Got Mirror

Blob

Date:: Sun Nov 11 14:13:06 2018 UTC
Message:: handle error imsg directly in got_privsep_recv_imsg()
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2018 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/queue.h>
19 #include <sys/uio.h>
20 #include <sys/syslimits.h>
21 #include <sys/wait.h>
22 
23 #include <stdio.h>
24 #include <stdlib.h>
25 #include <string.h>
26 #include <errno.h>
27 #include <stdint.h>
28 #include <poll.h>
29 #include <imsg.h>
30 #include <sha1.h>
31 #include <zlib.h>
32 #include <time.h>
33 
34 #include "got_object.h"
35 #include "got_error.h"
36 
37 #include "got_lib_sha1.h"
38 #include "got_lib_delta.h"
39 #include "got_lib_inflate.h"
40 #include "got_lib_object.h"
41 #include "got_lib_object_parse.h"
42 #include "got_lib_privsep.h"
43 #include "got_lib_pack.h"
44 
45 #ifndef MIN
46 #define	MIN(_a,_b) ((_a) < (_b) ? (_a) : (_b))
47 #endif
48 
49 static const struct got_error *
50 poll_fd(int fd, int events, int timeout)
51 {
52 	struct pollfd pfd[1];
53 	int n;
54 
55 	pfd[0].fd = fd;
56 	pfd[0].events = events;
57 
58 	n = poll(pfd, 1, timeout);
59 	if (n == -1)
60 		return got_error_from_errno();
61 	if (n == 0)
62 		return got_error(GOT_ERR_TIMEOUT);
63 	if (pfd[0].revents & (POLLERR | POLLNVAL))
64 		return got_error_from_errno();
65 	if (pfd[0].revents & (events | POLLHUP))
66 		return NULL;
67 
68 	return got_error(GOT_ERR_INTERRUPT);
69 }
70 
71 static const struct got_error *
72 read_imsg(struct imsgbuf *ibuf)
73 {
74 	const struct got_error *err;
75 	size_t n;
76 
77 	err = poll_fd(ibuf->fd, POLLIN, INFTIM);
78 	if (err)
79 		return err;
80 
81 	n = imsg_read(ibuf);
82 	if (n == -1) {
83 		if (errno == EAGAIN) /* Could be a file-descriptor leak. */
84 			return got_error(GOT_ERR_PRIVSEP_NO_FD);
85 		return got_error(GOT_ERR_PRIVSEP_READ);
86 	}
87 	if (n == 0)
88 		return got_error(GOT_ERR_PRIVSEP_PIPE);
89 
90 	return NULL;
91 }
92 
93 const struct got_error *
94 got_privsep_wait_for_child(pid_t pid)
95 {
96 	int child_status;
97 
98 	waitpid(pid, &child_status, 0);
99 
100 	if (!WIFEXITED(child_status))
101 		return got_error(GOT_ERR_PRIVSEP_DIED);
102 
103 	if (WEXITSTATUS(child_status) != 0)
104 		return got_error(GOT_ERR_PRIVSEP_EXIT);
105 
106 	return NULL;
107 }
108 
109 static const struct got_error *
110 recv_imsg_error(struct imsg *imsg, size_t datalen)
111 {
112 	struct got_imsg_error *ierr;
113 
114 	if (datalen != sizeof(*ierr))
115 		return got_error(GOT_ERR_PRIVSEP_LEN);
116 
117 	ierr = imsg->data;
118 	if (ierr->code == GOT_ERR_ERRNO) {
119 		static struct got_error serr;
120 		serr.code = GOT_ERR_ERRNO;
121 		serr.msg = strerror(ierr->errno_code);
122 		return &serr;
123 	}
124 
125 	return got_error(ierr->code);
126 }
127 
128 const struct got_error *
129 got_privsep_recv_imsg(struct imsg *imsg, struct imsgbuf *ibuf,
130     size_t min_datalen)
131 {
132 	const struct got_error *err;
133 	ssize_t n;
134 
135 	n = imsg_get(ibuf, imsg);
136 	if (n == -1)
137 		return got_error_from_errno();
138 
139 	while (n == 0) {
140 		err = read_imsg(ibuf);
141 		if (err)
142 			return err;
143 		n = imsg_get(ibuf, imsg);
144 	}
145 
146 	if (imsg->hdr.len < IMSG_HEADER_SIZE + min_datalen)
147 		return got_error(GOT_ERR_PRIVSEP_LEN);
148 
149 	if (imsg->hdr.type == GOT_IMSG_ERROR) {
150 		size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
