op public repos

Blob

Date:: Sun Jan 13 16:15:53 2019 UTC
Message:: happy new copyright year
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2018, 2019 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/queue.h>
19 #include <sys/uio.h>
20 #include <sys/syslimits.h>
21 #include <sys/wait.h>
22 
23 #include <stdio.h>
24 #include <stdlib.h>
25 #include <string.h>
26 #include <errno.h>
27 #include <stdint.h>
28 #include <poll.h>
29 #include <imsg.h>
30 #include <sha1.h>
31 #include <zlib.h>
32 #include <time.h>
33 
34 #include "got_object.h"
35 #include "got_error.h"
36 
37 #include "got_lib_sha1.h"
38 #include "got_lib_delta.h"
39 #include "got_lib_inflate.h"
40 #include "got_lib_object.h"
41 #include "got_lib_object_parse.h"
42 #include "got_lib_privsep.h"
43 #include "got_lib_pack.h"
44 
45 #ifndef MIN
46 #define	MIN(_a,_b) ((_a) < (_b) ? (_a) : (_b))
47 #endif
48 
49 static const struct got_error *
50 poll_fd(int fd, int events, int timeout)
51 {
52 	struct pollfd pfd[1];
53 	int n;
54 
55 	pfd[0].fd = fd;
56 	pfd[0].events = events;
57 
58 	n = poll(pfd, 1, timeout);
59 	if (n == -1)
60 		return got_error_from_errno();
61 	if (n == 0)
62 		return got_error(GOT_ERR_TIMEOUT);
63 	if (pfd[0].revents & (POLLERR | POLLNVAL))
64 		return got_error_from_errno();
65 	if (pfd[0].revents & (events | POLLHUP))
66 		return NULL;
67 
68 	return got_error(GOT_ERR_INTERRUPT);
69 }
70 
71 static const struct got_error *
72 read_imsg(struct imsgbuf *ibuf)
73 {
74 	const struct got_error *err;
75 	size_t n;
76 
77 	err = poll_fd(ibuf->fd, POLLIN, INFTIM);
78 	if (err)
79 		return err;
80 
81 	n = imsg_read(ibuf);
82 	if (n == -1) {
83 		if (errno == EAGAIN) /* Could be a file-descriptor leak. */
84 			return got_error(GOT_ERR_PRIVSEP_NO_FD);
85 		return got_error(GOT_ERR_PRIVSEP_READ);
86 	}
87 	if (n == 0)
88 		return got_error(GOT_ERR_PRIVSEP_PIPE);
89 
90 	return NULL;
91 }
92 
93 const struct got_error *
94 got_privsep_wait_for_child(pid_t pid)
95 {
96 	int child_status;
97 
98 	waitpid(pid, &child_status, 0);
99 
100 	if (!WIFEXITED(child_status))
101 		return got_error(GOT_ERR_PRIVSEP_DIED);
102 
103 	if (WEXITSTATUS(child_status) != 0)
104 		return got_error(GOT_ERR_PRIVSEP_EXIT);
105 
106 	return NULL;
107 }
108 
109 static const struct got_error *
110 recv_imsg_error(struct imsg *imsg, size_t datalen)
111 {
112 	struct got_imsg_error *ierr;
113 
114 	if (datalen != sizeof(*ierr))
115 		return got_error(GOT_ERR_PRIVSEP_LEN);
116 
117 	ierr = imsg->data;
118 	if (ierr->code == GOT_ERR_ERRNO) {
119 		static struct got_error serr;
120 		serr.code = GOT_ERR_ERRNO;
121 		serr.msg = strerror(ierr->errno_code);
122 		return &serr;
123 	}
124 
125 	return got_error(ierr->code);
126 }
127 
128 const struct got_error *
129 got_privsep_recv_imsg(struct imsg *imsg, struct imsgbuf *ibuf,
130     size_t min_datalen)
131 {
132 	const struct got_error *err;
133 	ssize_t n;
134 
135 	n = imsg_get(ibuf, imsg);
136 	if (n == -1)
137 		return got_error_from_errno();
138 
139 	while (n == 0) {
140 		err = read_imsg(ibuf);
141 		if (err)
142 			return err;
143 		n = imsg_get(ibuf, imsg);
144 	}
145 
146 	if (imsg->hdr.len < IMSG_HEADER_SIZE + min_datalen)
147 		return got_error(GOT_ERR_PRIVSEP_LEN);
148 
149 	if (imsg->hdr.type == GOT_IMSG_ERROR) {
150 		size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
151 		return recv_imsg_error(imsg, datalen);
152 	}
153 
154 	return NULL;
155 }
156 
157 /* Attempt to send an error in an imsg. Complain on stderr as a last resort. */
158 void
159 got_privsep_send_error(struct imsgbuf *ibuf, const struct got_error *err)
160 {
161 	const struct got_error *poll_err;
162 	struct got_imsg_error ierr;
163 	int ret;
164 
165 	ierr.code = err->code;
166 	if (err->code == GOT_ERR_ERRNO)
167 		ierr.errno_code = errno;
168 	else
169 		ierr.errno_code = 0;
170 	ret = imsg_compose(ibuf, GOT_IMSG_ERROR, 0, 0, -1, &ierr, sizeof(ierr));
171 	if (ret == -1) {
172 		fprintf(stderr, "%s: error %d \"%s\": imsg_compose: %s\n",
