msg(GOT_ERR_BAD_REQUEST,
 534                     "unexpected list-refs request received");
 535
 536         datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
 537         if (datalen != sizeof(ireq))
 538                 return got_error(GOT_ERR_PRIVSEP_LEN);
 539
 540         memcpy(&ireq, imsg->data, datalen);
 541
 542         if (ireq.client_is_reading) {
 543                 err = ensure_client_is_not_writing(client);
 544                 if (err)
 545                         return err;
 546                 repo = gotd_find_repo_by_name(ireq.repo_name, &gotd);
 547                 if (repo == NULL)
 548                         return got_error(GOT_ERR_NOT_GIT_REPO);
 549                 err = start_auth_child(client, GOTD_AUTH_READ, repo,
 550                     gotd.argv0, gotd.confpath, gotd.daemonize,
 551                     gotd.verbosity);
 552                 if (err)
 553                         return err;
 554         } else {
 555                 err = ensure_client_is_not_reading(client);
 556                 if (err)
 557                         return err;
 558                 repo = gotd_find_repo_by_name(ireq.repo_name, &gotd);
 559                 if (repo == NULL)
 560                         return got_error(GOT_ERR_NOT_GIT_REPO);
 561                 err = start_auth_child(client,
 562                     GOTD_AUTH_READ | GOTD_AUTH_WRITE,
 563                     repo, gotd.argv0, gotd.confpath, gotd.daemonize,
 564                     gotd.verbosity);
 565                 if (err)
 566                         return err;
 567         }
 568
 569         evtimer_add(&client->tmo, &auth_timeout);
 570
 571         /* Flow continues upon authentication success/failure or timeout. */
 572         return NULL;
 573 }
 574
 575 static void
 576 gotd_request(int fd, short events, void *arg)
 577 {
 578         struct gotd_imsgev *iev = arg;
 579         struct imsgbuf *ibuf = &iev->ibuf;
 580         struct gotd_client *client = iev->handler_arg;
 581         const struct got_error *err = NULL;
 582         struct imsg imsg;
 583         ssize_t n;
 584
 585         if (events & EV_WRITE) {
 586                 while (ibuf->w.queued) {
 587                         n = msgbuf_write(&ibuf->w);
 588                         if (n == -1 && errno == EPIPE) {
 589                                 /*
 590                                  * The client has closed its socket.
 591                                  * This can happen when Git clients are
 592                                  * done sending pack file data.
 593                                  */
 594                                 msgbuf_clear(&ibuf->w);
 595                                 continue;
 596                         } else if (n == -1 && errno != EAGAIN) {
 597                                 err = got_error_from_errno("imsg_flush");
 598                                 disconnect_on_error(client, err);
 599                                 return;
 600                         }
 601                         if (n == 0) {
 602                                 /* Connection closed. */
 603                                 err = got_error(GOT_ERR_EOF);
 604                                 disconnect_on_error(client, err);
 605                                 return;
 606                         }
 607                 }
 608
 609                 /* Disconnect gotctl(8) now that messages have been sent. */
 610                 if (!client_is_reading(client) && !client_is_writing(client)) {
 611                         disconnect(client);
 612                         return;
 613                 }
 614         }
 615
 616         if ((events & EV_READ) == 0)
 617                 return;
 618
 619         memset(&imsg, 0, sizeof(imsg));
 620
 621         while (err == NULL) {
 622                 err = gotd_imsg_recv(&imsg, ibuf, 0);
 623                 if (err) {
 624                         if (err->code == GOT_ERR_PRIVSEP_READ)
 625                                 err = NULL;
 626                         break;
 627                 }
 628
 629                 evtimer_del(&client->tmo);
 630
 631                 switch (imsg.hdr.type) {
 632                 case GOTD_IMSG_INFO:
 633                         err = send_info(client);
 634                         break;
 635                 case GOTD_IMSG_STOP:
 636                         err = stop_gotd(client);
 637                         break;
 638                 case GOTD_IMSG_LIST_REFS:
 639                         err = start_client_authentication(client, &imsg);
 640                         break;
 641                 default:
 642                         log_debug("unexpected imsg %d", imsg.hdr.type);
 643                         err = got_error(GOT_ERR_PRIVSEP_MSG);
 644                         break;
 645                 }
 646
 647                 imsg_free(&imsg);
 648         }
 649
 650         if (err) {
 651                 disconnect_on_error(client, err);
 652         } else {
 653                 gotd_imsg_event_add(&client->iev);
 654         }
 655 }
 656
 657 static void
 658 gotd_auth_timeout(int fd, short events, void *arg)
 659 {
 660         struct gotd_client *client = arg;
 661
 662         log_debug("disconnecting uid %d due to authentication timeout",
 663             client->euid);
 664         disconnect(client);
 665 }
 666
 667 static const struct got_error *
 668 recv_connect(uint32_t *client_id, struct imsg *imsg)
 669 {
 670         const struct got_error *err = NULL;
 671         struct gotd_imsg_connect iconnect;
 672         size_t datalen;
 673         int s = -1;
 674         struct gotd_client *client = NULL;
 675
 676         *client_id = 0;
 677
 678         datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
 679         if (datalen != sizeof(iconnect))
 680                 return got_error(GOT_ERR_PRIVSEP_LEN);
 681         memcpy(&iconnect, imsg->data, sizeof(iconnect));
 682
 683         s = imsg->fd;
 684         if (s == -1) {
 685                 err = got_error(GOT_ERR_PRIVSEP_NO_FD);
 686                 goto done;
 687         }
 688
 689         if (find_client(iconnect.client_id)) {
 690                 err = got_error_msg(GOT_ERR_CLIENT_ID, "duplicate client ID");
 691                 goto done;
 692         }
 693
 694         client = calloc(1, sizeof(*client));
 695         if (client == NULL) {
 696                 err = got_error_from_errno("calloc");
 697                 goto done;
 698         }
 699
 700         *client_id = iconnect.client_id;
 701
 702         client->state = GOTD_CLIENT_STATE_NEW;
 703         client->id = iconnect.client_id;
 704         client->fd = s;
 705         s = -1;
 706         /* The auth process will verify UID/GID for us. */
 707         client->euid = iconnect.euid;
 708         client->egid = iconnect.egid;
 709
 710         imsg_init(&client->iev.ibuf, client->fd);
 711         client->iev.handler = gotd_request;
 712         client->iev.events = EV_READ;
 713         client->iev.handler_arg = client;
 714
 715         event_set(&client->iev.ev, client->fd, EV_READ, gotd_request,
 716             &client->iev);
 717         gotd_imsg_event_add(&client->iev);
 718
 719         evtimer_set(&client->tmo, gotd_auth_timeout, client);
 720
 721         add_client(client);
 722         log_debug("%s: new client uid %d connected on fd %d", __func__,
 723             client->euid, client->fd);
 724 done:
 725         if (err) {
 726                 struct gotd_child_proc *listen_proc = gotd.listen_proc;
 727                 struct gotd_imsg_disconnect idisconnect;
 728
 729                 idisconnect.client_id = client->id;
 730                 if (gotd_imsg_compose_event(&listen_proc->iev,
