op public repos

Blob

Date:: Mon May 13 16:40:57 2019 UTC
Message:: rename got_error_prefix_errno() to got_error_from_errno()
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2018, 2019 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/queue.h>
19 #include <sys/uio.h>
20 #include <sys/syslimits.h>
21 #include <sys/wait.h>
22 
23 #include <stdio.h>
24 #include <stdlib.h>
25 #include <string.h>
26 #include <errno.h>
27 #include <stdint.h>
28 #include <poll.h>
29 #include <imsg.h>
30 #include <sha1.h>
31 #include <zlib.h>
32 #include <time.h>
33 
34 #include "got_object.h"
35 #include "got_error.h"
36 
37 #include "got_lib_sha1.h"
38 #include "got_lib_delta.h"
39 #include "got_lib_inflate.h"
40 #include "got_lib_object.h"
41 #include "got_lib_object_parse.h"
42 #include "got_lib_privsep.h"
43 #include "got_lib_pack.h"
44 
45 #ifndef MIN
46 #define	MIN(_a,_b) ((_a) < (_b) ? (_a) : (_b))
47 #endif
48 
49 static const struct got_error *
50 poll_fd(int fd, int events, int timeout)
51 {
52 	struct pollfd pfd[1];
53 	int n;
54 
55 	pfd[0].fd = fd;
56 	pfd[0].events = events;
57 
58 	n = poll(pfd, 1, timeout);
59 	if (n == -1)
60 		return got_error_from_errno("poll");
61 	if (n == 0)
62 		return got_error(GOT_ERR_TIMEOUT);
63 	if (pfd[0].revents & (POLLERR | POLLNVAL))
64 		return got_error_from_errno("poll error");
65 	if (pfd[0].revents & (events | POLLHUP))
66 		return NULL;
67 
68 	return got_error(GOT_ERR_INTERRUPT);
69 }
70 
71 static const struct got_error *
72 read_imsg(struct imsgbuf *ibuf)
73 {
74 	const struct got_error *err;
75 	size_t n;
76 
77 	err = poll_fd(ibuf->fd, POLLIN, INFTIM);
78 	if (err)
79 		return err;
80 
81 	n = imsg_read(ibuf);
82 	if (n == -1) {
83 		if (errno == EAGAIN) /* Could be a file-descriptor leak. */
84 			return got_error(GOT_ERR_PRIVSEP_NO_FD);
85 		return got_error(GOT_ERR_PRIVSEP_READ);
86 	}
87 	if (n == 0)
88 		return got_error(GOT_ERR_PRIVSEP_PIPE);
89 
90 	return NULL;
91 }
92 
93 const struct got_error *
94 got_privsep_wait_for_child(pid_t pid)
95 {
96 	int child_status;
97 
98 	if (waitpid(pid, &child_status, 0) == -1)
99 		return got_error_from_errno("waitpid");
100 
101 	if (!WIFEXITED(child_status))
102 		return got_error(GOT_ERR_PRIVSEP_DIED);
103 
104 	if (WEXITSTATUS(child_status) != 0)
105 		return got_error(GOT_ERR_PRIVSEP_EXIT);
106 
107 	return NULL;
108 }
109 
110 static const struct got_error *
111 recv_imsg_error(struct imsg *imsg, size_t datalen)
112 {
113 	struct got_imsg_error *ierr;
114 
115 	if (datalen != sizeof(*ierr))
116 		return got_error(GOT_ERR_PRIVSEP_LEN);
117 
118 	ierr = imsg->data;
119 	if (ierr->code == GOT_ERR_ERRNO) {
120 		static struct got_error serr;
121 		serr.code = GOT_ERR_ERRNO;
122 		serr.msg = strerror(ierr->errno_code);
123 		return &serr;
124 	}
125 
126 	return got_error(ierr->code);
127 }
128 
129 const struct got_error *
130 got_privsep_recv_imsg(struct imsg *imsg, struct imsgbuf *ibuf,
131     size_t min_datalen)
132 {
133 	const struct got_error *err;
134 	ssize_t n;
135 
136 	n = imsg_get(ibuf, imsg);
137 	if (n == -1)
138 		return got_error_from_errno("imsg_get");
139 
140 	while (n == 0) {
141 		err = read_imsg(ibuf);
142 		if (err)
143 			return err;
144 		n = imsg_get(ibuf, imsg);
145 	}
146 
147 	if (imsg->hdr.len < IMSG_HEADER_SIZE + min_datalen)
148 		return got_error(GOT_ERR_PRIVSEP_LEN);
149 
150 	if (imsg->hdr.type == GOT_IMSG_ERROR) {
151 		size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
152 		return recv_imsg_error(imsg, datalen);
153 	}
154 
155 	return NULL;
156 }
157 
158 /* Attempt to send an error in an imsg. Complain on stderr as a last resort. */
159 void
160 got_privsep_send_error(struct imsgbuf *ibuf, const struct got_error *err)
161 {
162 	const struct got_error *poll_err;
163 	struct got_imsg_error ierr;
164 	int ret;
165 
166 	ierr.code = err->code;
167 	if (err->code == GOT_ERR_ERRNO)
168 		ierr.errno_code = errno;
169 	else
170 		ierr.errno_code = 0;
171 	ret = imsg_compose(ibuf, GOT_IMSG_ERROR, 0, 0, -1, &ierr, sizeof(ierr));
172 	if (ret == -1) {
173 		fprintf(stderr, "%s: error %d \"%s\": imsg_compose: %s\n",
174 		    getprogname(), err->code, err->msg, strerror(errno));
175 		return;
176 	}
177 
