1 /*
2  * Copyright (c) 2018, 2019, 2020 Stefan Sperling <stsp@openbsd.org>
3  * Copyright (c) 2020 Ori Bernstein <ori@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include <sys/types.h>
19 #include <sys/queue.h>
20 #include <sys/uio.h>
21 #include <sys/syslimits.h>
22 #include <sys/wait.h>
23 
24 #include <stdio.h>
25 #include <stdlib.h>
26 #include <string.h>
27 #include <errno.h>
28 #include <stdint.h>
29 #include <poll.h>
30 #include <imsg.h>
31 #include <sha1.h>
32 #include <zlib.h>
33 #include <time.h>
34 
35 #include "got_object.h"
36 #include "got_error.h"
37 #include "got_path.h"
38 #include "got_repository.h"
39 
40 #include "got_lib_sha1.h"
41 #include "got_lib_delta.h"
42 #include "got_lib_inflate.h"
43 #include "got_lib_object.h"
44 #include "got_lib_object_parse.h"
45 #include "got_lib_privsep.h"
46 #include "got_lib_pack.h"
47 
48 #ifndef MIN
49 #define	MIN(_a,_b) ((_a) < (_b) ? (_a) : (_b))
50 #endif
51 
52 #ifndef nitems
53 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
54 #endif
55 
56 static const struct got_error *
57 poll_fd(int fd, int events, int timeout)
58 {
59 	struct pollfd pfd[1];
60 	int n;
61 
62 	pfd[0].fd = fd;
63 	pfd[0].events = events;
64 
65 	n = poll(pfd, 1, timeout);
66 	if (n == -1)
67 		return got_error_from_errno("poll");
68 	if (n == 0)
69 		return got_error(GOT_ERR_TIMEOUT);
70 	if (pfd[0].revents & (POLLERR | POLLNVAL))
71 		return got_error_from_errno("poll error");
72 	if (pfd[0].revents & (events | POLLHUP))
73 		return NULL;
74 
75 	return got_error(GOT_ERR_INTERRUPT);
76 }
77 
78 static const struct got_error *
79 read_imsg(struct imsgbuf *ibuf)
80 {
81 	const struct got_error *err;
82 	size_t n;
83 
84 	err = poll_fd(ibuf->fd, POLLIN, INFTIM);
85 	if (err)
86 		return err;
87 
88 	n = imsg_read(ibuf);
89 	if (n == -1) {
90 		if (errno == EAGAIN) /* Could be a file-descriptor leak. */
91 			return got_error(GOT_ERR_PRIVSEP_NO_FD);
92 		return got_error(GOT_ERR_PRIVSEP_READ);
93 	}
94 	if (n == 0)
95 		return got_error(GOT_ERR_PRIVSEP_PIPE);
96 
97 	return NULL;
98 }
99 
100 const struct got_error *
101 got_privsep_wait_for_child(pid_t pid)
102 {
103 	int child_status;
104 
105 	if (waitpid(pid, &child_status, 0) == -1)
106 		return got_error_from_errno("waitpid");
107 
108 	if (!WIFEXITED(child_status))
109 		return got_error(GOT_ERR_PRIVSEP_DIED);
110 
111 	if (WEXITSTATUS(child_status) != 0)
112 		return got_error(GOT_ERR_PRIVSEP_EXIT);
113 
114 	return NULL;
115 }
116 
117 static const struct got_error *
118 recv_imsg_error(struct imsg *imsg, size_t datalen)
119 {
120 	struct got_imsg_error *ierr;
121 
122 	if (datalen != sizeof(*ierr))
123 		return got_error(GOT_ERR_PRIVSEP_LEN);
124 
125 	ierr = imsg->data;
126 	if (ierr->code == GOT_ERR_ERRNO) {
127 		static struct got_error serr;
128 		serr.code = GOT_ERR_ERRNO;
129 		serr.msg = strerror(ierr->errno_code);
130 		return &serr;
131 	}
132 
133 	return got_error(ierr->code);
134 }
135 
136 const struct got_error *
137 got_privsep_recv_imsg(struct imsg *imsg, struct imsgbuf *ibuf,
138     size_t min_datalen)
139 {
140 	const struct got_error *err;
141 	ssize_t n;
142 
143 	n = imsg_get(ibuf, imsg);
144 	if (n == -1)
145 		return got_error_from_errno("imsg_get");
146 
147 	while (n == 0) {
148 		err = read_imsg(ibuf);
149 		if (err)
150 			return err;
151 		n = imsg_get(ibuf, imsg);
152 		if (n == -1)
153 			return got_error_from_errno("imsg_get");
154 	}
155 
156 	if (imsg->hdr.len < IMSG_HEADER_SIZE + min_datalen)
157 		return got_error(GOT_ERR_PRIVSEP_LEN);
158 
159 	if (imsg->hdr.type == GOT_IMSG_ERROR) {
160 		size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
161 		return recv_imsg_error(imsg, datalen);
162 	}
163 
164 	return NULL;
165 }
166 
167 /* Attempt to send an error in an imsg. Complain on stderr as a last resort. */
168 void
169 got_privsep_send_error(struct imsgbuf *ibuf, const struct got_error *err)
170 {
171 	const struct got_error *poll_err;
172 	struct got_imsg_error ierr;
173 	int ret;
174 
175 	ierr.code = err->code;
176 	if (err->code == GOT_ERR_ERRNO)
177 		ierr.errno_code = errno;
178 	else
179 		ierr.errno_code = 0;
180 	ret = imsg_compose(ibuf, GOT_IMSG_ERROR, 0, 0, -1, &ierr, sizeof(ierr));
181 	if (ret == -1) {
182 		fprintf(stderr, "%s: error %d \"%s\": imsg_compose: %s\n",
183 		    getprogname(), err->code, err->msg, strerror(errno));
184 		return;
185 	}
186 
187 	poll_err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
188 	if (poll_err) {
189 		fprintf(stderr, "%s: error %d \"%s\": poll: %s\n",
190 		    getprogname(), err->code, err->msg, poll_err->msg);
191 		return;
192 	}
193 
194 	ret = imsg_flush(ibuf);
195 	if (ret == -1) {
196 		fprintf(stderr, "%s: error %d \"%s\": imsg_flush: %s\n",
197 		    getprogname(), err->code, err->msg, strerror(errno));
198 		return;
199 	}
200 }
201 
202 static const struct got_error *
203 flush_imsg(struct imsgbuf *ibuf)
204 {
205 	const struct got_error *err;
206 
207 	err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
208 	if (err)
209 		return err;
210 
211 	if (imsg_flush(ibuf) == -1)
212 		return got_error_from_errno("imsg_flush");
213 
214 	return NULL;
215 }
216 
217 const struct got_error *
218 got_privsep_send_stop(int fd)
219 {
220 	const struct got_error *err = NULL;
221 	struct imsgbuf ibuf;
222 
223 	imsg_init(&ibuf, fd);
224 
225 	if (imsg_compose(&ibuf, GOT_IMSG_STOP, 0, 0, -1, NULL, 0) == -1)
226 		return got_error_from_errno("imsg_compose STOP");
227 
228 	err = flush_imsg(&ibuf);
229 	imsg_clear(&ibuf);
230 	return err;
231 }
232 
233 const struct got_error *
234 got_privsep_send_obj_req(struct imsgbuf *ibuf, int fd)
235 {
236 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT_REQUEST, 0, 0, fd, NULL, 0)
237 	    == -1)
238 		return got_error_from_errno("imsg_compose OBJECT_REQUEST");
239 
240 	return flush_imsg(ibuf);
241 }
242 
243 const struct got_error *
244 got_privsep_send_commit_req(struct imsgbuf *ibuf, int fd,
245     struct got_object_id *id, int pack_idx)
246 {
247 	const struct got_error *err = NULL;
248 	struct got_imsg_packed_object iobj, *iobjp;
249 	size_t len;
250 
251 	if (id) { /* commit is packed */
252 		iobj.idx = pack_idx;
253 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
254 		iobjp = &iobj;
255 		len = sizeof(iobj);
256 	} else {
257 		iobjp = NULL;
258 		len = 0;
259 	}
260 
261 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_REQUEST, 0, 0, fd, iobjp, len)
262 	    == -1) {
263 		err = got_error_from_errno("imsg_compose COMMIT_REQUEST");
264 		close(fd);
265 		return err;
266 	}
267 
268 	return flush_imsg(ibuf);
269 }
270 
271 const struct got_error *
272 got_privsep_send_tree_req(struct imsgbuf *ibuf, int fd,
273     struct got_object_id *id, int pack_idx)
274 {
275 	const struct got_error *err = NULL;
276 	struct ibuf *wbuf;
277 	size_t len = id ? sizeof(struct got_imsg_packed_object) : 0;