 731                     GOTD_IMSG_DISCONNECT, PROC_GOTD, -1,
 732                     &idisconnect, sizeof(idisconnect)) == -1)
 733                         log_warn("imsg compose DISCONNECT");
 734
 735                 if (s != -1)
 736                         close(s);
 737         }
 738
 739         return err;
 740 }
 741
 742 static const char *gotd_proc_names[PROC_MAX] = {
 743         "parent",
 744         "listen",
 745         "auth",
 746         "session_read",
 747         "session_write",
 748         "repo_read",
 749         "repo_write",
 750         "gitwrapper"
 751 };
 752
 753 static void
 754 kill_proc(struct gotd_child_proc *proc, int fatal)
 755 {
 756         struct timeval tv = { 5, 0 };
 757
 758         log_debug("kill -%d %d", fatal ? SIGKILL : SIGTERM, proc->pid);
 759
 760         if (proc->iev.ibuf.fd != -1) {
 761                 event_del(&proc->iev.ev);
 762                 msgbuf_clear(&proc->iev.ibuf.w);
 763                 close(proc->iev.ibuf.fd);
 764                 proc->iev.ibuf.fd = -1;
 765         }
 766
 767         if (!evtimer_pending(&proc->tmo, NULL) && !fatal)
 768                 evtimer_add(&proc->tmo, &tv);
 769
 770         if (fatal) {
 771                 log_warnx("sending SIGKILL to PID %d", proc->pid);
 772                 kill(proc->pid, SIGKILL);
 773         } else
 774                 kill(proc->pid, SIGTERM);
 775 }
 776
 777 static void
 778 kill_proc_timeout(int fd, short ev, void *d)
 779 {
 780         struct gotd_child_proc *proc = d;
 781
 782         log_warnx("timeout waiting for PID %d to terminate;"
 783             " retrying with force", proc->pid);
 784         kill_proc(proc, 1);
 785 }
 786
 787 static void
 788 gotd_shutdown(void)
 789 {
 790         uint64_t slot;
 791
 792         log_debug("shutting down");
 793         for (slot = 0; slot < nitems(gotd_clients); slot++) {
 794                 struct gotd_client *c, *tmp;
 795
 796                 STAILQ_FOREACH_SAFE(c, &gotd_clients[slot], entry, tmp)
 797                         disconnect(c);
 798         }
 799
 800         kill_proc(gotd.listen_proc, 0);
 801
 802         log_info("terminating");
 803         exit(0);
 804 }
 805
 806 static struct gotd_child_proc *
 807 find_proc_by_pid(pid_t pid)
 808 {
 809         struct gotd_child_proc *proc = NULL;
 810
 811         TAILQ_FOREACH(proc, &procs, entry)
 812                 if (proc->pid == pid)
 813                         break;
 814
 815         return proc;
 816 }
 817
 818 void
 819 gotd_sighdlr(int sig, short event, void *arg)
 820 {
 821         struct gotd_child_proc *proc;
 822         pid_t pid;
 823         int status;
 824
 825         /*
 826          * Normal signal handler rules don't apply because libevent
 827          * decouples for us.
 828          */
 829
 830         switch (sig) {
 831         case SIGHUP:
 832                 log_info("%s: ignoring SIGHUP", __func__);
 833                 break;
 834         case SIGUSR1:
 835                 log_info("%s: ignoring SIGUSR1", __func__);
 836                 break;
 837         case SIGTERM:
 838         case SIGINT:
 839                 gotd_shutdown();
 840                 break;
 841         case SIGCHLD:
 842                 for (;;) {
 843                         pid = waitpid(WAIT_ANY, &status, WNOHANG);
 844                         if (pid == -1) {
 845                                 if (errno == EINTR)
 846                                         continue;
 847                                 if (errno == ECHILD)
 848                                         break;
 849                                 fatal("waitpid");
 850                         }
 851                         if (pid == 0)
 852                                 break;
 853
 854                         log_debug("reaped pid %d", pid);
 855                         proc = find_proc_by_pid(pid);
 856                         if (proc == NULL) {
 857                                 log_info("caught exit of unknown child %d",
 858                                     pid);
 859                                 continue;
 860                         }
 861
 862                         if (WIFSIGNALED(status)) {
 863                                 log_warnx("child PID %d terminated with"
 864                                     " signal %d", pid, WTERMSIG(status));
 865                         }
 866
 867                         proc_done(proc);
 868                 }
 869                 break;
 870         default:
 871                 fatalx("unexpected signal");
 872         }
 873 }
 874
 875 static const struct got_error *
 876 ensure_proc_is_reading(struct gotd_client *client,
 877     struct gotd_child_proc *proc)
 878 {
 879         if (!client_is_reading(client)) {
 880                 kill_proc(proc, 1);
 881                 return got_error_fmt(GOT_ERR_BAD_PACKET,
 882                     "PID %d handled a read-request for uid %d but this "
 883                     "user is not reading from a repository", proc->pid,
 884                     client->euid);
 885         }
 886
 887         return NULL;
 888 }
 889
 890 static const struct got_error *
 891 ensure_proc_is_writing(struct gotd_client *client,
 892     struct gotd_child_proc *proc)
 893 {
 894         if (!client_is_writing(client)) {
 895                 kill_proc(proc, 1);
 896                 return got_error_fmt(GOT_ERR_BAD_PACKET,
 897                     "PID %d handled a write-request for uid %d but this "
 898                     "user is not writing to a repository", proc->pid,
 899                     client->euid);
 900         }
 901
 902         return NULL;
 903 }
 904
 905 static int
 906 verify_imsg_src(struct gotd_client *client, struct gotd_child_proc *proc,
 907     struct imsg *imsg)
 908 {
 909         const struct got_error *err;
 910         int ret = 0;
 911
 912         if (proc->type == PROC_REPO_READ || proc->type == PROC_REPO_WRITE) {
 913                 if (client->repo == NULL)
 914                         fatalx("no process found for uid %d", client->euid);
 915                 if (proc->pid != client->repo->pid) {
 916                         kill_proc(proc, 1);
 917                         log_warnx("received message from PID %d for uid %d, "
 918                             "while PID %d is the process serving this user",
 919                             proc->pid, client->euid, client->repo->pid);
 920                         return 0;
 921                 }
 922         }
 923         if (proc->type == PROC_SESSION_READ ||
 924             proc->type == PROC_SESSION_WRITE) {
 925                 if (client->session == NULL) {
 926                         log_warnx("no session found for uid %d", client->euid);
 927                         return 0;
 928                 }
 929                 if (proc->pid != client->session->pid) {
 930                         kill_proc(proc, 1);
 931                         log_warnx("received message from PID %d for uid %d, "
 932                             "while PID %d is the process serving this user",
 933                             proc->pid, client->euid, client->session->pid);
 934                         return 0;
 935                 }
 936         }
 937
 938         switch (imsg->hdr.type) {
 939         case GOTD_IMSG_ERROR:
 940                 ret = 1;
 941                 break;
 942         case GOTD_IMSG_CONNECT:
 943                 if (proc->type != PROC_LISTEN) {
 944                         err = got_error_fmt(GOT_ERR_BAD_PACKET,
 945                             "new connection for uid %d from PID %d "
 946                             "which is not the listen process",
 947                             proc->pid, client->euid);
 948                 } else
