op public repos

Blob

Date:: Tue Apr 24 11:30:34 2018 UTC
Message:: verify size of blob received from privsep child
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2018 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/queue.h>
19 #include <sys/uio.h>
20 
21 #include <stdio.h>
22 #include <stdlib.h>
23 #include <string.h>
24 #include <errno.h>
25 #include <stdint.h>
26 #include <poll.h>
27 #include <imsg.h>
28 #include <sha1.h>
29 #include <zlib.h>
30 
31 #include "got_object.h"
32 #include "got_error.h"
33 
34 #include "got_lib_sha1.h"
35 #include "got_lib_delta.h"
36 #include "got_lib_zbuf.h"
37 #include "got_lib_object.h"
38 #include "got_lib_privsep.h"
39 
40 #ifndef MIN
41 #define	MIN(_a,_b) ((_a) < (_b) ? (_a) : (_b))
42 #endif
43 
44 static const struct got_error *
45 poll_fd(int fd, int events, int timeout)
46 {
47 	struct pollfd pfd[1];
48 	int n;
49 
50 	pfd[0].fd = fd;
51 	pfd[0].events = events;
52 
53 	n = poll(pfd, 1, timeout);
54 	if (n == -1)
55 		return got_error_from_errno();
56 	if (n == 0)
57 		return got_error(GOT_ERR_TIMEOUT);
58 	if (pfd[0].revents & (POLLERR | POLLNVAL))
59 		return got_error_from_errno();
60 	if (pfd[0].revents & (events | POLLHUP))
61 		return NULL;
62 
63 	return got_error(GOT_ERR_INTERRUPT);
64 }
65 
66 static const struct got_error *
67 read_imsg(struct imsgbuf *ibuf)
68 {
69 	const struct got_error *err;
70 	size_t n;
71 
72 	err = poll_fd(ibuf->fd, POLLIN, INFTIM);
73 	if (err)
74 		return err;
75 
76 	n = imsg_read(ibuf);
77 	if (n == -1) {
78 		if (errno == EAGAIN) /* Could be a file-descriptor leak. */
79 			return got_error(GOT_ERR_PRIVSEP_NO_FD);
80 		return got_error(GOT_ERR_PRIVSEP_READ);
81 	}
82 	if (n == 0)
83 		return got_error(GOT_ERR_PRIVSEP_PIPE);
84 
85 	return NULL;
86 }
87 
88 static const struct got_error *
89 recv_one_imsg(struct imsg *imsg, struct imsgbuf *ibuf, size_t min_datalen)
90 {
91 	const struct got_error *err;
92 	ssize_t n;
93 
94 	err = read_imsg(ibuf);
95 	if (err)
96 		return err;
97 
98 	n = imsg_get(ibuf, imsg);
99 	if (n == 0)
100 		return got_error(GOT_ERR_PRIVSEP_READ);
101 
102 	if (imsg->hdr.len < IMSG_HEADER_SIZE + min_datalen)
103 		return got_error(GOT_ERR_PRIVSEP_LEN);
104 
105 	return NULL;
106 }
107 
108 static const struct got_error *
109 recv_imsg_error(struct imsg *imsg, size_t datalen)
110 {
111 	struct got_imsg_error ierr;
112 
113 	if (datalen != sizeof(ierr))
114 		return got_error(GOT_ERR_PRIVSEP_LEN);
115 
116 	memcpy(&ierr, imsg->data, sizeof(ierr));
117 	if (ierr.code == GOT_ERR_ERRNO) {
118 		static struct got_error serr;
119 		serr.code = GOT_ERR_ERRNO;
120 		serr.msg = strerror(ierr.errno_code);
121 		return &serr;
122 	}
123 
124 	return got_error(ierr.code);
125 }
126 
127 /* Attempt to send an error in an imsg. Complain on stderr as a last resort. */
128 void
129 got_privsep_send_error(struct imsgbuf *ibuf, const struct got_error *err)
130 {
131 	const struct got_error *poll_err;
132 	struct got_imsg_error ierr;
133 	int ret;
134 
135 	ierr.code = err->code;
136 	if (err->code == GOT_ERR_ERRNO)
137 		ierr.errno_code = errno;
138 	else
139 		ierr.errno_code = 0;
140 	ret = imsg_compose(ibuf, GOT_IMSG_ERROR, 0, 0, -1, &ierr, sizeof(ierr));
141 	if (ret != -1) {
142 		fprintf(stderr, "%s: error %d \"%s\": imsg_compose: %s\n",
143 		    getprogname(), err->code, err->msg, strerror(errno));
144 		return;
145 	}
146 
147 	poll_err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
148 	if (poll_err) {
