op public repos

Blob

Date:: Fri Aug 9 12:35:32 2019 UTC
Message:: improve error message if helper binaries fail to unveil(2)
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2018, 2019 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/queue.h>
19 #include <sys/uio.h>
20 #include <sys/syslimits.h>
21 #include <sys/wait.h>
22 
23 #include <stdio.h>
24 #include <stdlib.h>
25 #include <string.h>
26 #include <errno.h>
27 #include <stdint.h>
28 #include <poll.h>
29 #include <imsg.h>
30 #include <sha1.h>
31 #include <zlib.h>
32 #include <time.h>
33 
34 #include "got_object.h"
35 #include "got_error.h"
36 
37 #include "got_lib_sha1.h"
38 #include "got_lib_delta.h"
39 #include "got_lib_inflate.h"
40 #include "got_lib_object.h"
41 #include "got_lib_object_parse.h"
42 #include "got_lib_privsep.h"
43 #include "got_lib_pack.h"
44 
45 #ifndef MIN
46 #define	MIN(_a,_b) ((_a) < (_b) ? (_a) : (_b))
47 #endif
48 
49 #ifndef nitems
50 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
51 #endif
52 
53 static const struct got_error *
54 poll_fd(int fd, int events, int timeout)
55 {
56 	struct pollfd pfd[1];
57 	int n;
58 
59 	pfd[0].fd = fd;
60 	pfd[0].events = events;
61 
62 	n = poll(pfd, 1, timeout);
63 	if (n == -1)
64 		return got_error_from_errno("poll");
65 	if (n == 0)
66 		return got_error(GOT_ERR_TIMEOUT);
67 	if (pfd[0].revents & (POLLERR | POLLNVAL))
68 		return got_error_from_errno("poll error");
69 	if (pfd[0].revents & (events | POLLHUP))
70 		return NULL;
71 
72 	return got_error(GOT_ERR_INTERRUPT);
73 }
74 
75 static const struct got_error *
76 read_imsg(struct imsgbuf *ibuf)
77 {
78 	const struct got_error *err;
79 	size_t n;
80 
81 	err = poll_fd(ibuf->fd, POLLIN, INFTIM);
82 	if (err)
83 		return err;
84 
85 	n = imsg_read(ibuf);
86 	if (n == -1) {
87 		if (errno == EAGAIN) /* Could be a file-descriptor leak. */
88 			return got_error(GOT_ERR_PRIVSEP_NO_FD);
89 		return got_error(GOT_ERR_PRIVSEP_READ);
90 	}
91 	if (n == 0)
92 		return got_error(GOT_ERR_PRIVSEP_PIPE);
93 
94 	return NULL;
95 }
96 
97 const struct got_error *
98 got_privsep_wait_for_child(pid_t pid)
99 {
100 	int child_status;
101 
102 	if (waitpid(pid, &child_status, 0) == -1)
103 		return got_error_from_errno("waitpid");
104 
105 	if (!WIFEXITED(child_status))
106 		return got_error(GOT_ERR_PRIVSEP_DIED);
107 
108 	if (WEXITSTATUS(child_status) != 0)
109 		return got_error(GOT_ERR_PRIVSEP_EXIT);
110 
111 	return NULL;
112 }
113 
114 static const struct got_error *
115 recv_imsg_error(struct imsg *imsg, size_t datalen)
116 {
117 	struct got_imsg_error *ierr;
118 
119 	if (datalen != sizeof(*ierr))
120 		return got_error(GOT_ERR_PRIVSEP_LEN);
121 
122 	ierr = imsg->data;
123 	if (ierr->code == GOT_ERR_ERRNO) {
124 		static struct got_error serr;
125 		serr.code = GOT_ERR_ERRNO;
126 		serr.msg = strerror(ierr->errno_code);
127 		return &serr;
128 	}
129 
130 	return got_error(ierr->code);
131 }
132 
133 const struct got_error *
134 got_privsep_recv_imsg(struct imsg *imsg, struct imsgbuf *ibuf,
135     size_t min_datalen)
136 {
137 	const struct got_error *err;
138 	ssize_t n;
139 
140 	n = imsg_get(ibuf, imsg);
141 	if (n == -1)
142 		return got_error_from_errno("imsg_get");
143 
144 	while (n == 0) {
145 		err = read_imsg(ibuf);
146 		if (err)
147 			return err;
148 		n = imsg_get(ibuf, imsg);
149 	}
150 
151 	if (imsg->hdr.len < IMSG_HEADER_SIZE + min_datalen)
152 		return got_error(GOT_ERR_PRIVSEP_LEN);
153 
154 	if (imsg->hdr.type == GOT_IMSG_ERROR) {
155 		size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
156 		return recv_imsg_error(imsg, datalen);
157 	}
158 
159 	return NULL;
160 }
161 
162 /* Attempt to send an error in an imsg. Complain on stderr as a last resort. */
163 void
164 got_privsep_send_error(struct imsgbuf *ibuf, const struct got_error *err)
165 {
166 	const struct got_error *poll_err;
167 	struct got_imsg_error ierr;
168 	int ret;
169 
170 	ierr.code = err->code;
171 	if (err->code == GOT_ERR_ERRNO)
172 		ierr.errno_code = errno;
173 	else
174 		ierr.errno_code = 0;
175 	ret = imsg_compose(ibuf, GOT_IMSG_ERROR, 0, 0, -1, &ierr, sizeof(ierr));
176 	if (ret == -1) {
177 		fprintf(stderr, "%s: error %d \"%s\": imsg_compose: %s\n",
