1 /*
2  * Copyright (c) 2018 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/queue.h>
19 #include <sys/uio.h>
20 
21 #include <stdio.h>
22 #include <stdlib.h>
23 #include <string.h>
24 #include <errno.h>
25 #include <stdint.h>
26 #include <poll.h>
27 #include <imsg.h>
28 #include <sha1.h>
29 #include <zlib.h>
30 
31 #include "got_object.h"
32 #include "got_error.h"
33 
34 #include "got_lib_sha1.h"
35 #include "got_lib_delta.h"
36 #include "got_lib_zbuf.h"
37 #include "got_lib_object.h"
38 #include "got_lib_privsep.h"
39 
40 #ifndef MIN
41 #define	MIN(_a,_b) ((_a) < (_b) ? (_a) : (_b))
42 #endif
43 
44 static const struct got_error *
45 poll_fd(int fd, int events, int timeout)
46 {
47 	struct pollfd pfd[1];
48 	int n;
49 
50 	pfd[0].fd = fd;
51 	pfd[0].events = events;
52 
53 	n = poll(pfd, 1, timeout);
54 	if (n == -1)
55 		return got_error_from_errno();
56 	if (n == 0)
57 		return got_error(GOT_ERR_TIMEOUT);
58 	if (pfd[0].revents & (POLLERR | POLLNVAL))
59 		return got_error_from_errno();
60 	if (pfd[0].revents & (events | POLLHUP))
61 		return NULL;
62 
63 	return got_error(GOT_ERR_INTERRUPT);
64 }
65 
66 static const struct got_error *
67 recv_one_imsg(struct imsg *imsg, struct imsgbuf *ibuf, size_t min_datalen)
68 {
69 	const struct got_error *err;
70 	ssize_t n, m;
71 
72 	err = poll_fd(ibuf->fd, POLLIN, INFTIM);
73 	if (err)
74 		return err;
75 
76 	n = imsg_read(ibuf);
77 	if (n == -1) {
78 		if (errno == EAGAIN) /* Could be a file-descriptor leak. */
79 			return got_error(GOT_ERR_PRIVSEP_NO_FD);
80 		return got_error(GOT_ERR_PRIVSEP_READ);
81 	}
82 	if (n == 0)
83 		return got_error(GOT_ERR_PRIVSEP_PIPE);
84 
85 	m = imsg_get(ibuf, imsg);
86 	if (m == 0)
87 		return got_error(GOT_ERR_PRIVSEP_READ);
88 
89 	if (imsg->hdr.len < IMSG_HEADER_SIZE + min_datalen)
90 		return got_error(GOT_ERR_PRIVSEP_LEN);
91 
92 	return NULL;
93 }
94 
95 static const struct got_error *
96 recv_imsg_error(struct imsg *imsg, size_t datalen)
97 {
98 	struct got_imsg_error ierr;
99 
100 	if (datalen != sizeof(ierr))
101 		return got_error(GOT_ERR_PRIVSEP_LEN);
102 
103 	memcpy(&ierr, imsg->data, sizeof(ierr));
104 	if (ierr.code == GOT_ERR_ERRNO) {
105 		static struct got_error serr;
106 		serr.code = GOT_ERR_ERRNO;
107 		serr.msg = strerror(ierr.errno_code);
108 		return &serr;
109 	}
110 
111 	return got_error(ierr.code);
112 }
113 
114 /* Attempt to send an error in an imsg. Complain on stderr as a last resort. */
115 void
116 got_privsep_send_error(struct imsgbuf *ibuf, const struct got_error *err)
117 {
118 	const struct got_error *poll_err;
119 	struct got_imsg_error ierr;
120 	int ret;
121 
122 	ierr.code = err->code;
123 	if (err->code == GOT_ERR_ERRNO)
124 		ierr.errno_code = errno;
125 	else
126 		ierr.errno_code = 0;
127 	ret = imsg_compose(ibuf, GOT_IMSG_ERROR, 0, 0, -1, &ierr, sizeof(ierr));
128 	if (ret != -1) {
129 		fprintf(stderr, "%s: error %d \"%s\": imsg_compose: %s\n",
130 		    getprogname(), err->code, err->msg, strerror(errno));
131 		return;
132 	}
133 
134 	poll_err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
135 	if (poll_err) {
136 		fprintf(stderr, "%s: error %d \"%s\": poll: %s\n",
137 		    getprogname(), err->code, err->msg, poll_err->msg);
138 		return;
139 	}
140 
141 	ret = imsg_flush(ibuf);
142 	if (ret == -1) {
143 		fprintf(stderr, "%s: error %d \"%s\": imsg_flush: %s\n",
144 		    getprogname(), err->code, err->msg, strerror(errno));
145 		return;
146 	}
147 }
148 
149 const struct got_error *
150 got_privsep_send_obj(struct imsgbuf *ibuf, struct got_object *obj, int ndeltas)
151 {
152 	const struct got_error *err = NULL;
153 	struct got_imsg_object iobj;
154 
155 	iobj.type = obj->type;
156 	iobj.flags = obj->flags;
157 	iobj.hdrlen = obj->hdrlen;
158 	iobj.size = obj->size;
159 	iobj.ndeltas = ndeltas;
160 
161 	if (ndeltas > 0) {
162 		/* TODO: Handle deltas */
163 	}
