Gotweb

Blob

Date:: Thu Mar 7 12:00:23 2019 UTC
Message:: do not deadlock in waitpid() when user hits Ctrl-C
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2018, 2019 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/queue.h>
19 #include <sys/uio.h>
20 #include <sys/syslimits.h>
21 #include <sys/wait.h>
22 
23 #include <stdio.h>
24 #include <stdlib.h>
25 #include <string.h>
26 #include <errno.h>
27 #include <stdint.h>
28 #include <poll.h>
29 #include <imsg.h>
30 #include <sha1.h>
31 #include <zlib.h>
32 #include <time.h>
33 
34 #include "got_object.h"
35 #include "got_error.h"
36 
37 #include "got_lib_sha1.h"
38 #include "got_lib_delta.h"
39 #include "got_lib_inflate.h"
40 #include "got_lib_object.h"
41 #include "got_lib_object_parse.h"
42 #include "got_lib_privsep.h"
43 #include "got_lib_pack.h"
44 
45 #ifndef MIN
46 #define	MIN(_a,_b) ((_a) < (_b) ? (_a) : (_b))
47 #endif
48 
49 static const struct got_error *
50 poll_fd(int fd, int events, int timeout)
51 {
52 	struct pollfd pfd[1];
53 	int n;
54 
55 	pfd[0].fd = fd;
56 	pfd[0].events = events;
57 
58 	n = poll(pfd, 1, timeout);
59 	if (n == -1)
60 		return got_error_from_errno();
61 	if (n == 0)
62 		return got_error(GOT_ERR_TIMEOUT);
63 	if (pfd[0].revents & (POLLERR | POLLNVAL))
64 		return got_error_from_errno();
65 	if (pfd[0].revents & (events | POLLHUP))
66 		return NULL;
67 
68 	return got_error(GOT_ERR_INTERRUPT);
69 }
70 
71 static const struct got_error *
72 read_imsg(struct imsgbuf *ibuf)
73 {
74 	const struct got_error *err;
75 	size_t n;
76 
77 	err = poll_fd(ibuf->fd, POLLIN, INFTIM);
78 	if (err)
79 		return err;
80 
81 	n = imsg_read(ibuf);
82 	if (n == -1) {
83 		if (errno == EAGAIN) /* Could be a file-descriptor leak. */
84 			return got_error(GOT_ERR_PRIVSEP_NO_FD);
85 		return got_error(GOT_ERR_PRIVSEP_READ);
86 	}
87 	if (n == 0)
88 		return got_error(GOT_ERR_PRIVSEP_PIPE);
89 
90 	return NULL;
91 }
92 
93 const struct got_error *
94 got_privsep_wait_for_child(pid_t pid)
95 {
96 	int child_status;
97 
98 	if (waitpid(pid, &child_status, WNOHANG) == 0)
99 		return NULL;
100 
101 	if (!WIFEXITED(child_status))
102 		return got_error(GOT_ERR_PRIVSEP_DIED);
103 
104 	if (WEXITSTATUS(child_status) != 0)
105 		return got_error(GOT_ERR_PRIVSEP_EXIT);
106 
107 	return NULL;
108 }
109 
110 static const struct got_error *
111 recv_imsg_error(struct imsg *imsg, size_t datalen)
112 {
113 	struct got_imsg_error *ierr;
114 
115 	if (datalen != sizeof(*ierr))
116 		return got_error(GOT_ERR_PRIVSEP_LEN);
117 
118 	ierr = imsg->data;
119 	if (ierr->code == GOT_ERR_ERRNO) {
120 		static struct got_error serr;
121 		serr.code = GOT_ERR_ERRNO;
122 		serr.msg = strerror(ierr->errno_code);
123 		return &serr;
124 	}
125 
126 	return got_error(ierr->code);
127 }
128 
129 const struct got_error *
130 got_privsep_recv_imsg(struct imsg *imsg, struct imsgbuf *ibuf,
131     size_t min_datalen)
132 {
133 	const struct got_error *err;
134 	ssize_t n;
135 
136 	n = imsg_get(ibuf, imsg);
137 	if (n == -1)
138 		return got_error_from_errno();
139 
140 	while (n == 0) {
141 		err = read_imsg(ibuf);
142 		if (err)
143 			return err;
144 		n = imsg_get(ibuf, imsg);
145 	}
146 
147 	if (imsg->hdr.len < IMSG_HEADER_SIZE + min_datalen)
148 		return got_error(GOT_ERR_PRIVSEP_LEN);
149 
150 	if (imsg->hdr.type == GOT_IMSG_ERROR) {
151 		size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
152 		return recv_imsg_error(imsg, datalen);
153 	}
154 
155 	return NULL;
156 }
157 
158 /* Attempt to send an error in an imsg. Complain on stderr as a last resort. */
159 void
160 got_privsep_send_error(struct imsgbuf *ibuf, const struct got_error *err)
161 {
162 	const struct got_error *poll_err;
163 	struct got_imsg_error ierr;
164 	int ret;
165 
166 	ierr.code = err->code;
167 	if (err->code == GOT_ERR_ERRNO)
168 		ierr.errno_code = errno;
169 	else
170 		ierr.errno_code = 0;
171 	ret = imsg_compose(ibuf, GOT_IMSG_ERROR, 0, 0, -1, &ierr, sizeof(ierr));
172 	if (ret == -1) {
173 		fprintf(stderr, "%s: error %d \"%s\": imsg_compose: %s\n",
174 		    getprogname(), err->code, err->msg, strerror(errno));