173 		    getprogname(), err->code, err->msg, strerror(errno));
174 		return;
175 	}
176 
177 	poll_err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
178 	if (poll_err) {
179 		fprintf(stderr, "%s: error %d \"%s\": poll: %s\n",
180 		    getprogname(), err->code, err->msg, poll_err->msg);
181 		return;
182 	}
183 
184 	ret = imsg_flush(ibuf);
185 	if (ret == -1) {
186 		fprintf(stderr, "%s: error %d \"%s\": imsg_flush: %s\n",
187 		    getprogname(), err->code, err->msg, strerror(errno));
188 		return;
189 	}
190 }
191 
192 static const struct got_error *
193 flush_imsg(struct imsgbuf *ibuf)
194 {
195 	const struct got_error *err;
196 
197 	err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
198 	if (err)
199 		return err;
200 
201 	if (imsg_flush(ibuf) == -1)
202 		return got_error_from_errno();
203 
204 	return NULL;
205 }
206 
207 const struct got_error *
208 got_privsep_send_stop(int fd)
209 {
210 	const struct got_error *err = NULL;
211 	struct imsgbuf ibuf;
212 
213 	imsg_init(&ibuf, fd);
214 
215 	if (imsg_compose(&ibuf, GOT_IMSG_STOP, 0, 0, -1, NULL, 0) == -1)
216 		return got_error_from_errno();
217 
218 	err = flush_imsg(&ibuf);
219 	imsg_clear(&ibuf);
220 	return err;
221 }
222 
223 const struct got_error *
224 got_privsep_send_obj_req(struct imsgbuf *ibuf, int fd)
225 {
226 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT_REQUEST, 0, 0, fd, NULL, 0)
227 	    == -1)
228 		return got_error_from_errno();
229 
230 	return flush_imsg(ibuf);
231 }
232 
233 const struct got_error *
234 got_privsep_send_commit_req(struct imsgbuf *ibuf, int fd,
235     struct got_object_id *id, int pack_idx)
236 {
237 	struct got_imsg_packed_object iobj, *iobjp;
238 	size_t len;
239 
240 	if (id) { /* commit is packed */
241 		iobj.idx = pack_idx;
242 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
243 		iobjp = &iobj;
244 		len = sizeof(iobj);
245 	} else {
246 		iobjp = NULL;
247 		len = 0;
248 	}
249 
250 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_REQUEST, 0, 0, fd, iobjp, len)
251 	    == -1)
252 		return got_error_from_errno();
253 
254 	return flush_imsg(ibuf);
255 }
256 
257 const struct got_error *
258 got_privsep_send_tree_req(struct imsgbuf *ibuf, int fd,
259     struct got_object_id *id, int pack_idx)
260 {
261 	struct got_imsg_packed_object iobj, *iobjp;
262 	size_t len;
263 
264 	if (id) { /* tree is packed */
265 		iobj.idx = pack_idx;
266 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
267 		iobjp = &iobj;
268 		len = sizeof(iobj);
269 	} else {
270 		iobjp = NULL;
271 		len = 0;
272 	}
273 
274 	if (imsg_compose(ibuf, GOT_IMSG_TREE_REQUEST, 0, 0, fd, iobjp, len)
275 	    == -1)
276 		return got_error_from_errno();
277 
278 	return flush_imsg(ibuf);
279 }
280 
281 const struct got_error *
282 got_privsep_send_tag_req(struct imsgbuf *ibuf, int fd,
283     struct got_object_id *id, int pack_idx)
284 {
285 	struct got_imsg_packed_object iobj, *iobjp;
286 	size_t len;
287 
288 	if (id) { /* tag is packed */
289 		iobj.idx = pack_idx;
290 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
291 		iobjp = &iobj;
292 		len = sizeof(iobj);
293 	} else {
294 		iobjp = NULL;
295 		len = 0;
296 	}
297 
298 	if (imsg_compose(ibuf, GOT_IMSG_TAG_REQUEST, 0, 0, fd, iobjp, len)
299 	    == -1)
300 		return got_error_from_errno();
301 
302 	return flush_imsg(ibuf);
303 }
304 
305 const struct got_error *
306 got_privsep_send_blob_req(struct imsgbuf *ibuf, int infd,
307     struct got_object_id *id, int pack_idx)
308 {
309 	struct got_imsg_packed_object iobj, *iobjp;
310 	size_t len;
311 
312 	if (id) { /* blob is packed */
313 		iobj.idx = pack_idx;
314 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
315 		iobjp = &iobj;
316 		len = sizeof(iobj);
317 	} else {
318 		iobjp = NULL;
319 		len = 0;
320 	}
321 
322 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_REQUEST, 0, 0, infd, iobjp, len)
323 	    == -1)
324 		return got_error_from_errno();
325 
326 	return flush_imsg(ibuf);
327 }
328 
329 const struct got_error *
