Got Mirror

Blob

Date:: Wed Nov 7 07:59:06 2018 UTC
Message:: avoid unnecessary memcpy in got_privsep_send_commit()
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2018 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/queue.h>
19 #include <sys/uio.h>
20 #include <sys/syslimits.h>
21 #include <sys/wait.h>
22 
23 #include <stdio.h>
24 #include <stdlib.h>
25 #include <string.h>
26 #include <errno.h>
27 #include <stdint.h>
28 #include <poll.h>
29 #include <imsg.h>
30 #include <sha1.h>
31 #include <zlib.h>
32 #include <time.h>
33 
34 #include "got_object.h"
35 #include "got_error.h"
36 
37 #include "got_lib_sha1.h"
38 #include "got_lib_delta.h"
39 #include "got_lib_inflate.h"
40 #include "got_lib_object.h"
41 #include "got_lib_object_parse.h"
42 #include "got_lib_privsep.h"
43 #include "got_lib_pack.h"
44 
45 #ifndef MIN
46 #define	MIN(_a,_b) ((_a) < (_b) ? (_a) : (_b))
47 #endif
48 
49 static const struct got_error *
50 poll_fd(int fd, int events, int timeout)
51 {
52 	struct pollfd pfd[1];
53 	int n;
54 
55 	pfd[0].fd = fd;
56 	pfd[0].events = events;
57 
58 	n = poll(pfd, 1, timeout);
59 	if (n == -1)
60 		return got_error_from_errno();
61 	if (n == 0)
62 		return got_error(GOT_ERR_TIMEOUT);
63 	if (pfd[0].revents & (POLLERR | POLLNVAL))
64 		return got_error_from_errno();
65 	if (pfd[0].revents & (events | POLLHUP))
66 		return NULL;
67 
68 	return got_error(GOT_ERR_INTERRUPT);
69 }
70 
71 static const struct got_error *
72 read_imsg(struct imsgbuf *ibuf)
73 {
74 	const struct got_error *err;
75 	size_t n;
76 
77 	err = poll_fd(ibuf->fd, POLLIN, INFTIM);
78 	if (err)
79 		return err;
80 
81 	n = imsg_read(ibuf);
82 	if (n == -1) {
83 		if (errno == EAGAIN) /* Could be a file-descriptor leak. */
84 			return got_error(GOT_ERR_PRIVSEP_NO_FD);
85 		return got_error(GOT_ERR_PRIVSEP_READ);
86 	}
87 	if (n == 0)
88 		return got_error(GOT_ERR_PRIVSEP_PIPE);
89 
90 	return NULL;
91 }
92 
93 const struct got_error *
94 got_privsep_wait_for_child(pid_t pid)
95 {
96 	int child_status;
97 
98 	waitpid(pid, &child_status, 0);
99 
100 	if (!WIFEXITED(child_status))
101 		return got_error(GOT_ERR_PRIVSEP_DIED);
102 
103 	if (WEXITSTATUS(child_status) != 0)
104 		return got_error(GOT_ERR_PRIVSEP_EXIT);
105 
106 	return NULL;
107 }
108 
109 const struct got_error *
110 got_privsep_recv_imsg(struct imsg *imsg, struct imsgbuf *ibuf, size_t min_datalen)
111 {
112 	const struct got_error *err;
113 	ssize_t n;
114 
115 	n = imsg_get(ibuf, imsg);
116 	if (n == -1)
117 		return got_error_from_errno();
118 
119 	while (n == 0) {
120 		err = read_imsg(ibuf);
121 		if (err)
122 			return err;
123 		n = imsg_get(ibuf, imsg);
124 	}
125 
126 	if (imsg->hdr.len < IMSG_HEADER_SIZE + min_datalen)
127 		return got_error(GOT_ERR_PRIVSEP_LEN);
128 
129 	return NULL;
130 }
131 
132 static const struct got_error *
133 recv_imsg_error(struct imsg *imsg, size_t datalen)
134 {
135 	struct got_imsg_error *ierr;
136 
137 	if (datalen != sizeof(*ierr))
138 		return got_error(GOT_ERR_PRIVSEP_LEN);
139 
140 	ierr = imsg->data;
141 	if (ierr->code == GOT_ERR_ERRNO) {
142 		static struct got_error serr;
143 		serr.code = GOT_ERR_ERRNO;
144 		serr.msg = strerror(ierr->errno_code);
145 		return &serr;
146 	}
147 
148 	return got_error(ierr->code);
149 }
150 