178 		    getprogname(), err->code, err->msg, strerror(errno));
179 		return;
180 	}
181 
182 	poll_err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
183 	if (poll_err) {
184 		fprintf(stderr, "%s: error %d \"%s\": poll: %s\n",
185 		    getprogname(), err->code, err->msg, poll_err->msg);
186 		return;
187 	}
188 
189 	ret = imsg_flush(ibuf);
190 	if (ret == -1) {
191 		fprintf(stderr, "%s: error %d \"%s\": imsg_flush: %s\n",
192 		    getprogname(), err->code, err->msg, strerror(errno));
193 		return;
194 	}
195 }
196 
197 static const struct got_error *
198 flush_imsg(struct imsgbuf *ibuf)
199 {
200 	const struct got_error *err;
201 
202 	err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
203 	if (err)
204 		return err;
205 
206 	if (imsg_flush(ibuf) == -1)
207 		return got_error_from_errno("imsg_flush");
208 
209 	return NULL;
210 }
211 
212 const struct got_error *
213 got_privsep_send_stop(int fd)
214 {
215 	const struct got_error *err = NULL;
216 	struct imsgbuf ibuf;
217 
218 	imsg_init(&ibuf, fd);
219 
220 	if (imsg_compose(&ibuf, GOT_IMSG_STOP, 0, 0, -1, NULL, 0) == -1)
221 		return got_error_from_errno("imsg_compose STOP");
222 
223 	err = flush_imsg(&ibuf);
224 	imsg_clear(&ibuf);
225 	return err;
226 }
227 
228 const struct got_error *
229 got_privsep_send_obj_req(struct imsgbuf *ibuf, int fd)
230 {
231 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT_REQUEST, 0, 0, fd, NULL, 0)
232 	    == -1)
233 		return got_error_from_errno("imsg_compose OBJECT_REQUEST");
234 
235 	return flush_imsg(ibuf);
236 }
237 
238 const struct got_error *
239 got_privsep_send_commit_req(struct imsgbuf *ibuf, int fd,
240     struct got_object_id *id, int pack_idx)
241 {
242 	const struct got_error *err = NULL;
243 	struct got_imsg_packed_object iobj, *iobjp;
244 	size_t len;
245 
246 	if (id) { /* commit is packed */
247 		iobj.idx = pack_idx;
248 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
249 		iobjp = &iobj;
250 		len = sizeof(iobj);
251 	} else {
252 		iobjp = NULL;
253 		len = 0;
254 	}
255 
256 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_REQUEST, 0, 0, fd, iobjp, len)
257 	    == -1) {
258 		err = got_error_from_errno("imsg_compose COMMIT_REQUEST");
259 		close(fd);
260 		return err;
261 	}
262 
263 	return flush_imsg(ibuf);
264 }
265 
266 const struct got_error *
267 got_privsep_send_tree_req(struct imsgbuf *ibuf, int fd,
268     struct got_object_id *id, int pack_idx)
269 {
270 	const struct got_error *err = NULL;
271 	struct got_imsg_packed_object iobj, *iobjp;
272 	size_t len;
273 
274 	if (id) { /* tree is packed */
275 		iobj.idx = pack_idx;
276 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
277 		iobjp = &iobj;
278 		len = sizeof(iobj);
279 	} else {
280 		iobjp = NULL;
281 		len = 0;
282 	}
283 
284 	if (imsg_compose(ibuf, GOT_IMSG_TREE_REQUEST, 0, 0, fd, iobjp, len)
285 	    == -1) {
286 		err = got_error_from_errno("imsg_compose TREE_REQUEST");
287 		close(fd);
288 		return err;
289 	}
290 
291 	return flush_imsg(ibuf);
292 }
293 
294 const struct got_error *
295 got_privsep_send_tag_req(struct imsgbuf *ibuf, int fd,
296     struct got_object_id *id, int pack_idx)
297 {
298 	struct got_imsg_packed_object iobj, *iobjp;
299 	size_t len;
300 
301 	if (id) { /* tag is packed */
302 		iobj.idx = pack_idx;
303 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
304 		iobjp = &iobj;
305 		len = sizeof(iobj);
306 	} else {
307 		iobjp = NULL;
308 		len = 0;
309 	}
310 
311 	if (imsg_compose(ibuf, GOT_IMSG_TAG_REQUEST, 0, 0, fd, iobjp, len)
312 	    == -1)
313 		return got_error_from_errno("imsg_compose TAG_REQUEST");
314 
315 	return flush_imsg(ibuf);
316 }
317 
318 const struct got_error *
319 got_privsep_send_blob_req(struct imsgbuf *ibuf, int infd,
320     struct got_object_id *id, int pack_idx)
321 {
322 	const struct got_error *err = NULL;
323 	struct got_imsg_packed_object iobj, *iobjp;
324 	size_t len;
325 
326 	if (id) { /* blob is packed */
327 		iobj.idx = pack_idx;
328 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
329 		iobjp = &iobj;
330 		len = sizeof(iobj);
331 	} else {
332 		iobjp = NULL;
333 		len = 0;
334 	}
335 
336 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_REQUEST, 0, 0, infd, iobjp, len)