175 		return;
176 	}
177 
178 	poll_err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
179 	if (poll_err) {
180 		fprintf(stderr, "%s: error %d \"%s\": poll: %s\n",
181 		    getprogname(), err->code, err->msg, poll_err->msg);
182 		return;
183 	}
184 
185 	ret = imsg_flush(ibuf);
186 	if (ret == -1) {
187 		fprintf(stderr, "%s: error %d \"%s\": imsg_flush: %s\n",
188 		    getprogname(), err->code, err->msg, strerror(errno));
189 		return;
190 	}
191 }
192 
193 static const struct got_error *
194 flush_imsg(struct imsgbuf *ibuf)
195 {
196 	const struct got_error *err;
197 
198 	err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
199 	if (err)
200 		return err;
201 
202 	if (imsg_flush(ibuf) == -1)
203 		return got_error_from_errno();
204 
205 	return NULL;
206 }
207 
208 const struct got_error *
209 got_privsep_send_stop(int fd)
210 {
211 	const struct got_error *err = NULL;
212 	struct imsgbuf ibuf;
213 
214 	imsg_init(&ibuf, fd);
215 
216 	if (imsg_compose(&ibuf, GOT_IMSG_STOP, 0, 0, -1, NULL, 0) == -1)
217 		return got_error_from_errno();
218 
219 	err = flush_imsg(&ibuf);
220 	imsg_clear(&ibuf);
221 	return err;
222 }
223 
224 const struct got_error *
225 got_privsep_send_obj_req(struct imsgbuf *ibuf, int fd)
226 {
227 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT_REQUEST, 0, 0, fd, NULL, 0)
228 	    == -1)
229 		return got_error_from_errno();
230 
231 	return flush_imsg(ibuf);
232 }
233 
234 const struct got_error *
235 got_privsep_send_commit_req(struct imsgbuf *ibuf, int fd,
236     struct got_object_id *id, int pack_idx)
237 {
238 	const struct got_error *err = NULL;
239 	struct got_imsg_packed_object iobj, *iobjp;
240 	size_t len;
241 
242 	if (id) { /* commit is packed */
243 		iobj.idx = pack_idx;
244 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
245 		iobjp = &iobj;
246 		len = sizeof(iobj);
247 	} else {
248 		iobjp = NULL;
249 		len = 0;
250 	}
251 
252 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_REQUEST, 0, 0, fd, iobjp, len)
253 	    == -1) {
254 		err = got_error_from_errno();
255 		close(fd);
256 		return err;
257 	}
258 
259 	return flush_imsg(ibuf);
260 }
261 
262 const struct got_error *
263 got_privsep_send_tree_req(struct imsgbuf *ibuf, int fd,
264     struct got_object_id *id, int pack_idx)
265 {
266 	const struct got_error *err = NULL;
267 	struct got_imsg_packed_object iobj, *iobjp;
268 	size_t len;
269 
270 	if (id) { /* tree is packed */
271 		iobj.idx = pack_idx;
272 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
273 		iobjp = &iobj;
274 		len = sizeof(iobj);
275 	} else {
276 		iobjp = NULL;
277 		len = 0;
278 	}
279 
280 	if (imsg_compose(ibuf, GOT_IMSG_TREE_REQUEST, 0, 0, fd, iobjp, len)
281 	    == -1) {
282 		err = got_error_from_errno();
283 		close(fd);
284 		return err;
285 	}
286 
287 	return flush_imsg(ibuf);
288 }
289 
290 const struct got_error *
291 got_privsep_send_tag_req(struct imsgbuf *ibuf, int fd,
292     struct got_object_id *id, int pack_idx)
293 {
294 	struct got_imsg_packed_object iobj, *iobjp;
295 	size_t len;
296 
297 	if (id) { /* tag is packed */
298 		iobj.idx = pack_idx;
299 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
300 		iobjp = &iobj;
301 		len = sizeof(iobj);
302 	} else {
303 		iobjp = NULL;
304 		len = 0;
305 	}
306 
307 	if (imsg_compose(ibuf, GOT_IMSG_TAG_REQUEST, 0, 0, fd, iobjp, len)
308 	    == -1)
309 		return got_error_from_errno();
310 
311 	return flush_imsg(ibuf);
312 }
313 
314 const struct got_error *
315 got_privsep_send_blob_req(struct imsgbuf *ibuf, int infd,
316     struct got_object_id *id, int pack_idx)
317 {
318 	const struct got_error *err = NULL;
319 	struct got_imsg_packed_object iobj, *iobjp;
320 	size_t len;
321 
322 	if (id) { /* blob is packed */
323 		iobj.idx = pack_idx;
324 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
325 		iobjp = &iobj;
326 		len = sizeof(iobj);
327 	} else {
328 		iobjp = NULL;
329 		len = 0;
330 	}
331 
332 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_REQUEST, 0, 0, infd, iobjp, len)
333 	    == -1) {
334 		err = got_error_from_errno();