151 		return recv_imsg_error(imsg, datalen);
152 	}
153 
154 	return NULL;
155 }
156 
157 /* Attempt to send an error in an imsg. Complain on stderr as a last resort. */
158 void
159 got_privsep_send_error(struct imsgbuf *ibuf, const struct got_error *err)
160 {
161 	const struct got_error *poll_err;
162 	struct got_imsg_error ierr;
163 	int ret;
164 
165 	ierr.code = err->code;
166 	if (err->code == GOT_ERR_ERRNO)
167 		ierr.errno_code = errno;
168 	else
169 		ierr.errno_code = 0;
170 	ret = imsg_compose(ibuf, GOT_IMSG_ERROR, 0, 0, -1, &ierr, sizeof(ierr));
171 	if (ret == -1) {
172 		fprintf(stderr, "%s: error %d \"%s\": imsg_compose: %s\n",
173 		    getprogname(), err->code, err->msg, strerror(errno));
174 		return;
175 	}
176 
177 	poll_err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
178 	if (poll_err) {
179 		fprintf(stderr, "%s: error %d \"%s\": poll: %s\n",
180 		    getprogname(), err->code, err->msg, poll_err->msg);
181 		return;
182 	}
183 
184 	ret = imsg_flush(ibuf);
185 	if (ret == -1) {
186 		fprintf(stderr, "%s: error %d \"%s\": imsg_flush: %s\n",
187 		    getprogname(), err->code, err->msg, strerror(errno));
188 		return;
189 	}
190 }
191 
192 static const struct got_error *
193 flush_imsg(struct imsgbuf *ibuf)
194 {
195 	const struct got_error *err;
196 
197 	err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
198 	if (err)
199 		return err;
200 
201 	if (imsg_flush(ibuf) == -1)
202 		return got_error_from_errno();
203 
204 	return NULL;
205 }
206 
207 const struct got_error *
208 got_privsep_send_stop(int fd)
209 {
210 	const struct got_error *err = NULL;
211 	struct imsgbuf ibuf;
212 
213 	imsg_init(&ibuf, fd);
214 
215 	if (imsg_compose(&ibuf, GOT_IMSG_STOP, 0, 0, -1, NULL, 0) == -1)
216 		return got_error_from_errno();
217 
218 	err = flush_imsg(&ibuf);
219 	imsg_clear(&ibuf);
220 	return err;
221 }
222 
223 const struct got_error *
224 got_privsep_send_obj_req(struct imsgbuf *ibuf, int fd, struct got_object *obj)
225 {
226 	struct got_imsg_object iobj, *iobjp = NULL;
227 	size_t iobj_size = 0;
228 	int imsg_code = GOT_IMSG_OBJECT_REQUEST;
229 
230 	if (obj) {
231 		switch (obj->type) {
232 		case GOT_OBJ_TYPE_TREE:
233 			imsg_code = GOT_IMSG_TREE_REQUEST;
234 			break;
235 		case GOT_OBJ_TYPE_COMMIT:
236 			imsg_code = GOT_IMSG_COMMIT_REQUEST;
237 			break;
238 		case GOT_OBJ_TYPE_BLOB:
239 			imsg_code = GOT_IMSG_BLOB_REQUEST;
240 			break;
241 		default:
242 			return got_error(GOT_ERR_OBJ_TYPE);
243 		}
244 
245 		memcpy(iobj.id, obj->id.sha1, sizeof(iobj.id));
246 		iobj.type = obj->type;
247 		iobj.flags = obj->flags;
248 		iobj.hdrlen = obj->hdrlen;
249 		iobj.size = obj->size;
250 		if (iobj.flags & GOT_OBJ_FLAG_PACKED) {
251 			iobj.pack_offset = obj->pack_offset;
252 			iobj.pack_idx = obj->pack_idx;
253 		}
254 
255 		iobjp = &iobj;
256 		iobj_size = sizeof(iobj);
257 	}
258 
259 	if (imsg_compose(ibuf, imsg_code, 0, 0, fd, iobjp, iobj_size) == -1)
260 		return got_error_from_errno();
261 
262 	return flush_imsg(ibuf);
263 }
264 
265 const struct got_error *
266 got_privsep_send_blob_req(struct imsgbuf *ibuf, int infd)
267 {
268 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_REQUEST, 0, 0, infd, NULL, 0)
269 	    == -1)
270 		return got_error_from_errno();
271 
272 	return flush_imsg(ibuf);
273 }
274 
275 const struct got_error *
276 got_privsep_send_blob_outfd(struct imsgbuf *ibuf, int outfd)