149 		fprintf(stderr, "%s: error %d \"%s\": poll: %s\n",
150 		    getprogname(), err->code, err->msg, poll_err->msg);
151 		return;
152 	}
153 
154 	ret = imsg_flush(ibuf);
155 	if (ret == -1) {
156 		fprintf(stderr, "%s: error %d \"%s\": imsg_flush: %s\n",
157 		    getprogname(), err->code, err->msg, strerror(errno));
158 		return;
159 	}
160 }
161 
162 static const struct got_error *
163 flush_imsg(struct imsgbuf *ibuf)
164 {
165 	const struct got_error *err;
166 
167 	err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
168 	if (err)
169 		return err;
170 
171 	if (imsg_flush(ibuf) == -1)
172 		return got_error_from_errno();
173 
174 	return NULL;
175 }
176 
177 const struct got_error *
178 got_privsep_send_obj(struct imsgbuf *ibuf, struct got_object *obj, int ndeltas)
179 {
180 	struct got_imsg_object iobj;
181 
182 	iobj.type = obj->type;
183 	iobj.flags = obj->flags;
184 	iobj.hdrlen = obj->hdrlen;
185 	iobj.size = obj->size;
186 	iobj.ndeltas = ndeltas;
187 
188 	if (ndeltas > 0) {
189 		/* TODO: Handle deltas */
190 	}
191 
192 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT, 0, 0, -1, &iobj, sizeof(iobj))
193 	    == -1)
194 		return got_error_from_errno();
195 
196 	return flush_imsg(ibuf);
197 }
198 
199 const struct got_error *
200 got_privsep_recv_obj(struct got_object **obj, struct imsgbuf *ibuf)
201 {
202 	const struct got_error *err = NULL;
203 	struct imsg imsg;
204 	struct got_imsg_object iobj;
205 	size_t datalen;
206 	int i;
207 	const size_t min_datalen =
208 	    MIN(sizeof(struct got_imsg_error), sizeof(struct got_imsg_object));
209 
210 	*obj = NULL;
211 
212 	err = recv_one_imsg(&imsg, ibuf, min_datalen);
213 	if (err)
214 		return err;
215 
216 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
217 
218 	switch (imsg.hdr.type) {
219 	case GOT_IMSG_ERROR:
220 		err = recv_imsg_error(&imsg, datalen);
221 		break;
222 	case GOT_IMSG_OBJECT:
223 		if (datalen != sizeof(iobj)) {
224 			err = got_error(GOT_ERR_PRIVSEP_LEN);
225 			break;
226 		}
227 
228 		memcpy(&iobj, imsg.data, sizeof(iobj));
229 		if (iobj.ndeltas < 0 ||
230 		    iobj.ndeltas > GOT_DELTA_CHAIN_RECURSION_MAX) {
231 			err = got_error(GOT_ERR_PRIVSEP_LEN);
232 			break;
233 		}
234 
235 		*obj = calloc(1, sizeof(**obj));
236 		if (*obj == NULL) {
237 			err = got_error_from_errno();
238 			break;
239 		}
240 
241 		(*obj)->type = iobj.type;
242 		(*obj)->hdrlen = iobj.hdrlen;
243 		(*obj)->size = iobj.size;
244 		for (i = 0; i < iobj.ndeltas; i++) {
245 			/* TODO: Handle deltas */
246 		}
247 		break;
248 	default:
249 		err = got_error(GOT_ERR_PRIVSEP_MSG);
250 		break;
251 	}
252 
253 	imsg_free(&imsg);
254 
255 	return err;
256 }
257 
258 const struct got_error *
259 got_privsep_send_commit(struct imsgbuf *ibuf, struct got_commit_object *commit)
260 {
261 	const struct got_error *err = NULL;
262 	struct got_imsg_commit_object icommit;
263 	uint8_t *buf;
264 	size_t len, total;
265 	struct got_parent_id *pid;
266 
267 	memcpy(icommit.tree_id, commit->tree_id->sha1, sizeof(icommit.tree_id));
268 	icommit.author_len = strlen(commit->author);
269 	icommit.committer_len = strlen(commit->committer);
270 	icommit.logmsg_len = strlen(commit->logmsg);
271 	icommit.nparents = commit->nparents;
272 
273 	total = sizeof(icommit) + icommit.author_len +
274 	    icommit.committer_len + icommit.logmsg_len +
275 	    icommit.nparents * SHA1_DIGEST_LENGTH;
276 	/* XXX TODO support very large log messages properly */
277 	if (total > MAX_IMSGSIZE)