335 		close(infd);
336 		return err;
337 	}
338 
339 	return flush_imsg(ibuf);
340 }
341 
342 const struct got_error *
343 got_privsep_send_blob_outfd(struct imsgbuf *ibuf, int outfd)
344 {
345 	const struct got_error *err = NULL;
346 
347 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_OUTFD, 0, 0, outfd, NULL, 0)
348 	    == -1) {
349 		err = got_error_from_errno();
350 		close(outfd);
351 		return err;
352 	}
353 
354 	return flush_imsg(ibuf);
355 }
356 
357 const struct got_error *
358 got_privsep_send_tmpfd(struct imsgbuf *ibuf, int fd)
359 {
360 	const struct got_error *err = NULL;
361 
362 	if (imsg_compose(ibuf, GOT_IMSG_TMPFD, 0, 0, fd, NULL, 0)
363 	    == -1) {
364 		err = got_error_from_errno();
365 		close(fd);
366 		return err;
367 	}
368 
369 	return flush_imsg(ibuf);
370 }
371 
372 const struct got_error *
373 got_privsep_send_obj(struct imsgbuf *ibuf, struct got_object *obj)
374 {
375 	struct got_imsg_object iobj;
376 
377 	memcpy(iobj.id, obj->id.sha1, sizeof(iobj.id));
378 	iobj.type = obj->type;
379 	iobj.flags = obj->flags;
380 	iobj.hdrlen = obj->hdrlen;
381 	iobj.size = obj->size;
382 	if (iobj.flags & GOT_OBJ_FLAG_PACKED) {
383 		iobj.pack_offset = obj->pack_offset;
384 		iobj.pack_idx = obj->pack_idx;
385 	}
386 
387 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT, 0, 0, -1, &iobj, sizeof(iobj))
388 	    == -1)
389 		return got_error_from_errno();
390 
391 	return flush_imsg(ibuf);
392 }
393 
394 const struct got_error *
395 got_privsep_get_imsg_obj(struct got_object **obj, struct imsg *imsg,
396     struct imsgbuf *ibuf)
397 {
398 	const struct got_error *err = NULL;
399 	struct got_imsg_object *iobj;
400 	size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
401 
402 	if (datalen != sizeof(*iobj))
403 		return got_error(GOT_ERR_PRIVSEP_LEN);
404 	iobj = imsg->data;
405 
406 	*obj = calloc(1, sizeof(**obj));
407 	if (*obj == NULL)
408 		return got_error_from_errno();
409 
410 	memcpy((*obj)->id.sha1, iobj->id, SHA1_DIGEST_LENGTH);
411 	(*obj)->type = iobj->type;
412 	(*obj)->flags = iobj->flags;
413 	(*obj)->hdrlen = iobj->hdrlen;
414 	(*obj)->size = iobj->size;
415 	/* path_packfile is handled by caller */
416 	if (iobj->flags & GOT_OBJ_FLAG_PACKED) {
417 		(*obj)->pack_offset = iobj->pack_offset;
418 		(*obj)->pack_idx = iobj->pack_idx;
419 	}
420 
421 	return err;
422 }
423 
424 const struct got_error *
425 got_privsep_recv_obj(struct got_object **obj, struct imsgbuf *ibuf)
426 {
427 	const struct got_error *err = NULL;
428 	struct imsg imsg;
429 	size_t datalen;
430 	const size_t min_datalen =
431 	    MIN(sizeof(struct got_imsg_error), sizeof(struct got_imsg_object));
432 
433 	*obj = NULL;
434 
435 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
436 	if (err)
437 		return err;
438 
439 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
440 
441 	switch (imsg.hdr.type) {
442 	case GOT_IMSG_OBJECT:
443 		err = got_privsep_get_imsg_obj(obj, &imsg, ibuf);
444 		break;
445 	default:
446 		err = got_error(GOT_ERR_PRIVSEP_MSG);
447 		break;
448 	}
449 
450 	imsg_free(&imsg);
451 
452 	return err;
453 }
454 
455 static const struct got_error *
456 send_commit_logmsg(struct imsgbuf *ibuf, struct got_commit_object *commit,
457     size_t logmsg_len)
458 {
459 	const struct got_error *err = NULL;
460 	size_t offset, remain;
461 
462 	offset = 0;
463 	remain = logmsg_len;
464 	while (remain > 0) {
465 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
466 
467 		if (imsg_compose(ibuf, GOT_IMSG_COMMIT_LOGMSG, 0, 0, -1,
468 		    commit->logmsg + offset, n) == -1) {
469 			err = got_error_from_errno();
470 			break;
471 		}
472 
473 		err = flush_imsg(ibuf);
474 		if (err)
475 			break;
476 
477 		offset += n;
478 		remain -= n;
479 	}
480 
481 	return err;
482 }
483 
484 const struct got_error *
485 got_privsep_send_commit(struct imsgbuf *ibuf, struct got_commit_object *commit)
486 {
487 	const struct got_error *err = NULL;
488 	struct got_imsg_commit_object *icommit;
489 	uint8_t *buf;
490 	size_t len, total;
491 	struct got_object_qid *qid;
492 	size_t author_len = strlen(commit->author);