164 
165 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT, 0, 0, -1, &iobj, sizeof(iobj))
166 	    == -1)
167 		return got_error_from_errno();
168 
169 	err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
170 	if (err)
171 		return err;
172 
173 	if (imsg_flush(ibuf) == -1)
174 		return got_error_from_errno();
175 
176 	return NULL;
177 }
178 
179 const struct got_error *
180 got_privsep_recv_obj(struct got_object **obj, struct imsgbuf *ibuf)
181 {
182 	const struct got_error *err = NULL;
183 	struct imsg imsg;
184 	struct got_imsg_object iobj;
185 	size_t datalen;
186 	int i;
187 	const size_t min_datalen =
188 	    MIN(sizeof(struct got_imsg_error), sizeof(struct got_imsg_object));
189 
190 	*obj = NULL;
191 
192 	err = recv_one_imsg(&imsg, ibuf, min_datalen);
193 	if (err)
194 		return err;
195 
196 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
197 
198 	switch (imsg.hdr.type) {
199 	case GOT_IMSG_ERROR:
200 		err = recv_imsg_error(&imsg, datalen);
201 		break;
202 	case GOT_IMSG_OBJECT:
203 		if (datalen != sizeof(iobj)) {
204 			err = got_error(GOT_ERR_PRIVSEP_LEN);
205 			break;
206 		}
207 
208 		memcpy(&iobj, imsg.data, sizeof(iobj));
209 		if (iobj.ndeltas < 0 ||
210 		    iobj.ndeltas > GOT_DELTA_CHAIN_RECURSION_MAX) {
211 			err = got_error(GOT_ERR_PRIVSEP_LEN);
212 			break;
213 		}
214 
215 		*obj = calloc(1, sizeof(**obj));
216 		if (*obj == NULL) {
217 			err = got_error_from_errno();
218 			break;
219 		}
220 
221 		(*obj)->type = iobj.type;
222 		(*obj)->hdrlen = iobj.hdrlen;
223 		(*obj)->size = iobj.size;
224 		for (i = 0; i < iobj.ndeltas; i++) {
225 			/* TODO: Handle deltas */
226 		}
227 		break;
228 	default:
229 		err = got_error(GOT_ERR_PRIVSEP_MSG);
230 		break;
231 	}
232 
233 	imsg_free(&imsg);
234 
235 	return err;
236 }
237 
238 const struct got_error *
239 got_privsep_send_commit_obj(struct imsgbuf *ibuf, struct got_commit_object *commit)
240 {
241 	const struct got_error *err = NULL;
242 	struct got_imsg_commit_object icommit;
243 	uint8_t *buf;
244 	size_t len, total;
245 	struct got_parent_id *pid;
246 
247 	if (got_sha1_digest_to_str(commit->tree_id->sha1, icommit.tree_id,
248 	    sizeof(icommit.tree_id)) == NULL)
249 			return got_error(GOT_ERR_BAD_OBJ_ID_STR);
250 	icommit.author_len = strlen(commit->author);
251 	icommit.committer_len = strlen(commit->committer);
252 	icommit.logmsg_len = strlen(commit->logmsg);
253 	icommit.nparents = commit->nparents;
254 
255 	total = sizeof(icommit) + icommit.author_len +
256 	    icommit.committer_len + icommit.logmsg_len +
257 	    icommit.nparents * (SHA1_DIGEST_STRING_LENGTH);
258 	/* XXX TODO support very large log messages properly */
259 	if (total > MAX_IMSGSIZE)
260 		return got_error(GOT_ERR_NO_SPACE);
261 
262 	buf = malloc(total);
263 	if (buf == NULL)
264 		return got_error_from_errno();
265 
266 	len = 0;
267 	memcpy(buf + len, &icommit, sizeof(icommit));
268 	len += sizeof(icommit);
269 	memcpy(buf + len, commit->author, icommit.author_len);
270 	len += icommit.author_len;
271 	memcpy(buf + len, commit->committer, icommit.committer_len);
272 	len += icommit.committer_len;
273 	memcpy(buf + len, commit->logmsg, icommit.logmsg_len);
274 	len += icommit.logmsg_len;
275 	SIMPLEQ_FOREACH(pid, &commit->parent_ids, entry) {
276 		char id_str[SHA1_DIGEST_STRING_LENGTH];
277 		if (got_sha1_digest_to_str(pid->id->sha1, id_str,
278 		    sizeof(id_str)) == NULL) {
279 			err = got_error(GOT_ERR_BAD_OBJ_ID_STR);
280 			goto done;
281 		}
282 		memcpy(buf + len, id_str, SHA1_DIGEST_STRING_LENGTH);
283 		len += SHA1_DIGEST_STRING_LENGTH;
284 	}
285 
286 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT, 0, 0, -1, buf, len) == -1) {
287 		err = got_error_from_errno();
288 		goto done;
289 	}
290 
291 	err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
292 	if (err)
293 		goto done;
294 