337 	    == -1) {
338 		err = got_error_from_errno("imsg_compose BLOB_REQUEST");
339 		close(infd);
340 		return err;
341 	}
342 
343 	return flush_imsg(ibuf);
344 }
345 
346 const struct got_error *
347 got_privsep_send_blob_outfd(struct imsgbuf *ibuf, int outfd)
348 {
349 	const struct got_error *err = NULL;
350 
351 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_OUTFD, 0, 0, outfd, NULL, 0)
352 	    == -1) {
353 		err = got_error_from_errno("imsg_compose BLOB_OUTFD");
354 		close(outfd);
355 		return err;
356 	}
357 
358 	return flush_imsg(ibuf);
359 }
360 
361 const struct got_error *
362 got_privsep_send_tmpfd(struct imsgbuf *ibuf, int fd)
363 {
364 	const struct got_error *err = NULL;
365 
366 	if (imsg_compose(ibuf, GOT_IMSG_TMPFD, 0, 0, fd, NULL, 0)
367 	    == -1) {
368 		err = got_error_from_errno("imsg_compose TMPFD");
369 		close(fd);
370 		return err;
371 	}
372 
373 	return flush_imsg(ibuf);
374 }
375 
376 const struct got_error *
377 got_privsep_send_obj(struct imsgbuf *ibuf, struct got_object *obj)
378 {
379 	struct got_imsg_object iobj;
380 
381 	memcpy(iobj.id, obj->id.sha1, sizeof(iobj.id));
382 	iobj.type = obj->type;
383 	iobj.flags = obj->flags;
384 	iobj.hdrlen = obj->hdrlen;
385 	iobj.size = obj->size;
386 	if (iobj.flags & GOT_OBJ_FLAG_PACKED) {
387 		iobj.pack_offset = obj->pack_offset;
388 		iobj.pack_idx = obj->pack_idx;
389 	}
390 
391 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT, 0, 0, -1, &iobj, sizeof(iobj))
392 	    == -1)
393 		return got_error_from_errno("imsg_compose OBJECT");
394 
395 	return flush_imsg(ibuf);
396 }
397 
398 const struct got_error *
399 got_privsep_get_imsg_obj(struct got_object **obj, struct imsg *imsg,
400     struct imsgbuf *ibuf)
401 {
402 	const struct got_error *err = NULL;
403 	struct got_imsg_object *iobj;
404 	size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
405 
406 	if (datalen != sizeof(*iobj))
407 		return got_error(GOT_ERR_PRIVSEP_LEN);
408 	iobj = imsg->data;
409 
410 	*obj = calloc(1, sizeof(**obj));
411 	if (*obj == NULL)
412 		return got_error_from_errno("calloc");
413 
414 	memcpy((*obj)->id.sha1, iobj->id, SHA1_DIGEST_LENGTH);
415 	(*obj)->type = iobj->type;
416 	(*obj)->flags = iobj->flags;
417 	(*obj)->hdrlen = iobj->hdrlen;
418 	(*obj)->size = iobj->size;
419 	/* path_packfile is handled by caller */
420 	if (iobj->flags & GOT_OBJ_FLAG_PACKED) {
421 		(*obj)->pack_offset = iobj->pack_offset;
422 		(*obj)->pack_idx = iobj->pack_idx;
423 	}
424 
425 	return err;
426 }
427 
428 const struct got_error *
429 got_privsep_recv_obj(struct got_object **obj, struct imsgbuf *ibuf)
430 {
431 	const struct got_error *err = NULL;
432 	struct imsg imsg;
433 	size_t datalen;
434 	const size_t min_datalen =
435 	    MIN(sizeof(struct got_imsg_error), sizeof(struct got_imsg_object));
436 
437 	*obj = NULL;
438 
439 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
440 	if (err)
441 		return err;
442 
443 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
444 
445 	switch (imsg.hdr.type) {
446 	case GOT_IMSG_OBJECT:
447 		err = got_privsep_get_imsg_obj(obj, &imsg, ibuf);
448 		break;
449 	default:
450 		err = got_error(GOT_ERR_PRIVSEP_MSG);
451 		break;
452 	}
453 
454 	imsg_free(&imsg);
455 
456 	return err;
457 }
458 
459 static const struct got_error *
460 send_commit_logmsg(struct imsgbuf *ibuf, struct got_commit_object *commit,
461     size_t logmsg_len)
462 {
463 	const struct got_error *err = NULL;
464 	size_t offset, remain;
465 
466 	offset = 0;
467 	remain = logmsg_len;
468 	while (remain > 0) {
469 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
470 
471 		if (imsg_compose(ibuf, GOT_IMSG_COMMIT_LOGMSG, 0, 0, -1,
472 		    commit->logmsg + offset, n) == -1) {
473 			err = got_error_from_errno("imsg_compose "
474 			    "COMMIT_LOGMSG");
475 			break;
476 		}
477 
478 		err = flush_imsg(ibuf);
479 		if (err)
480 			break;
481 
482 		offset += n;
483 		remain -= n;
484 	}
485 
486 	return err;
487 }
488 
489 const struct got_error *
490 got_privsep_send_commit(struct imsgbuf *ibuf, struct got_commit_object *commit)
491 {
492 	const struct got_error *err = NULL;
493 	struct got_imsg_commit_object *icommit;
494 	uint8_t *buf;
495 	size_t len, total;