277 {
278 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_OUTFD, 0, 0, outfd, NULL, 0)
279 	    == -1)
280 		return got_error_from_errno();
281 
282 	return flush_imsg(ibuf);
283 }
284 
285 const struct got_error *
286 got_privsep_send_tmpfd(struct imsgbuf *ibuf, int fd)
287 {
288 	if (imsg_compose(ibuf, GOT_IMSG_TMPFD, 0, 0, fd, NULL, 0)
289 	    == -1)
290 		return got_error_from_errno();
291 
292 	return flush_imsg(ibuf);
293 }
294 
295 const struct got_error *
296 got_privsep_send_obj(struct imsgbuf *ibuf, struct got_object *obj)
297 {
298 	struct got_imsg_object iobj;
299 
300 	memcpy(iobj.id, obj->id.sha1, sizeof(iobj.id));
301 	iobj.type = obj->type;
302 	iobj.flags = obj->flags;
303 	iobj.hdrlen = obj->hdrlen;
304 	iobj.size = obj->size;
305 	if (iobj.flags & GOT_OBJ_FLAG_PACKED) {
306 		iobj.pack_offset = obj->pack_offset;
307 		iobj.pack_idx = obj->pack_idx;
308 	}
309 
310 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT, 0, 0, -1, &iobj, sizeof(iobj))
311 	    == -1)
312 		return got_error_from_errno();
313 
314 	return flush_imsg(ibuf);
315 }
316 
317 const struct got_error *
318 got_privsep_get_imsg_obj(struct got_object **obj, struct imsg *imsg,
319     struct imsgbuf *ibuf)
320 {
321 	const struct got_error *err = NULL;
322 	struct got_imsg_object *iobj;
323 	size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
324 
325 	if (datalen != sizeof(*iobj))
326 		return got_error(GOT_ERR_PRIVSEP_LEN);
327 	iobj = imsg->data;
328 
329 	*obj = calloc(1, sizeof(**obj));
330 	if (*obj == NULL)
331 		return got_error_from_errno();
332 
333 	memcpy((*obj)->id.sha1, iobj->id, SHA1_DIGEST_LENGTH);
334 	(*obj)->type = iobj->type;
335 	(*obj)->flags = iobj->flags;
336 	(*obj)->hdrlen = iobj->hdrlen;
337 	(*obj)->size = iobj->size;
338 	/* path_packfile is handled by caller */
339 	if (iobj->flags & GOT_OBJ_FLAG_PACKED) {
340 		(*obj)->pack_offset = iobj->pack_offset;
341 		(*obj)->pack_idx = iobj->pack_idx;
342 	}
343 
344 	return err;
345 }
346 
347 const struct got_error *
348 got_privsep_recv_obj(struct got_object **obj, struct imsgbuf *ibuf)
349 {
350 	const struct got_error *err = NULL;
351 	struct imsg imsg;
352 	size_t datalen;
353 	const size_t min_datalen =
354 	    MIN(sizeof(struct got_imsg_error), sizeof(struct got_imsg_object));
355 
356 	*obj = NULL;
357 
358 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
359 	if (err)
360 		return err;
361 
362 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
363 
364 	switch (imsg.hdr.type) {
365 	case GOT_IMSG_OBJECT:
366 		err = got_privsep_get_imsg_obj(obj, &imsg, ibuf);
367 		break;
368 	default:
369 		err = got_error(GOT_ERR_PRIVSEP_MSG);
370 		break;
371 	}
372 
373 	imsg_free(&imsg);
374 
375 	return err;
376 }
377 
378 static const struct got_error *
379 send_commit_logmsg(struct imsgbuf *ibuf, struct got_commit_object *commit,
380     size_t logmsg_len)
381 {
382 	const struct got_error *err = NULL;
383 	size_t offset, remain;
384 
385 	offset = 0;
386 	remain = logmsg_len;
387 	while (remain > 0) {
388 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
389 
390 		if (imsg_compose(ibuf, GOT_IMSG_COMMIT_LOGMSG, 0, 0, -1,
391 		    commit->logmsg + offset, n) == -1) {
392 			err = got_error_from_errno();
393 			break;
394 		}
395 
396 		err = flush_imsg(ibuf);
397 		if (err)
398 			break;
399 
400 		offset += n;
