Gotweb

Blob

Date:: Wed Nov 7 07:50:59 2018 UTC
Message:: avoid unnecessary memcpy in got_privsep_send_tree()
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2018 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/queue.h>
19 #include <sys/uio.h>
20 #include <sys/syslimits.h>
21 #include <sys/wait.h>
22 
23 #include <stdio.h>
24 #include <stdlib.h>
25 #include <string.h>
26 #include <errno.h>
27 #include <stdint.h>
28 #include <poll.h>
29 #include <imsg.h>
30 #include <sha1.h>
31 #include <zlib.h>
32 #include <time.h>
33 
34 #include "got_object.h"
35 #include "got_error.h"
36 
37 #include "got_lib_sha1.h"
38 #include "got_lib_delta.h"
39 #include "got_lib_inflate.h"
40 #include "got_lib_object.h"
41 #include "got_lib_object_parse.h"
42 #include "got_lib_privsep.h"
43 #include "got_lib_pack.h"
44 
45 #ifndef MIN
46 #define	MIN(_a,_b) ((_a) < (_b) ? (_a) : (_b))
47 #endif
48 
49 static const struct got_error *
50 poll_fd(int fd, int events, int timeout)
51 {
52 	struct pollfd pfd[1];
53 	int n;
54 
55 	pfd[0].fd = fd;
56 	pfd[0].events = events;
57 
58 	n = poll(pfd, 1, timeout);
59 	if (n == -1)
60 		return got_error_from_errno();
61 	if (n == 0)
62 		return got_error(GOT_ERR_TIMEOUT);
63 	if (pfd[0].revents & (POLLERR | POLLNVAL))
64 		return got_error_from_errno();
65 	if (pfd[0].revents & (events | POLLHUP))
66 		return NULL;
67 
68 	return got_error(GOT_ERR_INTERRUPT);
69 }
70 
71 static const struct got_error *
72 read_imsg(struct imsgbuf *ibuf)
73 {
74 	const struct got_error *err;
75 	size_t n;
76 
77 	err = poll_fd(ibuf->fd, POLLIN, INFTIM);
78 	if (err)
79 		return err;
80 
81 	n = imsg_read(ibuf);
82 	if (n == -1) {
83 		if (errno == EAGAIN) /* Could be a file-descriptor leak. */
84 			return got_error(GOT_ERR_PRIVSEP_NO_FD);
85 		return got_error(GOT_ERR_PRIVSEP_READ);
86 	}
87 	if (n == 0)
88 		return got_error(GOT_ERR_PRIVSEP_PIPE);
89 
90 	return NULL;
91 }
92 
93 const struct got_error *
94 got_privsep_wait_for_child(pid_t pid)
95 {
96 	int child_status;
97 
98 	waitpid(pid, &child_status, 0);
99 
100 	if (!WIFEXITED(child_status))
101 		return got_error(GOT_ERR_PRIVSEP_DIED);
102 
103 	if (WEXITSTATUS(child_status) != 0)
104 		return got_error(GOT_ERR_PRIVSEP_EXIT);
105 
106 	return NULL;
107 }
108 
109 const struct got_error *
110 got_privsep_recv_imsg(struct imsg *imsg, struct imsgbuf *ibuf, size_t min_datalen)
111 {
112 	const struct got_error *err;
113 	ssize_t n;
114 
115 	n = imsg_get(ibuf, imsg);
116 	if (n == -1)
117 		return got_error_from_errno();
118 
119 	while (n == 0) {
120 		err = read_imsg(ibuf);
121 		if (err)
122 			return err;
123 		n = imsg_get(ibuf, imsg);
124 	}
125 
126 	if (imsg->hdr.len < IMSG_HEADER_SIZE + min_datalen)
127 		return got_error(GOT_ERR_PRIVSEP_LEN);
128 
129 	return NULL;
130 }
131 
132 static const struct got_error *
133 recv_imsg_error(struct imsg *imsg, size_t datalen)
134 {
135 	struct got_imsg_error *ierr;
136 
137 	if (datalen != sizeof(*ierr))
138 		return got_error(GOT_ERR_PRIVSEP_LEN);
139 
140 	ierr = imsg->data;
141 	if (ierr->code == GOT_ERR_ERRNO) {
142 		static struct got_error serr;
143 		serr.code = GOT_ERR_ERRNO;
144 		serr.msg = strerror(ierr->errno_code);
145 		return &serr;
146 	}
147 
148 	return got_error(ierr->code);
149 }
150 
151 /* Attempt to send an error in an imsg. Complain on stderr as a last resort. */
152 void