496 	struct got_object_qid *qid;
497 	size_t author_len = strlen(commit->author);
498 	size_t committer_len = strlen(commit->committer);
499 	size_t logmsg_len = strlen(commit->logmsg);
500 
501 	total = sizeof(*icommit) + author_len + committer_len +
502 	    commit->nparents * SHA1_DIGEST_LENGTH;
503 
504 	buf = malloc(total);
505 	if (buf == NULL)
506 		return got_error_from_errno("malloc");
507 
508 	icommit = (struct got_imsg_commit_object *)buf;
509 	memcpy(icommit->tree_id, commit->tree_id->sha1,
510 	    sizeof(icommit->tree_id));
511 	icommit->author_len = author_len;
512 	icommit->author_time = commit->author_time;
513 	icommit->author_gmtoff = commit->author_gmtoff;
514 	icommit->committer_len = committer_len;
515 	icommit->committer_time = commit->committer_time;
516 	icommit->committer_gmtoff = commit->committer_gmtoff;
517 	icommit->logmsg_len = logmsg_len;
518 	icommit->nparents = commit->nparents;
519 
520 	len = sizeof(*icommit);
521 	memcpy(buf + len, commit->author, author_len);
522 	len += author_len;
523 	memcpy(buf + len, commit->committer, committer_len);
524 	len += committer_len;
525 	SIMPLEQ_FOREACH(qid, &commit->parent_ids, entry) {
526 		memcpy(buf + len, qid->id, SHA1_DIGEST_LENGTH);
527 		len += SHA1_DIGEST_LENGTH;
528 	}
529 
530 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT, 0, 0, -1, buf, len) == -1) {
531 		err = got_error_from_errno("imsg_compose COMMIT");
532 		goto done;
533 	}
534 
535 	if (logmsg_len == 0 ||
536 	    logmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
537 		err = flush_imsg(ibuf);
538 		if (err)
539 			goto done;
540 	}
541 	err = send_commit_logmsg(ibuf, commit, logmsg_len);
542 done:
543 	free(buf);
544 	return err;
545 }
546 
547 const struct got_error *
548 got_privsep_recv_commit(struct got_commit_object **commit, struct imsgbuf *ibuf)
549 {
550 	const struct got_error *err = NULL;
551 	struct imsg imsg;
552 	struct got_imsg_commit_object *icommit;
553 	size_t len, datalen;
554 	int i;
555 	const size_t min_datalen =
556 	    MIN(sizeof(struct got_imsg_error),
557 	    sizeof(struct got_imsg_commit_object));
558 
559 	*commit = NULL;
560 
561 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
562 	if (err)
563 		return err;
564 
565 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
566 	len = 0;
567 
568 	switch (imsg.hdr.type) {
569 	case GOT_IMSG_COMMIT:
570 		if (datalen < sizeof(*icommit)) {
571 			err = got_error(GOT_ERR_PRIVSEP_LEN);
572 			break;
573 		}
574 		icommit = imsg.data;
575 		if (datalen != sizeof(*icommit) + icommit->author_len +
576 		    icommit->committer_len +
577 		    icommit->nparents * SHA1_DIGEST_LENGTH) {
578 			err = got_error(GOT_ERR_PRIVSEP_LEN);
579 			break;
580 		}
581 		if (icommit->nparents < 0) {
582 			err = got_error(GOT_ERR_PRIVSEP_LEN);
583 			break;
584 		}
585 		len += sizeof(*icommit);
586 
587 		*commit = got_object_commit_alloc_partial();
588 		if (*commit == NULL) {
589 			err = got_error_from_errno(
590 			    "got_object_commit_alloc_partial");
591 			break;
592 		}
593 
594 		memcpy((*commit)->tree_id->sha1, icommit->tree_id,
595 		    SHA1_DIGEST_LENGTH);
596 		(*commit)->author_time = icommit->author_time;
597 		(*commit)->author_gmtoff = icommit->author_gmtoff;
598 		(*commit)->committer_time = icommit->committer_time;
599 		(*commit)->committer_gmtoff = icommit->committer_gmtoff;
600 
601 		if (icommit->author_len == 0) {
602 			(*commit)->author = strdup("");
603 			if ((*commit)->author == NULL) {
604 				err = got_error_from_errno("strdup");
605 				break;
606 			}
607 		} else {
608 			(*commit)->author = malloc(icommit->author_len + 1);
609 			if ((*commit)->author == NULL) {
610 				err = got_error_from_errno("malloc");
611 				break;
612 			}
613 			memcpy((*commit)->author, imsg.data + len,
614 			    icommit->author_len);
615 			(*commit)->author[icommit->author_len] = '\0';
616 		}
617 		len += icommit->author_len;
618 
619 		if (icommit->committer_len == 0) {
620 			(*commit)->committer = strdup("");
621 			if ((*commit)->committer == NULL) {
622 				err = got_error_from_errno("strdup");
623 				break;
624 			}
625 		} else {
626 			(*commit)->committer =
627 			    malloc(icommit->committer_len + 1);
628 			if ((*commit)->committer == NULL) {