 949                         ret = 1;
 950                 break;
 951         case GOTD_IMSG_ACCESS_GRANTED:
 952                 if (proc->type != PROC_AUTH) {
 953                         err = got_error_fmt(GOT_ERR_BAD_PACKET,
 954                             "authentication of uid %d from PID %d "
 955                             "which is not the auth process",
 956                             proc->pid, client->euid);
 957                 } else
 958                         ret = 1;
 959                 break;
 960         case GOTD_IMSG_CLIENT_SESSION_READY:
 961                 if (proc->type != PROC_SESSION_READ &&
 962                     proc->type != PROC_SESSION_WRITE) {
 963                         err = got_error_fmt(GOT_ERR_BAD_PACKET,
 964                             "unexpected \"ready\" signal from PID %d",
 965                             proc->pid);
 966                 } else
 967                         ret = 1;
 968                 break;
 969         case GOTD_IMSG_REPO_CHILD_READY:
 970                 if (proc->type != PROC_REPO_READ &&
 971                     proc->type != PROC_REPO_WRITE) {
 972                         err = got_error_fmt(GOT_ERR_BAD_PACKET,
 973                             "unexpected \"ready\" signal from PID %d",
 974                             proc->pid);
 975                 } else
 976                         ret = 1;
 977                 break;
 978         case GOTD_IMSG_PACKFILE_DONE:
 979                 err = ensure_proc_is_reading(client, proc);
 980                 if (err)
 981                         log_warnx("uid %d: %s", client->euid, err->msg);
 982                 else
 983                         ret = 1;
 984                 break;
 985         case GOTD_IMSG_PACKFILE_INSTALL:
 986         case GOTD_IMSG_REF_UPDATES_START:
 987         case GOTD_IMSG_REF_UPDATE:
 988                 err = ensure_proc_is_writing(client, proc);
 989                 if (err)
 990                         log_warnx("uid %d: %s", client->euid, err->msg);
 991                 else
 992                         ret = 1;
 993                 break;
 994         default:
 995                 log_debug("%s: unexpected imsg %d", __func__, imsg->hdr.type);
 996                 break;
 997         }
 998
 999         return ret;
1000 }
1001
1002 static const struct got_error *
1003 connect_repo_child(struct gotd_client *client,
1004     struct gotd_child_proc *repo_proc)
1005 {
1006         static const struct got_error *err;
1007         struct gotd_imsgev *session_iev = &client->session->iev;
1008         struct gotd_imsg_connect_repo_child ireq;
1009         int pipe[2];
1010         int sock_flags = SOCK_STREAM | SOCK_NONBLOCK;
1011
1012 #ifdef SOCK_CLOEXEC
1013         sock_flags |= SOCK_CLOEXEC;
1014 #endif
1015
1016         if (client->state != GOTD_CLIENT_STATE_ACCESS_GRANTED)
1017                 return got_error_msg(GOT_ERR_BAD_REQUEST,
1018                     "unexpected repo child ready signal received");
1019
1020         if (socketpair(AF_UNIX, sock_flags, PF_UNSPEC, pipe) == -1)
1021                 fatal("socketpair");
1022
1023         memset(&ireq, 0, sizeof(ireq));
1024         ireq.client_id = client->id;
1025         ireq.proc_id = repo_proc->type;
1026
1027         /* Pass repo child pipe to session child process. */
1028         if (gotd_imsg_compose_event(session_iev, GOTD_IMSG_CONNECT_REPO_CHILD,
1029             PROC_GOTD, pipe[0], &ireq, sizeof(ireq)) == -1) {
1030                 err = got_error_from_errno("imsg compose CONNECT_REPO_CHILD");
1031                 close(pipe[0]);
1032                 close(pipe[1]);
1033                 return err;
1034         }
1035
1036         /* Pass session child pipe to repo child process. */
1037         if (gotd_imsg_compose_event(&repo_proc->iev,
1038             GOTD_IMSG_CONNECT_REPO_CHILD, PROC_GOTD, pipe[1], NULL, 0) == -1) {
1039                 err = got_error_from_errno("imsg compose CONNECT_REPO_CHILD");
1040                 close(pipe[1]);
1041                 return err;
1042         }
1043
1044         return NULL;
1045 }
1046
1047 static void
1048 gotd_dispatch_listener(int fd, short event, void *arg)
1049 {
1050         struct gotd_imsgev *iev = arg;
1051         struct imsgbuf *ibuf = &iev->ibuf;
1052         struct gotd_child_proc *proc = gotd.listen_proc;
1053         ssize_t n;
1054         int shut = 0;
1055         struct imsg imsg;
1056
1057         if (proc->iev.ibuf.fd != fd)
1058                 fatalx("%s: unexpected fd %d", __func__, fd);
1059
1060         if (event & EV_READ) {
1061                 if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1062                         fatal("imsg_read error");
1063                 if (n == 0) {
1064                         /* Connection closed. */
1065                         shut = 1;
1066                         goto done;
1067                 }
1068         }
1069
1070         if (event & EV_WRITE) {
1071                 n = msgbuf_write(&ibuf->w);
1072                 if (n == -1 && errno != EAGAIN)
1073                         fatal("msgbuf_write");
1074                 if (n == 0) {
1075                         /* Connection closed. */
1076                         shut = 1;
1077                         goto done;
1078                 }
1079         }
1080
1081         for (;;) {
1082                 const struct got_error *err = NULL;
1083                 struct gotd_client *client = NULL;
1084                 uint32_t client_id = 0;
1085                 int do_disconnect = 0;
1086
1087                 if ((n = imsg_get(ibuf, &imsg)) == -1)
1088                         fatal("%s: imsg_get error", __func__);
1089                 if (n == 0)     /* No more messages. */
1090                         break;
1091
1092                 switch (imsg.hdr.type) {
1093                 case GOTD_IMSG_ERROR:
1094                         do_disconnect = 1;
1095                         err = gotd_imsg_recv_error(&client_id, &imsg);
1096                         break;
1097                 case GOTD_IMSG_CONNECT:
1098                         err = recv_connect(&client_id, &imsg);
1099                         break;
1100                 default:
1101                         log_debug("unexpected imsg %d", imsg.hdr.type);
1102                         break;
1103                 }
1104
1105                 client = find_client(client_id);
1106                 if (client == NULL) {
1107                         log_warnx("%s: client not found", __func__);
1108                         imsg_free(&imsg);
1109                         continue;
1110                 }
1111
1112                 if (err)
1113                         log_warnx("uid %d: %s", client->euid, err->msg);
1114
1115                 if (do_disconnect) {
1116                         if (err)
1117                                 disconnect_on_error(client, err);
1118                         else
1119                                 disconnect(client);
1120                 }
1121
1122                 imsg_free(&imsg);
1123         }
1124 done:
1125         if (!shut) {
1126                 gotd_imsg_event_add(iev);
1127         } else {
1128                 /* This pipe is dead. Remove its event handler */
1129                 event_del(&iev->ev);
1130                 event_loopexit(NULL);
1131         }
1132 }
1133
1134 static void
1135 gotd_dispatch_auth_child(int fd, short event, void *arg)
1136 {
1137         const struct got_error *err = NULL;
1138         struct gotd_imsgev *iev = arg;
1139         struct imsgbuf *ibuf = &iev->ibuf;
1140         struct gotd_client *client;
1141         struct gotd_repo *repo = NULL;
1142         ssize_t n;
1143         int shut = 0;
1144         struct imsg imsg;
1145         uint32_t client_id = 0;