178 	poll_err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
179 	if (poll_err) {
180 		fprintf(stderr, "%s: error %d \"%s\": poll: %s\n",
181 		    getprogname(), err->code, err->msg, poll_err->msg);
182 		return;
183 	}
184 
185 	ret = imsg_flush(ibuf);
186 	if (ret == -1) {
187 		fprintf(stderr, "%s: error %d \"%s\": imsg_flush: %s\n",
188 		    getprogname(), err->code, err->msg, strerror(errno));
189 		return;
190 	}
191 }
192 
193 static const struct got_error *
194 flush_imsg(struct imsgbuf *ibuf)
195 {
196 	const struct got_error *err;
197 
198 	err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
199 	if (err)
200 		return err;
201 
202 	if (imsg_flush(ibuf) == -1)
203 		return got_error_from_errno("imsg_flush");
204 
205 	return NULL;
206 }
207 
208 const struct got_error *
209 got_privsep_send_stop(int fd)
210 {
211 	const struct got_error *err = NULL;
212 	struct imsgbuf ibuf;
213 
214 	imsg_init(&ibuf, fd);
215 
216 	if (imsg_compose(&ibuf, GOT_IMSG_STOP, 0, 0, -1, NULL, 0) == -1)
217 		return got_error_from_errno("imsg_compose STOP");
218 
219 	err = flush_imsg(&ibuf);
220 	imsg_clear(&ibuf);
221 	return err;
222 }
223 
224 const struct got_error *
225 got_privsep_send_obj_req(struct imsgbuf *ibuf, int fd)
226 {
227 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT_REQUEST, 0, 0, fd, NULL, 0)
228 	    == -1)
229 		return got_error_from_errno("imsg_compose OBJECT_REQUEST");
230 
231 	return flush_imsg(ibuf);
232 }
233 
234 const struct got_error *
235 got_privsep_send_commit_req(struct imsgbuf *ibuf, int fd,
236     struct got_object_id *id, int pack_idx)
237 {
238 	const struct got_error *err = NULL;
239 	struct got_imsg_packed_object iobj, *iobjp;
240 	size_t len;
241 
242 	if (id) { /* commit is packed */
243 		iobj.idx = pack_idx;
244 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
245 		iobjp = &iobj;
246 		len = sizeof(iobj);
247 	} else {
248 		iobjp = NULL;
249 		len = 0;
250 	}
251 
252 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_REQUEST, 0, 0, fd, iobjp, len)
253 	    == -1) {
254 		err = got_error_from_errno("imsg_compose COMMIT_REQUEST");
255 		close(fd);
256 		return err;
257 	}
258 
259 	return flush_imsg(ibuf);
260 }
261 
262 const struct got_error *
263 got_privsep_send_tree_req(struct imsgbuf *ibuf, int fd,
264     struct got_object_id *id, int pack_idx)
265 {
266 	const struct got_error *err = NULL;
267 	struct got_imsg_packed_object iobj, *iobjp;
268 	size_t len;
269 
270 	if (id) { /* tree is packed */
271 		iobj.idx = pack_idx;
272 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
273 		iobjp = &iobj;
274 		len = sizeof(iobj);
275 	} else {
276 		iobjp = NULL;
277 		len = 0;
278 	}
279 
280 	if (imsg_compose(ibuf, GOT_IMSG_TREE_REQUEST, 0, 0, fd, iobjp, len)
281 	    == -1) {
282 		err = got_error_from_errno("imsg_compose TREE_REQUEST");
283 		close(fd);
284 		return err;
285 	}
286 
287 	return flush_imsg(ibuf);
288 }
289 
290 const struct got_error *
291 got_privsep_send_tag_req(struct imsgbuf *ibuf, int fd,
292     struct got_object_id *id, int pack_idx)
293 {
294 	struct got_imsg_packed_object iobj, *iobjp;
295 	size_t len;
296 
297 	if (id) { /* tag is packed */
298 		iobj.idx = pack_idx;
299 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
300 		iobjp = &iobj;
301 		len = sizeof(iobj);
302 	} else {
303 		iobjp = NULL;
304 		len = 0;
305 	}
306 
307 	if (imsg_compose(ibuf, GOT_IMSG_TAG_REQUEST, 0, 0, fd, iobjp, len)
308 	    == -1)
309 		return got_error_from_errno("imsg_compose TAG_REQUEST");
310 
311 	return flush_imsg(ibuf);
312 }
313 
314 const struct got_error *
315 got_privsep_send_blob_req(struct imsgbuf *ibuf, int infd,
316     struct got_object_id *id, int pack_idx)
317 {
318 	const struct got_error *err = NULL;
319 	struct got_imsg_packed_object iobj, *iobjp;
320 	size_t len;
321 
322 	if (id) { /* blob is packed */
323 		iobj.idx = pack_idx;
324 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
325 		iobjp = &iobj;
326 		len = sizeof(iobj);
327 	} else {
328 		iobjp = NULL;
329 		len = 0;
330 	}
331 
332 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_REQUEST, 0, 0, infd, iobjp, len)
333 	    == -1) {
334 		err = got_error_from_errno("imsg_compose BLOB_REQUEST");