330 got_privsep_send_blob_outfd(struct imsgbuf *ibuf, int outfd)
331 {
332 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_OUTFD, 0, 0, outfd, NULL, 0)
333 	    == -1)
334 		return got_error_from_errno();
335 
336 	return flush_imsg(ibuf);
337 }
338 
339 const struct got_error *
340 got_privsep_send_tmpfd(struct imsgbuf *ibuf, int fd)
341 {
342 	if (imsg_compose(ibuf, GOT_IMSG_TMPFD, 0, 0, fd, NULL, 0)
343 	    == -1)
344 		return got_error_from_errno();
345 
346 	return flush_imsg(ibuf);
347 }
348 
349 const struct got_error *
350 got_privsep_send_obj(struct imsgbuf *ibuf, struct got_object *obj)
351 {
352 	struct got_imsg_object iobj;
353 
354 	memcpy(iobj.id, obj->id.sha1, sizeof(iobj.id));
355 	iobj.type = obj->type;
356 	iobj.flags = obj->flags;
357 	iobj.hdrlen = obj->hdrlen;
358 	iobj.size = obj->size;
359 	if (iobj.flags & GOT_OBJ_FLAG_PACKED) {
360 		iobj.pack_offset = obj->pack_offset;
361 		iobj.pack_idx = obj->pack_idx;
362 	}
363 
364 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT, 0, 0, -1, &iobj, sizeof(iobj))
365 	    == -1)
366 		return got_error_from_errno();
367 
368 	return flush_imsg(ibuf);
369 }
370 
371 const struct got_error *
372 got_privsep_get_imsg_obj(struct got_object **obj, struct imsg *imsg,
373     struct imsgbuf *ibuf)
374 {
375 	const struct got_error *err = NULL;
376 	struct got_imsg_object *iobj;
377 	size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
378 
379 	if (datalen != sizeof(*iobj))
380 		return got_error(GOT_ERR_PRIVSEP_LEN);
381 	iobj = imsg->data;
382 
383 	*obj = calloc(1, sizeof(**obj));
384 	if (*obj == NULL)
385 		return got_error_from_errno();
386 
387 	memcpy((*obj)->id.sha1, iobj->id, SHA1_DIGEST_LENGTH);
388 	(*obj)->type = iobj->type;
389 	(*obj)->flags = iobj->flags;
390 	(*obj)->hdrlen = iobj->hdrlen;
391 	(*obj)->size = iobj->size;
392 	/* path_packfile is handled by caller */
393 	if (iobj->flags & GOT_OBJ_FLAG_PACKED) {
394 		(*obj)->pack_offset = iobj->pack_offset;
395 		(*obj)->pack_idx = iobj->pack_idx;
396 	}
397 
398 	return err;
399 }
400 
401 const struct got_error *
402 got_privsep_recv_obj(struct got_object **obj, struct imsgbuf *ibuf)
403 {
404 	const struct got_error *err = NULL;
405 	struct imsg imsg;
406 	size_t datalen;
407 	const size_t min_datalen =
408 	    MIN(sizeof(struct got_imsg_error), sizeof(struct got_imsg_object));
409 
410 	*obj = NULL;
411 
412 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
413 	if (err)
414 		return err;
415 
416 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
417 
418 	switch (imsg.hdr.type) {
419 	case GOT_IMSG_OBJECT:
420 		err = got_privsep_get_imsg_obj(obj, &imsg, ibuf);
421 		break;
422 	default:
423 		err = got_error(GOT_ERR_PRIVSEP_MSG);
424 		break;
425 	}
426 
427 	imsg_free(&imsg);
428 
429 	return err;
430 }
431 
432 static const struct got_error *
433 send_commit_logmsg(struct imsgbuf *ibuf, struct got_commit_object *commit,
434     size_t logmsg_len)
435 {
436 	const struct got_error *err = NULL;
437 	size_t offset, remain;
438 
439 	offset = 0;
440 	remain = logmsg_len;
441 	while (remain > 0) {
442 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
443 
444 		if (imsg_compose(ibuf, GOT_IMSG_COMMIT_LOGMSG, 0, 0, -1,
445 		    commit->logmsg + offset, n) == -1) {
446 			err = got_error_from_errno();
447 			break;
448 		}
449 
450 		err = flush_imsg(ibuf);
451 		if (err)
452 			break;
453 
454 		offset += n;
455 		remain -= n;
456 	}
457 
458 	return err;
459 }
460 
461 const struct got_error *
462 got_privsep_send_commit(struct imsgbuf *ibuf, struct got_commit_object *commit)
463 {
464 	const struct got_error *err = NULL;
465 	struct got_imsg_commit_object *icommit;
466 	uint8_t *buf;
467 	size_t len, total;
468 	struct got_object_qid *qid;
469 	size_t author_len = strlen(commit->author);
470 	size_t committer_len = strlen(commit->committer);
471 	size_t logmsg_len = strlen(commit->logmsg);
472 
473 	total = sizeof(*icommit) + author_len + committer_len +
474 	    commit->nparents * SHA1_DIGEST_LENGTH;
475 
476 	buf = malloc(total);