278 
279 	wbuf = imsg_create(ibuf, GOT_IMSG_TREE_REQUEST, 0, 0, len);
280 	if (wbuf == NULL)
281 		return got_error_from_errno("imsg_create TREE_REQUEST");
282 
283 	if (id) { /* tree is packed */
284 		if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
285 			err = got_error_from_errno("imsg_add TREE_ENTRY");
286 			ibuf_free(wbuf);
287 			return err;
288 		}
289 
290 		if (imsg_add(wbuf, &pack_idx, sizeof(pack_idx)) == -1) {
291 			err = got_error_from_errno("imsg_add TREE_ENTRY");
292 			ibuf_free(wbuf);
293 			return err;
294 		}
295 	}
296 
297 	wbuf->fd = fd;
298 	imsg_close(ibuf, wbuf);
299 
300 	return flush_imsg(ibuf);
301 }
302 
303 const struct got_error *
304 got_privsep_send_tag_req(struct imsgbuf *ibuf, int fd,
305     struct got_object_id *id, int pack_idx)
306 {
307 	struct got_imsg_packed_object iobj, *iobjp;
308 	size_t len;
309 
310 	if (id) { /* tag is packed */
311 		iobj.idx = pack_idx;
312 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
313 		iobjp = &iobj;
314 		len = sizeof(iobj);
315 	} else {
316 		iobjp = NULL;
317 		len = 0;
318 	}
319 
320 	if (imsg_compose(ibuf, GOT_IMSG_TAG_REQUEST, 0, 0, fd, iobjp, len)
321 	    == -1)
322 		return got_error_from_errno("imsg_compose TAG_REQUEST");
323 
324 	return flush_imsg(ibuf);
325 }
326 
327 const struct got_error *
328 got_privsep_send_blob_req(struct imsgbuf *ibuf, int infd,
329     struct got_object_id *id, int pack_idx)
330 {
331 	const struct got_error *err = NULL;
332 	struct got_imsg_packed_object iobj, *iobjp;
333 	size_t len;
334 
335 	if (id) { /* blob is packed */
336 		iobj.idx = pack_idx;
337 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
338 		iobjp = &iobj;
339 		len = sizeof(iobj);
340 	} else {
341 		iobjp = NULL;
342 		len = 0;
343 	}
344 
345 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_REQUEST, 0, 0, infd, iobjp, len)
346 	    == -1) {
347 		err = got_error_from_errno("imsg_compose BLOB_REQUEST");
348 		close(infd);
349 		return err;
350 	}
351 
352 	return flush_imsg(ibuf);
353 }
354 
355 const struct got_error *
356 got_privsep_send_blob_outfd(struct imsgbuf *ibuf, int outfd)
357 {
358 	const struct got_error *err = NULL;
359 
360 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_OUTFD, 0, 0, outfd, NULL, 0)
361 	    == -1) {
362 		err = got_error_from_errno("imsg_compose BLOB_OUTFD");
363 		close(outfd);
364 		return err;
365 	}
366 
367 	return flush_imsg(ibuf);
368 }
369 
370 const struct got_error *
371 got_privsep_send_tmpfd(struct imsgbuf *ibuf, int fd)
372 {
373 	const struct got_error *err = NULL;
374 
375 	if (imsg_compose(ibuf, GOT_IMSG_TMPFD, 0, 0, fd, NULL, 0)
376 	    == -1) {
377 		err = got_error_from_errno("imsg_compose TMPFD");
378 		close(fd);
379 		return err;
380 	}
381 
382 	return flush_imsg(ibuf);
383 }
384 
385 const struct got_error *
386 got_privsep_send_obj(struct imsgbuf *ibuf, struct got_object *obj)
387 {
388 	struct got_imsg_object iobj;
389 
390 	memcpy(iobj.id, obj->id.sha1, sizeof(iobj.id));
391 	iobj.type = obj->type;
392 	iobj.flags = obj->flags;
393 	iobj.hdrlen = obj->hdrlen;
394 	iobj.size = obj->size;
395 	if (iobj.flags & GOT_OBJ_FLAG_PACKED) {
396 		iobj.pack_offset = obj->pack_offset;
397 		iobj.pack_idx = obj->pack_idx;
398 	}
399 
400 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT, 0, 0, -1, &iobj, sizeof(iobj))
401 	    == -1)
402 		return got_error_from_errno("imsg_compose OBJECT");
403 
404 	return flush_imsg(ibuf);
405 }
406 
407 const struct got_error *
408 got_privsep_send_fetch_req(struct imsgbuf *ibuf, int fd)
409 {
410 	const struct got_error *err = NULL;
411 
412 	if (imsg_compose(ibuf, GOT_IMSG_FETCH_REQUEST, 0, 0, fd,
413 	    NULL, 0) == -1) {
414 		err = got_error_from_errno("imsg_compose FETCH_REQUEST");
415 		close(fd);
416 		return err;
417 	}
418 	return flush_imsg(ibuf);
419 }
420 
421 const struct got_error *
422 got_privsep_send_fetch_progress(struct imsgbuf *ibuf,
423     struct got_object_id *refid, const char *refname)
424 {
425 	const struct got_error *err = NULL;
426 	struct ibuf *wbuf;
427 	size_t len, reflen = strlen(refname);
428 
429 	len = sizeof(struct got_imsg_fetch_progress) + reflen;
430 	if (len >= MAX_IMSGSIZE - IMSG_HEADER_SIZE)
431 		return got_error(GOT_ERR_NO_SPACE);
432 
433 	wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_PROGRESS, 0, 0, len);
434 	if (wbuf == NULL)
435 		return got_error_from_errno("imsg_create FETCH_PROGRESS");
436 
437 	/* Keep in sync with struct got_imsg_fetch_progress definition! */
438 	if (imsg_add(wbuf, refid->sha1, SHA1_DIGEST_LENGTH) == -1) {
439 		err = got_error_from_errno("imsg_add FETCH_PROGRESS");
440 		ibuf_free(wbuf);
441 		return err;
442 	}
443 	if (imsg_add(wbuf, refname, reflen) == -1) {
444 		err = got_error_from_errno("imsg_add FETCH_PROGRESS");
445 		ibuf_free(wbuf);
446 		return err;
447 	}
448 
449 	wbuf->fd = -1;
450 	imsg_close(ibuf, wbuf);
451 	return flush_imsg(ibuf);
452 }
453 
454 const struct got_error *
455 got_privsep_send_fetch_done(struct imsgbuf *ibuf, struct got_object_id hash)
456 {
457 	if (imsg_compose(ibuf, GOT_IMSG_FETCH_DONE, 0, 0, -1,
458 	    hash.sha1, SHA1_DIGEST_LENGTH) == -1)
459 		return got_error_from_errno("imsg_compose FETCH");
460 	return flush_imsg(ibuf);
461 }
462 
463 
464 const struct got_error *
465 got_privsep_recv_fetch_progress(int *done, struct got_object_id **id,
466     char **refname, struct imsgbuf *ibuf)
467 {
468 	const struct got_error *err = NULL;
469 	struct imsg imsg;
470 	size_t datalen;
471 	const size_t min_datalen =
472 	    MIN(sizeof(struct got_imsg_error),
473 	    sizeof(struct got_imsg_fetch_progress));
474 
475 	*done = 0;
476 	*id = NULL;
477 	*refname = NULL;
478 
479 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
480 	if (err)
481 		return err;
482 
483 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
484 	switch (imsg.hdr.type) {
485 	case GOT_IMSG_ERROR:
486 		err = recv_imsg_error(&imsg, datalen);
487 		break;
488 	case GOT_IMSG_FETCH_PROGRESS:
489 		*id = malloc(sizeof(**id));
490 		if (*id == NULL) {
491 			err = got_error_from_errno("malloc");
492 			break;
493 		}
494 		memcpy((*id)->sha1, imsg.data, SHA1_DIGEST_LENGTH);
495 		if (datalen <= SHA1_DIGEST_LENGTH) {
496 			err = got_error(GOT_ERR_PRIVSEP_MSG);
497 			break;
498 		}
499 		*refname = strndup(imsg.data + SHA1_DIGEST_LENGTH,
500 		    datalen - SHA1_DIGEST_LENGTH);
501 		if (*refname == NULL) {
502 			err = got_error_from_errno("strndup");
503 			break;
504 		}
505 		break;
506 	case GOT_IMSG_FETCH_DONE:
507 		*id = malloc(sizeof(**id));
508 		if (*id == NULL) {
509 			err = got_error_from_errno("malloc");
510 			break;
511 		}
512 		if (datalen != SHA1_DIGEST_LENGTH) {
513 			err = got_error(GOT_ERR_PRIVSEP_MSG);
514 			break;
515 		}
516 		memcpy((*id)->sha1, imsg.data, SHA1_DIGEST_LENGTH);
517 		*done = 1;