493 	size_t committer_len = strlen(commit->committer);
494 	size_t logmsg_len = strlen(commit->logmsg);
495 
496 	total = sizeof(*icommit) + author_len + committer_len +
497 	    commit->nparents * SHA1_DIGEST_LENGTH;
498 
499 	buf = malloc(total);
500 	if (buf == NULL)
501 		return got_error_from_errno();
502 
503 	icommit = (struct got_imsg_commit_object *)buf;
504 	memcpy(icommit->tree_id, commit->tree_id->sha1,
505 	    sizeof(icommit->tree_id));
506 	icommit->author_len = author_len;
507 	icommit->author_time = commit->author_time;
508 	icommit->author_gmtoff = commit->author_gmtoff;
509 	icommit->committer_len = committer_len;
510 	icommit->committer_time = commit->committer_time;
511 	icommit->committer_gmtoff = commit->committer_gmtoff;
512 	icommit->logmsg_len = logmsg_len;
513 	icommit->nparents = commit->nparents;
514 
515 	len = sizeof(*icommit);
516 	memcpy(buf + len, commit->author, author_len);
517 	len += author_len;
518 	memcpy(buf + len, commit->committer, committer_len);
519 	len += committer_len;
520 	SIMPLEQ_FOREACH(qid, &commit->parent_ids, entry) {
521 		memcpy(buf + len, qid->id, SHA1_DIGEST_LENGTH);
522 		len += SHA1_DIGEST_LENGTH;
523 	}
524 
525 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT, 0, 0, -1, buf, len) == -1) {
526 		err = got_error_from_errno();
527 		goto done;
528 	}
529 
530 	if (logmsg_len == 0 ||
531 	    logmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
532 		err = flush_imsg(ibuf);
533 		if (err)
534 			goto done;
535 	}
536 	err = send_commit_logmsg(ibuf, commit, logmsg_len);
537 done:
538 	free(buf);
539 	return err;
540 }
541 
542 const struct got_error *
543 got_privsep_recv_commit(struct got_commit_object **commit, struct imsgbuf *ibuf)
544 {
545 	const struct got_error *err = NULL;
546 	struct imsg imsg;
547 	struct got_imsg_commit_object *icommit;
548 	size_t len, datalen;
549 	int i;
550 	const size_t min_datalen =
551 	    MIN(sizeof(struct got_imsg_error),
552 	    sizeof(struct got_imsg_commit_object));
553 
554 	*commit = NULL;
555 
556 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
557 	if (err)
558 		return err;
559 
560 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
561 	len = 0;
562 
563 	switch (imsg.hdr.type) {
564 	case GOT_IMSG_COMMIT:
565 		if (datalen < sizeof(*icommit)) {
566 			err = got_error(GOT_ERR_PRIVSEP_LEN);
567 			break;
568 		}
569 		icommit = imsg.data;
570 		if (datalen != sizeof(*icommit) + icommit->author_len +
571 		    icommit->committer_len +
572 		    icommit->nparents * SHA1_DIGEST_LENGTH) {
573 			err = got_error(GOT_ERR_PRIVSEP_LEN);
574 			break;
575 		}
576 		if (icommit->nparents < 0) {
577 			err = got_error(GOT_ERR_PRIVSEP_LEN);
578 			break;
579 		}
580 		len += sizeof(*icommit);
581 
582 		*commit = got_object_commit_alloc_partial();
583 		if (*commit == NULL) {
584 			err = got_error_from_errno();
585 			break;
586 		}
587 
588 		memcpy((*commit)->tree_id->sha1, icommit->tree_id,
589 		    SHA1_DIGEST_LENGTH);
590 		(*commit)->author_time = icommit->author_time;
591 		(*commit)->author_gmtoff = icommit->author_gmtoff;
592 		(*commit)->committer_time = icommit->committer_time;
593 		(*commit)->committer_gmtoff = icommit->committer_gmtoff;
594 
595 		if (icommit->author_len == 0) {
596 			(*commit)->author = strdup("");
597 			if ((*commit)->author == NULL) {
598 				err = got_error_from_errno();
599 				break;
600 			}
601 		} else {
602 			(*commit)->author = malloc(icommit->author_len + 1);
603 			if ((*commit)->author == NULL) {
604 				err = got_error_from_errno();
605 				break;
606 			}
607 			memcpy((*commit)->author, imsg.data + len,
608 			    icommit->author_len);
609 			(*commit)->author[icommit->author_len] = '\0';
610 		}
611 		len += icommit->author_len;
612 
613 		if (icommit->committer_len == 0) {
614 			(*commit)->committer = strdup("");
615 			if ((*commit)->committer == NULL) {
616 				err = got_error_from_errno();
617 				break;
618 			}
619 		} else {
620 			(*commit)->committer =
621 			    malloc(icommit->committer_len + 1);
622 			if ((*commit)->committer == NULL) {