153 got_privsep_send_error(struct imsgbuf *ibuf, const struct got_error *err)
154 {
155 	const struct got_error *poll_err;
156 	struct got_imsg_error ierr;
157 	int ret;
158 
159 	ierr.code = err->code;
160 	if (err->code == GOT_ERR_ERRNO)
161 		ierr.errno_code = errno;
162 	else
163 		ierr.errno_code = 0;
164 	ret = imsg_compose(ibuf, GOT_IMSG_ERROR, 0, 0, -1, &ierr, sizeof(ierr));
165 	if (ret != -1) {
166 		fprintf(stderr, "%s: error %d \"%s\": imsg_compose: %s\n",
167 		    getprogname(), err->code, err->msg, strerror(errno));
168 		return;
169 	}
170 
171 	poll_err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
172 	if (poll_err) {
173 		fprintf(stderr, "%s: error %d \"%s\": poll: %s\n",
174 		    getprogname(), err->code, err->msg, poll_err->msg);
175 		return;
176 	}
177 
178 	ret = imsg_flush(ibuf);
179 	if (ret == -1) {
180 		fprintf(stderr, "%s: error %d \"%s\": imsg_flush: %s\n",
181 		    getprogname(), err->code, err->msg, strerror(errno));
182 		return;
183 	}
184 }
185 
186 static const struct got_error *
187 flush_imsg(struct imsgbuf *ibuf)
188 {
189 	const struct got_error *err;
190 
191 	err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
192 	if (err)
193 		return err;
194 
195 	if (imsg_flush(ibuf) == -1)
196 		return got_error_from_errno();
197 
198 	return NULL;
199 }
200 
201 const struct got_error *
202 got_privsep_send_stop(int fd)
203 {
204 	const struct got_error *err = NULL;
205 	struct imsgbuf ibuf;
206 
207 	imsg_init(&ibuf, fd);
208 
209 	if (imsg_compose(&ibuf, GOT_IMSG_STOP, 0, 0, -1, NULL, 0) == -1)
210 		return got_error_from_errno();
211 
212 	err = flush_imsg(&ibuf);
213 	imsg_clear(&ibuf);
214 	return err;
215 }
216 
217 const struct got_error *
218 got_privsep_send_obj_req(struct imsgbuf *ibuf, int fd, struct got_object *obj)
219 {
220 	struct got_imsg_object iobj, *iobjp = NULL;
221 	size_t iobj_size = 0;
222 	int imsg_code = GOT_IMSG_OBJECT_REQUEST;
223 
224 	if (obj) {
225 		switch (obj->type) {
226 		case GOT_OBJ_TYPE_TREE:
227 			imsg_code = GOT_IMSG_TREE_REQUEST;
228 			break;
229 		case GOT_OBJ_TYPE_COMMIT:
230 			imsg_code = GOT_IMSG_COMMIT_REQUEST;
231 			break;
232 		case GOT_OBJ_TYPE_BLOB:
233 			imsg_code = GOT_IMSG_BLOB_REQUEST;
234 			break;
235 		default:
236 			return got_error(GOT_ERR_OBJ_TYPE);
237 		}
238 
239 		memcpy(iobj.id, obj->id.sha1, sizeof(iobj.id));
240 		iobj.type = obj->type;
241 		iobj.flags = obj->flags;
242 		iobj.hdrlen = obj->hdrlen;
243 		iobj.size = obj->size;
244 		if (iobj.flags & GOT_OBJ_FLAG_PACKED) {
245 			iobj.pack_offset = obj->pack_offset;
246 			iobj.pack_idx = obj->pack_idx;
247 		}
248 
249 		iobjp = &iobj;
250 		iobj_size = sizeof(iobj);
251 	}
252 
253 	if (imsg_compose(ibuf, imsg_code, 0, 0, fd, iobjp, iobj_size) == -1)
254 		return got_error_from_errno();
255 
256 	return flush_imsg(ibuf);
257 }
258 
259 const struct got_error *
260 got_privsep_send_blob_req(struct imsgbuf *ibuf, int infd)
261 {
262 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_REQUEST, 0, 0, infd, NULL, 0)
263 	    == -1)
264 		return got_error_from_errno();
265 
266 	return flush_imsg(ibuf);
267 }
268 
269 const struct got_error *
270 got_privsep_send_blob_outfd(struct imsgbuf *ibuf, int outfd)
271 {
272 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_OUTFD, 0, 0, outfd, NULL, 0)
273 	    == -1)
274 		return got_error_from_errno();
275 
276 	return flush_imsg(ibuf);