151 /* Attempt to send an error in an imsg. Complain on stderr as a last resort. */
152 void
153 got_privsep_send_error(struct imsgbuf *ibuf, const struct got_error *err)
154 {
155 	const struct got_error *poll_err;
156 	struct got_imsg_error ierr;
157 	int ret;
158 
159 	ierr.code = err->code;
160 	if (err->code == GOT_ERR_ERRNO)
161 		ierr.errno_code = errno;
162 	else
163 		ierr.errno_code = 0;
164 	ret = imsg_compose(ibuf, GOT_IMSG_ERROR, 0, 0, -1, &ierr, sizeof(ierr));
165 	if (ret != -1) {
166 		fprintf(stderr, "%s: error %d \"%s\": imsg_compose: %s\n",
167 		    getprogname(), err->code, err->msg, strerror(errno));
168 		return;
169 	}
170 
171 	poll_err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
172 	if (poll_err) {
173 		fprintf(stderr, "%s: error %d \"%s\": poll: %s\n",
174 		    getprogname(), err->code, err->msg, poll_err->msg);
175 		return;
176 	}
177 
178 	ret = imsg_flush(ibuf);
179 	if (ret == -1) {
180 		fprintf(stderr, "%s: error %d \"%s\": imsg_flush: %s\n",
181 		    getprogname(), err->code, err->msg, strerror(errno));
182 		return;
183 	}
184 }
185 
186 static const struct got_error *
187 flush_imsg(struct imsgbuf *ibuf)
188 {
189 	const struct got_error *err;
190 
191 	err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
192 	if (err)
193 		return err;
194 
195 	if (imsg_flush(ibuf) == -1)
196 		return got_error_from_errno();
197 
198 	return NULL;
199 }
200 
201 const struct got_error *
202 got_privsep_send_stop(int fd)
203 {
204 	const struct got_error *err = NULL;
205 	struct imsgbuf ibuf;
206 
207 	imsg_init(&ibuf, fd);
208 
209 	if (imsg_compose(&ibuf, GOT_IMSG_STOP, 0, 0, -1, NULL, 0) == -1)
210 		return got_error_from_errno();
211 
212 	err = flush_imsg(&ibuf);
213 	imsg_clear(&ibuf);
214 	return err;
215 }
216 
217 const struct got_error *
218 got_privsep_send_obj_req(struct imsgbuf *ibuf, int fd, struct got_object *obj)
219 {
220 	struct got_imsg_object iobj, *iobjp = NULL;
221 	size_t iobj_size = 0;
222 	int imsg_code = GOT_IMSG_OBJECT_REQUEST;
223 
224 	if (obj) {
225 		switch (obj->type) {
226 		case GOT_OBJ_TYPE_TREE:
227 			imsg_code = GOT_IMSG_TREE_REQUEST;
228 			break;
229 		case GOT_OBJ_TYPE_COMMIT:
230 			imsg_code = GOT_IMSG_COMMIT_REQUEST;
231 			break;
232 		case GOT_OBJ_TYPE_BLOB:
233 			imsg_code = GOT_IMSG_BLOB_REQUEST;
234 			break;
235 		default:
236 			return got_error(GOT_ERR_OBJ_TYPE);
237 		}
238 
239 		memcpy(iobj.id, obj->id.sha1, sizeof(iobj.id));
240 		iobj.type = obj->type;
241 		iobj.flags = obj->flags;
242 		iobj.hdrlen = obj->hdrlen;
243 		iobj.size = obj->size;
244 		if (iobj.flags & GOT_OBJ_FLAG_PACKED) {
245 			iobj.pack_offset = obj->pack_offset;
246 			iobj.pack_idx = obj->pack_idx;
247 		}
248 
249 		iobjp = &iobj;
250 		iobj_size = sizeof(iobj);
251 	}
252 
253 	if (imsg_compose(ibuf, imsg_code, 0, 0, fd, iobjp, iobj_size) == -1)
254 		return got_error_from_errno();
255 
256 	return flush_imsg(ibuf);
257 }
258 
259 const struct got_error *
260 got_privsep_send_blob_req(struct imsgbuf *ibuf, int infd)
261 {
262 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_REQUEST, 0, 0, infd, NULL, 0)
263 	    == -1)
264 		return got_error_from_errno();
265 
266 	return flush_imsg(ibuf);
267 }
268 
269 const struct got_error *
270 got_privsep_send_blob_outfd(struct imsgbuf *ibuf, int outfd)