1146         int do_disconnect = 0;
1147
1148         client = find_client_by_proc_fd(fd);
1149         if (client == NULL) {
1150                 /* Can happen during process teardown. */
1151                 warnx("cannot find client for fd %d", fd);
1152                 shut = 1;
1153                 goto done;
1154         }
1155
1156         if (client->auth == NULL)
1157                 fatalx("cannot find auth child process for fd %d", fd);
1158
1159         if (event & EV_READ) {
1160                 if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1161                         fatal("imsg_read error");
1162                 if (n == 0) {
1163                         /* Connection closed. */
1164                         shut = 1;
1165                         goto done;
1166                 }
1167         }
1168
1169         if (event & EV_WRITE) {
1170                 n = msgbuf_write(&ibuf->w);
1171                 if (n == -1 && errno != EAGAIN)
1172                         fatal("msgbuf_write");
1173                 if (n == 0) {
1174                         /* Connection closed. */
1175                         shut = 1;
1176                 }
1177                 goto done;
1178         }
1179
1180         if (client->auth->iev.ibuf.fd != fd)
1181                 fatalx("%s: unexpected fd %d", __func__, fd);
1182
1183         if ((n = imsg_get(ibuf, &imsg)) == -1)
1184                 fatal("%s: imsg_get error", __func__);
1185         if (n == 0)     /* No more messages. */
1186                 return;
1187
1188         evtimer_del(&client->tmo);
1189
1190         switch (imsg.hdr.type) {
1191         case GOTD_IMSG_ERROR:
1192                 do_disconnect = 1;
1193                 err = gotd_imsg_recv_error(&client_id, &imsg);
1194                 break;
1195         case GOTD_IMSG_ACCESS_GRANTED:
1196                 client->state = GOTD_CLIENT_STATE_ACCESS_GRANTED;
1197                 break;
1198         default:
1199                 do_disconnect = 1;
1200                 log_debug("unexpected imsg %d", imsg.hdr.type);
1201                 break;
1202         }
1203
1204         if (!verify_imsg_src(client, client->auth, &imsg)) {
1205                 do_disconnect = 1;
1206                 log_debug("dropping imsg type %d from PID %d",
1207                     imsg.hdr.type, client->auth->pid);
1208         }
1209         imsg_free(&imsg);
1210
1211         if (do_disconnect) {
1212                 if (err)
1213                         disconnect_on_error(client, err);
1214                 else
1215                         disconnect(client);
1216                 return;
1217         }
1218
1219         repo = gotd_find_repo_by_name(client->auth->repo_name, &gotd);
1220         if (repo == NULL) {
1221                 err = got_error(GOT_ERR_NOT_GIT_REPO);
1222                 goto done;
1223         }
1224         kill_auth_proc(client);
1225
1226         log_info("authenticated uid %d for repository %s",
1227             client->euid, repo->name);
1228
1229         err = start_session_child(client, repo, gotd.argv0,
1230             gotd.confpath, gotd.daemonize, gotd.verbosity);
1231         if (err)
1232                 goto done;
1233 done:
1234         if (err)
1235                 log_warnx("uid %d: %s", client->euid, err->msg);
1236
1237         /* We might have killed the auth process by now. */
1238         if (client->auth != NULL) {
1239                 if (!shut) {
1240                         gotd_imsg_event_add(iev);
1241                 } else {
1242                         /* This pipe is dead. Remove its event handler */
1243                         event_del(&iev->ev);
1244                 }
1245         }
1246 }
1247
1248 static const struct got_error *
1249 connect_session(struct gotd_client *client)
1250 {
1251         const struct got_error *err = NULL;
1252         struct gotd_imsg_connect iconnect;
1253         int s;
1254
1255         memset(&iconnect, 0, sizeof(iconnect));
1256
1257         s = dup(client->fd);
1258         if (s == -1)
1259                 return got_error_from_errno("dup");
1260
1261         iconnect.client_id = client->id;
1262         iconnect.euid = client->euid;
1263         iconnect.egid = client->egid;
1264
1265         if (gotd_imsg_compose_event(&client->session->iev, GOTD_IMSG_CONNECT,
1266             PROC_GOTD, s, &iconnect, sizeof(iconnect)) == -1) {
1267                 err = got_error_from_errno("imsg compose CONNECT");
1268                 close(s);
1269                 return err;
1270         }
1271
1272         /*
1273          * We are no longer interested in messages from this client.
1274          * Further client requests will be handled by the session process.
1275          */
1276         msgbuf_clear(&client->iev.ibuf.w);
1277         imsg_clear(&client->iev.ibuf);
1278         event_del(&client->iev.ev);
1279         client->fd = -1; /* will be closed via copy in client->iev.ibuf.fd */
1280
1281         return NULL;
1282 }
1283
1284 static void
1285 gotd_dispatch_client_session(int fd, short event, void *arg)
1286 {
1287         struct gotd_imsgev *iev = arg;
1288         struct imsgbuf *ibuf = &iev->ibuf;
1289         struct gotd_child_proc *proc = NULL;
1290         struct gotd_client *client = NULL;
1291         ssize_t n;
1292         int shut = 0;
1293         struct imsg imsg;
1294
1295         client = find_client_by_proc_fd(fd);
1296         if (client == NULL) {
1297                 /* Can happen during process teardown. */
1298                 warnx("cannot find client for fd %d", fd);
1299                 shut = 1;
1300                 goto done;
1301         }
1302
1303         if (event & EV_READ) {
1304                 if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1305                         fatal("imsg_read error");
1306                 if (n == 0) {
1307                         /* Connection closed. */
1308                         shut = 1;
1309                         goto done;
1310                 }
1311         }
1312
1313         if (event & EV_WRITE) {
1314                 n = msgbuf_write(&ibuf->w);
1315                 if (n == -1 && errno != EAGAIN)
1316                         fatal("msgbuf_write");
1317                 if (n == 0) {
1318                         /* Connection closed. */
1319                         shut = 1;
1320                         goto done;
1321                 }
1322         }
1323
1324         proc = client->session;
1325         if (proc == NULL)
1326                 fatalx("cannot find session child process for fd %d", fd);
1327
1328         for (;;) {
1329                 const struct got_error *err = NULL;
1330                 uint32_t client_id = 0;
1331                 int do_disconnect = 0, do_start_repo_child = 0;
1332
1333                 if ((n = imsg_get(ibuf, &imsg)) == -1)
1334                         fatal("%s: imsg_get error", __func__);
1335                 if (n == 0)     /* No more messages. */
1336                         break;
1337
1338                 switch (imsg.hdr.type) {
1339                 case GOTD_IMSG_ERROR:
1340                         do_disconnect = 1;
1341                         err = gotd_imsg_recv_error(&client_id, &imsg);
1342                         break;
1343                 case GOTD_IMSG_CLIENT_SESSION_READY:
1344                         if (client->state != GOTD_CLIENT_STATE_ACCESS_GRANTED) {
1345                                 err = got_error(GOT_ERR_PRIVSEP_MSG);
1346                                 break;
1347                         }
1348                         do_start_repo_child = 1;
1349                         break;
1350                 case GOTD_IMSG_DISCONNECT:
1351                         do_disconnect = 1;