277 }
278 
279 const struct got_error *
280 got_privsep_send_tmpfd(struct imsgbuf *ibuf, int fd)
281 {
282 	if (imsg_compose(ibuf, GOT_IMSG_TMPFD, 0, 0, fd, NULL, 0)
283 	    == -1)
284 		return got_error_from_errno();
285 
286 	return flush_imsg(ibuf);
287 }
288 
289 const struct got_error *
290 got_privsep_send_obj(struct imsgbuf *ibuf, struct got_object *obj)
291 {
292 	struct got_imsg_object iobj;
293 
294 	memcpy(iobj.id, obj->id.sha1, sizeof(iobj.id));
295 	iobj.type = obj->type;
296 	iobj.flags = obj->flags;
297 	iobj.hdrlen = obj->hdrlen;
298 	iobj.size = obj->size;
299 	if (iobj.flags & GOT_OBJ_FLAG_PACKED) {
300 		iobj.pack_offset = obj->pack_offset;
301 		iobj.pack_idx = obj->pack_idx;
302 	}
303 
304 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT, 0, 0, -1, &iobj, sizeof(iobj))
305 	    == -1)
306 		return got_error_from_errno();
307 
308 	return flush_imsg(ibuf);
309 }
310 
311 const struct got_error *
312 got_privsep_get_imsg_obj(struct got_object **obj, struct imsg *imsg,
313     struct imsgbuf *ibuf)
314 {
315 	const struct got_error *err = NULL;
316 	struct got_imsg_object *iobj;
317 	size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
318 
319 	if (datalen != sizeof(*iobj))
320 		return got_error(GOT_ERR_PRIVSEP_LEN);
321 	iobj = imsg->data;
322 
323 	*obj = calloc(1, sizeof(**obj));
324 	if (*obj == NULL)
325 		return got_error_from_errno();
326 
327 	memcpy((*obj)->id.sha1, iobj->id, SHA1_DIGEST_LENGTH);
328 	(*obj)->type = iobj->type;
329 	(*obj)->flags = iobj->flags;
330 	(*obj)->hdrlen = iobj->hdrlen;
331 	(*obj)->size = iobj->size;
332 	/* path_packfile is handled by caller */
333 	if (iobj->flags & GOT_OBJ_FLAG_PACKED) {
334 		(*obj)->pack_offset = iobj->pack_offset;
335 		(*obj)->pack_idx = iobj->pack_idx;
336 	}
337 
338 	return err;
339 }
340 
341 const struct got_error *
342 got_privsep_recv_obj(struct got_object **obj, struct imsgbuf *ibuf)
343 {
344 	const struct got_error *err = NULL;
345 	struct imsg imsg;
346 	size_t datalen;
347 	const size_t min_datalen =
348 	    MIN(sizeof(struct got_imsg_error), sizeof(struct got_imsg_object));
349 
350 	*obj = NULL;
351 
352 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
353 	if (err)
354 		return err;
355 
356 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
357 
358 	switch (imsg.hdr.type) {
359 	case GOT_IMSG_ERROR:
360 		err = recv_imsg_error(&imsg, datalen);
361 		break;
362 	case GOT_IMSG_OBJECT:
363 		err = got_privsep_get_imsg_obj(obj, &imsg, ibuf);
364 		break;
365 	default:
366 		err = got_error(GOT_ERR_PRIVSEP_MSG);
367 		break;
368 	}
369 
370 	imsg_free(&imsg);
371 
372 	return err;
373 }
374 
375 static const struct got_error *
376 send_commit_logmsg(struct imsgbuf *ibuf, struct got_commit_object *commit,
377     size_t logmsg_len)
378 {
379 	const struct got_error *err = NULL;
380 	size_t offset, remain;
381 
382 	offset = 0;
383 	remain = logmsg_len;
384 	while (remain > 0) {
385 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
386 
387 		if (imsg_compose(ibuf, GOT_IMSG_COMMIT_LOGMSG, 0, 0, -1,
388 		    commit->logmsg + offset, n) == -1) {
389 			err = got_error_from_errno();
390 			break;
391 		}
392 
393 		err = flush_imsg(ibuf);
394 		if (err)
395 			break;
396 
397 		offset += n;
398 		remain -= n;
399 	}
400 
401 	return err;
402 }
403 
404 const struct got_error *