477 	if (buf == NULL)
478 		return got_error_from_errno();
479 
480 	icommit = (struct got_imsg_commit_object *)buf;
481 	memcpy(icommit->tree_id, commit->tree_id->sha1,
482 	    sizeof(icommit->tree_id));
483 	icommit->author_len = author_len;
484 	icommit->author_time = commit->author_time;
485 	icommit->author_gmtoff = commit->author_gmtoff;
486 	icommit->committer_len = committer_len;
487 	icommit->committer_time = commit->committer_time;
488 	icommit->committer_gmtoff = commit->committer_gmtoff;
489 	icommit->logmsg_len = logmsg_len;
490 	icommit->nparents = commit->nparents;
491 
492 	len = sizeof(*icommit);
493 	memcpy(buf + len, commit->author, author_len);
494 	len += author_len;
495 	memcpy(buf + len, commit->committer, committer_len);
496 	len += committer_len;
497 	SIMPLEQ_FOREACH(qid, &commit->parent_ids, entry) {
498 		memcpy(buf + len, qid->id, SHA1_DIGEST_LENGTH);
499 		len += SHA1_DIGEST_LENGTH;
500 	}
501 
502 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT, 0, 0, -1, buf, len) == -1) {
503 		err = got_error_from_errno();
504 		goto done;
505 	}
506 
507 	if (logmsg_len == 0 ||
508 	    logmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
509 		err = flush_imsg(ibuf);
510 		if (err)
511 			goto done;
512 	}
513 	err = send_commit_logmsg(ibuf, commit, logmsg_len);
514 done:
515 	free(buf);
516 	return err;
517 }
518 
519 const struct got_error *
520 got_privsep_recv_commit(struct got_commit_object **commit, struct imsgbuf *ibuf)
521 {
522 	const struct got_error *err = NULL;
523 	struct imsg imsg;
524 	struct got_imsg_commit_object *icommit;
525 	size_t len, datalen;
526 	int i;
527 	const size_t min_datalen =
528 	    MIN(sizeof(struct got_imsg_error),
529 	    sizeof(struct got_imsg_commit_object));
530 
531 	*commit = NULL;
532 
533 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
534 	if (err)
535 		return err;
536 
537 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
538 	len = 0;
539 
540 	switch (imsg.hdr.type) {
541 	case GOT_IMSG_COMMIT:
542 		if (datalen < sizeof(*icommit)) {
543 			err = got_error(GOT_ERR_PRIVSEP_LEN);
544 			break;
545 		}
546 		icommit = imsg.data;
547 		if (datalen != sizeof(*icommit) + icommit->author_len +
548 		    icommit->committer_len +
549 		    icommit->nparents * SHA1_DIGEST_LENGTH) {
550 			err = got_error(GOT_ERR_PRIVSEP_LEN);
551 			break;
552 		}
553 		if (icommit->nparents < 0) {
554 			err = got_error(GOT_ERR_PRIVSEP_LEN);
555 			break;
556 		}
557 		len += sizeof(*icommit);
558 
559 		*commit = got_object_commit_alloc_partial();
560 		if (*commit == NULL) {
561 			err = got_error_from_errno();
562 			break;
563 		}
564 
565 		memcpy((*commit)->tree_id->sha1, icommit->tree_id,
566 		    SHA1_DIGEST_LENGTH);
567 		(*commit)->author_time = icommit->author_time;
568 		(*commit)->author_gmtoff = icommit->author_gmtoff;
569 		(*commit)->committer_time = icommit->committer_time;
570 		(*commit)->committer_gmtoff = icommit->committer_gmtoff;
571 
572 		if (icommit->author_len == 0) {
573 			(*commit)->author = strdup("");
574 			if ((*commit)->author == NULL) {
575 				err = got_error_from_errno();
576 				break;
577 			}
578 		} else {
579 			(*commit)->author = malloc(icommit->author_len + 1);
580 			if ((*commit)->author == NULL) {
581 				err = got_error_from_errno();
582 				break;
583 			}
584 			memcpy((*commit)->author, imsg.data + len,
585 			    icommit->author_len);
586 			(*commit)->author[icommit->author_len] = '\0';
587 		}
588 		len += icommit->author_len;
589 
590 		if (icommit->committer_len == 0) {
591 			(*commit)->committer = strdup("");
592 			if ((*commit)->committer == NULL) {
593 				err = got_error_from_errno();
594 				break;
595 			}
596 		} else {
597 			(*commit)->committer =
598 			    malloc(icommit->committer_len + 1);
599 			if ((*commit)->committer == NULL) {
600 				err = got_error_from_errno();
601 				break;
602 			}
603 			memcpy((*commit)->committer, imsg.data + len,
604 			    icommit->committer_len);