629 				err = got_error_from_errno("malloc");
630 				break;
631 			}
632 			memcpy((*commit)->committer, imsg.data + len,
633 			    icommit->committer_len);
634 			(*commit)->committer[icommit->committer_len] = '\0';
635 		}
636 		len += icommit->committer_len;
637 
638 		if (icommit->logmsg_len == 0) {
639 			(*commit)->logmsg = strdup("");
640 			if ((*commit)->logmsg == NULL) {
641 				err = got_error_from_errno("strdup");
642 				break;
643 			}
644 		} else {
645 			size_t offset = 0, remain = icommit->logmsg_len;
646 
647 			(*commit)->logmsg = malloc(icommit->logmsg_len + 1);
648 			if ((*commit)->logmsg == NULL) {
649 				err = got_error_from_errno("malloc");
650 				break;
651 			}
652 			while (remain > 0) {
653 				struct imsg imsg_log;
654 				size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
655 				    remain);
656 
657 				err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
658 				if (err)
659 					return err;
660 
661 				if (imsg_log.hdr.type != GOT_IMSG_COMMIT_LOGMSG)
662 					return got_error(GOT_ERR_PRIVSEP_MSG);
663 
664 				memcpy((*commit)->logmsg + offset,
665 				    imsg_log.data, n);
666 				imsg_free(&imsg_log);
667 				offset += n;
668 				remain -= n;
669 			}
670 			(*commit)->logmsg[icommit->logmsg_len] = '\0';
671 		}
672 
673 		for (i = 0; i < icommit->nparents; i++) {
674 			struct got_object_qid *qid;
675 
676 			err = got_object_qid_alloc_partial(&qid);
677 			if (err)
678 				break;
679 			memcpy(qid->id, imsg.data + len +
680 			    i * SHA1_DIGEST_LENGTH, sizeof(*qid->id));
681 			SIMPLEQ_INSERT_TAIL(&(*commit)->parent_ids, qid, entry);
682 			(*commit)->nparents++;
683 		}
684 		break;
685 	default:
686 		err = got_error(GOT_ERR_PRIVSEP_MSG);
687 		break;
688 	}
689 
690 	imsg_free(&imsg);
691 
692 	return err;
693 }
694 
695 const struct got_error *
696 got_privsep_send_tree(struct imsgbuf *ibuf, struct got_tree_object *tree)
697 {
698 	const struct got_error *err = NULL;
699 	struct got_imsg_tree_object itree;
700 	struct got_tree_entry *te;
701 	size_t totlen;
702 	int nimsg; /* number of imsg queued in ibuf */
703 
704 	itree.nentries = tree->entries.nentries;
705 	if (imsg_compose(ibuf, GOT_IMSG_TREE, 0, 0, -1, &itree, sizeof(itree))
706 	    == -1)
707 		return got_error_from_errno("imsg_compose TREE");
708 
709 	totlen = sizeof(itree);
710 	nimsg = 1;
711 	SIMPLEQ_FOREACH(te, &tree->entries.head, entry) {
712 		struct got_imsg_tree_entry *ite;
713 		uint8_t *buf = NULL;
714 		size_t len = sizeof(*ite) + strlen(te->name);
715 
716 		if (len > MAX_IMSGSIZE)
717 			return got_error(GOT_ERR_NO_SPACE);
718 
719 		nimsg++;
720 		if (totlen + len >= MAX_IMSGSIZE - (IMSG_HEADER_SIZE * nimsg)) {
721 			err = flush_imsg(ibuf);
722 			if (err)
723 				return err;
724 			nimsg = 0;
725 		}
726 
727 		buf = malloc(len);
728 		if (buf == NULL)
729 			return got_error_from_errno("malloc");
730 
731 		ite = (struct got_imsg_tree_entry *)buf;
732 		memcpy(ite->id, te->id->sha1, sizeof(ite->id));
733 		ite->mode = te->mode;
734 		memcpy(buf + sizeof(*ite), te->name, strlen(te->name));
735 
736 		if (imsg_compose(ibuf, GOT_IMSG_TREE_ENTRY, 0, 0, -1,
737 		    buf, len) == -1)
738 			err = got_error_from_errno("imsg_compose TREE_ENTRY");
739 		free(buf);
740 		if (err)
741 			return err;
742 		totlen += len;
743 	}
744 
745 	return flush_imsg(ibuf);
746 }
747 
748 const struct got_error *
749 got_privsep_recv_tree(struct got_tree_object **tree, struct imsgbuf *ibuf)
750 {
751 	const struct got_error *err = NULL;
752 	const size_t min_datalen =
753 	    MIN(sizeof(struct got_imsg_error),
754 	    sizeof(struct got_imsg_tree_object));
755 	struct got_imsg_tree_object *itree;
756 	int nentries = 0;
757 
758 	*tree = NULL;
759 get_more:
760 	err = read_imsg(ibuf);
761 	if (err)
762 		goto done;
763 
764 	for (;;) {
765 		struct imsg imsg;
766 		size_t n;
767 		size_t datalen;
768 		struct got_imsg_tree_entry *ite;
769 		struct got_tree_entry *te = NULL;
770 
771 		n = imsg_get(ibuf, &imsg);
772 		if (n == 0) {
773 			if (*tree && (*tree)->entries.nentries != nentries)
774 				goto get_more;
775 			break;
776 		}
777 
778 		if (imsg.hdr.len < IMSG_HEADER_SIZE + min_datalen)
779 			return got_error(GOT_ERR_PRIVSEP_LEN);