405 got_privsep_send_commit(struct imsgbuf *ibuf, struct got_commit_object *commit)
406 {
407 	const struct got_error *err = NULL;
408 	struct got_imsg_commit_object icommit;
409 	uint8_t *buf;
410 	size_t len, total;
411 	struct got_object_qid *qid;
412 	size_t logmsg_len = strlen(commit->logmsg);
413 
414 	memcpy(icommit.tree_id, commit->tree_id->sha1, sizeof(icommit.tree_id));
415 	icommit.author_len = strlen(commit->author);
416 	icommit.author_time = commit->author_time;
417 	icommit.author_gmtoff = commit->author_gmtoff;
418 	icommit.committer_len = strlen(commit->committer);
419 	icommit.committer_time = commit->committer_time;
420 	icommit.committer_gmtoff = commit->committer_gmtoff;
421 	icommit.logmsg_len = logmsg_len;
422 	icommit.nparents = commit->nparents;
423 
424 	total = sizeof(icommit) + icommit.author_len +
425 	    icommit.committer_len + icommit.nparents * SHA1_DIGEST_LENGTH;
426 
427 	buf = malloc(total);
428 	if (buf == NULL)
429 		return got_error_from_errno();
430 
431 	len = 0;
432 	memcpy(buf + len, &icommit, sizeof(icommit));
433 	len += sizeof(icommit);
434 	memcpy(buf + len, commit->author, icommit.author_len);
435 	len += icommit.author_len;
436 	memcpy(buf + len, commit->committer, icommit.committer_len);
437 	len += icommit.committer_len;
438 	SIMPLEQ_FOREACH(qid, &commit->parent_ids, entry) {
439 		memcpy(buf + len, qid->id, SHA1_DIGEST_LENGTH);
440 		len += SHA1_DIGEST_LENGTH;
441 	}
442 
443 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT, 0, 0, -1, buf, len) == -1) {
444 		err = got_error_from_errno();
445 		goto done;
446 	}
447 
448 	if (logmsg_len == 0 ||
449 	    logmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
450 		err = flush_imsg(ibuf);
451 		if (err)
452 			goto done;
453 	}
454 	err = send_commit_logmsg(ibuf, commit, logmsg_len);
455 done:
456 	free(buf);
457 	return err;
458 }
459 
460 const struct got_error *
461 got_privsep_recv_commit(struct got_commit_object **commit, struct imsgbuf *ibuf)
462 {
463 	const struct got_error *err = NULL;
464 	struct imsg imsg;
465 	struct got_imsg_commit_object *icommit;
466 	size_t len, datalen;
467 	int i;
468 	const size_t min_datalen =
469 	    MIN(sizeof(struct got_imsg_error),
470 	    sizeof(struct got_imsg_commit_object));
471 
472 	*commit = NULL;
473 
474 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
475 	if (err)
476 		return err;
477 
478 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
479 	len = 0;
480 
481 	switch (imsg.hdr.type) {
482 	case GOT_IMSG_ERROR:
483 		err = recv_imsg_error(&imsg, datalen);
484 		break;
485 	case GOT_IMSG_COMMIT:
486 		if (datalen < sizeof(*icommit)) {
487 			err = got_error(GOT_ERR_PRIVSEP_LEN);
488 			break;
489 		}
490 		icommit = imsg.data;
491 		if (datalen != sizeof(*icommit) + icommit->author_len +
492 		    icommit->committer_len +
493 		    icommit->nparents * SHA1_DIGEST_LENGTH) {
494 			err = got_error(GOT_ERR_PRIVSEP_LEN);
495 			break;
496 		}
497 		if (icommit->nparents < 0) {
498 			err = got_error(GOT_ERR_PRIVSEP_LEN);
499 			break;
500 		}
501 		len += sizeof(*icommit);
502 
503 		*commit = got_object_commit_alloc_partial();
504 		if (*commit == NULL) {
505 			err = got_error_from_errno();
506 			break;
507 		}
508 
509 		memcpy((*commit)->tree_id->sha1, icommit->tree_id,
510 		    SHA1_DIGEST_LENGTH);
511 		(*commit)->author_time = icommit->author_time;