335 		close(infd);
336 		return err;
337 	}
338 
339 	return flush_imsg(ibuf);
340 }
341 
342 const struct got_error *
343 got_privsep_send_blob_outfd(struct imsgbuf *ibuf, int outfd)
344 {
345 	const struct got_error *err = NULL;
346 
347 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_OUTFD, 0, 0, outfd, NULL, 0)
348 	    == -1) {
349 		err = got_error_from_errno("imsg_compose BLOB_OUTFD");
350 		close(outfd);
351 		return err;
352 	}
353 
354 	return flush_imsg(ibuf);
355 }
356 
357 const struct got_error *
358 got_privsep_send_tmpfd(struct imsgbuf *ibuf, int fd)
359 {
360 	const struct got_error *err = NULL;
361 
362 	if (imsg_compose(ibuf, GOT_IMSG_TMPFD, 0, 0, fd, NULL, 0)
363 	    == -1) {
364 		err = got_error_from_errno("imsg_compose TMPFD");
365 		close(fd);
366 		return err;
367 	}
368 
369 	return flush_imsg(ibuf);
370 }
371 
372 const struct got_error *
373 got_privsep_send_obj(struct imsgbuf *ibuf, struct got_object *obj)
374 {
375 	struct got_imsg_object iobj;
376 
377 	memcpy(iobj.id, obj->id.sha1, sizeof(iobj.id));
378 	iobj.type = obj->type;
379 	iobj.flags = obj->flags;
380 	iobj.hdrlen = obj->hdrlen;
381 	iobj.size = obj->size;
382 	if (iobj.flags & GOT_OBJ_FLAG_PACKED) {
383 		iobj.pack_offset = obj->pack_offset;
384 		iobj.pack_idx = obj->pack_idx;
385 	}
386 
387 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT, 0, 0, -1, &iobj, sizeof(iobj))
388 	    == -1)
389 		return got_error_from_errno("imsg_compose OBJECT");
390 
391 	return flush_imsg(ibuf);
392 }
393 
394 const struct got_error *
395 got_privsep_get_imsg_obj(struct got_object **obj, struct imsg *imsg,
396     struct imsgbuf *ibuf)
397 {
398 	const struct got_error *err = NULL;
399 	struct got_imsg_object *iobj;
400 	size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
401 
402 	if (datalen != sizeof(*iobj))
403 		return got_error(GOT_ERR_PRIVSEP_LEN);
404 	iobj = imsg->data;
405 
406 	*obj = calloc(1, sizeof(**obj));
407 	if (*obj == NULL)
408 		return got_error_from_errno("calloc");
409 
410 	memcpy((*obj)->id.sha1, iobj->id, SHA1_DIGEST_LENGTH);
411 	(*obj)->type = iobj->type;
412 	(*obj)->flags = iobj->flags;
413 	(*obj)->hdrlen = iobj->hdrlen;
414 	(*obj)->size = iobj->size;
415 	/* path_packfile is handled by caller */
416 	if (iobj->flags & GOT_OBJ_FLAG_PACKED) {
417 		(*obj)->pack_offset = iobj->pack_offset;
418 		(*obj)->pack_idx = iobj->pack_idx;
419 	}
420 
421 	return err;
422 }
423 
424 const struct got_error *
425 got_privsep_recv_obj(struct got_object **obj, struct imsgbuf *ibuf)
426 {
427 	const struct got_error *err = NULL;
428 	struct imsg imsg;
429 	size_t datalen;
430 	const size_t min_datalen =
431 	    MIN(sizeof(struct got_imsg_error), sizeof(struct got_imsg_object));
432 
433 	*obj = NULL;
434 
435 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
436 	if (err)
437 		return err;
438 
439 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
440 
441 	switch (imsg.hdr.type) {
442 	case GOT_IMSG_OBJECT:
443 		err = got_privsep_get_imsg_obj(obj, &imsg, ibuf);
444 		break;
445 	default:
446 		err = got_error(GOT_ERR_PRIVSEP_MSG);
447 		break;
448 	}
449 
450 	imsg_free(&imsg);
451 
452 	return err;
453 }
454 
455 static const struct got_error *
456 send_commit_logmsg(struct imsgbuf *ibuf, struct got_commit_object *commit,
457     size_t logmsg_len)
458 {
459 	const struct got_error *err = NULL;
460 	size_t offset, remain;
461 
462 	offset = 0;
463 	remain = logmsg_len;
464 	while (remain > 0) {
465 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
466 
467 		if (imsg_compose(ibuf, GOT_IMSG_COMMIT_LOGMSG, 0, 0, -1,
468 		    commit->logmsg + offset, n) == -1) {
469 			err = got_error_from_errno("imsg_compose "
470 			    "COMMIT_LOGMSG");
471 			break;
472 		}
473 
474 		err = flush_imsg(ibuf);
475 		if (err)
476 			break;
477 
478 		offset += n;
479 		remain -= n;
480 	}
481 
482 	return err;
483 }
484 
485 const struct got_error *
486 got_privsep_send_commit(struct imsgbuf *ibuf, struct got_commit_object *commit)
487 {
488 	const struct got_error *err = NULL;
489 	struct got_imsg_commit_object *icommit;
490 	uint8_t *buf;
491 	size_t len, total;
492 	struct got_object_qid *qid;