518 		break;
519 	default:
520 		err = got_error(GOT_ERR_PRIVSEP_MSG);
521 		break;
522 	}
523 
524 	if (err) {
525 		free(*id);
526 		*id = NULL;
527 		free(*refname);
528 		*refname = NULL;
529 	}
530 	imsg_free(&imsg);
531 	return err;
532 }
533 
534 const struct got_error *
535 got_privsep_send_index_pack_req(struct imsgbuf *ibuf, int fd, struct got_object_id *hash)
536 {
537 	const struct got_error *err = NULL;
538 
539 	if (imsg_compose(ibuf, GOT_IMSG_IDXPACK_REQUEST, 0, 0, fd,
540 	    hash->sha1, SHA1_DIGEST_LENGTH) == -1) {
541 		err = got_error_from_errno("imsg_compose INDEX_REQUEST");
542 		close(fd);
543 		return err;
544 	}
545 	return flush_imsg(ibuf);
546 }
547 
548 const struct got_error *
549 got_privsep_send_index_pack_done(struct imsgbuf *ibuf)
550 {
551 	if (imsg_compose(ibuf, GOT_IMSG_IDXPACK_DONE, 0, 0, -1, NULL, 0) == -1)
552 		return got_error_from_errno("imsg_compose FETCH");
553 	return flush_imsg(ibuf);
554 }
555 
556 const struct got_error *
557 got_privsep_wait_index_pack_done(struct imsgbuf *ibuf)
558 {
559 	const struct got_error *err = NULL;
560 	struct imsg imsg;
561 
562 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
563 	if (err)
564 		return err;
565 	if (imsg.hdr.type == GOT_IMSG_IDXPACK_DONE)
566 		return NULL;
567 	else
568 		return got_error(GOT_ERR_PRIVSEP_MSG);
569 	imsg_free(&imsg);
570 }
571 
572 const struct got_error *
573 got_privsep_get_imsg_obj(struct got_object **obj, struct imsg *imsg,
574     struct imsgbuf *ibuf)
575 {
576 	const struct got_error *err = NULL;
577 	struct got_imsg_object *iobj;
578 	size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
579 
580 	if (datalen != sizeof(*iobj))
581 		return got_error(GOT_ERR_PRIVSEP_LEN);
582 	iobj = imsg->data;
583 
584 	*obj = calloc(1, sizeof(**obj));
585 	if (*obj == NULL)
586 		return got_error_from_errno("calloc");
587 
588 	memcpy((*obj)->id.sha1, iobj->id, SHA1_DIGEST_LENGTH);
589 	(*obj)->type = iobj->type;
590 	(*obj)->flags = iobj->flags;
591 	(*obj)->hdrlen = iobj->hdrlen;
592 	(*obj)->size = iobj->size;
593 	/* path_packfile is handled by caller */
594 	if (iobj->flags & GOT_OBJ_FLAG_PACKED) {
595 		(*obj)->pack_offset = iobj->pack_offset;
596 		(*obj)->pack_idx = iobj->pack_idx;
597 	}
598 
599 	return err;
600 }
601 
602 const struct got_error *
603 got_privsep_recv_obj(struct got_object **obj, struct imsgbuf *ibuf)
604 {
605 	const struct got_error *err = NULL;
606 	struct imsg imsg;
607 	const size_t min_datalen =
608 	    MIN(sizeof(struct got_imsg_error), sizeof(struct got_imsg_object));
609 
610 	*obj = NULL;
611 
612 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
613 	if (err)
614 		return err;
615 
616 	switch (imsg.hdr.type) {
617 	case GOT_IMSG_OBJECT:
618 		err = got_privsep_get_imsg_obj(obj, &imsg, ibuf);
619 		break;
620 	default:
621 		err = got_error(GOT_ERR_PRIVSEP_MSG);
622 		break;
623 	}
624 
625 	imsg_free(&imsg);
626 
627 	return err;
628 }
629 
630 static const struct got_error *
631 send_commit_logmsg(struct imsgbuf *ibuf, struct got_commit_object *commit,
632     size_t logmsg_len)
633 {
634 	const struct got_error *err = NULL;
635 	size_t offset, remain;
636 
637 	offset = 0;
638 	remain = logmsg_len;
639 	while (remain > 0) {
640 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
641 
642 		if (imsg_compose(ibuf, GOT_IMSG_COMMIT_LOGMSG, 0, 0, -1,
643 		    commit->logmsg + offset, n) == -1) {
644 			err = got_error_from_errno("imsg_compose "
645 			    "COMMIT_LOGMSG");
646 			break;
647 		}
648 
649 		err = flush_imsg(ibuf);
650 		if (err)
651 			break;
652 
653 		offset += n;
654 		remain -= n;
655 	}
656 
657 	return err;
658 }
659 
660 const struct got_error *
661 got_privsep_send_commit(struct imsgbuf *ibuf, struct got_commit_object *commit)
662 {
663 	const struct got_error *err = NULL;
664 	struct got_imsg_commit_object *icommit;
665 	uint8_t *buf;
666 	size_t len, total;
667 	struct got_object_qid *qid;
668 	size_t author_len = strlen(commit->author);
669 	size_t committer_len = strlen(commit->committer);
670 	size_t logmsg_len = strlen(commit->logmsg);
671 
672 	total = sizeof(*icommit) + author_len + committer_len +
673 	    commit->nparents * SHA1_DIGEST_LENGTH;
674 
675 	buf = malloc(total);
676 	if (buf == NULL)
677 		return got_error_from_errno("malloc");
678 
679 	icommit = (struct got_imsg_commit_object *)buf;
680 	memcpy(icommit->tree_id, commit->tree_id->sha1,
681 	    sizeof(icommit->tree_id));
682 	icommit->author_len = author_len;
683 	icommit->author_time = commit->author_time;
684 	icommit->author_gmtoff = commit->author_gmtoff;
685 	icommit->committer_len = committer_len;
686 	icommit->committer_time = commit->committer_time;
687 	icommit->committer_gmtoff = commit->committer_gmtoff;
688 	icommit->logmsg_len = logmsg_len;
689 	icommit->nparents = commit->nparents;
690 
691 	len = sizeof(*icommit);
692 	memcpy(buf + len, commit->author, author_len);
693 	len += author_len;
694 	memcpy(buf + len, commit->committer, committer_len);
695 	len += committer_len;
696 	SIMPLEQ_FOREACH(qid, &commit->parent_ids, entry) {
697 		memcpy(buf + len, qid->id, SHA1_DIGEST_LENGTH);
698 		len += SHA1_DIGEST_LENGTH;
699 	}
700 
701 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT, 0, 0, -1, buf, len) == -1) {
702 		err = got_error_from_errno("imsg_compose COMMIT");
703 		goto done;
704 	}
705 
706 	if (logmsg_len == 0 ||
707 	    logmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
708 		err = flush_imsg(ibuf);
709 		if (err)
710 			goto done;
711 	}
712 	err = send_commit_logmsg(ibuf, commit, logmsg_len);
713 done:
714 	free(buf);
715 	return err;
716 }
717 
718 static const struct got_error *
719 get_commit_from_imsg(struct got_commit_object **commit,
720     struct imsg *imsg, size_t datalen, struct imsgbuf *ibuf)
721 {
722 	const struct got_error *err = NULL;
723 	struct got_imsg_commit_object *icommit;
724 	size_t len = 0;
725 	int i;
726 
727 	if (datalen < sizeof(*icommit))
728 		return got_error(GOT_ERR_PRIVSEP_LEN);
729 
730 	icommit = imsg->data;
731 	if (datalen != sizeof(*icommit) + icommit->author_len +
732 	    icommit->committer_len +
733 	    icommit->nparents * SHA1_DIGEST_LENGTH)
734 		return got_error(GOT_ERR_PRIVSEP_LEN);
735 
736 	if (icommit->nparents < 0)
737 		return got_error(GOT_ERR_PRIVSEP_LEN);
738 
739 	len += sizeof(*icommit);
740 
741 	*commit = got_object_commit_alloc_partial();
742 	if (*commit == NULL)
743 		return got_error_from_errno(
744 		    "got_object_commit_alloc_partial");
745 
746 	memcpy((*commit)->tree_id->sha1, icommit->tree_id,
747 	    SHA1_DIGEST_LENGTH);
748 	(*commit)->author_time = icommit->author_time;
749 	(*commit)->author_gmtoff = icommit->author_gmtoff;
750 	(*commit)->committer_time = icommit->committer_time;
751 	(*commit)->committer_gmtoff = icommit->committer_gmtoff;
752 
753 	if (icommit->author_len == 0) {