295 	if (imsg_flush(ibuf) == -1) {
296 		err = got_error_from_errno();
297 		goto done;
298 	}
299 
300 done:
301 	free(buf);
302 	return err;
303 }
304 const struct got_error *
305 got_privsep_recv_commit_obj(struct got_commit_object **commit,
306     struct imsgbuf *ibuf)
307 {
308 	const struct got_error *err = NULL;
309 	struct imsg imsg;
310 	struct got_imsg_commit_object icommit;
311 	size_t len, datalen;
312 	int i;
313 	const size_t min_datalen =
314 	    MIN(sizeof(struct got_imsg_error),
315 	    sizeof(struct got_imsg_commit_object));
316 	uint8_t *data;
317 
318 	*commit = NULL;
319 
320 	err = recv_one_imsg(&imsg, ibuf, min_datalen);
321 	if (err)
322 		return err;
323 
324 	data = imsg.data;
325 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
326 	len = 0;
327 
328 	switch (imsg.hdr.type) {
329 	case GOT_IMSG_ERROR:
330 		err = recv_imsg_error(&imsg, datalen);
331 		break;
332 	case GOT_IMSG_COMMIT:
333 		if (datalen < sizeof(icommit)) {
334 			err = got_error(GOT_ERR_PRIVSEP_LEN);
335 			break;
336 		}
337 
338 		memcpy(&icommit, data, sizeof(icommit));
339 		if (datalen != sizeof(icommit) + icommit.author_len +
340 		    icommit.committer_len + icommit.logmsg_len +
341 		    icommit.nparents * (SHA1_DIGEST_STRING_LENGTH)) {
342 			err = got_error(GOT_ERR_PRIVSEP_LEN);
343 			break;
344 		}
345 		if (icommit.nparents < 0) {
346 			err = got_error(GOT_ERR_PRIVSEP_LEN);
347 			break;
348 		}
349 		len += sizeof(icommit);
350 
351 		*commit = got_object_commit_alloc_partial();
352 		if (*commit == NULL) {
353 			err = got_error_from_errno();
354 			break;
355 		}
356 
357 		if (!got_parse_sha1_digest((*commit)->tree_id->sha1,
358 		    icommit.tree_id)) {
359 			err = got_error(GOT_ERR_BAD_OBJ_DATA);
360 			break;
361 		}
362 
363 		if (icommit.author_len == 0) {
364 			(*commit)->author = strdup("");
365 			if ((*commit)->author == NULL) {
366 				err = got_error_from_errno();
367 				break;
368 			}
369 		} else {
370 			(*commit)->author = malloc(icommit.author_len + 1);
371 			if ((*commit)->author == NULL) {
372 				err = got_error_from_errno();
373 				break;
374 			}
375 			memcpy((*commit)->author, data + len,
376 			    icommit.author_len);
377 			(*commit)->author[icommit.author_len] = '\0';
378 		}
379 		len += icommit.author_len;
380 
381 		if (icommit.committer_len == 0) {
382 			(*commit)->committer = strdup("");
383 			if ((*commit)->committer == NULL) {
384 				err = got_error_from_errno();
385 				break;
386 			}
387 		} else {
388 			(*commit)->committer =
389 			    malloc(icommit.committer_len + 1);
390 			if ((*commit)->committer == NULL) {
391 				err = got_error_from_errno();
392 				break;
393 			}
394 			memcpy((*commit)->committer, data + len,
395 			    icommit.committer_len);
396 			(*commit)->committer[icommit.committer_len] = '\0';
397 		}
398 		len += icommit.committer_len;
399 
400 		if (icommit.logmsg_len == 0) {
401 			(*commit)->logmsg = strdup("");
402 			if ((*commit)->logmsg == NULL) {
403 				err = got_error_from_errno();
404 				break;
405 			}
406 		} else {
407 			(*commit)->logmsg = malloc(icommit.logmsg_len + 1);
408 			if ((*commit)->logmsg == NULL) {
409 				err = got_error_from_errno();
410 				break;
411 			}
412 			memcpy((*commit)->logmsg, data + len,
413 			    icommit.logmsg_len);
414 			(*commit)->logmsg[icommit.logmsg_len] = '\0';
415 		}
416 		len += icommit.logmsg_len;
417 
418 		for (i = 0; i < icommit.nparents; i++) {
419 			char id_str[SHA1_DIGEST_STRING_LENGTH];
420 			memcpy(id_str, data + len +
421 			    i * SHA1_DIGEST_STRING_LENGTH, sizeof(id_str));
422 			id_str[SHA1_DIGEST_STRING_LENGTH - 1] = '\0';
423 			err = got_object_commit_add_parent(*commit, id_str);
424 			if (err)
425 				break;
426 		}
427 		break;
428 	default:
429 		err = got_error(GOT_ERR_PRIVSEP_MSG);
430 		break;
431 	}
432 
433 	imsg_free(&imsg);
434 
435 	return err;
436 }