271 {
272 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_OUTFD, 0, 0, outfd, NULL, 0)
273 	    == -1)
274 		return got_error_from_errno();
275 
276 	return flush_imsg(ibuf);
277 }
278 
279 const struct got_error *
280 got_privsep_send_tmpfd(struct imsgbuf *ibuf, int fd)
281 {
282 	if (imsg_compose(ibuf, GOT_IMSG_TMPFD, 0, 0, fd, NULL, 0)
283 	    == -1)
284 		return got_error_from_errno();
285 
286 	return flush_imsg(ibuf);
287 }
288 
289 const struct got_error *
290 got_privsep_send_obj(struct imsgbuf *ibuf, struct got_object *obj)
291 {
292 	struct got_imsg_object iobj;
293 
294 	memcpy(iobj.id, obj->id.sha1, sizeof(iobj.id));
295 	iobj.type = obj->type;
296 	iobj.flags = obj->flags;
297 	iobj.hdrlen = obj->hdrlen;
298 	iobj.size = obj->size;
299 	if (iobj.flags & GOT_OBJ_FLAG_PACKED) {
300 		iobj.pack_offset = obj->pack_offset;
301 		iobj.pack_idx = obj->pack_idx;
302 	}
303 
304 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT, 0, 0, -1, &iobj, sizeof(iobj))
305 	    == -1)
306 		return got_error_from_errno();
307 
308 	return flush_imsg(ibuf);
309 }
310 
311 const struct got_error *
312 got_privsep_get_imsg_obj(struct got_object **obj, struct imsg *imsg,
313     struct imsgbuf *ibuf)
314 {
315 	const struct got_error *err = NULL;
316 	struct got_imsg_object *iobj;
317 	size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
318 
319 	if (datalen != sizeof(*iobj))
320 		return got_error(GOT_ERR_PRIVSEP_LEN);
321 	iobj = imsg->data;
322 
323 	*obj = calloc(1, sizeof(**obj));
324 	if (*obj == NULL)
325 		return got_error_from_errno();
326 
327 	memcpy((*obj)->id.sha1, iobj->id, SHA1_DIGEST_LENGTH);
328 	(*obj)->type = iobj->type;
329 	(*obj)->flags = iobj->flags;
330 	(*obj)->hdrlen = iobj->hdrlen;
331 	(*obj)->size = iobj->size;
332 	/* path_packfile is handled by caller */
333 	if (iobj->flags & GOT_OBJ_FLAG_PACKED) {
334 		(*obj)->pack_offset = iobj->pack_offset;
335 		(*obj)->pack_idx = iobj->pack_idx;
336 	}
337 
338 	return err;
339 }
340 
341 const struct got_error *
342 got_privsep_recv_obj(struct got_object **obj, struct imsgbuf *ibuf)
343 {
344 	const struct got_error *err = NULL;
345 	struct imsg imsg;
346 	size_t datalen;
347 	const size_t min_datalen =
348 	    MIN(sizeof(struct got_imsg_error), sizeof(struct got_imsg_object));
349 
350 	*obj = NULL;
351 
352 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
353 	if (err)
354 		return err;
355 
356 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
357 
358 	switch (imsg.hdr.type) {
359 	case GOT_IMSG_ERROR:
360 		err = recv_imsg_error(&imsg, datalen);
361 		break;
362 	case GOT_IMSG_OBJECT:
363 		err = got_privsep_get_imsg_obj(obj, &imsg, ibuf);
364 		break;
365 	default:
366 		err = got_error(GOT_ERR_PRIVSEP_MSG);
367 		break;
368 	}
369 
370 	imsg_free(&imsg);
371 
372 	return err;
373 }
374 
375 static const struct got_error *
376 send_commit_logmsg(struct imsgbuf *ibuf, struct got_commit_object *commit,
377     size_t logmsg_len)
378 {
379 	const struct got_error *err = NULL;
380 	size_t offset, remain;
381 
382 	offset = 0;
383 	remain = logmsg_len;
384 	while (remain > 0) {
385 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
386 
387 		if (imsg_compose(ibuf, GOT_IMSG_COMMIT_LOGMSG, 0, 0, -1,
388 		    commit->logmsg + offset, n) == -1) {