1352                         break;
1353                 default:
1354                         log_debug("unexpected imsg %d", imsg.hdr.type);
1355                         break;
1356                 }
1357
1358                 if (!verify_imsg_src(client, proc, &imsg)) {
1359                         log_debug("dropping imsg type %d from PID %d",
1360                             imsg.hdr.type, proc->pid);
1361                         imsg_free(&imsg);
1362                         continue;
1363                 }
1364                 if (err)
1365                         log_warnx("uid %d: %s", client->euid, err->msg);
1366
1367                 if (do_start_repo_child) {
1368                         struct gotd_repo *repo;
1369                         const char *name = client->session->repo_name;
1370
1371                         repo = gotd_find_repo_by_name(name, &gotd);
1372                         if (repo != NULL) {
1373                                 enum gotd_procid proc_type;
1374
1375                                 if (client->required_auth & GOTD_AUTH_WRITE)
1376                                         proc_type = PROC_REPO_WRITE;
1377                                 else
1378                                         proc_type = PROC_REPO_READ;
1379
1380                                 err = start_repo_child(client, proc_type, repo,
1381                                     gotd.argv0, gotd.confpath, gotd.daemonize,
1382                                     gotd.verbosity);
1383                         } else
1384                                 err = got_error(GOT_ERR_NOT_GIT_REPO);
1385
1386                         if (err) {
1387                                 log_warnx("uid %d: %s", client->euid, err->msg);
1388                                 do_disconnect = 1;
1389                         }
1390                 }
1391
1392                 if (do_disconnect) {
1393                         if (err)
1394                                 disconnect_on_error(client, err);
1395                         else
1396                                 disconnect(client);
1397                 }
1398
1399                 imsg_free(&imsg);
1400         }
1401 done:
1402         if (!shut) {
1403                 gotd_imsg_event_add(iev);
1404         } else {
1405                 /* This pipe is dead. Remove its event handler */
1406                 event_del(&iev->ev);
1407                 disconnect(client);
1408         }
1409 }
1410
1411 static void
1412 gotd_dispatch_repo_child(int fd, short event, void *arg)
1413 {
1414         struct gotd_imsgev *iev = arg;
1415         struct imsgbuf *ibuf = &iev->ibuf;
1416         struct gotd_child_proc *proc = NULL;
1417         struct gotd_client *client;
1418         ssize_t n;
1419         int shut = 0;
1420         struct imsg imsg;
1421
1422         client = find_client_by_proc_fd(fd);
1423         if (client == NULL) {
1424                 /* Can happen during process teardown. */
1425                 warnx("cannot find client for fd %d", fd);
1426                 shut = 1;
1427                 goto done;
1428         }
1429
1430         if (event & EV_READ) {
1431                 if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1432                         fatal("imsg_read error");
1433                 if (n == 0) {
1434                         /* Connection closed. */
1435                         shut = 1;
1436                         goto done;
1437                 }
1438         }
1439
1440         if (event & EV_WRITE) {
1441                 n = msgbuf_write(&ibuf->w);
1442                 if (n == -1 && errno != EAGAIN)
1443                         fatal("msgbuf_write");
1444                 if (n == 0) {
1445                         /* Connection closed. */
1446                         shut = 1;
1447                         goto done;
1448                 }
1449         }
1450
1451         proc = client->repo;
1452         if (proc == NULL)
1453                 fatalx("cannot find child process for fd %d", fd);
1454
1455         for (;;) {
1456                 const struct got_error *err = NULL;
1457                 uint32_t client_id = 0;
1458                 int do_disconnect = 0;
1459
1460                 if ((n = imsg_get(ibuf, &imsg)) == -1)
1461                         fatal("%s: imsg_get error", __func__);
1462                 if (n == 0)     /* No more messages. */
1463                         break;
1464
1465                 switch (imsg.hdr.type) {
1466                 case GOTD_IMSG_ERROR:
1467                         do_disconnect = 1;
1468                         err = gotd_imsg_recv_error(&client_id, &imsg);
1469                         break;
1470                 case GOTD_IMSG_REPO_CHILD_READY:
1471                         err = connect_session(client);
1472                         if (err)
1473                                 break;
1474                         err = connect_repo_child(client, proc);
1475                         break;
1476                 default:
1477                         log_debug("unexpected imsg %d", imsg.hdr.type);
1478                         break;
1479                 }
1480
1481                 if (!verify_imsg_src(client, proc, &imsg)) {
1482                         log_debug("dropping imsg type %d from PID %d",
1483                             imsg.hdr.type, proc->pid);
1484                         imsg_free(&imsg);
1485                         continue;
1486                 }
1487                 if (err)
1488                         log_warnx("uid %d: %s", client->euid, err->msg);
1489
1490                 if (do_disconnect) {
1491                         if (err)
1492                                 disconnect_on_error(client, err);
1493                         else
1494                                 disconnect(client);
1495                 }
1496
1497                 imsg_free(&imsg);
1498         }
1499 done:
1500         if (!shut) {
1501                 gotd_imsg_event_add(iev);
1502         } else {
1503                 /* This pipe is dead. Remove its event handler */
1504                 event_del(&iev->ev);
1505                 disconnect(client);
1506         }
1507 }
1508
1509 static pid_t
1510 start_child(enum gotd_procid proc_id, const char *repo_path,
1511     char *argv0, const char *confpath, int fd, int daemonize, int verbosity)
1512 {
1513         char    *argv[11];
1514         int      argc = 0;
1515         pid_t    pid;
1516
1517         switch (pid = fork()) {
1518         case -1:
1519                 fatal("cannot fork");
1520         case 0:
1521                 break;
1522         default:
1523                 close(fd);
1524                 return pid;
1525         }
1526
1527         if (fd != GOTD_FILENO_MSG_PIPE) {
1528                 if (dup2(fd, GOTD_FILENO_MSG_PIPE) == -1)
1529                         fatal("cannot setup imsg fd");
1530         } else if (fcntl(fd, F_SETFD, 0) == -1)
1531                 fatal("cannot setup imsg fd");
1532
1533         argv[argc++] = argv0;
1534         switch (proc_id) {
1535         case PROC_LISTEN:
1536                 argv[argc++] = (char *)"-L";
1537                 break;
1538         case PROC_AUTH:
1539                 argv[argc++] = (char *)"-A";
1540                 break;
1541         case PROC_SESSION_READ:
1542                 argv[argc++] = (char *)"-s";
1543                 break;
1544         case PROC_SESSION_WRITE:
1545                 argv[argc++] = (char *)"-S";
1546                 break;
1547         case PROC_REPO_READ:
1548                 argv[argc++] = (char *)"-R";
1549                 break;
1550         case PROC_REPO_WRITE:
1551                 argv[argc++] = (char *)"-W";
1552                 break;
1553         default:
1554                 fatalx("invalid process id %d", proc_id);
1555         }
1556
1557         argv[argc++] = (char *)"-f";
1558         argv[argc++] = (char *)confpath;
1559
1560         if (repo_path) {
1561                 argv[argc++] = (char *)"-P";
1562                 argv[argc++] = (char *)repo_path;
1563         }
1564
1565         if (!daemonize)
1566                 argv[argc++] = (char *)"-d";
1567         if (verbosity > 0)
1568                 argv[argc++] = (char *)"-v";
1569         if (verbosity > 1)
1570                 argv[argc++] = (char *)"-v";
1571         argv[argc++] = NULL;
1572
1573         execvp(argv0, argv);
1574         fatal("execvp");
1575 }
1576
1577 static void
1578 start_listener(char *argv0, const char *confpath, int daemonize, int verbosity)
1579 {
1580         struct gotd_child_proc *proc;
1581         int sock_flags = SOCK_STREAM|SOCK_NONBLOCK;
1582
1583 #ifdef SOCK_CLOEXEC
1584         sock_flags |= SOCK_CLOEXEC;
1585 #endif
1586
1587         proc = calloc(1, sizeof(*proc));
1588         if (proc == NULL)
1589                 fatal("calloc");
1590
1591         TAILQ_INSERT_HEAD(&procs, proc, entry);
1592
1593         /* proc->tmo is initialized in main() after event_init() */
1594
1595         proc->type = PROC_LISTEN;
1596
1597         if (socketpair(AF_UNIX, sock_flags,
1598             PF_UNSPEC, proc->pipe) == -1)
1599                 fatal("socketpair");
1600
1601         proc->pid = start_child(proc->type, NULL, argv0, confpath,
1602             proc->pipe[1], daemonize, verbosity);
1603         imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1604         proc->iev.handler = gotd_dispatch_listener;
1605         proc->iev.events = EV_READ;
1606         proc->iev.handler_arg = NULL;
1607
1608         gotd.listen_proc = proc;
1609 }
1610
1611 static const struct got_error *
1612 start_session_child(struct gotd_client *client, struct gotd_repo *repo,
1613     char *argv0, const char *confpath, int daemonize, int verbosity)
1614 {
1615         struct gotd_child_proc *proc;
1616         int sock_flags = SOCK_STREAM | SOCK_NONBLOCK;
1617
1618 #ifdef SOCK_CLOEXEC
1619         sock_flags |= SOCK_CLOEXEC;
1620 #endif
1621
1622         proc = calloc(1, sizeof(*proc));
1623         if (proc == NULL)
1624                 return got_error_from_errno("calloc");
1625
1626         TAILQ_INSERT_HEAD(&procs, proc, entry);
1627         evtimer_set(&proc->tmo, kill_proc_timeout, proc);
1628
1629         if (client_is_reading(client))
1630                 proc->type = PROC_SESSION_READ;
1631         else
1632                 proc->type = PROC_SESSION_WRITE;
1633         if (strlcpy(proc->repo_name, repo->name,
1634             sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
1635                 fatalx("repository name too long: %s", repo->name);
1636         log_debug("starting client uid %d session for repository %s",
1637             client->euid, repo->name);
1638         if (strlcpy(proc->repo_path, repo->path, sizeof(proc->repo_path)) >=
1639             sizeof(proc->repo_path))
1640                 fatalx("repository path too long: %s", repo->path);
1641         if (socketpair(AF_UNIX, sock_flags, PF_UNSPEC, proc->pipe) == -1)
1642                 fatal("socketpair");
1643         proc->pid = start_child(proc->type, proc->repo_path, argv0,
1644             confpath, proc->pipe[1], daemonize, verbosity);
1645         imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1646         log_debug("proc %s %s is on fd %d",
1647             gotd_proc_names[proc->type], proc->repo_path,
1648             proc->pipe[0]);
1649         proc->iev.handler = gotd_dispatch_client_session;
1650         proc->iev.events = EV_READ;
1651         proc->iev.handler_arg = NULL;
1652         event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
1653             gotd_dispatch_client_session, &proc->iev);
1654         gotd_imsg_event_add(&proc->iev);
1655
1656         client->session = proc;
1657         return NULL;
1658 }
1659
1660 static const struct got_error *
1661 start_repo_child(struct gotd_client *client, enum gotd_procid proc_type,
1662     struct gotd_repo *repo, char *argv0, const char *confpath,
1663     int daemonize, int verbosity)
1664 {
1665         struct gotd_child_proc *proc;
1666         int sock_flags = SOCK_STREAM|SOCK_NONBLOCK;
1667
1668 #ifdef SOCK_CLOEXEC
1669         sock_flags |= SOCK_CLOEXEC;
1670 #endif
1671
1672         if (proc_type != PROC_REPO_READ && proc_type != PROC_REPO_WRITE)
1673                 return got_error_msg(GOT_ERR_NOT_IMPL, "bad process type");
1674
1675         proc = calloc(1, sizeof(*proc));
1676         if (proc == NULL)
1677                 return got_error_from_errno("calloc");
1678
1679         TAILQ_INSERT_HEAD(&procs, proc, entry);
1680         evtimer_set(&proc->tmo, kill_proc_timeout, proc);
1681
1682         proc->type = proc_type;
1683         if (strlcpy(proc->repo_name, repo->name,
1684             sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
1685                 fatalx("repository name too long: %s", repo->name);
1686         log_debug("starting %s for repository %s",
1687             proc->type == PROC_REPO_READ ? "reader" : "writer", repo->name);
1688
1689         if (strlcpy(proc->repo_path, repo->path, sizeof(proc->repo_path)) >=
1690             sizeof(proc->repo_path))
1691                 fatalx("repository path too long: %s", repo->path);
1692         if (realpath(repo->path, proc->repo_path) == NULL)
1693                 fatal("%s", repo->path);
1694         if (socketpair(AF_UNIX, sock_flags,
1695             PF_UNSPEC, proc->pipe) == -1)
1696                 fatal("socketpair");
1697         proc->pid = start_child(proc->type, proc->repo_path, argv0,
1698             confpath, proc->pipe[1], daemonize, verbosity);
1699         imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1700         log_debug("proc %s %s is on fd %d",
1701             gotd_proc_names[proc->type], proc->repo_path,
1702             proc->pipe[0]);
1703         proc->iev.handler = gotd_dispatch_repo_child;
1704         proc->iev.events = EV_READ;
1705         proc->iev.handler_arg = NULL;
1706         event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
1707             gotd_dispatch_repo_child, &proc->iev);
1708         gotd_imsg_event_add(&proc->iev);
1709
1710         client->repo = proc;
1711         return NULL;
1712 }
1713
1714 static const struct got_error *
1715 start_auth_child(struct gotd_client *client, int required_auth,
1716     struct gotd_repo *repo, char *argv0, const char *confpath,
1717     int daemonize, int verbosity)
1718 {
1719         const struct got_error *err = NULL;
1720         struct gotd_child_proc *proc;
1721         struct gotd_imsg_auth iauth;
1722         int fd;
1723         int sock_flags = SOCK_STREAM|SOCK_NONBLOCK;
1724
1725 #ifdef SOCK_CLOEXEC
1726         sock_flags |= SOCK_CLOEXEC;
1727 #endif
1728
1729         memset(&iauth, 0, sizeof(iauth));
1730
1731         fd = dup(client->fd);
1732         if (fd == -1)
1733                 return got_error_from_errno("dup");
1734
1735         proc = calloc(1, sizeof(*proc));
1736         if (proc == NULL) {
1737                 err = got_error_from_errno("calloc");
1738                 close(fd);
1739                 return err;
1740         }
1741
1742         TAILQ_INSERT_HEAD(&procs, proc, entry);
1743         evtimer_set(&proc->tmo, kill_proc_timeout, proc);
1744
1745         proc->type = PROC_AUTH;
1746         if (strlcpy(proc->repo_name, repo->name,
1747             sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
1748                 fatalx("repository name too long: %s", repo->name);
1749         log_debug("starting auth for uid %d repository %s",
1750             client->euid, repo->name);