493 	size_t author_len = strlen(commit->author);
494 	size_t committer_len = strlen(commit->committer);
495 	size_t logmsg_len = strlen(commit->logmsg);
496 
497 	total = sizeof(*icommit) + author_len + committer_len +
498 	    commit->nparents * SHA1_DIGEST_LENGTH;
499 
500 	buf = malloc(total);
501 	if (buf == NULL)
502 		return got_error_from_errno("malloc");
503 
504 	icommit = (struct got_imsg_commit_object *)buf;
505 	memcpy(icommit->tree_id, commit->tree_id->sha1,
506 	    sizeof(icommit->tree_id));
507 	icommit->author_len = author_len;
508 	icommit->author_time = commit->author_time;
509 	icommit->author_gmtoff = commit->author_gmtoff;
510 	icommit->committer_len = committer_len;
511 	icommit->committer_time = commit->committer_time;
512 	icommit->committer_gmtoff = commit->committer_gmtoff;
513 	icommit->logmsg_len = logmsg_len;
514 	icommit->nparents = commit->nparents;
515 
516 	len = sizeof(*icommit);
517 	memcpy(buf + len, commit->author, author_len);
518 	len += author_len;
519 	memcpy(buf + len, commit->committer, committer_len);
520 	len += committer_len;
521 	SIMPLEQ_FOREACH(qid, &commit->parent_ids, entry) {
522 		memcpy(buf + len, qid->id, SHA1_DIGEST_LENGTH);
523 		len += SHA1_DIGEST_LENGTH;
524 	}
525 
526 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT, 0, 0, -1, buf, len) == -1) {
527 		err = got_error_from_errno("imsg_compose COMMIT");
528 		goto done;
529 	}
530 
531 	if (logmsg_len == 0 ||
532 	    logmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
533 		err = flush_imsg(ibuf);
534 		if (err)
535 			goto done;
536 	}
537 	err = send_commit_logmsg(ibuf, commit, logmsg_len);
538 done:
539 	free(buf);
540 	return err;
541 }
542 
543 const struct got_error *
544 got_privsep_recv_commit(struct got_commit_object **commit, struct imsgbuf *ibuf)
545 {
546 	const struct got_error *err = NULL;
547 	struct imsg imsg;
548 	struct got_imsg_commit_object *icommit;
549 	size_t len, datalen;
550 	int i;
551 	const size_t min_datalen =
552 	    MIN(sizeof(struct got_imsg_error),
553 	    sizeof(struct got_imsg_commit_object));
554 
555 	*commit = NULL;
556 
557 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
558 	if (err)
559 		return err;
560 
561 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
562 	len = 0;
563 
564 	switch (imsg.hdr.type) {
565 	case GOT_IMSG_COMMIT:
566 		if (datalen < sizeof(*icommit)) {
567 			err = got_error(GOT_ERR_PRIVSEP_LEN);
568 			break;
569 		}
570 		icommit = imsg.data;
571 		if (datalen != sizeof(*icommit) + icommit->author_len +
572 		    icommit->committer_len +
573 		    icommit->nparents * SHA1_DIGEST_LENGTH) {
574 			err = got_error(GOT_ERR_PRIVSEP_LEN);
575 			break;
576 		}
577 		if (icommit->nparents < 0) {
578 			err = got_error(GOT_ERR_PRIVSEP_LEN);
579 			break;
580 		}
581 		len += sizeof(*icommit);
582 
583 		*commit = got_object_commit_alloc_partial();
584 		if (*commit == NULL) {
585 			err = got_error_from_errno(
586 			    "got_object_commit_alloc_partial");
587 			break;
588 		}
589 
590 		memcpy((*commit)->tree_id->sha1, icommit->tree_id,
591 		    SHA1_DIGEST_LENGTH);
592 		(*commit)->author_time = icommit->author_time;
593 		(*commit)->author_gmtoff = icommit->author_gmtoff;
594 		(*commit)->committer_time = icommit->committer_time;
595 		(*commit)->committer_gmtoff = icommit->committer_gmtoff;
596 
597 		if (icommit->author_len == 0) {
598 			(*commit)->author = strdup("");
599 			if ((*commit)->author == NULL) {
600 				err = got_error_from_errno("strdup");
601 				break;
602 			}
603 		} else {
604 			(*commit)->author = malloc(icommit->author_len + 1);
605 			if ((*commit)->author == NULL) {
606 				err = got_error_from_errno("malloc");
607 				break;
608 			}
609 			memcpy((*commit)->author, imsg.data + len,
610 			    icommit->author_len);
611 			(*commit)->author[icommit->author_len] = '\0';
612 		}
613 		len += icommit->author_len;
614 
615 		if (icommit->committer_len == 0) {
616 			(*commit)->committer = strdup("");
617 			if ((*commit)->committer == NULL) {
618 				err = got_error_from_errno("strdup");
619 				break;
620 			}
621 		} else {
622 			(*commit)->committer =
623 			    malloc(icommit->committer_len + 1);
624 			if ((*commit)->committer == NULL) {