389 			err = got_error_from_errno();
390 			break;
391 		}
392 
393 		err = flush_imsg(ibuf);
394 		if (err)
395 			break;
396 
397 		offset += n;
398 		remain -= n;
399 	}
400 
401 	return err;
402 }
403 
404 const struct got_error *
405 got_privsep_send_commit(struct imsgbuf *ibuf, struct got_commit_object *commit)
406 {
407 	const struct got_error *err = NULL;
408 	struct got_imsg_commit_object *icommit;
409 	uint8_t *buf;
410 	size_t len, total;
411 	struct got_object_qid *qid;
412 	size_t author_len = strlen(commit->author);
413 	size_t committer_len = strlen(commit->committer);
414 	size_t logmsg_len = strlen(commit->logmsg);
415 
416 	total = sizeof(*icommit) + author_len + committer_len +
417 	    commit->nparents * SHA1_DIGEST_LENGTH;
418 
419 	buf = malloc(total);
420 	if (buf == NULL)
421 		return got_error_from_errno();
422 
423 	icommit = (struct got_imsg_commit_object *)buf;
424 	memcpy(icommit->tree_id, commit->tree_id->sha1, sizeof(icommit->tree_id));
425 	icommit->author_len = author_len;
426 	icommit->author_time = commit->author_time;
427 	icommit->author_gmtoff = commit->author_gmtoff;
428 	icommit->committer_len = committer_len;
429 	icommit->committer_time = commit->committer_time;
430 	icommit->committer_gmtoff = commit->committer_gmtoff;
431 	icommit->logmsg_len = logmsg_len;
432 	icommit->nparents = commit->nparents;
433 
434 	len = sizeof(*icommit);
435 	memcpy(buf + len, commit->author, author_len);
436 	len += author_len;
437 	memcpy(buf + len, commit->committer, committer_len);
438 	len += committer_len;
439 	SIMPLEQ_FOREACH(qid, &commit->parent_ids, entry) {
440 		memcpy(buf + len, qid->id, SHA1_DIGEST_LENGTH);
441 		len += SHA1_DIGEST_LENGTH;
442 	}
443 
444 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT, 0, 0, -1, buf, len) == -1) {
445 		err = got_error_from_errno();
446 		goto done;
447 	}
448 
449 	if (logmsg_len == 0 ||
450 	    logmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
451 		err = flush_imsg(ibuf);
452 		if (err)
453 			goto done;
454 	}
455 	err = send_commit_logmsg(ibuf, commit, logmsg_len);
456 done:
457 	free(buf);
458 	return err;
459 }
460 
461 const struct got_error *
462 got_privsep_recv_commit(struct got_commit_object **commit, struct imsgbuf *ibuf)
463 {
464 	const struct got_error *err = NULL;
465 	struct imsg imsg;
466 	struct got_imsg_commit_object *icommit;
467 	size_t len, datalen;
468 	int i;
469 	const size_t min_datalen =
470 	    MIN(sizeof(struct got_imsg_error),
471 	    sizeof(struct got_imsg_commit_object));
472 
473 	*commit = NULL;
474 
475 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
476 	if (err)
477 		return err;
478 
479 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
480 	len = 0;
481 
482 	switch (imsg.hdr.type) {
483 	case GOT_IMSG_ERROR:
484 		err = recv_imsg_error(&imsg, datalen);
485 		break;
486 	case GOT_IMSG_COMMIT:
487 		if (datalen < sizeof(*icommit)) {
488 			err = got_error(GOT_ERR_PRIVSEP_LEN);
489 			break;
490 		}
491 		icommit = imsg.data;
492 		if (datalen != sizeof(*icommit) + icommit->author_len +
493 		    icommit->committer_len +
494 		    icommit->nparents * SHA1_DIGEST_LENGTH) {
495 			err = got_error(GOT_ERR_PRIVSEP_LEN);
496 			break;
497 		}
498 		if (icommit->nparents < 0) {