605 			(*commit)->committer[icommit->committer_len] = '\0';
606 		}
607 		len += icommit->committer_len;
608 
609 		if (icommit->logmsg_len == 0) {
610 			(*commit)->logmsg = strdup("");
611 			if ((*commit)->logmsg == NULL) {
612 				err = got_error_from_errno();
613 				break;
614 			}
615 		} else {
616 			size_t offset = 0, remain = icommit->logmsg_len;
617 
618 			(*commit)->logmsg = malloc(icommit->logmsg_len + 1);
619 			if ((*commit)->logmsg == NULL) {
620 				err = got_error_from_errno();
621 				break;
622 			}
623 			while (remain > 0) {
624 				struct imsg imsg_log;
625 				size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
626 				    remain);
627 
628 				err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
629 				if (err)
630 					return err;
631 
632 				if (imsg_log.hdr.type != GOT_IMSG_COMMIT_LOGMSG)
633 					return got_error(GOT_ERR_PRIVSEP_MSG);
634 
635 				memcpy((*commit)->logmsg + offset,
636 				    imsg_log.data, n);
637 				imsg_free(&imsg_log);
638 				offset += n;
639 				remain -= n;
640 			}
641 			(*commit)->logmsg[icommit->logmsg_len] = '\0';
642 		}
643 
644 		for (i = 0; i < icommit->nparents; i++) {
645 			struct got_object_qid *qid;
646 
647 			err = got_object_qid_alloc_partial(&qid);
648 			if (err)
649 				break;
650 			memcpy(qid->id, imsg.data + len +
651 			    i * SHA1_DIGEST_LENGTH, sizeof(*qid->id));
652 			SIMPLEQ_INSERT_TAIL(&(*commit)->parent_ids, qid, entry);
653 			(*commit)->nparents++;
654 		}
655 		break;
656 	default:
657 		err = got_error(GOT_ERR_PRIVSEP_MSG);
658 		break;
659 	}
660 
661 	imsg_free(&imsg);
662 
663 	return err;
664 }
665 
666 const struct got_error *
667 got_privsep_send_tree(struct imsgbuf *ibuf, struct got_tree_object *tree)
668 {
669 	const struct got_error *err = NULL;
670 	struct got_imsg_tree_object itree;
671 	struct got_tree_entry *te;
672 	size_t totlen;
673 	int nimsg; /* number of imsg queued in ibuf */
674 
675 	itree.nentries = tree->entries.nentries;
676 	if (imsg_compose(ibuf, GOT_IMSG_TREE, 0, 0, -1, &itree, sizeof(itree))
677 	    == -1)
678 		return got_error_from_errno();
679 
680 	totlen = sizeof(itree);
681 	nimsg = 1;
682 	SIMPLEQ_FOREACH(te, &tree->entries.head, entry) {
683 		struct got_imsg_tree_entry *ite;
684 		uint8_t *buf = NULL;
685 		size_t len = sizeof(*ite) + strlen(te->name);
686 
687 		if (len > MAX_IMSGSIZE)
688 			return got_error(GOT_ERR_NO_SPACE);
689 
690 		nimsg++;
691 		if (totlen + len >= MAX_IMSGSIZE - (IMSG_HEADER_SIZE * nimsg)) {
692 			err = flush_imsg(ibuf);
693 			if (err)
694 				return err;
695 			nimsg = 0;
696 		}
697 
698 		buf = malloc(len);
699 		if (buf == NULL)
700 			return got_error_from_errno();
701 
702 		ite = (struct got_imsg_tree_entry *)buf;
703 		memcpy(ite->id, te->id->sha1, sizeof(ite->id));
704 		ite->mode = te->mode;
705 		memcpy(buf + sizeof(*ite), te->name, strlen(te->name));
706 
707 		if (imsg_compose(ibuf, GOT_IMSG_TREE_ENTRY, 0, 0, -1,
708 		    buf, len) == -1)
709 			err = got_error_from_errno();
710 		free(buf);
711 		if (err)
712 			return err;
713 		totlen += len;
714 	}
715 
716 	return flush_imsg(ibuf);
717 }
718 
719 const struct got_error *
720 got_privsep_recv_tree(struct got_tree_object **tree, struct imsgbuf *ibuf)
721 {
722 	const struct got_error *err = NULL;
723 	const size_t min_datalen =
724 	    MIN(sizeof(struct got_imsg_error),
725 	    sizeof(struct got_imsg_tree_object));
726 	struct got_imsg_tree_object *itree;
727 	int nentries = 0;
728 
729 	*tree = NULL;
730 get_more:
731 	err = read_imsg(ibuf);
732 	if (err)
733 		goto done;
734 
735 	while (1) {
736 		struct imsg imsg;
737 		size_t n;
738 		size_t datalen;
739 		struct got_imsg_tree_entry *ite;
740 		struct got_tree_entry *te = NULL;
741 
742 		n = imsg_get(ibuf, &imsg);
743 		if (n == 0) {
744 			if (*tree && (*tree)->entries.nentries != nentries)
745 				goto get_more;
746 			break;
747 		}
748 
749 		if (imsg.hdr.len < IMSG_HEADER_SIZE + min_datalen)
750 			return got_error(GOT_ERR_PRIVSEP_LEN);
751 
752 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