780 
781 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
782 
783 		switch (imsg.hdr.type) {
784 		case GOT_IMSG_ERROR:
785 			err = recv_imsg_error(&imsg, datalen);
786 			break;
787 		case GOT_IMSG_TREE:
788 			/* This message should only appear once. */
789 			if (*tree != NULL) {
790 				err = got_error(GOT_ERR_PRIVSEP_MSG);
791 				break;
792 			}
793 			if (datalen != sizeof(*itree)) {
794 				err = got_error(GOT_ERR_PRIVSEP_LEN);
795 				break;
796 			}
797 			itree = imsg.data;
798 			*tree = malloc(sizeof(**tree));
799 			if (*tree == NULL) {
800 				err = got_error_from_errno("malloc");
801 				break;
802 			}
803 			(*tree)->entries.nentries = itree->nentries;
804 			SIMPLEQ_INIT(&(*tree)->entries.head);
805 			(*tree)->refcnt = 0;
806 			break;
807 		case GOT_IMSG_TREE_ENTRY:
808 			/* This message should be preceeded by GOT_IMSG_TREE. */
809 			if (*tree == NULL) {
810 				err = got_error(GOT_ERR_PRIVSEP_MSG);
811 				break;
812 			}
813 			if (datalen < sizeof(*ite) || datalen > MAX_IMSGSIZE) {
814 				err = got_error(GOT_ERR_PRIVSEP_LEN);
815 				break;
816 			}
817 
818 			/* Remaining data contains the entry's name. */
819 			datalen -= sizeof(*ite);
820 			if (datalen == 0 || datalen > MAX_IMSGSIZE) {
821 				err = got_error(GOT_ERR_PRIVSEP_LEN);
822 				break;
823 			}
824 			ite = imsg.data;
825 
826 			te = got_alloc_tree_entry_partial();
827 			if (te == NULL) {
828 				err = got_error_from_errno(
829 				    "got_alloc_tree_entry_partial");
830 				break;
831 			}
832 			te->name = malloc(datalen + 1);
833 			if (te->name == NULL) {
834 				free(te);
835 				err = got_error_from_errno("malloc");
836 				break;
837 			}
838 			memcpy(te->name, imsg.data + sizeof(*ite), datalen);
839 			te->name[datalen] = '\0';
840 
841 			memcpy(te->id->sha1, ite->id, SHA1_DIGEST_LENGTH);
842 			te->mode = ite->mode;
843 			SIMPLEQ_INSERT_TAIL(&(*tree)->entries.head, te, entry);
844 			nentries++;
845 			break;
846 		default:
847 			err = got_error(GOT_ERR_PRIVSEP_MSG);
848 			break;
849 		}
850 
851 		imsg_free(&imsg);
852 	}
853 done:
854 	if (*tree && (*tree)->entries.nentries != nentries) {
855 		if (err == NULL)
856 			err = got_error(GOT_ERR_PRIVSEP_LEN);
857 		got_object_tree_close(*tree);
858 		*tree = NULL;
859 	}
860 
861 	return err;
862 }
863 
864 const struct got_error *
865 got_privsep_send_blob(struct imsgbuf *ibuf, size_t size, size_t hdrlen,
866     const uint8_t *data)
867 {
868 	struct got_imsg_blob iblob;
869 
870 	iblob.size = size;
871 	iblob.hdrlen = hdrlen;
872 
873 	if (data) {
874 		uint8_t *buf;
875 
876 		if (size > GOT_PRIVSEP_INLINE_BLOB_DATA_MAX)
877 			return got_error(GOT_ERR_NO_SPACE);
878 
879 		buf = malloc(sizeof(iblob) + size);
880 		if (buf == NULL)
881 			return got_error_from_errno("malloc");
882 
883 		memcpy(buf, &iblob, sizeof(iblob));
884 		memcpy(buf + sizeof(iblob), data, size);
885 		if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, buf,
886 		   sizeof(iblob) + size) == -1) {
887 			free(buf);
888 			return got_error_from_errno("imsg_compose BLOB");
889 		}
890 		free(buf);
891 	} else {
892 		/* Data has already been written to file descriptor. */
893 		if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, &iblob,
894 		    sizeof(iblob)) == -1)
895 			return got_error_from_errno("imsg_compose BLOB");
896 	}
897 
898 
899 	return flush_imsg(ibuf);
900 }
901 
902 const struct got_error *
903 got_privsep_recv_blob(uint8_t **outbuf, size_t *size, size_t *hdrlen,
904     struct imsgbuf *ibuf)
905 {
906 	const struct got_error *err = NULL;
907 	struct imsg imsg;
908 	struct got_imsg_blob *iblob;
909 	size_t datalen;
910 
911 	*outbuf = NULL;
912 
913 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
914 	if (err)
915 		return err;
916 
917 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
918 
919 	switch (imsg.hdr.type) {
920 	case GOT_IMSG_BLOB:
921 		if (datalen < sizeof(*iblob)) {
922 			err = got_error(GOT_ERR_PRIVSEP_LEN);
923 			break;
924 		}
925 		iblob = imsg.data;
926 		*size = iblob->size;
927 		*hdrlen = iblob->hdrlen;
928 
929 		if (datalen == sizeof(*iblob)) {
930 			/* Data has been written to file descriptor. */
931 			break;
932 		}
933 