401 		remain -= n;
402 	}
403 
404 	return err;
405 }
406 
407 const struct got_error *
408 got_privsep_send_commit(struct imsgbuf *ibuf, struct got_commit_object *commit)
409 {
410 	const struct got_error *err = NULL;
411 	struct got_imsg_commit_object *icommit;
412 	uint8_t *buf;
413 	size_t len, total;
414 	struct got_object_qid *qid;
415 	size_t author_len = strlen(commit->author);
416 	size_t committer_len = strlen(commit->committer);
417 	size_t logmsg_len = strlen(commit->logmsg);
418 
419 	total = sizeof(*icommit) + author_len + committer_len +
420 	    commit->nparents * SHA1_DIGEST_LENGTH;
421 
422 	buf = malloc(total);
423 	if (buf == NULL)
424 		return got_error_from_errno();
425 
426 	icommit = (struct got_imsg_commit_object *)buf;
427 	memcpy(icommit->tree_id, commit->tree_id->sha1, sizeof(icommit->tree_id));
428 	icommit->author_len = author_len;
429 	icommit->author_time = commit->author_time;
430 	icommit->author_gmtoff = commit->author_gmtoff;
431 	icommit->committer_len = committer_len;
432 	icommit->committer_time = commit->committer_time;
433 	icommit->committer_gmtoff = commit->committer_gmtoff;
434 	icommit->logmsg_len = logmsg_len;
435 	icommit->nparents = commit->nparents;
436 
437 	len = sizeof(*icommit);
438 	memcpy(buf + len, commit->author, author_len);
439 	len += author_len;
440 	memcpy(buf + len, commit->committer, committer_len);
441 	len += committer_len;
442 	SIMPLEQ_FOREACH(qid, &commit->parent_ids, entry) {
443 		memcpy(buf + len, qid->id, SHA1_DIGEST_LENGTH);
444 		len += SHA1_DIGEST_LENGTH;
445 	}
446 
447 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT, 0, 0, -1, buf, len) == -1) {
448 		err = got_error_from_errno();
449 		goto done;
450 	}
451 
452 	if (logmsg_len == 0 ||
453 	    logmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
454 		err = flush_imsg(ibuf);
455 		if (err)
456 			goto done;
457 	}
458 	err = send_commit_logmsg(ibuf, commit, logmsg_len);
459 done:
460 	free(buf);
461 	return err;
462 }
463 
464 const struct got_error *
465 got_privsep_recv_commit(struct got_commit_object **commit, struct imsgbuf *ibuf)
466 {
467 	const struct got_error *err = NULL;
468 	struct imsg imsg;
469 	struct got_imsg_commit_object *icommit;
470 	size_t len, datalen;
471 	int i;
472 	const size_t min_datalen =
473 	    MIN(sizeof(struct got_imsg_error),
474 	    sizeof(struct got_imsg_commit_object));
475 
476 	*commit = NULL;
477 
478 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
479 	if (err)
480 		return err;
481 
482 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
483 	len = 0;
484 
485 	switch (imsg.hdr.type) {
486 	case GOT_IMSG_COMMIT:
487 		if (datalen < sizeof(*icommit)) {
488 			err = got_error(GOT_ERR_PRIVSEP_LEN);
489 			break;
490 		}
491 		icommit = imsg.data;
492 		if (datalen != sizeof(*icommit) + icommit->author_len +
493 		    icommit->committer_len +
494 		    icommit->nparents * SHA1_DIGEST_LENGTH) {
495 			err = got_error(GOT_ERR_PRIVSEP_LEN);
496 			break;
497 		}
498 		if (icommit->nparents < 0) {
499 			err = got_error(GOT_ERR_PRIVSEP_LEN);
500 			break;
501 		}
502 		len += sizeof(*icommit);
503 
504 		*commit = got_object_commit_alloc_partial();
505 		if (*commit == NULL) {
506 			err = got_error_from_errno();
507 			break;
508 		}
509 
510 		memcpy((*commit)->tree_id->sha1, icommit->tree_id,
511 		    SHA1_DIGEST_LENGTH);