499 			err = got_error(GOT_ERR_PRIVSEP_LEN);
500 			break;
501 		}
502 		len += sizeof(*icommit);
503 
504 		*commit = got_object_commit_alloc_partial();
505 		if (*commit == NULL) {
506 			err = got_error_from_errno();
507 			break;
508 		}
509 
510 		memcpy((*commit)->tree_id->sha1, icommit->tree_id,
511 		    SHA1_DIGEST_LENGTH);
512 		(*commit)->author_time = icommit->author_time;
513 		(*commit)->author_gmtoff = icommit->author_gmtoff;
514 		(*commit)->committer_time = icommit->committer_time;
515 		(*commit)->committer_gmtoff = icommit->committer_gmtoff;
516 
517 		if (icommit->author_len == 0) {
518 			(*commit)->author = strdup("");
519 			if ((*commit)->author == NULL) {
520 				err = got_error_from_errno();
521 				break;
522 			}
523 		} else {
524 			(*commit)->author = malloc(icommit->author_len + 1);
525 			if ((*commit)->author == NULL) {
526 				err = got_error_from_errno();
527 				break;
528 			}
529 			memcpy((*commit)->author, imsg.data + len,
530 			    icommit->author_len);
531 			(*commit)->author[icommit->author_len] = '\0';
532 		}
533 		len += icommit->author_len;
534 
535 		if (icommit->committer_len == 0) {
536 			(*commit)->committer = strdup("");
537 			if ((*commit)->committer == NULL) {
538 				err = got_error_from_errno();
539 				break;
540 			}
541 		} else {
542 			(*commit)->committer =
543 			    malloc(icommit->committer_len + 1);
544 			if ((*commit)->committer == NULL) {
545 				err = got_error_from_errno();
546 				break;
547 			}
548 			memcpy((*commit)->committer, imsg.data + len,
549 			    icommit->committer_len);
550 			(*commit)->committer[icommit->committer_len] = '\0';
551 		}
552 		len += icommit->committer_len;
553 
554 		if (icommit->logmsg_len == 0) {
555 			(*commit)->logmsg = strdup("");
556 			if ((*commit)->logmsg == NULL) {
557 				err = got_error_from_errno();
558 				break;
559 			}
560 		} else {
561 			size_t offset = 0, remain = icommit->logmsg_len;
562 
563 			(*commit)->logmsg = malloc(icommit->logmsg_len + 1);
564 			if ((*commit)->logmsg == NULL) {
565 				err = got_error_from_errno();
566 				break;
567 			}
568 			while (remain > 0) {
569 				struct imsg imsg_log;
570 				size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
571 				    remain);
572 
573 				err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
574 				if (err)
575 					return err;
576 
577 				if (imsg_log.hdr.type != GOT_IMSG_COMMIT_LOGMSG)
578 					return got_error(GOT_ERR_PRIVSEP_MSG);
579 
580 				memcpy((*commit)->logmsg + offset,
581 				    imsg_log.data, n);
582 				imsg_free(&imsg_log);
583 				offset += n;
584 				remain -= n;
585 			}
586 			(*commit)->logmsg[icommit->logmsg_len] = '\0';
587 		}
588 
589 		for (i = 0; i < icommit->nparents; i++) {
590 			struct got_object_qid *qid;
591 
592 			err = got_object_qid_alloc_partial(&qid);
593 			if (err)
594 				break;
595 			memcpy(qid->id, imsg.data + len +
596 			    i * SHA1_DIGEST_LENGTH, sizeof(*qid->id));
597 			SIMPLEQ_INSERT_TAIL(&(*commit)->parent_ids, qid, entry);
598 			(*commit)->nparents++;
599 		}
600 		break;
601 	default:
602 		err = got_error(GOT_ERR_PRIVSEP_MSG);
603 		break;
604 	}
605 
606 	imsg_free(&imsg);
607 
608 	return err;
609 }
610 
611 const struct got_error *
612 got_privsep_send_tree(struct imsgbuf *ibuf, struct got_tree_object *tree)