753 
754 		switch (imsg.hdr.type) {
755 		case GOT_IMSG_ERROR:
756 			err = recv_imsg_error(&imsg, datalen);
757 			break;
758 		case GOT_IMSG_TREE:
759 			/* This message should only appear once. */
760 			if (*tree != NULL) {
761 				err = got_error(GOT_ERR_PRIVSEP_MSG);
762 				break;
763 			}
764 			if (datalen != sizeof(*itree)) {
765 				err = got_error(GOT_ERR_PRIVSEP_LEN);
766 				break;
767 			}
768 			itree = imsg.data;
769 			*tree = malloc(sizeof(**tree));
770 			if (*tree == NULL) {
771 				err = got_error_from_errno();
772 				break;
773 			}
774 			(*tree)->entries.nentries = itree->nentries;
775 			SIMPLEQ_INIT(&(*tree)->entries.head);
776 			(*tree)->refcnt = 0;
777 			break;
778 		case GOT_IMSG_TREE_ENTRY:
779 			/* This message should be preceeded by GOT_IMSG_TREE. */
780 			if (*tree == NULL) {
781 				err = got_error(GOT_ERR_PRIVSEP_MSG);
782 				break;
783 			}
784 			if (datalen < sizeof(*ite) || datalen > MAX_IMSGSIZE) {
785 				err = got_error(GOT_ERR_PRIVSEP_LEN);
786 				break;
787 			}
788 
789 			/* Remaining data contains the entry's name. */
790 			datalen -= sizeof(*ite);
791 			if (datalen == 0 || datalen > MAX_IMSGSIZE) {
792 				err = got_error(GOT_ERR_PRIVSEP_LEN);
793 				break;
794 			}
795 			ite = imsg.data;
796 
797 			te = got_alloc_tree_entry_partial();
798 			if (te == NULL) {
799 				err = got_error_from_errno();
800 				break;
801 			}
802 			te->name = malloc(datalen + 1);
803 			if (te->name == NULL) {
804 				free(te);
805 				err = got_error_from_errno();
806 				break;
807 			}
808 			memcpy(te->name, imsg.data + sizeof(*ite), datalen);
809 			te->name[datalen] = '\0';
810 
811 			memcpy(te->id->sha1, ite->id, SHA1_DIGEST_LENGTH);
812 			te->mode = ite->mode;
813 			SIMPLEQ_INSERT_TAIL(&(*tree)->entries.head, te, entry);
814 			nentries++;
815 			break;
816 		default:
817 			err = got_error(GOT_ERR_PRIVSEP_MSG);
818 			break;
819 		}
820 
821 		imsg_free(&imsg);
822 	}
823 done:
824 	if (*tree && (*tree)->entries.nentries != nentries) {
825 		if (err == NULL)
826 			err = got_error(GOT_ERR_PRIVSEP_LEN);
827 		got_object_tree_close(*tree);
828 		*tree = NULL;
829 	}
830 
831 	return err;
832 }
833 
834 const struct got_error *
835 got_privsep_send_blob(struct imsgbuf *ibuf, size_t size, size_t hdrlen,
836     const uint8_t *data)
837 {
838 	struct got_imsg_blob iblob;
839 
840 	iblob.size = size;
841 	iblob.hdrlen = hdrlen;
842 
843 	if (data) {
844 		uint8_t *buf;
845 
846 		if (size > GOT_PRIVSEP_INLINE_BLOB_DATA_MAX)
847 			return got_error(GOT_ERR_NO_SPACE);
848 
849 		buf = malloc(sizeof(iblob) + size);
850 		if (buf == NULL)
851 			return got_error_from_errno();
852 
853 		memcpy(buf, &iblob, sizeof(iblob));
854 		memcpy(buf + sizeof(iblob), data, size);
855 		if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, buf,
856 		   sizeof(iblob) + size) == -1) {
857 			free(buf);
858 			return got_error_from_errno();
859 		}
860 		free(buf);
861 	} else {
862 		/* Data has already been written to file descriptor. */
863 		if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, &iblob,
864 		    sizeof(iblob)) == -1)
865 			return got_error_from_errno();
866 	}
867 
868 
869 	return flush_imsg(ibuf);
870 }
871 
872 const struct got_error *
873 got_privsep_recv_blob(uint8_t **outbuf, size_t *size, size_t *hdrlen,
874     struct imsgbuf *ibuf)
875 {
876 	const struct got_error *err = NULL;
877 	struct imsg imsg;
878 	struct got_imsg_blob *iblob;
879 	size_t datalen;
880 
881 	*outbuf = NULL;
882 
883 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
884 	if (err)
885 		return err;
886 
887 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
888 
889 	switch (imsg.hdr.type) {
890 	case GOT_IMSG_BLOB:
891 		if (datalen < sizeof(*iblob)) {
892 			err = got_error(GOT_ERR_PRIVSEP_LEN);
893 			break;
894 		}
895 		iblob = imsg.data;
896 		*size = iblob->size;
897 		*hdrlen = iblob->hdrlen;
898 
899 		if (datalen == sizeof(*iblob)) {
900 			/* Data has been written to file descriptor. */