512 		(*commit)->author_gmtoff = icommit->author_gmtoff;
513 		(*commit)->committer_time = icommit->committer_time;
514 		(*commit)->committer_gmtoff = icommit->committer_gmtoff;
515 
516 		if (icommit->author_len == 0) {
517 			(*commit)->author = strdup("");
518 			if ((*commit)->author == NULL) {
519 				err = got_error_from_errno();
520 				break;
521 			}
522 		} else {
523 			(*commit)->author = malloc(icommit->author_len + 1);
524 			if ((*commit)->author == NULL) {
525 				err = got_error_from_errno();
526 				break;
527 			}
528 			memcpy((*commit)->author, imsg.data + len,
529 			    icommit->author_len);
530 			(*commit)->author[icommit->author_len] = '\0';
531 		}
532 		len += icommit->author_len;
533 
534 		if (icommit->committer_len == 0) {
535 			(*commit)->committer = strdup("");
536 			if ((*commit)->committer == NULL) {
537 				err = got_error_from_errno();
538 				break;
539 			}
540 		} else {
541 			(*commit)->committer =
542 			    malloc(icommit->committer_len + 1);
543 			if ((*commit)->committer == NULL) {
544 				err = got_error_from_errno();
545 				break;
546 			}
547 			memcpy((*commit)->committer, imsg.data + len,
548 			    icommit->committer_len);
549 			(*commit)->committer[icommit->committer_len] = '\0';
550 		}
551 		len += icommit->committer_len;
552 
553 		if (icommit->logmsg_len == 0) {
554 			(*commit)->logmsg = strdup("");
555 			if ((*commit)->logmsg == NULL) {
556 				err = got_error_from_errno();
557 				break;
558 			}
559 		} else {
560 			size_t offset = 0, remain = icommit->logmsg_len;
561 
562 			(*commit)->logmsg = malloc(icommit->logmsg_len + 1);
563 			if ((*commit)->logmsg == NULL) {
564 				err = got_error_from_errno();
565 				break;
566 			}
567 			while (remain > 0) {
568 				struct imsg imsg_log;
569 				size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
570 				    remain);
571 
572 				err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
573 				if (err)
574 					return err;
575 
576 				if (imsg_log.hdr.type != GOT_IMSG_COMMIT_LOGMSG)
577 					return got_error(GOT_ERR_PRIVSEP_MSG);
578 
579 				memcpy((*commit)->logmsg + offset,
580 				    imsg_log.data, n);
581 				imsg_free(&imsg_log);
582 				offset += n;
583 				remain -= n;
584 			}
585 			(*commit)->logmsg[icommit->logmsg_len] = '\0';
586 		}
587 
588 		for (i = 0; i < icommit->nparents; i++) {
589 			struct got_object_qid *qid;
590 
591 			err = got_object_qid_alloc_partial(&qid);
592 			if (err)
593 				break;
594 			memcpy(qid->id, imsg.data + len +
595 			    i * SHA1_DIGEST_LENGTH, sizeof(*qid->id));
596 			SIMPLEQ_INSERT_TAIL(&(*commit)->parent_ids, qid, entry);
597 			(*commit)->nparents++;
598 		}
599 		break;
600 	default:
601 		err = got_error(GOT_ERR_PRIVSEP_MSG);
602 		break;
603 	}
604 
605 	imsg_free(&imsg);
606 
607 	return err;
608 }
609 
610 const struct got_error *
611 got_privsep_send_tree(struct imsgbuf *ibuf, struct got_tree_object *tree)
612 {
613 	const struct got_error *err = NULL;
614 	struct got_imsg_tree_object itree;
615 	struct got_tree_entry *te;
616 	size_t totlen;
617 	int nimsg; /* number of imsg queued in ibuf */
618 
619 	itree.nentries = tree->entries.nentries;
620 	if (imsg_compose(ibuf, GOT_IMSG_TREE, 0, 0, -1, &itree, sizeof(itree))
621 	    == -1)
622 		return got_error_from_errno();
623 
624 	totlen = sizeof(itree);
625 	nimsg = 1;
626 	SIMPLEQ_FOREACH(te, &tree->entries.head, entry) {