278 		return got_error(GOT_ERR_NO_SPACE);
279 
280 	buf = malloc(total);
281 	if (buf == NULL)
282 		return got_error_from_errno();
283 
284 	len = 0;
285 	memcpy(buf + len, &icommit, sizeof(icommit));
286 	len += sizeof(icommit);
287 	memcpy(buf + len, commit->author, icommit.author_len);
288 	len += icommit.author_len;
289 	memcpy(buf + len, commit->committer, icommit.committer_len);
290 	len += icommit.committer_len;
291 	memcpy(buf + len, commit->logmsg, icommit.logmsg_len);
292 	len += icommit.logmsg_len;
293 	SIMPLEQ_FOREACH(pid, &commit->parent_ids, entry) {
294 		memcpy(buf + len, pid->id, SHA1_DIGEST_LENGTH);
295 		len += SHA1_DIGEST_LENGTH;
296 	}
297 
298 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT, 0, 0, -1, buf, len) == -1) {
299 		err = got_error_from_errno();
300 		goto done;
301 	}
302 
303 	err = flush_imsg(ibuf);
304 done:
305 	free(buf);
306 	return err;
307 }
308 const struct got_error *
309 got_privsep_recv_commit(struct got_commit_object **commit, struct imsgbuf *ibuf)
310 {
311 	const struct got_error *err = NULL;
312 	struct imsg imsg;
313 	struct got_imsg_commit_object icommit;
314 	size_t len, datalen;
315 	int i;
316 	const size_t min_datalen =
317 	    MIN(sizeof(struct got_imsg_error),
318 	    sizeof(struct got_imsg_commit_object));
319 	uint8_t *data;
320 
321 	*commit = NULL;
322 
323 	err = recv_one_imsg(&imsg, ibuf, min_datalen);
324 	if (err)
325 		return err;
326 
327 	data = imsg.data;
328 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
329 	len = 0;
330 
331 	switch (imsg.hdr.type) {
332 	case GOT_IMSG_ERROR:
333 		err = recv_imsg_error(&imsg, datalen);
334 		break;
335 	case GOT_IMSG_COMMIT:
336 		if (datalen < sizeof(icommit)) {
337 			err = got_error(GOT_ERR_PRIVSEP_LEN);
338 			break;
339 		}
340 
341 		memcpy(&icommit, data, sizeof(icommit));
342 		if (datalen != sizeof(icommit) + icommit.author_len +
343 		    icommit.committer_len + icommit.logmsg_len +
344 		    icommit.nparents * SHA1_DIGEST_LENGTH) {
345 			err = got_error(GOT_ERR_PRIVSEP_LEN);
346 			break;
347 		}
348 		if (icommit.nparents < 0) {
349 			err = got_error(GOT_ERR_PRIVSEP_LEN);
350 			break;
351 		}
352 		len += sizeof(icommit);
353 
354 		*commit = got_object_commit_alloc_partial();
355 		if (*commit == NULL) {
356 			err = got_error_from_errno();
357 			break;
358 		}
359 
360 		memcpy((*commit)->tree_id->sha1, icommit.tree_id,
361 		    SHA1_DIGEST_LENGTH);
362 
363 		if (icommit.author_len == 0) {
364 			(*commit)->author = strdup("");
365 			if ((*commit)->author == NULL) {
366 				err = got_error_from_errno();
367 				break;
368 			}
369 		} else {
370 			(*commit)->author = malloc(icommit.author_len + 1);
371 			if ((*commit)->author == NULL) {
372 				err = got_error_from_errno();
373 				break;
374 			}
375 			memcpy((*commit)->author, data + len,
376 			    icommit.author_len);
377 			(*commit)->author[icommit.author_len] = '\0';
378 		}
379 		len += icommit.author_len;
380 
381 		if (icommit.committer_len == 0) {
382 			(*commit)->committer = strdup("");
383 			if ((*commit)->committer == NULL) {
384 				err = got_error_from_errno();
385 				break;
386 			}
387 		} else {
388 			(*commit)->committer =
389 			    malloc(icommit.committer_len + 1);
390 			if ((*commit)->committer == NULL) {
391 				err = got_error_from_errno();
392 				break;
393 			}
394 			memcpy((*commit)->committer, data + len,
395 			    icommit.committer_len);
396 			(*commit)->committer[icommit.committer_len] = '\0';