623 				err = got_error_from_errno();
624 				break;
625 			}
626 			memcpy((*commit)->committer, imsg.data + len,
627 			    icommit->committer_len);
628 			(*commit)->committer[icommit->committer_len] = '\0';
629 		}
630 		len += icommit->committer_len;
631 
632 		if (icommit->logmsg_len == 0) {
633 			(*commit)->logmsg = strdup("");
634 			if ((*commit)->logmsg == NULL) {
635 				err = got_error_from_errno();
636 				break;
637 			}
638 		} else {
639 			size_t offset = 0, remain = icommit->logmsg_len;
640 
641 			(*commit)->logmsg = malloc(icommit->logmsg_len + 1);
642 			if ((*commit)->logmsg == NULL) {
643 				err = got_error_from_errno();
644 				break;
645 			}
646 			while (remain > 0) {
647 				struct imsg imsg_log;
648 				size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
649 				    remain);
650 
651 				err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
652 				if (err)
653 					return err;
654 
655 				if (imsg_log.hdr.type != GOT_IMSG_COMMIT_LOGMSG)
656 					return got_error(GOT_ERR_PRIVSEP_MSG);
657 
658 				memcpy((*commit)->logmsg + offset,
659 				    imsg_log.data, n);
660 				imsg_free(&imsg_log);
661 				offset += n;
662 				remain -= n;
663 			}
664 			(*commit)->logmsg[icommit->logmsg_len] = '\0';
665 		}
666 
667 		for (i = 0; i < icommit->nparents; i++) {
668 			struct got_object_qid *qid;
669 
670 			err = got_object_qid_alloc_partial(&qid);
671 			if (err)
672 				break;
673 			memcpy(qid->id, imsg.data + len +
674 			    i * SHA1_DIGEST_LENGTH, sizeof(*qid->id));
675 			SIMPLEQ_INSERT_TAIL(&(*commit)->parent_ids, qid, entry);
676 			(*commit)->nparents++;
677 		}
678 		break;
679 	default:
680 		err = got_error(GOT_ERR_PRIVSEP_MSG);
681 		break;
682 	}
683 
684 	imsg_free(&imsg);
685 
686 	return err;
687 }
688 
689 const struct got_error *
690 got_privsep_send_tree(struct imsgbuf *ibuf, struct got_tree_object *tree)
691 {
692 	const struct got_error *err = NULL;
693 	struct got_imsg_tree_object itree;
694 	struct got_tree_entry *te;
695 	size_t totlen;
696 	int nimsg; /* number of imsg queued in ibuf */
697 
698 	itree.nentries = tree->entries.nentries;
699 	if (imsg_compose(ibuf, GOT_IMSG_TREE, 0, 0, -1, &itree, sizeof(itree))
700 	    == -1)
701 		return got_error_from_errno();
702 
703 	totlen = sizeof(itree);
704 	nimsg = 1;
705 	SIMPLEQ_FOREACH(te, &tree->entries.head, entry) {
706 		struct got_imsg_tree_entry *ite;
707 		uint8_t *buf = NULL;
708 		size_t len = sizeof(*ite) + strlen(te->name);
709 
710 		if (len > MAX_IMSGSIZE)
711 			return got_error(GOT_ERR_NO_SPACE);
712 
713 		nimsg++;
714 		if (totlen + len >= MAX_IMSGSIZE - (IMSG_HEADER_SIZE * nimsg)) {
715 			err = flush_imsg(ibuf);
716 			if (err)
717 				return err;
718 			nimsg = 0;
719 		}
720 
721 		buf = malloc(len);
722 		if (buf == NULL)
723 			return got_error_from_errno();
724 
725 		ite = (struct got_imsg_tree_entry *)buf;
726 		memcpy(ite->id, te->id->sha1, sizeof(ite->id));
727 		ite->mode = te->mode;
728 		memcpy(buf + sizeof(*ite), te->name, strlen(te->name));
729 
730 		if (imsg_compose(ibuf, GOT_IMSG_TREE_ENTRY, 0, 0, -1,
731 		    buf, len) == -1)
732 			err = got_error_from_errno();
733 		free(buf);
734 		if (err)
735 			return err;
736 		totlen += len;
737 	}
738 
739 	return flush_imsg(ibuf);
740 }
741 
742 const struct got_error *
743 got_privsep_recv_tree(struct got_tree_object **tree, struct imsgbuf *ibuf)
744 {
745 	const struct got_error *err = NULL;
746 	const size_t min_datalen =
747 	    MIN(sizeof(struct got_imsg_error),
748 	    sizeof(struct got_imsg_tree_object));
749 	struct got_imsg_tree_object *itree;
750 	int nentries = 0;
751 
752 	*tree = NULL;
753 get_more:
754 	err = read_imsg(ibuf);
755 	if (err)
756 		goto done;
757 
758 	while (1) {
759 		struct imsg imsg;
760 		size_t n;
761 		size_t datalen;
762 		struct got_imsg_tree_entry *ite;
763 		struct got_tree_entry *te = NULL;
764 
765 		n = imsg_get(ibuf, &imsg);
766 		if (n == 0) {
767 			if (*tree && (*tree)->entries.nentries != nentries)
768 				goto get_more;
769 			break;
770 		}
771 
772 		if (imsg.hdr.len < IMSG_HEADER_SIZE + min_datalen)