754 		(*commit)->author = strdup("");
755 		if ((*commit)->author == NULL) {
756 			err = got_error_from_errno("strdup");
757 			goto done;
758 		}
759 	} else {
760 		(*commit)->author = malloc(icommit->author_len + 1);
761 		if ((*commit)->author == NULL) {
762 			err = got_error_from_errno("malloc");
763 			goto done;
764 		}
765 		memcpy((*commit)->author, imsg->data + len,
766 		    icommit->author_len);
767 		(*commit)->author[icommit->author_len] = '\0';
768 	}
769 	len += icommit->author_len;
770 
771 	if (icommit->committer_len == 0) {
772 		(*commit)->committer = strdup("");
773 		if ((*commit)->committer == NULL) {
774 			err = got_error_from_errno("strdup");
775 			goto done;
776 		}
777 	} else {
778 		(*commit)->committer =
779 		    malloc(icommit->committer_len + 1);
780 		if ((*commit)->committer == NULL) {
781 			err = got_error_from_errno("malloc");
782 			goto done;
783 		}
784 		memcpy((*commit)->committer, imsg->data + len,
785 		    icommit->committer_len);
786 		(*commit)->committer[icommit->committer_len] = '\0';
787 	}
788 	len += icommit->committer_len;
789 
790 	if (icommit->logmsg_len == 0) {
791 		(*commit)->logmsg = strdup("");
792 		if ((*commit)->logmsg == NULL) {
793 			err = got_error_from_errno("strdup");
794 			goto done;
795 		}
796 	} else {
797 		size_t offset = 0, remain = icommit->logmsg_len;
798 
799 		(*commit)->logmsg = malloc(icommit->logmsg_len + 1);
800 		if ((*commit)->logmsg == NULL) {
801 			err = got_error_from_errno("malloc");
802 			goto done;
803 		}
804 		while (remain > 0) {
805 			struct imsg imsg_log;
806 			size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
807 			    remain);
808 
809 			err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
810 			if (err)
811 				goto done;
812 
813 			if (imsg_log.hdr.type != GOT_IMSG_COMMIT_LOGMSG) {
814 				err = got_error(GOT_ERR_PRIVSEP_MSG);
815 				goto done;
816 			}
817 
818 			memcpy((*commit)->logmsg + offset,
819 			    imsg_log.data, n);
820 			imsg_free(&imsg_log);
821 			offset += n;
822 			remain -= n;
823 		}
824 		(*commit)->logmsg[icommit->logmsg_len] = '\0';
825 	}
826 
827 	for (i = 0; i < icommit->nparents; i++) {
828 		struct got_object_qid *qid;
829 
830 		err = got_object_qid_alloc_partial(&qid);
831 		if (err)
832 			break;
833 		memcpy(qid->id, imsg->data + len +
834 		    i * SHA1_DIGEST_LENGTH, sizeof(*qid->id));
835 		SIMPLEQ_INSERT_TAIL(&(*commit)->parent_ids, qid, entry);
836 		(*commit)->nparents++;
837 	}
838 done:
839 	if (err) {
840 		got_object_commit_close(*commit);
841 		*commit = NULL;
842 	}
843 	return err;
844 }
845 
846 const struct got_error *
847 got_privsep_recv_commit(struct got_commit_object **commit, struct imsgbuf *ibuf)
848 {
849 	const struct got_error *err = NULL;
850 	struct imsg imsg;
851 	size_t datalen;
852 	const size_t min_datalen =
853 	    MIN(sizeof(struct got_imsg_error),
854 	    sizeof(struct got_imsg_commit_object));
855 
856 	*commit = NULL;
857 
858 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
859 	if (err)
860 		return err;
861 
862 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
863 
864 	switch (imsg.hdr.type) {
865 	case GOT_IMSG_COMMIT:
866 		err = get_commit_from_imsg(commit, &imsg, datalen, ibuf);
867 		break;
868 	default:
869 		err = got_error(GOT_ERR_PRIVSEP_MSG);
870 		break;
871 	}
872 
873 	imsg_free(&imsg);
874 
875 	return err;
876 }
877 
878 const struct got_error *
879 got_privsep_send_tree(struct imsgbuf *ibuf, struct got_pathlist_head *entries,
880     int nentries)
881 {
882 	const struct got_error *err = NULL;
883 	struct got_imsg_tree_object itree;
884 	struct got_pathlist_entry *pe;
885 	size_t totlen;
886 	int nimsg; /* number of imsg queued in ibuf */
887 
888 	itree.nentries = nentries;
889 	if (imsg_compose(ibuf, GOT_IMSG_TREE, 0, 0, -1, &itree, sizeof(itree))
890 	    == -1)
891 		return got_error_from_errno("imsg_compose TREE");
892 
893 	totlen = sizeof(itree);
894 	nimsg = 1;
895 	TAILQ_FOREACH(pe, entries, entry) {
896 		const char *name = pe->path;
897 		struct got_parsed_tree_entry *pte = pe->data;
898 		struct ibuf *wbuf;
899 		size_t namelen = strlen(name);
900 		size_t len = sizeof(struct got_imsg_tree_entry) + namelen;
901 
902 		if (len > MAX_IMSGSIZE)
903 			return got_error(GOT_ERR_NO_SPACE);
904 
905 		nimsg++;
906 		if (totlen + len >= MAX_IMSGSIZE - (IMSG_HEADER_SIZE * nimsg)) {
907 			err = flush_imsg(ibuf);
908 			if (err)
909 				return err;
910 			nimsg = 0;
911 		}
912 
913 		wbuf = imsg_create(ibuf, GOT_IMSG_TREE_ENTRY, 0, 0, len);
914 		if (wbuf == NULL)
915 			return got_error_from_errno("imsg_create TREE_ENTRY");
916 
917 		/* Keep in sync with struct got_imsg_tree_object definition! */
918 		if (imsg_add(wbuf, pte->id, SHA1_DIGEST_LENGTH) == -1) {
919 			err = got_error_from_errno("imsg_add TREE_ENTRY");
920 			ibuf_free(wbuf);
921 			return err;
922 		}
923 		if (imsg_add(wbuf, &pte->mode, sizeof(pte->mode)) == -1) {
924 			err = got_error_from_errno("imsg_add TREE_ENTRY");
925 			ibuf_free(wbuf);
926 			return err;
927 		}
928 
929 		if (imsg_add(wbuf, name, namelen) == -1) {
930 			err = got_error_from_errno("imsg_add TREE_ENTRY");
931 			ibuf_free(wbuf);
932 			return err;
933 		}
934 
935 		wbuf->fd = -1;
936 		imsg_close(ibuf, wbuf);
937 
938 		totlen += len;
939 	}
940 
941 	return flush_imsg(ibuf);
942 }
943 
944 const struct got_error *
945 got_privsep_recv_tree(struct got_tree_object **tree, struct imsgbuf *ibuf)
946 {
947 	const struct got_error *err = NULL;
948 	const size_t min_datalen =
949 	    MIN(sizeof(struct got_imsg_error),
950 	    sizeof(struct got_imsg_tree_object));
951 	struct got_imsg_tree_object *itree;
952 	int nentries = 0;
953 
954 	*tree = NULL;
955 get_more:
956 	err = read_imsg(ibuf);
957 	if (err)
958 		goto done;
959 
960 	for (;;) {
961 		struct imsg imsg;
962 		size_t n;
963 		size_t datalen;
964 		struct got_imsg_tree_entry *ite;
965 		struct got_tree_entry *te = NULL;
966 
967 		n = imsg_get(ibuf, &imsg);
968 		if (n == 0) {
969 			if (*tree && (*tree)->nentries != nentries)
970 				goto get_more;
971 			break;
972 		}
973 
974 		if (imsg.hdr.len < IMSG_HEADER_SIZE + min_datalen)
975 			return got_error(GOT_ERR_PRIVSEP_LEN);
976 
977 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
978 
979 		switch (imsg.hdr.type) {
980 		case GOT_IMSG_ERROR:
981 			err = recv_imsg_error(&imsg, datalen);
982 			break;
983 		case GOT_IMSG_TREE:
984 			/* This message should only appear once. */
985 			if (*tree != NULL) {
986 				err = got_error(GOT_ERR_PRIVSEP_MSG);
987 				break;
988 			}
989 			if (datalen != sizeof(*itree)) {
990 				err = got_error(GOT_ERR_PRIVSEP_LEN);
991 				break;
992 			}
993 			itree = imsg.data;
994 			*tree = malloc(sizeof(**tree));
995 			if (*tree == NULL) {
996 				err = got_error_from_errno("malloc");
997 				break;
998 			}