934 		if (*size > GOT_PRIVSEP_INLINE_BLOB_DATA_MAX) {
935 			err = got_error(GOT_ERR_PRIVSEP_LEN);
936 			break;
937 		}
938 
939 		*outbuf = malloc(*size);
940 		if (*outbuf == NULL) {
941 			err = got_error_from_errno("malloc");
942 			break;
943 		}
944 		memcpy(*outbuf, imsg.data + sizeof(*iblob), *size);
945 		break;
946 	default:
947 		err = got_error(GOT_ERR_PRIVSEP_MSG);
948 		break;
949 	}
950 
951 	imsg_free(&imsg);
952 
953 	return err;
954 }
955 
956 static const struct got_error *
957 send_tagmsg(struct imsgbuf *ibuf, struct got_tag_object *tag, size_t tagmsg_len)
958 {
959 	const struct got_error *err = NULL;
960 	size_t offset, remain;
961 
962 	offset = 0;
963 	remain = tagmsg_len;
964 	while (remain > 0) {
965 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
966 
967 		if (imsg_compose(ibuf, GOT_IMSG_TAG_TAGMSG, 0, 0, -1,
968 		    tag->tagmsg + offset, n) == -1) {
969 			err = got_error_from_errno("imsg_compose TAG_TAGMSG");
970 			break;
971 		}
972 
973 		err = flush_imsg(ibuf);
974 		if (err)
975 			break;
976 
977 		offset += n;
978 		remain -= n;
979 	}
980 
981 	return err;
982 }
983 
984 const struct got_error *
985 got_privsep_send_tag(struct imsgbuf *ibuf, struct got_tag_object *tag)
986 {
987 	const struct got_error *err = NULL;
988 	struct got_imsg_tag_object *itag;
989 	uint8_t *buf;
990 	size_t len, total;
991 	size_t tag_len = strlen(tag->tag);
992 	size_t tagger_len = strlen(tag->tagger);
993 	size_t tagmsg_len = strlen(tag->tagmsg);
994 
995 	total = sizeof(*itag) + tag_len + tagger_len + tagmsg_len;
996 
997 	buf = malloc(total);
998 	if (buf == NULL)
999 		return got_error_from_errno("malloc");
1000 
1001 	itag = (struct got_imsg_tag_object *)buf;
1002 	memcpy(itag->id, tag->id.sha1, sizeof(itag->id));
1003 	itag->obj_type = tag->obj_type;
1004 	itag->tag_len = tag_len;
1005 	itag->tagger_len = tagger_len;
1006 	itag->tagger_time = tag->tagger_time;
1007 	itag->tagger_gmtoff = tag->tagger_gmtoff;
1008 	itag->tagmsg_len = tagmsg_len;
1009 
1010 	len = sizeof(*itag);
1011 	memcpy(buf + len, tag->tag, tag_len);
1012 	len += tag_len;
1013 	memcpy(buf + len, tag->tagger, tagger_len);
1014 	len += tagger_len;
1015 
1016 	if (imsg_compose(ibuf, GOT_IMSG_TAG, 0, 0, -1, buf, len) == -1) {
1017 		err = got_error_from_errno("imsg_compose TAG");
1018 		goto done;
1019 	}
1020 
1021 	if (tagmsg_len == 0 ||
1022 	    tagmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
1023 		err = flush_imsg(ibuf);
1024 		if (err)
1025 			goto done;
1026 	}
1027 	err = send_tagmsg(ibuf, tag, tagmsg_len);
1028 done:
1029 	free(buf);
1030 	return err;
1031 }
1032 
1033 const struct got_error *
1034 got_privsep_recv_tag(struct got_tag_object **tag, struct imsgbuf *ibuf)
1035 {
1036 	const struct got_error *err = NULL;
1037 	struct imsg imsg;
1038 	struct got_imsg_tag_object *itag;
1039 	size_t len, datalen;
1040 	const size_t min_datalen =
1041 	    MIN(sizeof(struct got_imsg_error),
1042 	    sizeof(struct got_imsg_tag_object));
1043 
1044 	*tag = NULL;
1045 
1046 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1047 	if (err)
1048 		return err;
1049 
1050 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1051 	len = 0;
1052 
1053 	switch (imsg.hdr.type) {
1054 	case GOT_IMSG_TAG:
1055 		if (datalen < sizeof(*itag)) {
1056 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1057 			break;
1058 		}
1059 		itag = imsg.data;
1060 		if (datalen != sizeof(*itag) + itag->tag_len +
1061 		    itag->tagger_len) {
1062 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1063 			break;
1064 		}
1065 		len += sizeof(*itag);
1066 
1067 		*tag = calloc(1, sizeof(**tag));
1068 		if (*tag == NULL) {
1069 			err = got_error_from_errno("calloc");
1070 			break;
1071 		}
1072 
1073 		memcpy((*tag)->id.sha1, itag->id, SHA1_DIGEST_LENGTH);
1074 
1075 		if (itag->tag_len == 0) {
1076 			(*tag)->tag = strdup("");
1077 			if ((*tag)->tag == NULL) {
1078 				err = got_error_from_errno("strdup");
1079 				break;
1080 			}
1081 		} else {
1082 			(*tag)->tag = malloc(itag->tag_len + 1);
1083 			if ((*tag)->tag == NULL) {
1084 				err = got_error_from_errno("malloc");
1085 				break;
1086 			}
1087 			memcpy((*tag)->tag, imsg.data + len,
1088 			    itag->tag_len);