512 		(*commit)->author_time = icommit->author_time;
513 		(*commit)->author_gmtoff = icommit->author_gmtoff;
514 		(*commit)->committer_time = icommit->committer_time;
515 		(*commit)->committer_gmtoff = icommit->committer_gmtoff;
516 
517 		if (icommit->author_len == 0) {
518 			(*commit)->author = strdup("");
519 			if ((*commit)->author == NULL) {
520 				err = got_error_from_errno();
521 				break;
522 			}
523 		} else {
524 			(*commit)->author = malloc(icommit->author_len + 1);
525 			if ((*commit)->author == NULL) {
526 				err = got_error_from_errno();
527 				break;
528 			}
529 			memcpy((*commit)->author, imsg.data + len,
530 			    icommit->author_len);
531 			(*commit)->author[icommit->author_len] = '\0';
532 		}
533 		len += icommit->author_len;
534 
535 		if (icommit->committer_len == 0) {
536 			(*commit)->committer = strdup("");
537 			if ((*commit)->committer == NULL) {
538 				err = got_error_from_errno();
539 				break;
540 			}
541 		} else {
542 			(*commit)->committer =
543 			    malloc(icommit->committer_len + 1);
544 			if ((*commit)->committer == NULL) {
545 				err = got_error_from_errno();
546 				break;
547 			}
548 			memcpy((*commit)->committer, imsg.data + len,
549 			    icommit->committer_len);
550 			(*commit)->committer[icommit->committer_len] = '\0';
551 		}
552 		len += icommit->committer_len;
553 
554 		if (icommit->logmsg_len == 0) {
555 			(*commit)->logmsg = strdup("");
556 			if ((*commit)->logmsg == NULL) {
557 				err = got_error_from_errno();
558 				break;
559 			}
560 		} else {
561 			size_t offset = 0, remain = icommit->logmsg_len;
562 
563 			(*commit)->logmsg = malloc(icommit->logmsg_len + 1);
564 			if ((*commit)->logmsg == NULL) {
565 				err = got_error_from_errno();
566 				break;
567 			}
568 			while (remain > 0) {
569 				struct imsg imsg_log;
570 				size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
571 				    remain);
572 
573 				err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
574 				if (err)
575 					return err;
576 
577 				if (imsg_log.hdr.type != GOT_IMSG_COMMIT_LOGMSG)
578 					return got_error(GOT_ERR_PRIVSEP_MSG);
579 
580 				memcpy((*commit)->logmsg + offset,
581 				    imsg_log.data, n);
582 				imsg_free(&imsg_log);
583 				offset += n;
584 				remain -= n;
585 			}
586 			(*commit)->logmsg[icommit->logmsg_len] = '\0';
587 		}
588 
589 		for (i = 0; i < icommit->nparents; i++) {
590 			struct got_object_qid *qid;
591 
592 			err = got_object_qid_alloc_partial(&qid);
593 			if (err)
594 				break;
595 			memcpy(qid->id, imsg.data + len +
596 			    i * SHA1_DIGEST_LENGTH, sizeof(*qid->id));
597 			SIMPLEQ_INSERT_TAIL(&(*commit)->parent_ids, qid, entry);
598 			(*commit)->nparents++;
599 		}
600 		break;
601 	default:
602 		err = got_error(GOT_ERR_PRIVSEP_MSG);
603 		break;
604 	}
605 
606 	imsg_free(&imsg);
607 
608 	return err;
609 }
610 
611 const struct got_error *
612 got_privsep_send_tree(struct imsgbuf *ibuf, struct got_tree_object *tree)
613 {
614 	const struct got_error *err = NULL;
615 	struct got_imsg_tree_object itree;
616 	struct got_tree_entry *te;
617 	size_t totlen;
618 	int nimsg; /* number of imsg queued in ibuf */
619 
620 	itree.nentries = tree->entries.nentries;
621 	if (imsg_compose(ibuf, GOT_IMSG_TREE, 0, 0, -1, &itree, sizeof(itree))
622 	    == -1)
623 		return got_error_from_errno();
624 