773 			return got_error(GOT_ERR_PRIVSEP_LEN);
774 
775 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
776 
777 		switch (imsg.hdr.type) {
778 		case GOT_IMSG_ERROR:
779 			err = recv_imsg_error(&imsg, datalen);
780 			break;
781 		case GOT_IMSG_TREE:
782 			/* This message should only appear once. */
783 			if (*tree != NULL) {
784 				err = got_error(GOT_ERR_PRIVSEP_MSG);
785 				break;
786 			}
787 			if (datalen != sizeof(*itree)) {
788 				err = got_error(GOT_ERR_PRIVSEP_LEN);
789 				break;
790 			}
791 			itree = imsg.data;
792 			*tree = malloc(sizeof(**tree));
793 			if (*tree == NULL) {
794 				err = got_error_from_errno();
795 				break;
796 			}
797 			(*tree)->entries.nentries = itree->nentries;
798 			SIMPLEQ_INIT(&(*tree)->entries.head);
799 			(*tree)->refcnt = 0;
800 			break;
801 		case GOT_IMSG_TREE_ENTRY:
802 			/* This message should be preceeded by GOT_IMSG_TREE. */
803 			if (*tree == NULL) {
804 				err = got_error(GOT_ERR_PRIVSEP_MSG);
805 				break;
806 			}
807 			if (datalen < sizeof(*ite) || datalen > MAX_IMSGSIZE) {
808 				err = got_error(GOT_ERR_PRIVSEP_LEN);
809 				break;
810 			}
811 
812 			/* Remaining data contains the entry's name. */
813 			datalen -= sizeof(*ite);
814 			if (datalen == 0 || datalen > MAX_IMSGSIZE) {
815 				err = got_error(GOT_ERR_PRIVSEP_LEN);
816 				break;
817 			}
818 			ite = imsg.data;
819 
820 			te = got_alloc_tree_entry_partial();
821 			if (te == NULL) {
822 				err = got_error_from_errno();
823 				break;
824 			}
825 			te->name = malloc(datalen + 1);
826 			if (te->name == NULL) {
827 				free(te);
828 				err = got_error_from_errno();
829 				break;
830 			}
831 			memcpy(te->name, imsg.data + sizeof(*ite), datalen);
832 			te->name[datalen] = '\0';
833 
834 			memcpy(te->id->sha1, ite->id, SHA1_DIGEST_LENGTH);
835 			te->mode = ite->mode;
836 			SIMPLEQ_INSERT_TAIL(&(*tree)->entries.head, te, entry);
837 			nentries++;
838 			break;
839 		default:
840 			err = got_error(GOT_ERR_PRIVSEP_MSG);
841 			break;
842 		}
843 
844 		imsg_free(&imsg);
845 	}
846 done:
847 	if (*tree && (*tree)->entries.nentries != nentries) {
848 		if (err == NULL)
849 			err = got_error(GOT_ERR_PRIVSEP_LEN);
850 		got_object_tree_close(*tree);
851 		*tree = NULL;
852 	}
853 
854 	return err;
855 }
856 
857 const struct got_error *
858 got_privsep_send_blob(struct imsgbuf *ibuf, size_t size, size_t hdrlen,
859     const uint8_t *data)
860 {
861 	struct got_imsg_blob iblob;
862 
863 	iblob.size = size;
864 	iblob.hdrlen = hdrlen;
865 
866 	if (data) {
867 		uint8_t *buf;
868 
869 		if (size > GOT_PRIVSEP_INLINE_BLOB_DATA_MAX)
870 			return got_error(GOT_ERR_NO_SPACE);
871 
872 		buf = malloc(sizeof(iblob) + size);
873 		if (buf == NULL)
874 			return got_error_from_errno();
875 
876 		memcpy(buf, &iblob, sizeof(iblob));
877 		memcpy(buf + sizeof(iblob), data, size);
878 		if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, buf,
879 		   sizeof(iblob) + size) == -1) {
880 			free(buf);
881 			return got_error_from_errno();
882 		}
883 		free(buf);
884 	} else {
885 		/* Data has already been written to file descriptor. */
886 		if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, &iblob,
887 		    sizeof(iblob)) == -1)
888 			return got_error_from_errno();
889 	}
890 
891 
892 	return flush_imsg(ibuf);
893 }
894 
895 const struct got_error *
896 got_privsep_recv_blob(uint8_t **outbuf, size_t *size, size_t *hdrlen,
897     struct imsgbuf *ibuf)
898 {
899 	const struct got_error *err = NULL;
900 	struct imsg imsg;
901 	struct got_imsg_blob *iblob;
902 	size_t datalen;
903 
904 	*outbuf = NULL;
905 
906 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
907 	if (err)
908 		return err;
909 
910 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
911 
912 	switch (imsg.hdr.type) {
913 	case GOT_IMSG_BLOB:
914 		if (datalen < sizeof(*iblob)) {
915 			err = got_error(GOT_ERR_PRIVSEP_LEN);
916 			break;
917 		}
918 		iblob = imsg.data;
919 		*size = iblob->size;
920 		*hdrlen = iblob->hdrlen;
921 
922 		if (datalen == sizeof(*iblob)) {
923 			/* Data has been written to file descriptor. */