999 			(*tree)->entries = calloc(itree->nentries,
1000 			    sizeof(struct got_tree_entry));
1001 			if ((*tree)->entries == NULL) {
1002 				err = got_error_from_errno("malloc");
1003 				break;
1004 			}
1005 			(*tree)->nentries = itree->nentries;
1006 			(*tree)->refcnt = 0;
1007 			break;
1008 		case GOT_IMSG_TREE_ENTRY:
1009 			/* This message should be preceeded by GOT_IMSG_TREE. */
1010 			if (*tree == NULL) {
1011 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1012 				break;
1013 			}
1014 			if (datalen < sizeof(*ite) || datalen > MAX_IMSGSIZE) {
1015 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1016 				break;
1017 			}
1018 
1019 			/* Remaining data contains the entry's name. */
1020 			datalen -= sizeof(*ite);
1021 			if (datalen == 0 || datalen > MAX_IMSGSIZE) {
1022 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1023 				break;
1024 			}
1025 			ite = imsg.data;
1026 
1027 			if (datalen + 1 > sizeof(te->name)) {
1028 				err = got_error(GOT_ERR_NO_SPACE);
1029 				break;
1030 			}
1031 			te = &(*tree)->entries[nentries];
1032 			memcpy(te->name, imsg.data + sizeof(*ite), datalen);
1033 			te->name[datalen] = '\0';
1034 
1035 			memcpy(te->id.sha1, ite->id, SHA1_DIGEST_LENGTH);
1036 			te->mode = ite->mode;
1037 			te->idx = nentries;
1038 			nentries++;
1039 			break;
1040 		default:
1041 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1042 			break;
1043 		}
1044 
1045 		imsg_free(&imsg);
1046 	}
1047 done:
1048 	if (*tree && (*tree)->nentries != nentries) {
1049 		if (err == NULL)
1050 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1051 		got_object_tree_close(*tree);
1052 		*tree = NULL;
1053 	}
1054 
1055 	return err;
1056 }
1057 
1058 const struct got_error *
1059 got_privsep_send_blob(struct imsgbuf *ibuf, size_t size, size_t hdrlen,
1060     const uint8_t *data)
1061 {
1062 	struct got_imsg_blob iblob;
1063 
1064 	iblob.size = size;
1065 	iblob.hdrlen = hdrlen;
1066 
1067 	if (data) {
1068 		uint8_t *buf;
1069 
1070 		if (size > GOT_PRIVSEP_INLINE_BLOB_DATA_MAX)
1071 			return got_error(GOT_ERR_NO_SPACE);
1072 
1073 		buf = malloc(sizeof(iblob) + size);
1074 		if (buf == NULL)
1075 			return got_error_from_errno("malloc");
1076 
1077 		memcpy(buf, &iblob, sizeof(iblob));
1078 		memcpy(buf + sizeof(iblob), data, size);
1079 		if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, buf,
1080 		   sizeof(iblob) + size) == -1) {
1081 			free(buf);
1082 			return got_error_from_errno("imsg_compose BLOB");
1083 		}
1084 		free(buf);
1085 	} else {
1086 		/* Data has already been written to file descriptor. */
1087 		if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, &iblob,
1088 		    sizeof(iblob)) == -1)
1089 			return got_error_from_errno("imsg_compose BLOB");
1090 	}
1091 
1092 
1093 	return flush_imsg(ibuf);
1094 }
1095 
1096 const struct got_error *
1097 got_privsep_recv_blob(uint8_t **outbuf, size_t *size, size_t *hdrlen,
1098     struct imsgbuf *ibuf)
1099 {
1100 	const struct got_error *err = NULL;
1101 	struct imsg imsg;
1102 	struct got_imsg_blob *iblob;
1103 	size_t datalen;
1104 
1105 	*outbuf = NULL;
1106 
1107 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
1108 	if (err)
1109 		return err;
1110 
1111 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1112 
1113 	switch (imsg.hdr.type) {
1114 	case GOT_IMSG_BLOB:
1115 		if (datalen < sizeof(*iblob)) {
1116 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1117 			break;
1118 		}
1119 		iblob = imsg.data;
1120 		*size = iblob->size;
1121 		*hdrlen = iblob->hdrlen;
1122 
1123 		if (datalen == sizeof(*iblob)) {
1124 			/* Data has been written to file descriptor. */
1125 			break;
1126 		}
1127 
1128 		if (*size > GOT_PRIVSEP_INLINE_BLOB_DATA_MAX) {
1129 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1130 			break;
1131 		}
1132 
1133 		*outbuf = malloc(*size);
1134 		if (*outbuf == NULL) {
1135 			err = got_error_from_errno("malloc");
1136 			break;
1137 		}
1138 		memcpy(*outbuf, imsg.data + sizeof(*iblob), *size);
1139 		break;
1140 	default:
1141 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1142 		break;
1143 	}
1144 
1145 	imsg_free(&imsg);
1146 
1147 	return err;
1148 }
1149 
1150 static const struct got_error *
1151 send_tagmsg(struct imsgbuf *ibuf, struct got_tag_object *tag, size_t tagmsg_len)
1152 {
1153 	const struct got_error *err = NULL;
1154 	size_t offset, remain;
1155 
1156 	offset = 0;
1157 	remain = tagmsg_len;
1158 	while (remain > 0) {
1159 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
1160 
1161 		if (imsg_compose(ibuf, GOT_IMSG_TAG_TAGMSG, 0, 0, -1,
1162 		    tag->tagmsg + offset, n) == -1) {
1163 			err = got_error_from_errno("imsg_compose TAG_TAGMSG");
1164 			break;
1165 		}
1166 
1167 		err = flush_imsg(ibuf);
1168 		if (err)
1169 			break;
1170 
1171 		offset += n;
1172 		remain -= n;
1173 	}
1174 
1175 	return err;
1176 }
1177 
1178 const struct got_error *
1179 got_privsep_send_tag(struct imsgbuf *ibuf, struct got_tag_object *tag)
1180 {
1181 	const struct got_error *err = NULL;
1182 	struct got_imsg_tag_object *itag;
1183 	uint8_t *buf;
1184 	size_t len, total;
1185 	size_t tag_len = strlen(tag->tag);
1186 	size_t tagger_len = strlen(tag->tagger);
1187 	size_t tagmsg_len = strlen(tag->tagmsg);
1188 
1189 	total = sizeof(*itag) + tag_len + tagger_len + tagmsg_len;
1190 
1191 	buf = malloc(total);
1192 	if (buf == NULL)
1193 		return got_error_from_errno("malloc");
1194 
1195 	itag = (struct got_imsg_tag_object *)buf;
1196 	memcpy(itag->id, tag->id.sha1, sizeof(itag->id));
1197 	itag->obj_type = tag->obj_type;
1198 	itag->tag_len = tag_len;
1199 	itag->tagger_len = tagger_len;
1200 	itag->tagger_time = tag->tagger_time;
1201 	itag->tagger_gmtoff = tag->tagger_gmtoff;
1202 	itag->tagmsg_len = tagmsg_len;
1203 
1204 	len = sizeof(*itag);
1205 	memcpy(buf + len, tag->tag, tag_len);
1206 	len += tag_len;
1207 	memcpy(buf + len, tag->tagger, tagger_len);
1208 	len += tagger_len;
1209 
1210 	if (imsg_compose(ibuf, GOT_IMSG_TAG, 0, 0, -1, buf, len) == -1) {
1211 		err = got_error_from_errno("imsg_compose TAG");
1212 		goto done;
1213 	}
1214 
1215 	if (tagmsg_len == 0 ||
1216 	    tagmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
1217 		err = flush_imsg(ibuf);
1218 		if (err)
1219 			goto done;
1220 	}
1221 	err = send_tagmsg(ibuf, tag, tagmsg_len);
1222 done:
1223 	free(buf);
1224 	return err;
1225 }
1226 
1227 const struct got_error *
1228 got_privsep_recv_tag(struct got_tag_object **tag, struct imsgbuf *ibuf)
1229 {
1230 	const struct got_error *err = NULL;
1231 	struct imsg imsg;
1232 	struct got_imsg_tag_object *itag;
1233 	size_t len, datalen;
1234 	const size_t min_datalen =
1235 	    MIN(sizeof(struct got_imsg_error),
1236 	    sizeof(struct got_imsg_tag_object));
1237 
1238 	*tag = NULL;
1239 
1240 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1241 	if (err)