613 {
614 	const struct got_error *err = NULL;
615 	struct got_imsg_tree_object itree;
616 	struct got_tree_entry *te;
617 	size_t totlen;
618 	int nimsg; /* number of imsg queued in ibuf */
619 
620 	itree.nentries = tree->entries.nentries;
621 	if (imsg_compose(ibuf, GOT_IMSG_TREE, 0, 0, -1, &itree, sizeof(itree))
622 	    == -1)
623 		return got_error_from_errno();
624 
625 	totlen = sizeof(itree);
626 	nimsg = 1;
627 	SIMPLEQ_FOREACH(te, &tree->entries.head, entry) {
628 		struct got_imsg_tree_entry *ite;
629 		uint8_t *buf = NULL;
630 		size_t len = sizeof(*ite) + strlen(te->name);
631 
632 		if (len > MAX_IMSGSIZE)
633 			return got_error(GOT_ERR_NO_SPACE);
634 
635 		nimsg++;
636 		if (totlen + len >= MAX_IMSGSIZE - (IMSG_HEADER_SIZE * nimsg)) {
637 			err = flush_imsg(ibuf);
638 			if (err)
639 				return err;
640 			nimsg = 0;
641 		}
642 
643 		buf = malloc(len);
644 		if (buf == NULL)
645 			return got_error_from_errno();
646 
647 		ite = (struct got_imsg_tree_entry *)buf;
648 		memcpy(ite->id, te->id->sha1, sizeof(ite->id));
649 		ite->mode = te->mode;
650 		memcpy(buf + sizeof(*ite), te->name, strlen(te->name));
651 
652 		if (imsg_compose(ibuf, GOT_IMSG_TREE_ENTRY, 0, 0, -1,
653 		    buf, len) == -1)
654 			err = got_error_from_errno();
655 		free(buf);
656 		if (err)
657 			return err;
658 		totlen += len;
659 	}
660 
661 	return flush_imsg(ibuf);
662 }
663 
664 const struct got_error *
665 got_privsep_recv_tree(struct got_tree_object **tree, struct imsgbuf *ibuf)
666 {
667 	const struct got_error *err = NULL;
668 	const size_t min_datalen =
669 	    MIN(sizeof(struct got_imsg_error),
670 	    sizeof(struct got_imsg_tree_object));
671 	struct got_imsg_tree_object *itree;
672 	int nentries = 0;
673 
674 	*tree = NULL;
675 get_more:
676 	err = read_imsg(ibuf);
677 	if (err)
678 		goto done;
679 
680 	while (1) {
681 		struct imsg imsg;
682 		size_t n;
683 		size_t datalen;
684 		struct got_imsg_tree_entry *ite;
685 		struct got_tree_entry *te = NULL;
686 
687 		n = imsg_get(ibuf, &imsg);
688 		if (n == 0) {
689 			if (*tree && (*tree)->entries.nentries != nentries)
690 				goto get_more;
691 			break;
692 		}
693 
694 		if (imsg.hdr.len < IMSG_HEADER_SIZE + min_datalen)
695 			return got_error(GOT_ERR_PRIVSEP_LEN);
696 
697 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
698 
699 		switch (imsg.hdr.type) {
700 		case GOT_IMSG_ERROR:
701 			err = recv_imsg_error(&imsg, datalen);
702 			break;
703 		case GOT_IMSG_TREE:
704 			/* This message should only appear once. */
705 			if (*tree != NULL) {
706 				err = got_error(GOT_ERR_PRIVSEP_MSG);
707 				break;
708 			}
709 			if (datalen != sizeof(*itree)) {
710 				err = got_error(GOT_ERR_PRIVSEP_LEN);
711 				break;
712 			}
713 			itree = imsg.data;
714 			*tree = malloc(sizeof(**tree));
715 			if (*tree == NULL) {
716 				err = got_error_from_errno();
717 				break;
718 			}
719 			(*tree)->entries.nentries = itree->nentries;
720 			SIMPLEQ_INIT(&(*tree)->entries.head);
721 			(*tree)->refcnt = 0;
722 			break;
723 		case GOT_IMSG_TREE_ENTRY:
724 			/* This message should be preceeded by GOT_IMSG_TREE. */
725 			if (*tree == NULL) {
726 				err = got_error(GOT_ERR_PRIVSEP_MSG);
727 				break;
728 			}
729 			if (datalen < sizeof(*ite) || datalen > MAX_IMSGSIZE) {