625 				err = got_error_from_errno("malloc");
626 				break;
627 			}
628 			memcpy((*commit)->committer, imsg.data + len,
629 			    icommit->committer_len);
630 			(*commit)->committer[icommit->committer_len] = '\0';
631 		}
632 		len += icommit->committer_len;
633 
634 		if (icommit->logmsg_len == 0) {
635 			(*commit)->logmsg = strdup("");
636 			if ((*commit)->logmsg == NULL) {
637 				err = got_error_from_errno("strdup");
638 				break;
639 			}
640 		} else {
641 			size_t offset = 0, remain = icommit->logmsg_len;
642 
643 			(*commit)->logmsg = malloc(icommit->logmsg_len + 1);
644 			if ((*commit)->logmsg == NULL) {
645 				err = got_error_from_errno("malloc");
646 				break;
647 			}
648 			while (remain > 0) {
649 				struct imsg imsg_log;
650 				size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
651 				    remain);
652 
653 				err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
654 				if (err)
655 					return err;
656 
657 				if (imsg_log.hdr.type != GOT_IMSG_COMMIT_LOGMSG)
658 					return got_error(GOT_ERR_PRIVSEP_MSG);
659 
660 				memcpy((*commit)->logmsg + offset,
661 				    imsg_log.data, n);
662 				imsg_free(&imsg_log);
663 				offset += n;
664 				remain -= n;
665 			}
666 			(*commit)->logmsg[icommit->logmsg_len] = '\0';
667 		}
668 
669 		for (i = 0; i < icommit->nparents; i++) {
670 			struct got_object_qid *qid;
671 
672 			err = got_object_qid_alloc_partial(&qid);
673 			if (err)
674 				break;
675 			memcpy(qid->id, imsg.data + len +
676 			    i * SHA1_DIGEST_LENGTH, sizeof(*qid->id));
677 			SIMPLEQ_INSERT_TAIL(&(*commit)->parent_ids, qid, entry);
678 			(*commit)->nparents++;
679 		}
680 		break;
681 	default:
682 		err = got_error(GOT_ERR_PRIVSEP_MSG);
683 		break;
684 	}
685 
686 	imsg_free(&imsg);
687 
688 	return err;
689 }
690 
691 const struct got_error *
692 got_privsep_send_tree(struct imsgbuf *ibuf, struct got_tree_object *tree)
693 {
694 	const struct got_error *err = NULL;
695 	struct got_imsg_tree_object itree;
696 	struct got_tree_entry *te;
697 	size_t totlen;
698 	int nimsg; /* number of imsg queued in ibuf */
699 
700 	itree.nentries = tree->entries.nentries;
701 	if (imsg_compose(ibuf, GOT_IMSG_TREE, 0, 0, -1, &itree, sizeof(itree))
702 	    == -1)
703 		return got_error_from_errno("imsg_compose TREE");
704 
705 	totlen = sizeof(itree);
706 	nimsg = 1;
707 	SIMPLEQ_FOREACH(te, &tree->entries.head, entry) {
708 		struct got_imsg_tree_entry *ite;
709 		uint8_t *buf = NULL;
710 		size_t len = sizeof(*ite) + strlen(te->name);
711 
712 		if (len > MAX_IMSGSIZE)
713 			return got_error(GOT_ERR_NO_SPACE);
714 
715 		nimsg++;
716 		if (totlen + len >= MAX_IMSGSIZE - (IMSG_HEADER_SIZE * nimsg)) {
717 			err = flush_imsg(ibuf);
718 			if (err)
719 				return err;
720 			nimsg = 0;
721 		}
722 
723 		buf = malloc(len);
724 		if (buf == NULL)
725 			return got_error_from_errno("malloc");
726 
727 		ite = (struct got_imsg_tree_entry *)buf;
728 		memcpy(ite->id, te->id->sha1, sizeof(ite->id));
729 		ite->mode = te->mode;
730 		memcpy(buf + sizeof(*ite), te->name, strlen(te->name));
731 
732 		if (imsg_compose(ibuf, GOT_IMSG_TREE_ENTRY, 0, 0, -1,
733 		    buf, len) == -1)
734 			err = got_error_from_errno("imsg_compose TREE_ENTRY");
735 		free(buf);
736 		if (err)
737 			return err;
738 		totlen += len;
739 	}
740 
741 	return flush_imsg(ibuf);
742 }
743 
744 const struct got_error *
745 got_privsep_recv_tree(struct got_tree_object **tree, struct imsgbuf *ibuf)
746 {
747 	const struct got_error *err = NULL;
748 	const size_t min_datalen =
749 	    MIN(sizeof(struct got_imsg_error),
750 	    sizeof(struct got_imsg_tree_object));
751 	struct got_imsg_tree_object *itree;
752 	int nentries = 0;
753 
754 	*tree = NULL;
755 get_more:
756 	err = read_imsg(ibuf);
757 	if (err)
758 		goto done;
759 
760 	for (;;) {
761 		struct imsg imsg;
762 		size_t n;
763 		size_t datalen;
764 		struct got_imsg_tree_entry *ite;
765 		struct got_tree_entry *te = NULL;
766 
767 		n = imsg_get(ibuf, &imsg);
768 		if (n == 0) {
769 			if (*tree && (*tree)->entries.nentries != nentries)
770 				goto get_more;
771 			break;
772 		}
773 
774 		if (imsg.hdr.len < IMSG_HEADER_SIZE + min_datalen)