1242 		return err;
1243 
1244 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1245 	len = 0;
1246 
1247 	switch (imsg.hdr.type) {
1248 	case GOT_IMSG_TAG:
1249 		if (datalen < sizeof(*itag)) {
1250 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1251 			break;
1252 		}
1253 		itag = imsg.data;
1254 		if (datalen != sizeof(*itag) + itag->tag_len +
1255 		    itag->tagger_len) {
1256 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1257 			break;
1258 		}
1259 		len += sizeof(*itag);
1260 
1261 		*tag = calloc(1, sizeof(**tag));
1262 		if (*tag == NULL) {
1263 			err = got_error_from_errno("calloc");
1264 			break;
1265 		}
1266 
1267 		memcpy((*tag)->id.sha1, itag->id, SHA1_DIGEST_LENGTH);
1268 
1269 		if (itag->tag_len == 0) {
1270 			(*tag)->tag = strdup("");
1271 			if ((*tag)->tag == NULL) {
1272 				err = got_error_from_errno("strdup");
1273 				break;
1274 			}
1275 		} else {
1276 			(*tag)->tag = malloc(itag->tag_len + 1);
1277 			if ((*tag)->tag == NULL) {
1278 				err = got_error_from_errno("malloc");
1279 				break;
1280 			}
1281 			memcpy((*tag)->tag, imsg.data + len,
1282 			    itag->tag_len);
1283 			(*tag)->tag[itag->tag_len] = '\0';
1284 		}
1285 		len += itag->tag_len;
1286 
1287 		(*tag)->obj_type = itag->obj_type;
1288 		(*tag)->tagger_time = itag->tagger_time;
1289 		(*tag)->tagger_gmtoff = itag->tagger_gmtoff;
1290 
1291 		if (itag->tagger_len == 0) {
1292 			(*tag)->tagger = strdup("");
1293 			if ((*tag)->tagger == NULL) {
1294 				err = got_error_from_errno("strdup");
1295 				break;
1296 			}
1297 		} else {
1298 			(*tag)->tagger = malloc(itag->tagger_len + 1);
1299 			if ((*tag)->tagger == NULL) {
1300 				err = got_error_from_errno("malloc");
1301 				break;
1302 			}
1303 			memcpy((*tag)->tagger, imsg.data + len,
1304 			    itag->tagger_len);
1305 			(*tag)->tagger[itag->tagger_len] = '\0';
1306 		}
1307 		len += itag->tagger_len;
1308 
1309 		if (itag->tagmsg_len == 0) {
1310 			(*tag)->tagmsg = strdup("");
1311 			if ((*tag)->tagmsg == NULL) {
1312 				err = got_error_from_errno("strdup");
1313 				break;
1314 			}
1315 		} else {
1316 			size_t offset = 0, remain = itag->tagmsg_len;
1317 
1318 			(*tag)->tagmsg = malloc(itag->tagmsg_len + 1);
1319 			if ((*tag)->tagmsg == NULL) {
1320 				err = got_error_from_errno("malloc");
1321 				break;
1322 			}
1323 			while (remain > 0) {
1324 				struct imsg imsg_log;
1325 				size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
1326 				    remain);
1327 
1328 				err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
1329 				if (err)
1330 					return err;
1331 
1332 				if (imsg_log.hdr.type != GOT_IMSG_TAG_TAGMSG)
1333 					return got_error(GOT_ERR_PRIVSEP_MSG);
1334 
1335 				memcpy((*tag)->tagmsg + offset, imsg_log.data,
1336 				    n);
1337 				imsg_free(&imsg_log);
1338 				offset += n;
1339 				remain -= n;
1340 			}
1341 			(*tag)->tagmsg[itag->tagmsg_len] = '\0';
1342 		}
1343 
1344 		break;
1345 	default:
1346 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1347 		break;
1348 	}
1349 
1350 	imsg_free(&imsg);
1351 
1352 	return err;
1353 }
1354 
1355 const struct got_error *
1356 got_privsep_init_pack_child(struct imsgbuf *ibuf, struct got_pack *pack,
1357     struct got_packidx *packidx)
1358 {
1359 	const struct got_error *err = NULL;
1360 	struct got_imsg_packidx ipackidx;
1361 	struct got_imsg_pack ipack;
1362 	int fd;
1363 
1364 	ipackidx.len = packidx->len;
1365 	fd = dup(packidx->fd);
1366 	if (fd == -1)
1367 		return got_error_from_errno("dup");
1368 
1369 	if (imsg_compose(ibuf, GOT_IMSG_PACKIDX, 0, 0, fd, &ipackidx,
1370 	    sizeof(ipackidx)) == -1) {
1371 		err = got_error_from_errno("imsg_compose PACKIDX");
1372 		close(fd);
1373 		return err;
1374 	}
1375 
1376 	if (strlcpy(ipack.path_packfile, pack->path_packfile,
1377 	    sizeof(ipack.path_packfile)) >= sizeof(ipack.path_packfile))
1378 		return got_error(GOT_ERR_NO_SPACE);
1379 	ipack.filesize = pack->filesize;
1380 
1381 	fd = dup(pack->fd);
1382 	if (fd == -1)
1383 		return got_error_from_errno("dup");
1384 
1385 	if (imsg_compose(ibuf, GOT_IMSG_PACK, 0, 0, fd, &ipack, sizeof(ipack))
1386 	    == -1) {
1387 		err = got_error_from_errno("imsg_compose PACK");
1388 		close(fd);
1389 		return err;
1390 	}
1391 
1392 	return flush_imsg(ibuf);
1393 }
1394 
1395 const struct got_error *
1396 got_privsep_send_packed_obj_req(struct imsgbuf *ibuf, int idx,
1397     struct got_object_id *id)
1398 {
1399 	struct got_imsg_packed_object iobj;
1400 
1401 	iobj.idx = idx;
1402 	memcpy(iobj.id, id->sha1, sizeof(iobj.id));
1403 
1404 	if (imsg_compose(ibuf, GOT_IMSG_PACKED_OBJECT_REQUEST, 0, 0, -1,
1405 	    &iobj, sizeof(iobj)) == -1)
1406 		return got_error_from_errno("imsg_compose "
1407 		    "PACKED_OBJECT_REQUEST");
1408 
1409 	return flush_imsg(ibuf);
1410 }
1411 
1412 const struct got_error *
1413 got_privsep_send_gitconfig_parse_req(struct imsgbuf *ibuf, int fd)
1414 {
1415 	const struct got_error *err = NULL;
1416 
1417 	if (imsg_compose(ibuf, GOT_IMSG_GITCONFIG_PARSE_REQUEST, 0, 0, fd,
1418 	    NULL, 0) == -1) {
1419 		err = got_error_from_errno("imsg_compose "
1420 		    "GITCONFIG_PARSE_REQUEST");
1421 		close(fd);
1422 		return err;
1423 	}
1424 
1425 	return flush_imsg(ibuf);
1426 }
1427 
1428 const struct got_error *
1429 got_privsep_send_gitconfig_repository_format_version_req(struct imsgbuf *ibuf)
1430 {
1431 	if (imsg_compose(ibuf,
1432 	    GOT_IMSG_GITCONFIG_REPOSITORY_FORMAT_VERSION_REQUEST, 0, 0, -1,
1433 	    NULL, 0) == -1)
1434 		return got_error_from_errno("imsg_compose "
1435 		    "GITCONFIG_REPOSITORY_FORMAT_VERSION_REQUEST");
1436 
1437 	return flush_imsg(ibuf);
1438 }
1439 
1440 const struct got_error *
1441 got_privsep_send_gitconfig_author_name_req(struct imsgbuf *ibuf)
1442 {
1443 	if (imsg_compose(ibuf,
1444 	    GOT_IMSG_GITCONFIG_AUTHOR_NAME_REQUEST, 0, 0, -1, NULL, 0) == -1)
1445 		return got_error_from_errno("imsg_compose "
1446 		    "GITCONFIG_AUTHOR_NAME_REQUEST");
1447 
1448 	return flush_imsg(ibuf);
1449 }
1450 
1451 const struct got_error *
1452 got_privsep_send_gitconfig_author_email_req(struct imsgbuf *ibuf)
1453 {
1454 	if (imsg_compose(ibuf,
1455 	    GOT_IMSG_GITCONFIG_AUTHOR_EMAIL_REQUEST, 0, 0, -1, NULL, 0) == -1)
1456 		return got_error_from_errno("imsg_compose "
1457 		    "GITCONFIG_AUTHOR_EMAIL_REQUEST");
1458 
1459 	return flush_imsg(ibuf);
1460 }
1461 
1462 const struct got_error *
1463 got_privsep_send_gitconfig_remotes_req(struct imsgbuf *ibuf)
1464 {
1465 	if (imsg_compose(ibuf,
1466 	    GOT_IMSG_GITCONFIG_REMOTES_REQUEST, 0, 0, -1, NULL, 0) == -1)
1467 		return got_error_from_errno("imsg_compose "
1468 		    "GITCONFIG_REMOTE_REQUEST");
1469 
1470 	return flush_imsg(ibuf);
1471 }
1472 
1473 const struct got_error *
1474 got_privsep_send_gitconfig_owner_req(struct imsgbuf *ibuf)
1475 {