901 			break;
902 		}
903 
904 		if (*size > GOT_PRIVSEP_INLINE_BLOB_DATA_MAX) {
905 			err = got_error(GOT_ERR_PRIVSEP_LEN);
906 			break;
907 		}
908 
909 		*outbuf = malloc(*size);
910 		if (*outbuf == NULL) {
911 			err = got_error_from_errno();
912 			break;
913 		}
914 		memcpy(*outbuf, imsg.data + sizeof(*iblob), *size);
915 		break;
916 	default:
917 		err = got_error(GOT_ERR_PRIVSEP_MSG);
918 		break;
919 	}
920 
921 	imsg_free(&imsg);
922 
923 	return err;
924 }
925 
926 static const struct got_error *
927 send_tagmsg(struct imsgbuf *ibuf, struct got_tag_object *tag, size_t tagmsg_len)
928 {
929 	const struct got_error *err = NULL;
930 	size_t offset, remain;
931 
932 	offset = 0;
933 	remain = tagmsg_len;
934 	while (remain > 0) {
935 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
936 
937 		if (imsg_compose(ibuf, GOT_IMSG_TAG_TAGMSG, 0, 0, -1,
938 		    tag->tagmsg + offset, n) == -1) {
939 			err = got_error_from_errno();
940 			break;
941 		}
942 
943 		err = flush_imsg(ibuf);
944 		if (err)
945 			break;
946 
947 		offset += n;
948 		remain -= n;
949 	}
950 
951 	return err;
952 }
953 
954 const struct got_error *
955 got_privsep_send_tag(struct imsgbuf *ibuf, struct got_tag_object *tag)
956 {
957 	const struct got_error *err = NULL;
958 	struct got_imsg_tag_object *itag;
959 	uint8_t *buf;
960 	size_t len, total;
961 	size_t tag_len = strlen(tag->tag);
962 	size_t tagger_len = strlen(tag->tagger);
963 	size_t tagmsg_len = strlen(tag->tagmsg);
964 
965 	total = sizeof(*itag) + tag_len + tagger_len + tagmsg_len;
966 
967 	buf = malloc(total);
968 	if (buf == NULL)
969 		return got_error_from_errno();
970 
971 	itag = (struct got_imsg_tag_object *)buf;
972 	memcpy(itag->id, tag->id.sha1, sizeof(itag->id));
973 	itag->obj_type = tag->obj_type;
974 	itag->tag_len = tag_len;
975 	itag->tagger_len = tagger_len;
976 	itag->tagger_time = tag->tagger_time;
977 	itag->tagger_gmtoff = tag->tagger_gmtoff;
978 	itag->tagmsg_len = tagmsg_len;
979 
980 	len = sizeof(*itag);
981 	memcpy(buf + len, tag->tag, tag_len);
982 	len += tag_len;
983 	memcpy(buf + len, tag->tagger, tagger_len);
984 	len += tagger_len;
985 
986 	if (imsg_compose(ibuf, GOT_IMSG_TAG, 0, 0, -1, buf, len) == -1) {
987 		err = got_error_from_errno();
988 		goto done;
989 	}
990 
991 	if (tagmsg_len == 0 ||
992 	    tagmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
993 		err = flush_imsg(ibuf);
994 		if (err)
995 			goto done;
996 	}
997 	err = send_tagmsg(ibuf, tag, tagmsg_len);
998 done:
999 	free(buf);
1000 	return err;
1001 }
1002 
1003 const struct got_error *
1004 got_privsep_recv_tag(struct got_tag_object **tag, struct imsgbuf *ibuf)
1005 {
1006 	const struct got_error *err = NULL;
1007 	struct imsg imsg;
1008 	struct got_imsg_tag_object *itag;
1009 	size_t len, datalen;
1010 	const size_t min_datalen =
1011 	    MIN(sizeof(struct got_imsg_error),
1012 	    sizeof(struct got_imsg_tag_object));
1013 
1014 	*tag = NULL;
1015 
1016 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1017 	if (err)
1018 		return err;
1019 
1020 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1021 	len = 0;
1022 
1023 	switch (imsg.hdr.type) {
1024 	case GOT_IMSG_TAG:
1025 		if (datalen < sizeof(*itag)) {
1026 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1027 			break;
1028 		}
1029 		itag = imsg.data;
1030 		if (datalen != sizeof(*itag) + itag->tag_len +
1031 		    itag->tagger_len) {
1032 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1033 			break;
1034 		}
1035 		len += sizeof(*itag);
1036 
1037 		*tag = calloc(1, sizeof(**tag));
1038 		if (*tag == NULL) {
1039 			err = got_error_from_errno();
1040 			break;
1041 		}
1042 
1043 		memcpy((*tag)->id.sha1, itag->id, SHA1_DIGEST_LENGTH);
1044 
1045 		if (itag->tag_len == 0) {
1046 			(*tag)->tag = strdup("");
1047 			if ((*tag)->tag == NULL) {
1048 				err = got_error_from_errno();
1049 				break;
1050 			}
1051 		} else {
1052 			(*tag)->tag = malloc(itag->tag_len + 1);
1053 			if ((*tag)->tag == NULL) {