627 		struct got_imsg_tree_entry *ite;
628 		uint8_t *buf = NULL;
629 		size_t len = sizeof(*ite) + strlen(te->name);
630 
631 		if (len > MAX_IMSGSIZE)
632 			return got_error(GOT_ERR_NO_SPACE);
633 
634 		nimsg++;
635 		if (totlen + len >= MAX_IMSGSIZE - (IMSG_HEADER_SIZE * nimsg)) {
636 			err = flush_imsg(ibuf);
637 			if (err)
638 				return err;
639 			nimsg = 0;
640 		}
641 
642 		buf = malloc(len);
643 		if (buf == NULL)
644 			return got_error_from_errno();
645 
646 		ite = (struct got_imsg_tree_entry *)buf;
647 		memcpy(ite->id, te->id->sha1, sizeof(ite->id));
648 		ite->mode = te->mode;
649 		memcpy(buf + sizeof(*ite), te->name, strlen(te->name));
650 
651 		if (imsg_compose(ibuf, GOT_IMSG_TREE_ENTRY, 0, 0, -1,
652 		    buf, len) == -1)
653 			err = got_error_from_errno();
654 		free(buf);
655 		if (err)
656 			return err;
657 		totlen += len;
658 	}
659 
660 	return flush_imsg(ibuf);
661 }
662 
663 const struct got_error *
664 got_privsep_recv_tree(struct got_tree_object **tree, struct imsgbuf *ibuf)
665 {
666 	const struct got_error *err = NULL;
667 	const size_t min_datalen =
668 	    MIN(sizeof(struct got_imsg_error),
669 	    sizeof(struct got_imsg_tree_object));
670 	struct got_imsg_tree_object *itree;
671 	int nentries = 0;
672 
673 	*tree = NULL;
674 get_more:
675 	err = read_imsg(ibuf);
676 	if (err)
677 		goto done;
678 
679 	while (1) {
680 		struct imsg imsg;
681 		size_t n;
682 		size_t datalen;
683 		struct got_imsg_tree_entry *ite;
684 		struct got_tree_entry *te = NULL;
685 
686 		n = imsg_get(ibuf, &imsg);
687 		if (n == 0) {
688 			if (*tree && (*tree)->entries.nentries != nentries)
689 				goto get_more;
690 			break;
691 		}
692 
693 		if (imsg.hdr.len < IMSG_HEADER_SIZE + min_datalen)
694 			return got_error(GOT_ERR_PRIVSEP_LEN);
695 
696 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
697 
698 		switch (imsg.hdr.type) {
699 		case GOT_IMSG_ERROR:
700 			err = recv_imsg_error(&imsg, datalen);
701 			break;
702 		case GOT_IMSG_TREE:
703 			/* This message should only appear once. */
704 			if (*tree != NULL) {
705 				err = got_error(GOT_ERR_PRIVSEP_MSG);
706 				break;
707 			}
708 			if (datalen != sizeof(*itree)) {
709 				err = got_error(GOT_ERR_PRIVSEP_LEN);
710 				break;
711 			}
712 			itree = imsg.data;
713 			*tree = malloc(sizeof(**tree));
714 			if (*tree == NULL) {
715 				err = got_error_from_errno();
716 				break;
717 			}
718 			(*tree)->entries.nentries = itree->nentries;
719 			SIMPLEQ_INIT(&(*tree)->entries.head);
720 			(*tree)->refcnt = 0;
721 			break;
722 		case GOT_IMSG_TREE_ENTRY:
723 			/* This message should be preceeded by GOT_IMSG_TREE. */
724 			if (*tree == NULL) {
725 				err = got_error(GOT_ERR_PRIVSEP_MSG);
726 				break;
727 			}
728 			if (datalen < sizeof(*ite) || datalen > MAX_IMSGSIZE) {
729 				err = got_error(GOT_ERR_PRIVSEP_LEN);
730 				break;
731 			}
732 
733 			/* Remaining data contains the entry's name. */
734 			datalen -= sizeof(*ite);
735 			if (datalen == 0 || datalen > MAX_IMSGSIZE) {
736 				err = got_error(GOT_ERR_PRIVSEP_LEN);
737 				break;
738 			}
739 			ite = imsg.data;
740 
741 			te = got_alloc_tree_entry_partial();
742 			if (te == NULL) {
743 				err = got_error_from_errno();
744 				break;
745 			}
746 			te->name = malloc(datalen + 1);
747 			if (te->name == NULL) {
748 				free(te);
749 				err = got_error_from_errno();