1751         if (strlcpy(proc->repo_path, repo->path, sizeof(proc->repo_path)) >=
1752             sizeof(proc->repo_path))
1753                 fatalx("repository path too long: %s", repo->path);
1754         if (realpath(repo->path, proc->repo_path) == NULL)
1755                 fatal("%s", repo->path);
1756         if (socketpair(AF_UNIX, sock_flags,
1757             PF_UNSPEC, proc->pipe) == -1)
1758                 fatal("socketpair");
1759         proc->pid = start_child(proc->type, proc->repo_path, argv0,
1760             confpath, proc->pipe[1], daemonize, verbosity);
1761         imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1762         log_debug("proc %s %s is on fd %d",
1763             gotd_proc_names[proc->type], proc->repo_path,
1764             proc->pipe[0]);
1765         proc->iev.handler = gotd_dispatch_auth_child;
1766         proc->iev.events = EV_READ;
1767         proc->iev.handler_arg = NULL;
1768         event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
1769             gotd_dispatch_auth_child, &proc->iev);
1770         gotd_imsg_event_add(&proc->iev);
1771
1772         iauth.euid = client->euid;
1773         iauth.egid = client->egid;
1774         iauth.required_auth = required_auth;
1775         iauth.client_id = client->id;
1776         if (gotd_imsg_compose_event(&proc->iev, GOTD_IMSG_AUTHENTICATE,
1777             PROC_GOTD, fd, &iauth, sizeof(iauth)) == -1) {
1778                 log_warn("imsg compose AUTHENTICATE");
1779                 close(fd);
1780                 /* Let the auth_timeout handler tidy up. */
1781         }
1782
1783         client->auth = proc;
1784         client->required_auth = required_auth;
1785         return NULL;
1786 }
1787
1788 static void
1789 apply_unveil_repo_readonly(const char *repo_path, int need_tmpdir)
1790 {
1791         if (need_tmpdir) {
1792                 if (unveil(GOT_TMPDIR_STR, "rwc") == -1)
1793                         fatal("unveil %s", GOT_TMPDIR_STR);
1794         }
1795
1796         if (unveil(repo_path, "r") == -1)
1797                 fatal("unveil %s", repo_path);
1798
1799         if (unveil(NULL, NULL) == -1)
1800                 fatal("unveil");
1801 }
1802
1803 static void
1804 apply_unveil_repo_readwrite(const char *repo_path)
1805 {
1806         if (unveil(repo_path, "rwc") == -1)
1807                 fatal("unveil %s", repo_path);
1808
1809         if (unveil(GOT_TMPDIR_STR, "rwc") == -1)
1810                 fatal("unveil %s", GOT_TMPDIR_STR);
1811
1812         if (unveil(NULL, NULL) == -1)
1813                 fatal("unveil");
1814 }
1815
1816 static void
1817 apply_unveil_none(void)
1818 {
1819         if (unveil("/", "") == -1)
1820                 fatal("unveil");
1821
1822         if (unveil(NULL, NULL) == -1)
1823                 fatal("unveil");
1824 }
1825
1826 static void
1827 apply_unveil_selfexec(void)
1828 {
1829         if (unveil(gotd.argv0, "x") == -1)
1830                 fatal("unveil %s", gotd.argv0);
1831
1832         if (unveil(NULL, NULL) == -1)
1833                 fatal("unveil");
1834 }
1835
1836 static void
1837 set_max_datasize(void)
1838 {
1839         struct rlimit rl;
1840
1841         if (getrlimit(RLIMIT_DATA, &rl) != 0)
1842                 return;
1843
1844         rl.rlim_cur = rl.rlim_max;
1845         setrlimit(RLIMIT_DATA, &rl);
1846 }
1847
1848 int
1849 main(int argc, char **argv)
1850 {
1851         const struct got_error *error = NULL;
1852         int ch, fd = -1, daemonize = 1, verbosity = 0, noaction = 0;
1853         const char *confpath = GOTD_CONF_PATH;
1854         char *argv0 = argv[0];
1855         char title[2048];
1856         struct passwd *pw = NULL;
1857         char *repo_path = NULL;
1858         enum gotd_procid proc_id = PROC_GOTD;
1859         struct event evsigint, evsigterm, evsighup, evsigusr1, evsigchld;
1860         int *pack_fds = NULL, *temp_fds = NULL;
1861         struct gotd_repo *repo = NULL;
1862
1863         TAILQ_INIT(&procs);
1864
1865         log_init(1, LOG_DAEMON); /* Log to stderr until daemonized. */
1866
1867         while ((ch = getopt(argc, argv, "Adf:LnP:RsSvW")) != -1) {
1868                 switch (ch) {
1869                 case 'A':
1870                         proc_id = PROC_AUTH;
1871                         break;
1872                 case 'd':
1873                         daemonize = 0;
1874                         break;
1875                 case 'f':
1876                         confpath = optarg;
1877                         break;
1878                 case 'L':
1879                         proc_id = PROC_LISTEN;
1880                         break;
1881                 case 'n':
1882                         noaction = 1;
1883                         break;
1884                 case 'P':
1885                         repo_path = realpath(optarg, NULL);
1886                         if (repo_path == NULL)
1887                                 fatal("realpath '%s'", optarg);
1888                         break;
1889                 case 'R':
1890                         proc_id = PROC_REPO_READ;
1891                         break;
1892                 case 's':
1893                         proc_id = PROC_SESSION_READ;
1894                         break;
1895                 case 'S':
1896                         proc_id = PROC_SESSION_WRITE;
1897                         break;
1898                 case 'v':
1899                         if (verbosity < 3)
1900                                 verbosity++;
1901                         break;
1902                 case 'W':
1903                         proc_id = PROC_REPO_WRITE;
1904                         break;
1905                 default:
1906                         usage();
1907                 }
1908         }
1909
1910         argc -= optind;
1911         argv += optind;
1912
1913         if (argc != 0)
1914                 usage();
1915
1916         if (geteuid() && (proc_id == PROC_GOTD || proc_id == PROC_LISTEN))
1917                 fatalx("need root privileges");
1918
1919         if (parse_config(confpath, proc_id, &gotd) != 0)
1920                 return 1;
1921
1922         pw = getpwnam(gotd.user_name);
1923         if (pw == NULL)
1924                 fatalx("user %s not found", gotd.user_name);
1925
1926         if (pw->pw_uid == 0)
1927                 fatalx("cannot run %s as the superuser", getprogname());
1928
1929         if (noaction) {
1930                 fprintf(stderr, "configuration OK\n");
1931                 return 0;
1932         }
1933
1934         gotd.argv0 = argv0;
1935         gotd.daemonize = daemonize;
1936         gotd.verbosity = verbosity;
1937         gotd.confpath = confpath;
1938
1939         /* Require an absolute path in argv[0] for reliable re-exec. */
1940         if (!got_path_is_absolute(argv0))
1941                 fatalx("bad path \"%s\": must be an absolute path", argv0);
1942
1943         log_init(daemonize ? 0 : 1, LOG_DAEMON);
1944         log_setverbose(verbosity);
1945
1946         if (proc_id == PROC_GOTD) {
1947                 snprintf(title, sizeof(title), "%s", gotd_proc_names[proc_id]);
1948                 arc4random_buf(&clients_hash_key, sizeof(clients_hash_key));
1949                 if (daemonize && daemon(1, 0) == -1)
1950                         fatal("daemon");
1951                 gotd.pid = getpid();
1952                 start_listener(argv0, confpath, daemonize, verbosity);
1953         } else if (proc_id == PROC_LISTEN) {
1954                 snprintf(title, sizeof(title), "%s", gotd_proc_names[proc_id]);
1955                 if (verbosity) {
1956                         log_info("socket: %s", gotd.unix_socket_path);
1957                         log_info("user: %s", pw->pw_name);
1958                 }