397 		}
398 		len += icommit.committer_len;
399 
400 		if (icommit.logmsg_len == 0) {
401 			(*commit)->logmsg = strdup("");
402 			if ((*commit)->logmsg == NULL) {
403 				err = got_error_from_errno();
404 				break;
405 			}
406 		} else {
407 			(*commit)->logmsg = malloc(icommit.logmsg_len + 1);
408 			if ((*commit)->logmsg == NULL) {
409 				err = got_error_from_errno();
410 				break;
411 			}
412 			memcpy((*commit)->logmsg, data + len,
413 			    icommit.logmsg_len);
414 			(*commit)->logmsg[icommit.logmsg_len] = '\0';
415 		}
416 		len += icommit.logmsg_len;
417 
418 		for (i = 0; i < icommit.nparents; i++) {
419 			struct got_parent_id *pid;
420 
421 			pid = calloc(1, sizeof(*pid));
422 			if (pid == NULL) {
423 				err = got_error_from_errno();
424 				break;
425 			}
426 			pid->id = calloc(1, sizeof(*pid->id));
427 			if (pid->id == NULL) {
428 				err = got_error_from_errno();
429 				free(pid);
430 				break;
431 			}
432 
433 			memcpy(pid->id, data + len + i * SHA1_DIGEST_LENGTH,
434 			    sizeof(*pid->id));
435 			SIMPLEQ_INSERT_TAIL(&(*commit)->parent_ids, pid, entry);
436 			(*commit)->nparents++;
437 		}
438 		break;
439 	default:
440 		err = got_error(GOT_ERR_PRIVSEP_MSG);
441 		break;
442 	}
443 
444 	imsg_free(&imsg);
445 
446 	return err;
447 }
448 
449 const struct got_error *
450 got_privsep_send_tree(struct imsgbuf *ibuf, struct got_tree_object *tree)
451 {
452 	const struct got_error *err = NULL;
453 	struct got_imsg_tree_object itree;
454 	struct got_tree_entry *te;
455 
456 	itree.nentries = tree->nentries;
457 	if (imsg_compose(ibuf, GOT_IMSG_TREE, 0, 0, -1, &itree, sizeof(itree))
458 	    == -1)
459 		return got_error_from_errno();
460 
461 	err = flush_imsg(ibuf);
462 	if (err)
463 		return err;
464 
465 	SIMPLEQ_FOREACH(te, &tree->entries, entry) {
466 		struct got_imsg_tree_entry ite;
467 		uint8_t *buf = NULL;
468 		size_t len = sizeof(ite) + strlen(te->name);
469 
470 		if (len > MAX_IMSGSIZE)
471 			return got_error(GOT_ERR_NO_SPACE);
472 
473 		buf = malloc(len);
474 		if (buf == NULL)
475 			return got_error_from_errno();
476 
477 		memcpy(ite.id, te->id->sha1, sizeof(ite.id));
478 		ite.mode = te->mode;
479 		memcpy(buf, &ite, sizeof(ite));
480 		memcpy(buf + sizeof(ite), te->name, strlen(te->name));
481 
482 		if (imsg_compose(ibuf, GOT_IMSG_TREE_ENTRY, 0, 0, -1,
483 		    buf, len) == -1)
484 			err = got_error_from_errno();
485 		free(buf);
486 		if (err)
487 			return err;
488 
489 		err = flush_imsg(ibuf);
490 		if (err)
491 			return err;
492 	}
493 
494 	return NULL;
495 }
496 
497 const struct got_error *
498 got_privsep_recv_tree(struct got_tree_object **tree, struct imsgbuf *ibuf)
499 {
500 	const struct got_error *err = NULL;
501 	const size_t min_datalen =
502 	    MIN(sizeof(struct got_imsg_error),
503 	    sizeof(struct got_imsg_tree_object));
504 	struct got_imsg_tree_object itree = { 0 };
505 	int nentries = 0;
506 
507 	*tree = NULL;
508 get_more:
509 	err = read_imsg(ibuf);
510 	if (err)
511 		goto done;
512 
513 	while (1) {
514 		struct imsg imsg;
515 		size_t n;
516 		size_t datalen;
517 		struct got_imsg_tree_entry ite;
518 		struct got_tree_entry *te = NULL;
519 
520 		n = imsg_get(ibuf, &imsg);
521 		if (n == 0) {
522 			if (*tree && (*tree)->nentries != nentries)
523 				goto get_more;
524 			break;
525 		}
526 
527 		if (imsg.hdr.len < IMSG_HEADER_SIZE + min_datalen)
528 			return got_error(GOT_ERR_PRIVSEP_LEN);
529 