775 			return got_error(GOT_ERR_PRIVSEP_LEN);
776 
777 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
778 
779 		switch (imsg.hdr.type) {
780 		case GOT_IMSG_ERROR:
781 			err = recv_imsg_error(&imsg, datalen);
782 			break;
783 		case GOT_IMSG_TREE:
784 			/* This message should only appear once. */
785 			if (*tree != NULL) {
786 				err = got_error(GOT_ERR_PRIVSEP_MSG);
787 				break;
788 			}
789 			if (datalen != sizeof(*itree)) {
790 				err = got_error(GOT_ERR_PRIVSEP_LEN);
791 				break;
792 			}
793 			itree = imsg.data;
794 			*tree = malloc(sizeof(**tree));
795 			if (*tree == NULL) {
796 				err = got_error_from_errno("malloc");
797 				break;
798 			}
799 			(*tree)->entries.nentries = itree->nentries;
800 			SIMPLEQ_INIT(&(*tree)->entries.head);
801 			(*tree)->refcnt = 0;
802 			break;
803 		case GOT_IMSG_TREE_ENTRY:
804 			/* This message should be preceeded by GOT_IMSG_TREE. */
805 			if (*tree == NULL) {
806 				err = got_error(GOT_ERR_PRIVSEP_MSG);
807 				break;
808 			}
809 			if (datalen < sizeof(*ite) || datalen > MAX_IMSGSIZE) {
810 				err = got_error(GOT_ERR_PRIVSEP_LEN);
811 				break;
812 			}
813 
814 			/* Remaining data contains the entry's name. */
815 			datalen -= sizeof(*ite);
816 			if (datalen == 0 || datalen > MAX_IMSGSIZE) {
817 				err = got_error(GOT_ERR_PRIVSEP_LEN);
818 				break;
819 			}
820 			ite = imsg.data;
821 
822 			te = got_alloc_tree_entry_partial();
823 			if (te == NULL) {
824 				err = got_error_from_errno(
825 				    "got_alloc_tree_entry_partial");
826 				break;
827 			}
828 			te->name = malloc(datalen + 1);
829 			if (te->name == NULL) {
830 				free(te);
831 				err = got_error_from_errno("malloc");
832 				break;
833 			}
834 			memcpy(te->name, imsg.data + sizeof(*ite), datalen);
835 			te->name[datalen] = '\0';
836 
837 			memcpy(te->id->sha1, ite->id, SHA1_DIGEST_LENGTH);
838 			te->mode = ite->mode;
839 			SIMPLEQ_INSERT_TAIL(&(*tree)->entries.head, te, entry);
840 			nentries++;
841 			break;
842 		default:
843 			err = got_error(GOT_ERR_PRIVSEP_MSG);
844 			break;
845 		}
846 
847 		imsg_free(&imsg);
848 	}
849 done:
850 	if (*tree && (*tree)->entries.nentries != nentries) {
851 		if (err == NULL)
852 			err = got_error(GOT_ERR_PRIVSEP_LEN);
853 		got_object_tree_close(*tree);
854 		*tree = NULL;
855 	}
856 
857 	return err;
858 }
859 
860 const struct got_error *
861 got_privsep_send_blob(struct imsgbuf *ibuf, size_t size, size_t hdrlen,
862     const uint8_t *data)
863 {
864 	struct got_imsg_blob iblob;
865 
866 	iblob.size = size;
867 	iblob.hdrlen = hdrlen;
868 
869 	if (data) {
870 		uint8_t *buf;
871 
872 		if (size > GOT_PRIVSEP_INLINE_BLOB_DATA_MAX)
873 			return got_error(GOT_ERR_NO_SPACE);
874 
875 		buf = malloc(sizeof(iblob) + size);
876 		if (buf == NULL)
877 			return got_error_from_errno("malloc");
878 
879 		memcpy(buf, &iblob, sizeof(iblob));
880 		memcpy(buf + sizeof(iblob), data, size);
881 		if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, buf,
882 		   sizeof(iblob) + size) == -1) {
883 			free(buf);
884 			return got_error_from_errno("imsg_compose BLOB");
885 		}
886 		free(buf);
887 	} else {
888 		/* Data has already been written to file descriptor. */
889 		if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, &iblob,
890 		    sizeof(iblob)) == -1)
891 			return got_error_from_errno("imsg_compose BLOB");
892 	}
893 
894 
895 	return flush_imsg(ibuf);
896 }
897 
898 const struct got_error *
899 got_privsep_recv_blob(uint8_t **outbuf, size_t *size, size_t *hdrlen,
900     struct imsgbuf *ibuf)
901 {
902 	const struct got_error *err = NULL;
903 	struct imsg imsg;
904 	struct got_imsg_blob *iblob;
905 	size_t datalen;
906 
907 	*outbuf = NULL;
908 
909 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
910 	if (err)
911 		return err;
912 
913 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
914 
915 	switch (imsg.hdr.type) {
916 	case GOT_IMSG_BLOB:
917 		if (datalen < sizeof(*iblob)) {
918 			err = got_error(GOT_ERR_PRIVSEP_LEN);
919 			break;
920 		}
921 		iblob = imsg.data;
922 		*size = iblob->size;
923 		*hdrlen = iblob->hdrlen;
924 
925 		if (datalen == sizeof(*iblob)) {
926 			/* Data has been written to file descriptor. */
927 			break;