1089 			(*tag)->tag[itag->tag_len] = '\0';
1090 		}
1091 		len += itag->tag_len;
1092 
1093 		(*tag)->obj_type = itag->obj_type;
1094 		(*tag)->tagger_time = itag->tagger_time;
1095 		(*tag)->tagger_gmtoff = itag->tagger_gmtoff;
1096 
1097 		if (itag->tagger_len == 0) {
1098 			(*tag)->tagger = strdup("");
1099 			if ((*tag)->tagger == NULL) {
1100 				err = got_error_from_errno("strdup");
1101 				break;
1102 			}
1103 		} else {
1104 			(*tag)->tagger = malloc(itag->tagger_len + 1);
1105 			if ((*tag)->tagger == NULL) {
1106 				err = got_error_from_errno("malloc");
1107 				break;
1108 			}
1109 			memcpy((*tag)->tagger, imsg.data + len,
1110 			    itag->tagger_len);
1111 			(*tag)->tagger[itag->tagger_len] = '\0';
1112 		}
1113 		len += itag->tagger_len;
1114 
1115 		if (itag->tagmsg_len == 0) {
1116 			(*tag)->tagmsg = strdup("");
1117 			if ((*tag)->tagmsg == NULL) {
1118 				err = got_error_from_errno("strdup");
1119 				break;
1120 			}
1121 		} else {
1122 			size_t offset = 0, remain = itag->tagmsg_len;
1123 
1124 			(*tag)->tagmsg = malloc(itag->tagmsg_len + 1);
1125 			if ((*tag)->tagmsg == NULL) {
1126 				err = got_error_from_errno("malloc");
1127 				break;
1128 			}
1129 			while (remain > 0) {
1130 				struct imsg imsg_log;
1131 				size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
1132 				    remain);
1133 
1134 				err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
1135 				if (err)
1136 					return err;
1137 
1138 				if (imsg_log.hdr.type != GOT_IMSG_TAG_TAGMSG)
1139 					return got_error(GOT_ERR_PRIVSEP_MSG);
1140 
1141 				memcpy((*tag)->tagmsg + offset, imsg_log.data,
1142 				    n);
1143 				imsg_free(&imsg_log);
1144 				offset += n;
1145 				remain -= n;
1146 			}
1147 			(*tag)->tagmsg[itag->tagmsg_len] = '\0';
1148 		}
1149 
1150 		break;
1151 	default:
1152 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1153 		break;
1154 	}
1155 
1156 	imsg_free(&imsg);
1157 
1158 	return err;
1159 }
1160 
1161 const struct got_error *
1162 got_privsep_init_pack_child(struct imsgbuf *ibuf, struct got_pack *pack,
1163     struct got_packidx *packidx)
1164 {
1165 	const struct got_error *err = NULL;
1166 	struct got_imsg_packidx ipackidx;
1167 	struct got_imsg_pack ipack;
1168 	int fd;
1169 
1170 	ipackidx.len = packidx->len;
1171 	fd = dup(packidx->fd);
1172 	if (fd == -1)
1173 		return got_error_from_errno("dup");
1174 
1175 	if (imsg_compose(ibuf, GOT_IMSG_PACKIDX, 0, 0, fd, &ipackidx,
1176 	    sizeof(ipackidx)) == -1) {
1177 		err = got_error_from_errno("imsg_compose PACKIDX");
1178 		close(fd);
1179 		return err;
1180 	}
1181 
1182 	if (strlcpy(ipack.path_packfile, pack->path_packfile,
1183 	    sizeof(ipack.path_packfile)) >= sizeof(ipack.path_packfile))
1184 		return got_error(GOT_ERR_NO_SPACE);
1185 	ipack.filesize = pack->filesize;
1186 
1187 	fd = dup(pack->fd);
1188 	if (fd == -1)
1189 		return got_error_from_errno("dup");
1190 
1191 	if (imsg_compose(ibuf, GOT_IMSG_PACK, 0, 0, fd, &ipack, sizeof(ipack))
1192 	    == -1) {
1193 		err = got_error_from_errno("imsg_compose PACK");
1194 		close(fd);
1195 		return err;
1196 	}
1197 
1198 	return flush_imsg(ibuf);
1199 }
1200 
1201 const struct got_error *
1202 got_privsep_send_packed_obj_req(struct imsgbuf *ibuf, int idx,
1203     struct got_object_id *id)
1204 {
1205 	struct got_imsg_packed_object iobj;
1206 
1207 	iobj.idx = idx;
1208 	memcpy(iobj.id, id->sha1, sizeof(iobj.id));
1209 
1210 	if (imsg_compose(ibuf, GOT_IMSG_PACKED_OBJECT_REQUEST, 0, 0, -1,
1211 	    &iobj, sizeof(iobj)) == -1)
1212 		return got_error_from_errno("imsg_compose "
1213 		    "PACKED_OBJECT_REQUEST");
1214 
1215 	return flush_imsg(ibuf);
1216 }
1217 
1218 const struct got_error *
1219 got_privsep_unveil_exec_helpers(void)
1220 {
1221 	const char *helpers[] = {
1222 	    GOT_PATH_PROG_READ_PACK,
1223 	    GOT_PATH_PROG_READ_OBJECT,
1224 	    GOT_PATH_PROG_READ_COMMIT,
1225 	    GOT_PATH_PROG_READ_TREE,
1226 	    GOT_PATH_PROG_READ_BLOB,
1227 	    GOT_PATH_PROG_READ_TAG,
1228 	};
1229 	int i;
1230 
1231 	for (i = 0; i < nitems(helpers); i++) {
1232 		if (unveil(helpers[i], "x") == 0)
1233 			continue;
1234 		return got_error_from_errno2("unveil", helpers[i]);
1235 	}
1236 
1237 	return NULL;
1238 }