530 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
531 
532 		switch (imsg.hdr.type) {
533 		case GOT_IMSG_ERROR:
534 			err = recv_imsg_error(&imsg, datalen);
535 			break;
536 		case GOT_IMSG_TREE:
537 			/* This message should only appear once. */
538 			if (*tree != NULL) {
539 				err = got_error(GOT_ERR_PRIVSEP_MSG);
540 				break;
541 			}
542 			if (datalen != sizeof(itree)) {
543 				err = got_error(GOT_ERR_PRIVSEP_LEN);
544 				break;
545 			}
546 			memcpy(&itree, imsg.data, sizeof(itree));
547 			*tree = calloc(1, sizeof(**tree));
548 			if (*tree == NULL) {
549 				err = got_error_from_errno();
550 				break;
551 			}
552 			(*tree)->nentries = itree.nentries;
553 			SIMPLEQ_INIT(&(*tree)->entries);
554 			break;
555 		case GOT_IMSG_TREE_ENTRY:
556 			/* This message should be preceeded by GOT_IMSG_TREE. */
557 			if (*tree == NULL) {
558 				err = got_error(GOT_ERR_PRIVSEP_MSG);
559 				break;
560 			}
561 			if (datalen < sizeof(ite) || datalen > MAX_IMSGSIZE) {
562 				err = got_error(GOT_ERR_PRIVSEP_LEN);
563 				break;
564 			}
565 
566 			/* Remaining data contains the entry's name. */
567 			datalen -= sizeof(ite);
568 			memcpy(&ite, imsg.data, sizeof(ite));
569 			if (datalen == 0 || datalen > MAX_IMSGSIZE) {
570 				err = got_error(GOT_ERR_PRIVSEP_LEN);
571 				break;
572 			}
573 
574 			te = got_alloc_tree_entry_partial();
575 			if (te == NULL) {
576 				err = got_error_from_errno();
577 				break;
578 			}
579 			te->name = malloc(datalen + 1);
580 			if (te->name == NULL) {
581 				free(te);
582 				err = got_error_from_errno();
583 				break;
584 			}
585 			memcpy(te->name, imsg.data + sizeof(ite), datalen);
586 			te->name[datalen] = '\0';
587 
588 			memcpy(te->id->sha1, ite.id, SHA1_DIGEST_LENGTH);
589 			te->mode = ite.mode;
590 			SIMPLEQ_INSERT_TAIL(&(*tree)->entries, te, entry);
591 			nentries++;
592 			break;
593 		default:
594 			err = got_error(GOT_ERR_PRIVSEP_MSG);
595 			break;
596 		}
597 
598 		imsg_free(&imsg);
599 	}
600 done:
601 	if (*tree && (*tree)->nentries != nentries) {
602 		if (err == NULL)
603 			err = got_error(GOT_ERR_PRIVSEP_LEN);
604 		got_object_tree_close(*tree);
605 		*tree = NULL;
606 	}
607 
608 	return err;
609 }
610 
611 const struct got_error *
612 got_privsep_send_blob(struct imsgbuf *ibuf, size_t size)
613 {
614 	struct got_imsg_blob iblob;
615 
616 	iblob.size = size;
617 	/* Data has already been written to file descriptor. */
618 
619 	if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, &iblob, sizeof(iblob))
620 	    == -1)
621 		return got_error_from_errno();
622 
623 	return flush_imsg(ibuf);
624 }
625 
626 const struct got_error *
627 got_privsep_recv_blob(size_t *size, struct imsgbuf *ibuf)
628 {
629 	const struct got_error *err = NULL;
630 	struct imsg imsg;
631 	struct got_imsg_blob iblob;
632 	size_t datalen;
633 
634 	err = recv_one_imsg(&imsg, ibuf, 0);
635 	if (err)
636 		return err;
637 
638 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
639 
640 	switch (imsg.hdr.type) {
641 	case GOT_IMSG_ERROR:
642 		err = recv_imsg_error(&imsg, datalen);
643 		break;
644 	case GOT_IMSG_BLOB:
645 		if (datalen != sizeof(iblob))
646 			err = got_error(GOT_ERR_PRIVSEP_LEN);
647 		memcpy(&iblob, imsg.data, sizeof(iblob));
648 		*size = iblob.size;
649 		/* Data has been written to file descriptor. */
650 		break;
651 	default:
652 		err = got_error(GOT_ERR_PRIVSEP_MSG);
653 		break;
654 	}
655 
656 	imsg_free(&imsg);
657 
658 	return err;
659 }