1476 	if (imsg_compose(ibuf,
1477 	    GOT_IMSG_GITCONFIG_OWNER_REQUEST, 0, 0, -1, NULL, 0) == -1)
1478 		return got_error_from_errno("imsg_compose "
1479 		    "GITCONFIG_OWNER_REQUEST");
1480 
1481 	return flush_imsg(ibuf);
1482 }
1483 
1484 const struct got_error *
1485 got_privsep_send_gitconfig_str(struct imsgbuf *ibuf, const char *value)
1486 {
1487 	size_t len = value ? strlen(value) + 1 : 0;
1488 
1489 	if (imsg_compose(ibuf, GOT_IMSG_GITCONFIG_STR_VAL, 0, 0, -1,
1490 	    value, len) == -1)
1491 		return got_error_from_errno("imsg_compose GITCONFIG_STR_VAL");
1492 
1493 	return flush_imsg(ibuf);
1494 }
1495 
1496 const struct got_error *
1497 got_privsep_recv_gitconfig_str(char **str, struct imsgbuf *ibuf)
1498 {
1499 	const struct got_error *err = NULL;
1500 	struct imsg imsg;
1501 	size_t datalen;
1502 	const size_t min_datalen = 0;
1503 
1504 	*str = NULL;
1505 
1506 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1507 	if (err)
1508 		return err;
1509 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1510 
1511 	switch (imsg.hdr.type) {
1512 	case GOT_IMSG_GITCONFIG_STR_VAL:
1513 		if (datalen == 0)
1514 			break;
1515 		*str = malloc(datalen);
1516 		if (*str == NULL) {
1517 			err = got_error_from_errno("malloc");
1518 			break;
1519 		}
1520 		if (strlcpy(*str, imsg.data, datalen) >= datalen)
1521 			err = got_error(GOT_ERR_NO_SPACE);
1522 		break;
1523 	default:
1524 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1525 		break;
1526 	}
1527 
1528 	imsg_free(&imsg);
1529 	return err;
1530 }
1531 
1532 const struct got_error *
1533 got_privsep_send_gitconfig_int(struct imsgbuf *ibuf, int value)
1534 {
1535 	if (imsg_compose(ibuf, GOT_IMSG_GITCONFIG_INT_VAL, 0, 0, -1,
1536 	    &value, sizeof(value)) == -1)
1537 		return got_error_from_errno("imsg_compose GITCONFIG_INT_VAL");
1538 
1539 	return flush_imsg(ibuf);
1540 }
1541 
1542 const struct got_error *
1543 got_privsep_recv_gitconfig_int(int *val, struct imsgbuf *ibuf)
1544 {
1545 	const struct got_error *err = NULL;
1546 	struct imsg imsg;
1547 	size_t datalen;
1548 	const size_t min_datalen =
1549 	    MIN(sizeof(struct got_imsg_error), sizeof(int));
1550 
1551 	*val = 0;
1552 
1553 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1554 	if (err)
1555 		return err;
1556 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1557 
1558 	switch (imsg.hdr.type) {
1559 	case GOT_IMSG_GITCONFIG_INT_VAL:
1560 		if (datalen != sizeof(*val)) {
1561 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1562 			break;
1563 		}
1564 		memcpy(val, imsg.data, sizeof(*val));
1565 		break;
1566 	default:
1567 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1568 		break;
1569 	}
1570 
1571 	imsg_free(&imsg);
1572 	return err;
1573 }
1574 
1575 const struct got_error *
1576 got_privsep_send_gitconfig_remotes(struct imsgbuf *ibuf,
1577     struct got_remote_repo *remotes, int nremotes)
1578 {
1579 	const struct got_error *err = NULL;
1580 	struct got_imsg_remotes iremotes;
1581 	int i;
1582 
1583 	iremotes.nremotes = nremotes;
1584 	if (imsg_compose(ibuf, GOT_IMSG_GITCONFIG_REMOTES, 0, 0, -1,
1585 	    &iremotes, sizeof(iremotes)) == -1)
1586 		return got_error_from_errno("imsg_compose GITCONFIG_REMOTES");
1587 
1588 	err = flush_imsg(ibuf);
1589 	imsg_clear(ibuf);
1590 	if (err)
1591 		return err;
1592 
1593 	for (i = 0; i < nremotes; i++) {
1594 		struct got_imsg_remote iremote;
1595 		size_t len = sizeof(iremote);
1596 		struct ibuf *wbuf;
1597 
1598 		iremote.name_len = strlen(remotes[i].name);
1599 		len += iremote.name_len;
1600 		iremote.url_len = strlen(remotes[i].url);
1601 		len += iremote.url_len;
1602 
1603 		wbuf = imsg_create(ibuf, GOT_IMSG_GITCONFIG_REMOTE, 0, 0, len);
1604 		if (wbuf == NULL)
1605 			return got_error_from_errno(
1606 			    "imsg_create GITCONFIG_REMOTE");
1607 
1608 		if (imsg_add(wbuf, &iremote, sizeof(iremote)) == -1) {
1609 			err = got_error_from_errno(
1610 			    "imsg_add GIITCONFIG_REMOTE");
1611 			ibuf_free(wbuf);
1612 			return err;
1613 		}
1614 
1615 		if (imsg_add(wbuf, remotes[i].name, iremote.name_len) == -1) {
1616 			err = got_error_from_errno(
1617 			    "imsg_add GIITCONFIG_REMOTE");
1618 			ibuf_free(wbuf);
1619 			return err;
1620 		}
1621 		if (imsg_add(wbuf, remotes[i].url, iremote.url_len) == -1) {
1622 			err = got_error_from_errno(
1623 			    "imsg_add GIITCONFIG_REMOTE");
1624 			ibuf_free(wbuf);
1625 			return err;
1626 		}
1627 
1628 		wbuf->fd = -1;
1629 		imsg_close(ibuf, wbuf);
1630 		err = flush_imsg(ibuf);
1631 		if (err)
1632 			return err;
1633 	}
1634 
1635 	return NULL;
1636 }
1637 
1638 const struct got_error *
1639 got_privsep_recv_gitconfig_remotes(struct got_remote_repo **remotes,
1640     int *nremotes, struct imsgbuf *ibuf)
1641 {
1642 	const struct got_error *err = NULL;
1643 	struct imsg imsg;
1644 	size_t datalen;
1645 	struct got_imsg_remotes iremotes;
1646 	struct got_imsg_remote iremote;
1647 
1648 	*remotes = NULL;
1649 	*nremotes = 0;
1650 	iremotes.nremotes = 0;
1651 
1652 	err = got_privsep_recv_imsg(&imsg, ibuf, sizeof(iremotes));
1653 	if (err)
1654 		return err;
1655 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1656 
1657 	switch (imsg.hdr.type) {
1658 	case GOT_IMSG_GITCONFIG_REMOTES:
1659 		if (datalen != sizeof(iremotes)) {
1660 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1661 			break;
1662 		}
1663 		memcpy(&iremotes, imsg.data, sizeof(iremotes));
1664 		if (iremotes.nremotes == 0) {
1665 			imsg_free(&imsg);
1666 			return NULL;
1667 		}
1668 		break;
1669 	default:
1670 		imsg_free(&imsg);
1671 		return got_error(GOT_ERR_PRIVSEP_MSG);
1672 	}
1673 
1674 	imsg_free(&imsg);
1675 
1676 	*remotes = recallocarray(NULL, 0, iremotes.nremotes, sizeof(iremote));
1677 	if (*remotes == NULL)
1678 		return got_error_from_errno("recallocarray");
1679 
1680 	while (*nremotes < iremotes.nremotes) {
1681 		struct got_remote_repo *remote;
1682 	
1683 		err = got_privsep_recv_imsg(&imsg, ibuf, sizeof(iremote));
1684 		if (err)
1685 			break;
1686 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1687 
1688 		switch (imsg.hdr.type) {
1689 		case GOT_IMSG_GITCONFIG_REMOTE:
1690 			remote = &(*remotes)[*nremotes];
1691 			if (datalen < sizeof(iremote)) {
1692 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1693 				break;
1694 			}
1695 			memcpy(&iremote, imsg.data, sizeof(iremote));
1696 			if (iremote.name_len == 0 || iremote.url_len == 0 ||
1697 			    (sizeof(iremote) + iremote.name_len +
1698 			    iremote.url_len) > datalen) {
1699 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1700 				break;
1701 			}
1702 			remote->name = strndup(imsg.data + sizeof(iremote),
1703 			    iremote.name_len);
1704 			if (remote->name == NULL) {
1705 				err = got_error_from_errno("strndup");
1706 				break;
1707 			}
1708 			remote->url = strndup(imsg.data + sizeof(iremote) +