928 		}
929 
930 		if (*size > GOT_PRIVSEP_INLINE_BLOB_DATA_MAX) {
931 			err = got_error(GOT_ERR_PRIVSEP_LEN);
932 			break;
933 		}
934 
935 		*outbuf = malloc(*size);
936 		if (*outbuf == NULL) {
937 			err = got_error_from_errno("malloc");
938 			break;
939 		}
940 		memcpy(*outbuf, imsg.data + sizeof(*iblob), *size);
941 		break;
942 	default:
943 		err = got_error(GOT_ERR_PRIVSEP_MSG);
944 		break;
945 	}
946 
947 	imsg_free(&imsg);
948 
949 	return err;
950 }
951 
952 static const struct got_error *
953 send_tagmsg(struct imsgbuf *ibuf, struct got_tag_object *tag, size_t tagmsg_len)
954 {
955 	const struct got_error *err = NULL;
956 	size_t offset, remain;
957 
958 	offset = 0;
959 	remain = tagmsg_len;
960 	while (remain > 0) {
961 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
962 
963 		if (imsg_compose(ibuf, GOT_IMSG_TAG_TAGMSG, 0, 0, -1,
964 		    tag->tagmsg + offset, n) == -1) {
965 			err = got_error_from_errno("imsg_compose TAG_TAGMSG");
966 			break;
967 		}
968 
969 		err = flush_imsg(ibuf);
970 		if (err)
971 			break;
972 
973 		offset += n;
974 		remain -= n;
975 	}
976 
977 	return err;
978 }
979 
980 const struct got_error *
981 got_privsep_send_tag(struct imsgbuf *ibuf, struct got_tag_object *tag)
982 {
983 	const struct got_error *err = NULL;
984 	struct got_imsg_tag_object *itag;
985 	uint8_t *buf;
986 	size_t len, total;
987 	size_t tag_len = strlen(tag->tag);
988 	size_t tagger_len = strlen(tag->tagger);
989 	size_t tagmsg_len = strlen(tag->tagmsg);
990 
991 	total = sizeof(*itag) + tag_len + tagger_len + tagmsg_len;
992 
993 	buf = malloc(total);
994 	if (buf == NULL)
995 		return got_error_from_errno("malloc");
996 
997 	itag = (struct got_imsg_tag_object *)buf;
998 	memcpy(itag->id, tag->id.sha1, sizeof(itag->id));
999 	itag->obj_type = tag->obj_type;
1000 	itag->tag_len = tag_len;
1001 	itag->tagger_len = tagger_len;
1002 	itag->tagger_time = tag->tagger_time;
1003 	itag->tagger_gmtoff = tag->tagger_gmtoff;
1004 	itag->tagmsg_len = tagmsg_len;
1005 
1006 	len = sizeof(*itag);
1007 	memcpy(buf + len, tag->tag, tag_len);
1008 	len += tag_len;
1009 	memcpy(buf + len, tag->tagger, tagger_len);
1010 	len += tagger_len;
1011 
1012 	if (imsg_compose(ibuf, GOT_IMSG_TAG, 0, 0, -1, buf, len) == -1) {
1013 		err = got_error_from_errno("imsg_compose TAG");
1014 		goto done;
1015 	}
1016 
1017 	if (tagmsg_len == 0 ||
1018 	    tagmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
1019 		err = flush_imsg(ibuf);
1020 		if (err)
1021 			goto done;
1022 	}
1023 	err = send_tagmsg(ibuf, tag, tagmsg_len);
1024 done:
1025 	free(buf);
1026 	return err;
1027 }
1028 
1029 const struct got_error *
1030 got_privsep_recv_tag(struct got_tag_object **tag, struct imsgbuf *ibuf)
1031 {
1032 	const struct got_error *err = NULL;
1033 	struct imsg imsg;
1034 	struct got_imsg_tag_object *itag;
1035 	size_t len, datalen;
1036 	const size_t min_datalen =
1037 	    MIN(sizeof(struct got_imsg_error),
1038 	    sizeof(struct got_imsg_tag_object));
1039 
1040 	*tag = NULL;
1041 
1042 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1043 	if (err)
1044 		return err;
1045 
1046 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1047 	len = 0;
1048 
1049 	switch (imsg.hdr.type) {
1050 	case GOT_IMSG_TAG:
1051 		if (datalen < sizeof(*itag)) {
1052 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1053 			break;
1054 		}
1055 		itag = imsg.data;
1056 		if (datalen != sizeof(*itag) + itag->tag_len +
1057 		    itag->tagger_len) {
1058 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1059 			break;
1060 		}
1061 		len += sizeof(*itag);
1062 
1063 		*tag = calloc(1, sizeof(**tag));
1064 		if (*tag == NULL) {
1065 			err = got_error_from_errno("calloc");
1066 			break;
1067 		}
1068 
1069 		memcpy((*tag)->id.sha1, itag->id, SHA1_DIGEST_LENGTH);
1070 
1071 		if (itag->tag_len == 0) {
1072 			(*tag)->tag = strdup("");
1073 			if ((*tag)->tag == NULL) {
1074 				err = got_error_from_errno("strdup");
1075 				break;
1076 			}
1077 		} else {
1078 			(*tag)->tag = malloc(itag->tag_len + 1);
1079 			if ((*tag)->tag == NULL) {
1080 				err = got_error_from_errno("malloc");
1081 				break;
1082 			}
1083 			memcpy((*tag)->tag, imsg.data + len,