750 				break;
751 			}
752 			memcpy(te->name, imsg.data + sizeof(*ite), datalen);
753 			te->name[datalen] = '\0';
754 
755 			memcpy(te->id->sha1, ite->id, SHA1_DIGEST_LENGTH);
756 			te->mode = ite->mode;
757 			SIMPLEQ_INSERT_TAIL(&(*tree)->entries.head, te, entry);
758 			nentries++;
759 			break;
760 		default:
761 			err = got_error(GOT_ERR_PRIVSEP_MSG);
762 			break;
763 		}
764 
765 		imsg_free(&imsg);
766 	}
767 done:
768 	if (*tree && (*tree)->entries.nentries != nentries) {
769 		if (err == NULL)
770 			err = got_error(GOT_ERR_PRIVSEP_LEN);
771 		got_object_tree_close(*tree);
772 		*tree = NULL;
773 	}
774 
775 	return err;
776 }
777 
778 const struct got_error *
779 got_privsep_send_blob(struct imsgbuf *ibuf, size_t size)
780 {
781 	struct got_imsg_blob iblob;
782 
783 	iblob.size = size;
784 	/* Data has already been written to file descriptor. */
785 
786 	if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, &iblob, sizeof(iblob))
787 	    == -1)
788 		return got_error_from_errno();
789 
790 	return flush_imsg(ibuf);
791 }
792 
793 const struct got_error *
794 got_privsep_recv_blob(size_t *size, struct imsgbuf *ibuf)
795 {
796 	const struct got_error *err = NULL;
797 	struct imsg imsg;
798 	struct got_imsg_blob *iblob;
799 	size_t datalen;
800 
801 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
802 	if (err)
803 		return err;
804 
805 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
806 
807 	switch (imsg.hdr.type) {
808 	case GOT_IMSG_ERROR:
809 		err = recv_imsg_error(&imsg, datalen);
810 		break;
811 	case GOT_IMSG_BLOB:
812 		if (datalen != sizeof(*iblob)) {
813 			err = got_error(GOT_ERR_PRIVSEP_LEN);
814 			break;
815 		}
816 		iblob = imsg.data;
817 		*size = iblob->size;
818 		/* Data has been written to file descriptor. */
819 		break;
820 	default:
821 		err = got_error(GOT_ERR_PRIVSEP_MSG);
822 		break;
823 	}
824 
825 	imsg_free(&imsg);
826 
827 	return err;
828 }
829 
830 const struct got_error *
831 got_privsep_init_pack_child(struct imsgbuf *ibuf, struct got_pack *pack,
832     struct got_packidx *packidx)
833 {
834 	struct got_imsg_packidx ipackidx;
835 	struct got_imsg_pack ipack;
836 	int fd;
837 
838 	ipackidx.len = packidx->len;
839 	fd = dup(packidx->fd);
840 	if (fd == -1)
841 		return got_error_from_errno();
842 
843 	if (imsg_compose(ibuf, GOT_IMSG_PACKIDX, 0, 0, fd, &ipackidx,
844 	    sizeof(ipackidx)) == -1)
845 		return got_error_from_errno();
846 
847 	if (strlcpy(ipack.path_packfile, pack->path_packfile,
848 	    sizeof(ipack.path_packfile)) >= sizeof(ipack.path_packfile))
849 		return got_error(GOT_ERR_NO_SPACE);
850 	ipack.filesize = pack->filesize;
851 
852 	fd = dup(pack->fd);
853 	if (fd == -1)
854 		return got_error_from_errno();
855 
856 	if (imsg_compose(ibuf, GOT_IMSG_PACK, 0, 0, fd, &ipack, sizeof(ipack))
857 	    == -1)
858 		return got_error_from_errno();
859 
860 	return flush_imsg(ibuf);
861 }
862 
863 const struct got_error *
864 got_privsep_send_packed_obj_req(struct imsgbuf *ibuf, int idx,
865     struct got_object_id *id)
866 {
867 	struct got_imsg_packed_object iobj;
868 
869 	iobj.idx = idx;
870 	memcpy(iobj.id, id->sha1, sizeof(iobj.id));
871 
872 	if (imsg_compose(ibuf, GOT_IMSG_PACKED_OBJECT_REQUEST, 0, 0, -1,
873 	    &iobj, sizeof(iobj)) == -1)
874 		return got_error_from_errno();
875 
876 	return flush_imsg(ibuf);
877 }