625 	totlen = sizeof(itree);
626 	nimsg = 1;
627 	SIMPLEQ_FOREACH(te, &tree->entries.head, entry) {
628 		struct got_imsg_tree_entry *ite;
629 		uint8_t *buf = NULL;
630 		size_t len = sizeof(*ite) + strlen(te->name);
631 
632 		if (len > MAX_IMSGSIZE)
633 			return got_error(GOT_ERR_NO_SPACE);
634 
635 		nimsg++;
636 		if (totlen + len >= MAX_IMSGSIZE - (IMSG_HEADER_SIZE * nimsg)) {
637 			err = flush_imsg(ibuf);
638 			if (err)
639 				return err;
640 			nimsg = 0;
641 		}
642 
643 		buf = malloc(len);
644 		if (buf == NULL)
645 			return got_error_from_errno();
646 
647 		ite = (struct got_imsg_tree_entry *)buf;
648 		memcpy(ite->id, te->id->sha1, sizeof(ite->id));
649 		ite->mode = te->mode;
650 		memcpy(buf + sizeof(*ite), te->name, strlen(te->name));
651 
652 		if (imsg_compose(ibuf, GOT_IMSG_TREE_ENTRY, 0, 0, -1,
653 		    buf, len) == -1)
654 			err = got_error_from_errno();
655 		free(buf);
656 		if (err)
657 			return err;
658 		totlen += len;
659 	}
660 
661 	return flush_imsg(ibuf);
662 }
663 
664 const struct got_error *
665 got_privsep_recv_tree(struct got_tree_object **tree, struct imsgbuf *ibuf)
666 {
667 	const struct got_error *err = NULL;
668 	const size_t min_datalen =
669 	    MIN(sizeof(struct got_imsg_error),
670 	    sizeof(struct got_imsg_tree_object));
671 	struct got_imsg_tree_object *itree;
672 	int nentries = 0;
673 
674 	*tree = NULL;
675 get_more:
676 	err = read_imsg(ibuf);
677 	if (err)
678 		goto done;
679 
680 	while (1) {
681 		struct imsg imsg;
682 		size_t n;
683 		size_t datalen;
684 		struct got_imsg_tree_entry *ite;
685 		struct got_tree_entry *te = NULL;
686 
687 		n = imsg_get(ibuf, &imsg);
688 		if (n == 0) {
689 			if (*tree && (*tree)->entries.nentries != nentries)
690 				goto get_more;
691 			break;
692 		}
693 
694 		if (imsg.hdr.len < IMSG_HEADER_SIZE + min_datalen)
695 			return got_error(GOT_ERR_PRIVSEP_LEN);
696 
697 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
698 
699 		switch (imsg.hdr.type) {
700 		case GOT_IMSG_ERROR:
701 			err = recv_imsg_error(&imsg, datalen);
702 			break;
703 		case GOT_IMSG_TREE:
704 			/* This message should only appear once. */
705 			if (*tree != NULL) {
706 				err = got_error(GOT_ERR_PRIVSEP_MSG);
707 				break;
708 			}
709 			if (datalen != sizeof(*itree)) {
710 				err = got_error(GOT_ERR_PRIVSEP_LEN);
711 				break;
712 			}
713 			itree = imsg.data;
714 			*tree = malloc(sizeof(**tree));
715 			if (*tree == NULL) {
716 				err = got_error_from_errno();
717 				break;
718 			}
719 			(*tree)->entries.nentries = itree->nentries;
720 			SIMPLEQ_INIT(&(*tree)->entries.head);
721 			(*tree)->refcnt = 0;
722 			break;
723 		case GOT_IMSG_TREE_ENTRY:
724 			/* This message should be preceeded by GOT_IMSG_TREE. */
725 			if (*tree == NULL) {
726 				err = got_error(GOT_ERR_PRIVSEP_MSG);
727 				break;
728 			}
729 			if (datalen < sizeof(*ite) || datalen > MAX_IMSGSIZE) {
730 				err = got_error(GOT_ERR_PRIVSEP_LEN);
731 				break;
732 			}
733 
734 			/* Remaining data contains the entry's name. */
735 			datalen -= sizeof(*ite);
736 			if (datalen == 0 || datalen > MAX_IMSGSIZE) {
737 				err = got_error(GOT_ERR_PRIVSEP_LEN);
738 				break;
739 			}
740 			ite = imsg.data;
741 
742 			te = got_alloc_tree_entry_partial();
743 			if (te == NULL) {
744 				err = got_error_from_errno();
745 				break;
746 			}
747 			te->name = malloc(datalen + 1);