1709 			    iremote.name_len, iremote.url_len);
1710 			if (remote->url == NULL) {
1711 				err = got_error_from_errno("strndup");
1712 				free(remote->name);
1713 				break;
1714 			}
1715 			(*nremotes)++;
1716 			break;
1717 		default:
1718 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1719 			break;
1720 		}
1721 
1722 		imsg_free(&imsg);
1723 		if (err)
1724 			break;
1725 	}
1726 
1727 	if (err) {
1728 		int i;
1729 		for (i = 0; i < *nremotes; i++) {
1730 			free((*remotes)[i].name);
1731 			free((*remotes)[i].url);
1732 		}
1733 		free(*remotes);
1734 		*remotes = NULL;
1735 		*nremotes = 0;
1736 	}
1737 	return err;
1738 }
1739 
1740 const struct got_error *
1741 got_privsep_send_commit_traversal_request(struct imsgbuf *ibuf,
1742      struct got_object_id *id, int idx, const char *path)
1743 {
1744 	const struct got_error *err = NULL;
1745 	struct ibuf *wbuf;
1746 	size_t path_len = strlen(path) + 1;
1747 
1748 	wbuf = imsg_create(ibuf, GOT_IMSG_COMMIT_TRAVERSAL_REQUEST, 0, 0,
1749 	    sizeof(struct got_imsg_commit_traversal_request) + path_len);
1750 	if (wbuf == NULL)
1751 		return got_error_from_errno(
1752 		    "imsg_create COMMIT_TRAVERSAL_REQUEST");
1753 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
1754 		err = got_error_from_errno("imsg_add COMMIT_TRAVERSAL_REQUEST");
1755 		ibuf_free(wbuf);
1756 		return err;
1757 	}
1758 	if (imsg_add(wbuf, &idx, sizeof(idx)) == -1) {
1759 		err = got_error_from_errno("imsg_add COMMIT_TRAVERSAL_REQUEST");
1760 		ibuf_free(wbuf);
1761 		return err;
1762 	}
1763 	if (imsg_add(wbuf, path, path_len) == -1) {
1764 		err = got_error_from_errno("imsg_add COMMIT_TRAVERSAL_REQUEST");
1765 		ibuf_free(wbuf);
1766 		return err;
1767 	}
1768 
1769 	wbuf->fd = -1;
1770 	imsg_close(ibuf, wbuf);
1771 
1772 	return flush_imsg(ibuf);
1773 }
1774 
1775 const struct got_error *
1776 got_privsep_send_traversed_commits(struct got_object_id *commit_ids, 
1777     size_t ncommits, struct imsgbuf *ibuf)
1778 {
1779 	const struct got_error *err;
1780 	struct ibuf *wbuf;
1781 	int i;
1782 
1783 	wbuf = imsg_create(ibuf, GOT_IMSG_TRAVERSED_COMMITS, 0, 0,
1784 	    sizeof(struct got_imsg_traversed_commits) +
1785 	    ncommits * SHA1_DIGEST_LENGTH);
1786 	if (wbuf == NULL)
1787 		return got_error_from_errno("imsg_create TRAVERSED_COMMITS");
1788 
1789 	if (imsg_add(wbuf, &ncommits, sizeof(ncommits)) == -1) {
1790 		err = got_error_from_errno("imsg_add TRAVERSED_COMMITS");
1791 		ibuf_free(wbuf);
1792 		return err;
1793 	}
1794 	for (i = 0; i < ncommits; i++) {
1795 		struct got_object_id *id = &commit_ids[i];
1796 		if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
1797 			err = got_error_from_errno(
1798 			    "imsg_add TRAVERSED_COMMITS");
1799 			ibuf_free(wbuf);
1800 			return err;
1801 		}
1802 	}
1803 
1804 	wbuf->fd = -1;
1805 	imsg_close(ibuf, wbuf);
1806 
1807 	return flush_imsg(ibuf);
1808 }
1809 
1810 const struct got_error *
1811 got_privsep_recv_traversed_commits(struct got_commit_object **changed_commit,
1812     struct got_object_id **changed_commit_id,
1813     struct got_object_id_queue *commit_ids, struct imsgbuf *ibuf)
1814 {
1815 	const struct got_error *err = NULL;
1816 	struct imsg imsg;
1817 	struct got_imsg_traversed_commits *icommits;
1818 	size_t datalen;
1819 	int i, done = 0;
1820 
1821 	*changed_commit = NULL;
1822 	*changed_commit_id = NULL;
1823 
1824 	while (!done) {
1825 		err = got_privsep_recv_imsg(&imsg, ibuf, 0);
1826 		if (err)
1827 			return err;
1828 
1829 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1830 		switch (imsg.hdr.type) {
1831 		case GOT_IMSG_TRAVERSED_COMMITS:
1832 			icommits = imsg.data;
1833 			if (datalen != sizeof(*icommits) +
1834 			    icommits->ncommits * SHA1_DIGEST_LENGTH) {
1835 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1836 				break;
1837 			}
1838 			for (i = 0; i < icommits->ncommits; i++) {
1839 				struct got_object_qid *qid;
1840 				uint8_t *sha1 = (uint8_t *)imsg.data +
1841 				    sizeof(*icommits) + i * SHA1_DIGEST_LENGTH;
1842 				err = got_object_qid_alloc_partial(&qid);
1843 				if (err)
1844 					break;
1845 				memcpy(qid->id->sha1, sha1, SHA1_DIGEST_LENGTH);
1846 				SIMPLEQ_INSERT_TAIL(commit_ids, qid, entry);
1847 
1848 				/* The last commit may contain a change. */
1849 				if (i == icommits->ncommits - 1) {
1850 					*changed_commit_id =
1851 					    got_object_id_dup(qid->id);
1852 					if (*changed_commit_id == NULL) {
1853 						err = got_error_from_errno(
1854 						    "got_object_id_dup");
1855 						break;
1856 					}
1857 				}
1858 			}
1859 			break;
1860 		case GOT_IMSG_COMMIT:
1861 			if (*changed_commit_id == NULL) {
1862 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1863 				break;
1864 			}
1865 			err = get_commit_from_imsg(changed_commit, &imsg,
1866 			    datalen, ibuf);
1867 			break;
1868 		case GOT_IMSG_COMMIT_TRAVERSAL_DONE:
1869 			done = 1;
1870 			break;
1871 		default:
1872 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1873 			break;
1874 		}
1875 
1876 		imsg_free(&imsg);
1877 		if (err)
1878 			break;
1879 	}
1880 
1881 	if (err)
1882 		got_object_id_queue_free(commit_ids);
1883 	return err;
1884 }
1885 
1886 const struct got_error *
1887 got_privsep_send_commit_traversal_done(struct imsgbuf *ibuf)
1888 {
1889 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_TRAVERSAL_DONE, 0, 0, -1,
1890 	    NULL, 0) == -1)
1891 		return got_error_from_errno("imsg_compose TRAVERSAL_DONE");
1892 
1893 	return flush_imsg(ibuf);
1894 }
1895 
1896 const struct got_error *
1897 got_privsep_unveil_exec_helpers(void)
1898 {
1899 	const char *helpers[] = {
1900 	    GOT_PATH_PROG_READ_PACK,
1901 	    GOT_PATH_PROG_READ_OBJECT,
1902 	    GOT_PATH_PROG_READ_COMMIT,
1903 	    GOT_PATH_PROG_READ_TREE,
1904 	    GOT_PATH_PROG_READ_BLOB,
1905 	    GOT_PATH_PROG_READ_TAG,
1906 	    GOT_PATH_PROG_READ_GITCONFIG,
1907 	};
1908 	int i;
1909 
1910 	for (i = 0; i < nitems(helpers); i++) {
1911 		if (unveil(helpers[i], "x") == 0)
1912 			continue;
1913 		return got_error_from_errno2("unveil", helpers[i]);
1914 	}
1915 
1916 	return NULL;
1917 }
1918 
1919 void
1920 got_privsep_exec_child(int imsg_fds[2], const char *path, const char *repo_path)
1921 {
1922 	if (close(imsg_fds[0]) != 0) {
1923 		fprintf(stderr, "%s: %s\n", getprogname(), strerror(errno));
1924 		_exit(1);
1925 	}
1926 
1927 	if (dup2(imsg_fds[1], GOT_IMSG_FD_CHILD) == -1) {
1928 		fprintf(stderr, "%s: %s\n", getprogname(), strerror(errno));
1929 		_exit(1);
1930 	}
1931 	if (closefrom(GOT_IMSG_FD_CHILD + 1) == -1) {
1932 		fprintf(stderr, "%s: %s\n", getprogname(), strerror(errno));
1933 		_exit(1);
1934 	}
1935 
1936 	if (execl(path, path, repo_path, (char *)NULL) == -1) {
1937 		fprintf(stderr, "%s: %s: %s\n", getprogname(), path,
1938 		    strerror(errno));
1939 		_exit(1);
1940 	}
1941 }