1084 			    itag->tag_len);
1085 			(*tag)->tag[itag->tag_len] = '\0';
1086 		}
1087 		len += itag->tag_len;
1088 
1089 		(*tag)->obj_type = itag->obj_type;
1090 		(*tag)->tagger_time = itag->tagger_time;
1091 		(*tag)->tagger_gmtoff = itag->tagger_gmtoff;
1092 
1093 		if (itag->tagger_len == 0) {
1094 			(*tag)->tagger = strdup("");
1095 			if ((*tag)->tagger == NULL) {
1096 				err = got_error_from_errno("strdup");
1097 				break;
1098 			}
1099 		} else {
1100 			(*tag)->tagger = malloc(itag->tagger_len + 1);
1101 			if ((*tag)->tagger == NULL) {
1102 				err = got_error_from_errno("malloc");
1103 				break;
1104 			}
1105 			memcpy((*tag)->tagger, imsg.data + len,
1106 			    itag->tagger_len);
1107 			(*tag)->tagger[itag->tagger_len] = '\0';
1108 		}
1109 		len += itag->tagger_len;
1110 
1111 		if (itag->tagmsg_len == 0) {
1112 			(*tag)->tagmsg = strdup("");
1113 			if ((*tag)->tagmsg == NULL) {
1114 				err = got_error_from_errno("strdup");
1115 				break;
1116 			}
1117 		} else {
1118 			size_t offset = 0, remain = itag->tagmsg_len;
1119 
1120 			(*tag)->tagmsg = malloc(itag->tagmsg_len + 1);
1121 			if ((*tag)->tagmsg == NULL) {
1122 				err = got_error_from_errno("malloc");
1123 				break;
1124 			}
1125 			while (remain > 0) {
1126 				struct imsg imsg_log;
1127 				size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
1128 				    remain);
1129 
1130 				err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
1131 				if (err)
1132 					return err;
1133 
1134 				if (imsg_log.hdr.type != GOT_IMSG_TAG_TAGMSG)
1135 					return got_error(GOT_ERR_PRIVSEP_MSG);
1136 
1137 				memcpy((*tag)->tagmsg + offset, imsg_log.data,
1138 				    n);
1139 				imsg_free(&imsg_log);
1140 				offset += n;
1141 				remain -= n;
1142 			}
1143 			(*tag)->tagmsg[itag->tagmsg_len] = '\0';
1144 		}
1145 
1146 		break;
1147 	default:
1148 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1149 		break;
1150 	}
1151 
1152 	imsg_free(&imsg);
1153 
1154 	return err;
1155 }
1156 
1157 const struct got_error *
1158 got_privsep_init_pack_child(struct imsgbuf *ibuf, struct got_pack *pack,
1159     struct got_packidx *packidx)
1160 {
1161 	const struct got_error *err = NULL;
1162 	struct got_imsg_packidx ipackidx;
1163 	struct got_imsg_pack ipack;
1164 	int fd;
1165 
1166 	ipackidx.len = packidx->len;
1167 	fd = dup(packidx->fd);
1168 	if (fd == -1)
1169 		return got_error_from_errno("dup");
1170 
1171 	if (imsg_compose(ibuf, GOT_IMSG_PACKIDX, 0, 0, fd, &ipackidx,
1172 	    sizeof(ipackidx)) == -1) {
1173 		err = got_error_from_errno("imsg_compose PACKIDX");
1174 		close(fd);
1175 		return err;
1176 	}
1177 
1178 	if (strlcpy(ipack.path_packfile, pack->path_packfile,
1179 	    sizeof(ipack.path_packfile)) >= sizeof(ipack.path_packfile))
1180 		return got_error(GOT_ERR_NO_SPACE);
1181 	ipack.filesize = pack->filesize;
1182 
1183 	fd = dup(pack->fd);
1184 	if (fd == -1)
1185 		return got_error_from_errno("dup");
1186 
1187 	if (imsg_compose(ibuf, GOT_IMSG_PACK, 0, 0, fd, &ipack, sizeof(ipack))
1188 	    == -1) {
1189 		err = got_error_from_errno("imsg_compose PACK");
1190 		close(fd);
1191 		return err;
1192 	}
1193 
1194 	return flush_imsg(ibuf);
1195 }
1196 
1197 const struct got_error *
1198 got_privsep_send_packed_obj_req(struct imsgbuf *ibuf, int idx,
1199     struct got_object_id *id)
1200 {
1201 	struct got_imsg_packed_object iobj;
1202 
1203 	iobj.idx = idx;
1204 	memcpy(iobj.id, id->sha1, sizeof(iobj.id));
1205 
1206 	if (imsg_compose(ibuf, GOT_IMSG_PACKED_OBJECT_REQUEST, 0, 0, -1,
1207 	    &iobj, sizeof(iobj)) == -1)
1208 		return got_error_from_errno("imsg_compose "
1209 		    "PACKED_OBJECT_REQUEST");
1210 
1211 	return flush_imsg(ibuf);
1212 }
1213 
1214 const struct got_error *
1215 got_privsep_unveil_exec_helpers(void)
1216 {
1217 	if (unveil(GOT_PATH_PROG_READ_PACK, "x") != 0 ||
1218 	    unveil(GOT_PATH_PROG_READ_OBJECT, "x") != 0 ||
1219 	    unveil(GOT_PATH_PROG_READ_COMMIT, "x") != 0 ||
1220 	    unveil(GOT_PATH_PROG_READ_TREE, "x") != 0 ||
1221 	    unveil(GOT_PATH_PROG_READ_BLOB, "x") != 0 ||
1222 	    unveil(GOT_PATH_PROG_READ_TAG, "x") != 0)
1223 		return got_error_from_errno("unveil");
1224 
1225 	return NULL;
1226 }