748 			if (te->name == NULL) {
749 				free(te);
750 				err = got_error_from_errno();
751 				break;
752 			}
753 			memcpy(te->name, imsg.data + sizeof(*ite), datalen);
754 			te->name[datalen] = '\0';
755 
756 			memcpy(te->id->sha1, ite->id, SHA1_DIGEST_LENGTH);
757 			te->mode = ite->mode;
758 			SIMPLEQ_INSERT_TAIL(&(*tree)->entries.head, te, entry);
759 			nentries++;
760 			break;
761 		default:
762 			err = got_error(GOT_ERR_PRIVSEP_MSG);
763 			break;
764 		}
765 
766 		imsg_free(&imsg);
767 	}
768 done:
769 	if (*tree && (*tree)->entries.nentries != nentries) {
770 		if (err == NULL)
771 			err = got_error(GOT_ERR_PRIVSEP_LEN);
772 		got_object_tree_close(*tree);
773 		*tree = NULL;
774 	}
775 
776 	return err;
777 }
778 
779 const struct got_error *
780 got_privsep_send_blob(struct imsgbuf *ibuf, size_t size)
781 {
782 	struct got_imsg_blob iblob;
783 
784 	iblob.size = size;
785 	/* Data has already been written to file descriptor. */
786 
787 	if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, &iblob, sizeof(iblob))
788 	    == -1)
789 		return got_error_from_errno();
790 
791 	return flush_imsg(ibuf);
792 }
793 
794 const struct got_error *
795 got_privsep_recv_blob(size_t *size, struct imsgbuf *ibuf)
796 {
797 	const struct got_error *err = NULL;
798 	struct imsg imsg;
799 	struct got_imsg_blob *iblob;
800 	size_t datalen;
801 
802 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
803 	if (err)
804 		return err;
805 
806 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
807 
808 	switch (imsg.hdr.type) {
809 	case GOT_IMSG_BLOB:
810 		if (datalen != sizeof(*iblob)) {
811 			err = got_error(GOT_ERR_PRIVSEP_LEN);
812 			break;
813 		}
814 		iblob = imsg.data;
815 		*size = iblob->size;
816 		/* Data has been written to file descriptor. */
817 		break;
818 	default:
819 		err = got_error(GOT_ERR_PRIVSEP_MSG);
820 		break;
821 	}
822 
823 	imsg_free(&imsg);
824 
825 	return err;
826 }
827 
828 const struct got_error *
829 got_privsep_init_pack_child(struct imsgbuf *ibuf, struct got_pack *pack,
830     struct got_packidx *packidx)
831 {
832 	struct got_imsg_packidx ipackidx;
833 	struct got_imsg_pack ipack;
834 	int fd;
835 
836 	ipackidx.len = packidx->len;
837 	fd = dup(packidx->fd);
838 	if (fd == -1)
839 		return got_error_from_errno();
840 
841 	if (imsg_compose(ibuf, GOT_IMSG_PACKIDX, 0, 0, fd, &ipackidx,
842 	    sizeof(ipackidx)) == -1)
843 		return got_error_from_errno();
844 
845 	if (strlcpy(ipack.path_packfile, pack->path_packfile,
846 	    sizeof(ipack.path_packfile)) >= sizeof(ipack.path_packfile))
847 		return got_error(GOT_ERR_NO_SPACE);
848 	ipack.filesize = pack->filesize;
849 
850 	fd = dup(pack->fd);
851 	if (fd == -1)
852 		return got_error_from_errno();
853 
854 	if (imsg_compose(ibuf, GOT_IMSG_PACK, 0, 0, fd, &ipack, sizeof(ipack))
855 	    == -1)
856 		return got_error_from_errno();
857 
858 	return flush_imsg(ibuf);
859 }
860 
861 const struct got_error *
862 got_privsep_send_packed_obj_req(struct imsgbuf *ibuf, int idx,
863     struct got_object_id *id)
864 {
865 	struct got_imsg_packed_object iobj;
866 
867 	iobj.idx = idx;
868 	memcpy(iobj.id, id->sha1, sizeof(iobj.id));
869 
870 	if (imsg_compose(ibuf, GOT_IMSG_PACKED_OBJECT_REQUEST, 0, 0, -1,
871 	    &iobj, sizeof(iobj)) == -1)
872 		return got_error_from_errno();
873 
874 	return flush_imsg(ibuf);
875 }