924 			break;
925 		}
926 
927 		if (*size > GOT_PRIVSEP_INLINE_BLOB_DATA_MAX) {
928 			err = got_error(GOT_ERR_PRIVSEP_LEN);
929 			break;
930 		}
931 
932 		*outbuf = malloc(*size);
933 		if (*outbuf == NULL) {
934 			err = got_error_from_errno();
935 			break;
936 		}
937 		memcpy(*outbuf, imsg.data + sizeof(*iblob), *size);
938 		break;
939 	default:
940 		err = got_error(GOT_ERR_PRIVSEP_MSG);
941 		break;
942 	}
943 
944 	imsg_free(&imsg);
945 
946 	return err;
947 }
948 
949 static const struct got_error *
950 send_tagmsg(struct imsgbuf *ibuf, struct got_tag_object *tag, size_t tagmsg_len)
951 {
952 	const struct got_error *err = NULL;
953 	size_t offset, remain;
954 
955 	offset = 0;
956 	remain = tagmsg_len;
957 	while (remain > 0) {
958 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
959 
960 		if (imsg_compose(ibuf, GOT_IMSG_TAG_TAGMSG, 0, 0, -1,
961 		    tag->tagmsg + offset, n) == -1) {
962 			err = got_error_from_errno();
963 			break;
964 		}
965 
966 		err = flush_imsg(ibuf);
967 		if (err)
968 			break;
969 
970 		offset += n;
971 		remain -= n;
972 	}
973 
974 	return err;
975 }
976 
977 const struct got_error *
978 got_privsep_send_tag(struct imsgbuf *ibuf, struct got_tag_object *tag)
979 {
980 	const struct got_error *err = NULL;
981 	struct got_imsg_tag_object *itag;
982 	uint8_t *buf;
983 	size_t len, total;
984 	size_t tag_len = strlen(tag->tag);
985 	size_t tagger_len = strlen(tag->tagger);
986 	size_t tagmsg_len = strlen(tag->tagmsg);
987 
988 	total = sizeof(*itag) + tag_len + tagger_len + tagmsg_len;
989 
990 	buf = malloc(total);
991 	if (buf == NULL)
992 		return got_error_from_errno();
993 
994 	itag = (struct got_imsg_tag_object *)buf;
995 	memcpy(itag->id, tag->id.sha1, sizeof(itag->id));
996 	itag->obj_type = tag->obj_type;
997 	itag->tag_len = tag_len;
998 	itag->tagger_len = tagger_len;
999 	itag->tagger_time = tag->tagger_time;
1000 	itag->tagger_gmtoff = tag->tagger_gmtoff;
1001 	itag->tagmsg_len = tagmsg_len;
1002 
1003 	len = sizeof(*itag);
1004 	memcpy(buf + len, tag->tag, tag_len);
1005 	len += tag_len;
1006 	memcpy(buf + len, tag->tagger, tagger_len);
1007 	len += tagger_len;
1008 
1009 	if (imsg_compose(ibuf, GOT_IMSG_TAG, 0, 0, -1, buf, len) == -1) {
1010 		err = got_error_from_errno();
1011 		goto done;
1012 	}
1013 
1014 	if (tagmsg_len == 0 ||
1015 	    tagmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
1016 		err = flush_imsg(ibuf);
1017 		if (err)
1018 			goto done;
1019 	}
1020 	err = send_tagmsg(ibuf, tag, tagmsg_len);
1021 done:
1022 	free(buf);
1023 	return err;
1024 }
1025 
1026 const struct got_error *
1027 got_privsep_recv_tag(struct got_tag_object **tag, struct imsgbuf *ibuf)
1028 {
1029 	const struct got_error *err = NULL;
1030 	struct imsg imsg;
1031 	struct got_imsg_tag_object *itag;
1032 	size_t len, datalen;
1033 	const size_t min_datalen =
1034 	    MIN(sizeof(struct got_imsg_error),
1035 	    sizeof(struct got_imsg_tag_object));
1036 
1037 	*tag = NULL;
1038 
1039 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1040 	if (err)
1041 		return err;
1042 
1043 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1044 	len = 0;
1045 
1046 	switch (imsg.hdr.type) {
1047 	case GOT_IMSG_TAG:
1048 		if (datalen < sizeof(*itag)) {
1049 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1050 			break;
1051 		}
1052 		itag = imsg.data;
1053 		if (datalen != sizeof(*itag) + itag->tag_len +
1054 		    itag->tagger_len) {
1055 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1056 			break;
1057 		}
1058 		len += sizeof(*itag);
1059 
1060 		*tag = calloc(1, sizeof(**tag));
1061 		if (*tag == NULL) {
1062 			err = got_error_from_errno();
1063 			break;
1064 		}
1065 
1066 		memcpy((*tag)->id.sha1, itag->id, SHA1_DIGEST_LENGTH);
1067 
1068 		if (itag->tag_len == 0) {
1069 			(*tag)->tag = strdup("");
1070 			if ((*tag)->tag == NULL) {
1071 				err = got_error_from_errno();
1072 				break;
1073 			}
1074 		} else {
1075 			(*tag)->tag = malloc(itag->tag_len + 1);
1076 			if ((*tag)->tag == NULL) {
1077 				err = got_error_from_errno();
1078 				break;
1079 			}