1959
1960                 fd = unix_socket_listen(gotd.unix_socket_path, pw->pw_uid,
1961                     pw->pw_gid);
1962                 if (fd == -1) {
1963                         fatal("cannot listen on unix socket %s",
1964                             gotd.unix_socket_path);
1965                 }
1966         } else if (proc_id == PROC_AUTH) {
1967                 snprintf(title, sizeof(title), "%s %s",
1968                     gotd_proc_names[proc_id], repo_path);
1969         } else if (proc_id == PROC_REPO_READ || proc_id == PROC_REPO_WRITE ||
1970             proc_id == PROC_SESSION_READ || proc_id == PROC_SESSION_WRITE) {
1971                 error = got_repo_pack_fds_open(&pack_fds);
1972                 if (error != NULL)
1973                         fatalx("cannot open pack tempfiles: %s", error->msg);
1974                 error = got_repo_temp_fds_open(&temp_fds);
1975                 if (error != NULL)
1976                         fatalx("cannot open pack tempfiles: %s", error->msg);
1977                 if (repo_path == NULL)
1978                         fatalx("repository path not specified");
1979                 snprintf(title, sizeof(title), "%s %s",
1980                     gotd_proc_names[proc_id], repo_path);
1981         } else
1982                 fatal("invalid process id %d", proc_id);
1983
1984         setproctitle("%s", title);
1985         log_procinit(title);
1986
1987         if (proc_id != PROC_GOTD && proc_id != PROC_LISTEN &&
1988             proc_id != PROC_REPO_READ && proc_id != PROC_REPO_WRITE) {
1989                 /* Drop root privileges. */
1990                 if (setgid(pw->pw_gid) == -1)
1991                         fatal("setgid %d failed", pw->pw_gid);
1992                 if (setuid(pw->pw_uid) == -1)
1993                         fatal("setuid %d failed", pw->pw_uid);
1994         }
1995
1996         event_init();
1997
1998         switch (proc_id) {
1999         case PROC_GOTD:
2000 #ifndef PROFILE
2001                 /* "exec" promise will be limited to argv[0] via unveil(2). */
2002                 if (pledge("stdio proc exec sendfd recvfd unveil", NULL) == -1)
2003                         err(1, "pledge");
2004 #endif
2005                 break;
2006         case PROC_LISTEN:
2007 #ifndef PROFILE
2008                 if (pledge("stdio sendfd unix unveil", NULL) == -1)
2009                         err(1, "pledge");
2010 #endif
2011                 /*
2012                  * Ensure that AF_UNIX bind(2) cannot be used with any other
2013                  * sockets by revoking all filesystem access via unveil(2).
2014                  */
2015                 apply_unveil_none();
2016
2017                 enter_chroot(GOTD_EMPTY_PATH);
2018                 drop_privs(pw);
2019
2020                 listen_main(title, fd, gotd.connection_limits,
2021                     gotd.nconnection_limits);
2022                 /* NOTREACHED */
2023                 break;
2024         case PROC_AUTH:
2025 #ifndef PROFILE
2026                 if (pledge("stdio getpw recvfd unix unveil", NULL) == -1)
2027                         err(1, "pledge");
2028 #endif
2029                 /*
2030                  * We need the "unix" pledge promise for getpeername(2) only.
2031                  * Ensure that AF_UNIX bind(2) cannot be used by revoking all
2032                  * filesystem access via unveil(2). Access to password database
2033                  * files will still work since "getpw" bypasses unveil(2).
2034                  */
2035                 apply_unveil_none();
2036
2037                 auth_main(title, &gotd.repos, repo_path);
2038                 /* NOTREACHED */
2039                 break;
2040         case PROC_SESSION_READ:
2041         case PROC_SESSION_WRITE:
2042 #ifndef PROFILE
2043                 /*
2044                  * The "recvfd" promise is only needed during setup and
2045                  * will be removed in a later pledge(2) call.
2046                  */
2047                 if (pledge("stdio rpath wpath cpath recvfd sendfd fattr flock "
2048                     "unveil", NULL) == -1)
2049                         err(1, "pledge");
2050 #endif
2051                 if (proc_id == PROC_SESSION_READ)
2052                         apply_unveil_repo_readonly(repo_path, 1);
2053                 else
2054                         apply_unveil_repo_readwrite(repo_path);
2055
2056                 session_main(title, repo_path, pack_fds, temp_fds,
2057                     &gotd.request_timeout, proc_id);
2058                 /* NOTREACHED */
2059                 break;
2060         case PROC_REPO_READ:
2061                 set_max_datasize();
2062 #ifndef PROFILE
2063                 if (pledge("stdio rpath recvfd unveil", NULL) == -1)
2064                         err(1, "pledge");
2065 #endif
2066                 apply_unveil_repo_readonly(repo_path, 0);
2067
2068                 if (enter_chroot(repo_path)) {
2069                         log_info("change repo path %s", repo_path);
2070                         free(repo_path);
2071                         repo_path = strdup("/");
2072                         if (repo_path == NULL)
2073                                 fatal("strdup");
2074                         log_info("repo path is now %s", repo_path);
2075                 }
2076                 drop_privs(pw);
2077
2078                 repo_read_main(title, repo_path, pack_fds, temp_fds);
2079                 /* NOTREACHED */
2080                 exit(0);
2081         case PROC_REPO_WRITE:
2082                 set_max_datasize();
2083 #ifndef PROFILE
2084                 if (pledge("stdio rpath recvfd unveil", NULL) == -1)
2085                         err(1, "pledge");
2086 #endif
2087                 apply_unveil_repo_readonly(repo_path, 0);
2088                 repo = gotd_find_repo_by_path(repo_path, &gotd);
2089                 if (repo == NULL)
2090                         fatalx("no repository for path %s", repo_path);
2091
2092                 if (enter_chroot(repo_path)) {
2093                         free(repo_path);
2094                         repo_path = strdup("/");
2095                         if (repo_path == NULL)
2096                                 fatal("strdup");
2097                 }
2098                 drop_privs(pw);
2099
2100                 repo_write_main(title, repo_path, pack_fds, temp_fds,
2101                     &repo->protected_tag_namespaces,
2102                     &repo->protected_branch_namespaces,
2103                     &repo->protected_branches);
2104                 /* NOTREACHED */
2105                 exit(0);
2106         default:
2107                 fatal("invalid process id %d", proc_id);
2108         }
2109
2110         if (proc_id != PROC_GOTD)
2111                 fatal("invalid process id %d", proc_id);
2112
2113         evtimer_set(&gotd.listen_proc->tmo, kill_proc_timeout,
2114             gotd.listen_proc);
2115
2116         apply_unveil_selfexec();
2117
2118         signal_set(&evsigint, SIGINT, gotd_sighdlr, NULL);
2119         signal_set(&evsigterm, SIGTERM, gotd_sighdlr, NULL);
2120         signal_set(&evsighup, SIGHUP, gotd_sighdlr, NULL);
2121         signal_set(&evsigusr1, SIGUSR1, gotd_sighdlr, NULL);
2122         signal_set(&evsigchld, SIGCHLD, gotd_sighdlr, NULL);
2123         signal(SIGPIPE, SIG_IGN);
2124
2125         signal_add(&evsigint, NULL);
2126         signal_add(&evsigterm, NULL);
2127         signal_add(&evsighup, NULL);
2128         signal_add(&evsigusr1, NULL);
2129         signal_add(&evsigchld, NULL);
2130
2131         gotd_imsg_event_add(&gotd.listen_proc->iev);
2132
2133         event_dispatch();
2134
2135         free(repo_path);
2136         gotd_shutdown();
2137
2138         return 0;
2139 }