1054 				err = got_error_from_errno();
1055 				break;
1056 			}
1057 			memcpy((*tag)->tag, imsg.data + len,
1058 			    itag->tag_len);
1059 			(*tag)->tag[itag->tag_len] = '\0';
1060 		}
1061 		len += itag->tag_len;
1062 
1063 		(*tag)->obj_type = itag->obj_type;
1064 		(*tag)->tagger_time = itag->tagger_time;
1065 		(*tag)->tagger_gmtoff = itag->tagger_gmtoff;
1066 
1067 		if (itag->tagger_len == 0) {
1068 			(*tag)->tagger = strdup("");
1069 			if ((*tag)->tagger == NULL) {
1070 				err = got_error_from_errno();
1071 				break;
1072 			}
1073 		} else {
1074 			(*tag)->tagger = malloc(itag->tagger_len + 1);
1075 			if ((*tag)->tagger == NULL) {
1076 				err = got_error_from_errno();
1077 				break;
1078 			}
1079 			memcpy((*tag)->tagger, imsg.data + len,
1080 			    itag->tagger_len);
1081 			(*tag)->tagger[itag->tagger_len] = '\0';
1082 		}
1083 		len += itag->tagger_len;
1084 
1085 		if (itag->tagmsg_len == 0) {
1086 			(*tag)->tagmsg = strdup("");
1087 			if ((*tag)->tagmsg == NULL) {
1088 				err = got_error_from_errno();
1089 				break;
1090 			}
1091 		} else {
1092 			size_t offset = 0, remain = itag->tagmsg_len;
1093 
1094 			(*tag)->tagmsg = malloc(itag->tagmsg_len + 1);
1095 			if ((*tag)->tagmsg == NULL) {
1096 				err = got_error_from_errno();
1097 				break;
1098 			}
1099 			while (remain > 0) {
1100 				struct imsg imsg_log;
1101 				size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
1102 				    remain);
1103 
1104 				err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
1105 				if (err)
1106 					return err;
1107 
1108 				if (imsg_log.hdr.type != GOT_IMSG_TAG_TAGMSG)
1109 					return got_error(GOT_ERR_PRIVSEP_MSG);
1110 
1111 				memcpy((*tag)->tagmsg + offset, imsg_log.data,
1112 				    n);
1113 				imsg_free(&imsg_log);
1114 				offset += n;
1115 				remain -= n;
1116 			}
1117 			(*tag)->tagmsg[itag->tagmsg_len] = '\0';
1118 		}
1119 
1120 		break;
1121 	default:
1122 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1123 		break;
1124 	}
1125 
1126 	imsg_free(&imsg);
1127 
1128 	return err;
1129 }
1130 
1131 const struct got_error *
1132 got_privsep_init_pack_child(struct imsgbuf *ibuf, struct got_pack *pack,
1133     struct got_packidx *packidx)
1134 {
1135 	struct got_imsg_packidx ipackidx;
1136 	struct got_imsg_pack ipack;
1137 	int fd;
1138 
1139 	ipackidx.len = packidx->len;
1140 	fd = dup(packidx->fd);
1141 	if (fd == -1)
1142 		return got_error_from_errno();
1143 
1144 	if (imsg_compose(ibuf, GOT_IMSG_PACKIDX, 0, 0, fd, &ipackidx,
1145 	    sizeof(ipackidx)) == -1)
1146 		return got_error_from_errno();
1147 
1148 	if (strlcpy(ipack.path_packfile, pack->path_packfile,
1149 	    sizeof(ipack.path_packfile)) >= sizeof(ipack.path_packfile))
1150 		return got_error(GOT_ERR_NO_SPACE);
1151 	ipack.filesize = pack->filesize;
1152 
1153 	fd = dup(pack->fd);
1154 	if (fd == -1)
1155 		return got_error_from_errno();
1156 
1157 	if (imsg_compose(ibuf, GOT_IMSG_PACK, 0, 0, fd, &ipack, sizeof(ipack))
1158 	    == -1)
1159 		return got_error_from_errno();
1160 
1161 	return flush_imsg(ibuf);
1162 }
1163 
1164 const struct got_error *
1165 got_privsep_send_packed_obj_req(struct imsgbuf *ibuf, int idx,
1166     struct got_object_id *id)
1167 {
1168 	struct got_imsg_packed_object iobj;
1169 
1170 	iobj.idx = idx;
1171 	memcpy(iobj.id, id->sha1, sizeof(iobj.id));
1172 
1173 	if (imsg_compose(ibuf, GOT_IMSG_PACKED_OBJECT_REQUEST, 0, 0, -1,
1174 	    &iobj, sizeof(iobj)) == -1)
1175 		return got_error_from_errno();
1176 
1177 	return flush_imsg(ibuf);
1178 }
1179 
1180 const struct got_error *
1181 got_privsep_unveil_exec_helpers(void)
1182 {
1183 	if (unveil(GOT_PATH_PROG_READ_PACK, "x") != 0 ||
1184 	    unveil(GOT_PATH_PROG_READ_OBJECT, "x") != 0 ||
1185 	    unveil(GOT_PATH_PROG_READ_COMMIT, "x") != 0 ||
1186 	    unveil(GOT_PATH_PROG_READ_TREE, "x") != 0 ||
1187 	    unveil(GOT_PATH_PROG_READ_BLOB, "x") != 0 ||
1188 	    unveil(GOT_PATH_PROG_READ_TAG, "x") != 0)
1189 		return got_error_from_errno();
1190 
1191 	return NULL;
1192 }