1080 			memcpy((*tag)->tag, imsg.data + len,
1081 			    itag->tag_len);
1082 			(*tag)->tag[itag->tag_len] = '\0';
1083 		}
1084 		len += itag->tag_len;
1085 
1086 		(*tag)->obj_type = itag->obj_type;
1087 		(*tag)->tagger_time = itag->tagger_time;
1088 		(*tag)->tagger_gmtoff = itag->tagger_gmtoff;
1089 
1090 		if (itag->tagger_len == 0) {
1091 			(*tag)->tagger = strdup("");
1092 			if ((*tag)->tagger == NULL) {
1093 				err = got_error_from_errno();
1094 				break;
1095 			}
1096 		} else {
1097 			(*tag)->tagger = malloc(itag->tagger_len + 1);
1098 			if ((*tag)->tagger == NULL) {
1099 				err = got_error_from_errno();
1100 				break;
1101 			}
1102 			memcpy((*tag)->tagger, imsg.data + len,
1103 			    itag->tagger_len);
1104 			(*tag)->tagger[itag->tagger_len] = '\0';
1105 		}
1106 		len += itag->tagger_len;
1107 
1108 		if (itag->tagmsg_len == 0) {
1109 			(*tag)->tagmsg = strdup("");
1110 			if ((*tag)->tagmsg == NULL) {
1111 				err = got_error_from_errno();
1112 				break;
1113 			}
1114 		} else {
1115 			size_t offset = 0, remain = itag->tagmsg_len;
1116 
1117 			(*tag)->tagmsg = malloc(itag->tagmsg_len + 1);
1118 			if ((*tag)->tagmsg == NULL) {
1119 				err = got_error_from_errno();
1120 				break;
1121 			}
1122 			while (remain > 0) {
1123 				struct imsg imsg_log;
1124 				size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
1125 				    remain);
1126 
1127 				err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
1128 				if (err)
1129 					return err;
1130 
1131 				if (imsg_log.hdr.type != GOT_IMSG_TAG_TAGMSG)
1132 					return got_error(GOT_ERR_PRIVSEP_MSG);
1133 
1134 				memcpy((*tag)->tagmsg + offset, imsg_log.data,
1135 				    n);
1136 				imsg_free(&imsg_log);
1137 				offset += n;
1138 				remain -= n;
1139 			}
1140 			(*tag)->tagmsg[itag->tagmsg_len] = '\0';
1141 		}
1142 
1143 		break;
1144 	default:
1145 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1146 		break;
1147 	}
1148 
1149 	imsg_free(&imsg);
1150 
1151 	return err;
1152 }
1153 
1154 const struct got_error *
1155 got_privsep_init_pack_child(struct imsgbuf *ibuf, struct got_pack *pack,
1156     struct got_packidx *packidx)
1157 {
1158 	const struct got_error *err = NULL;
1159 	struct got_imsg_packidx ipackidx;
1160 	struct got_imsg_pack ipack;
1161 	int fd;
1162 
1163 	ipackidx.len = packidx->len;
1164 	fd = dup(packidx->fd);
1165 	if (fd == -1)
1166 		return got_error_from_errno();
1167 
1168 	if (imsg_compose(ibuf, GOT_IMSG_PACKIDX, 0, 0, fd, &ipackidx,
1169 	    sizeof(ipackidx)) == -1) {
1170 		err = got_error_from_errno();
1171 		close(fd);
1172 		return err;
1173 	}
1174 
1175 	if (strlcpy(ipack.path_packfile, pack->path_packfile,
1176 	    sizeof(ipack.path_packfile)) >= sizeof(ipack.path_packfile))
1177 		return got_error(GOT_ERR_NO_SPACE);
1178 	ipack.filesize = pack->filesize;
1179 
1180 	fd = dup(pack->fd);
1181 	if (fd == -1)
1182 		return got_error_from_errno();
1183 
1184 	if (imsg_compose(ibuf, GOT_IMSG_PACK, 0, 0, fd, &ipack, sizeof(ipack))
1185 	    == -1) {
1186 		err = got_error_from_errno();
1187 		close(fd);
1188 		return err;
1189 	}
1190 
1191 	return flush_imsg(ibuf);
1192 }
1193 
1194 const struct got_error *
1195 got_privsep_send_packed_obj_req(struct imsgbuf *ibuf, int idx,
1196     struct got_object_id *id)
1197 {
1198 	struct got_imsg_packed_object iobj;
1199 
1200 	iobj.idx = idx;
1201 	memcpy(iobj.id, id->sha1, sizeof(iobj.id));
1202 
1203 	if (imsg_compose(ibuf, GOT_IMSG_PACKED_OBJECT_REQUEST, 0, 0, -1,
1204 	    &iobj, sizeof(iobj)) == -1)
1205 		return got_error_from_errno();
1206 
1207 	return flush_imsg(ibuf);
1208 }
1209 
1210 const struct got_error *
1211 got_privsep_unveil_exec_helpers(void)
1212 {
1213 	if (unveil(GOT_PATH_PROG_READ_PACK, "x") != 0 ||
1214 	    unveil(GOT_PATH_PROG_READ_OBJECT, "x") != 0 ||
1215 	    unveil(GOT_PATH_PROG_READ_COMMIT, "x") != 0 ||
1216 	    unveil(GOT_PATH_PROG_READ_TREE, "x") != 0 ||
1217 	    unveil(GOT_PATH_PROG_READ_BLOB, "x") != 0 ||
1218 	    unveil(GOT_PATH_PROG_READ_TAG, "x") != 0)
1219 		return got_error_from_errno();
1220 
1221 	return NULL;
1222 }