730 				err = got_error(GOT_ERR_PRIVSEP_LEN);
731 				break;
732 			}
733 
734 			/* Remaining data contains the entry's name. */
735 			datalen -= sizeof(*ite);
736 			if (datalen == 0 || datalen > MAX_IMSGSIZE) {
737 				err = got_error(GOT_ERR_PRIVSEP_LEN);
738 				break;
739 			}
740 			ite = imsg.data;
741 
742 			te = got_alloc_tree_entry_partial();
743 			if (te == NULL) {
744 				err = got_error_from_errno();
745 				break;
746 			}
747 			te->name = malloc(datalen + 1);
748 			if (te->name == NULL) {
749 				free(te);
750 				err = got_error_from_errno();
751 				break;
752 			}
753 			memcpy(te->name, imsg.data + sizeof(*ite), datalen);
754 			te->name[datalen] = '\0';
755 
756 			memcpy(te->id->sha1, ite->id, SHA1_DIGEST_LENGTH);
757 			te->mode = ite->mode;
758 			SIMPLEQ_INSERT_TAIL(&(*tree)->entries.head, te, entry);
759 			nentries++;
760 			break;
761 		default:
762 			err = got_error(GOT_ERR_PRIVSEP_MSG);
763 			break;
764 		}
765 
766 		imsg_free(&imsg);
767 	}
768 done:
769 	if (*tree && (*tree)->entries.nentries != nentries) {
770 		if (err == NULL)
771 			err = got_error(GOT_ERR_PRIVSEP_LEN);
772 		got_object_tree_close(*tree);
773 		*tree = NULL;
774 	}
775 
776 	return err;
777 }
778 
779 const struct got_error *
780 got_privsep_send_blob(struct imsgbuf *ibuf, size_t size)
781 {
782 	struct got_imsg_blob iblob;
783 
784 	iblob.size = size;
785 	/* Data has already been written to file descriptor. */
786 
787 	if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, &iblob, sizeof(iblob))
788 	    == -1)
789 		return got_error_from_errno();
790 
791 	return flush_imsg(ibuf);
792 }
793 
794 const struct got_error *
795 got_privsep_recv_blob(size_t *size, struct imsgbuf *ibuf)
796 {
797 	const struct got_error *err = NULL;
798 	struct imsg imsg;
799 	struct got_imsg_blob *iblob;
800 	size_t datalen;
801 
802 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
803 	if (err)
804 		return err;
805 
806 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
807 
808 	switch (imsg.hdr.type) {
809 	case GOT_IMSG_ERROR:
810 		err = recv_imsg_error(&imsg, datalen);
811 		break;
812 	case GOT_IMSG_BLOB:
813 		if (datalen != sizeof(*iblob)) {
814 			err = got_error(GOT_ERR_PRIVSEP_LEN);
815 			break;
816 		}
817 		iblob = imsg.data;
818 		*size = iblob->size;
819 		/* Data has been written to file descriptor. */
820 		break;
821 	default:
822 		err = got_error(GOT_ERR_PRIVSEP_MSG);
823 		break;
824 	}
825 
826 	imsg_free(&imsg);
827 
828 	return err;
829 }
830 
831 const struct got_error *
832 got_privsep_init_pack_child(struct imsgbuf *ibuf, struct got_pack *pack,
833     struct got_packidx *packidx)
834 {
835 	struct got_imsg_packidx ipackidx;
836 	struct got_imsg_pack ipack;
837 	int fd;
838 
839 	ipackidx.len = packidx->len;
840 	fd = dup(packidx->fd);
841 	if (fd == -1)
842 		return got_error_from_errno();
843 
844 	if (imsg_compose(ibuf, GOT_IMSG_PACKIDX, 0, 0, fd, &ipackidx,
845 	    sizeof(ipackidx)) == -1)
846 		return got_error_from_errno();
847 
848 	if (strlcpy(ipack.path_packfile, pack->path_packfile,
849 	    sizeof(ipack.path_packfile)) >= sizeof(ipack.path_packfile))
850 		return got_error(GOT_ERR_NO_SPACE);
851 	ipack.filesize = pack->filesize;
852 
853 	fd = dup(pack->fd);
854 	if (fd == -1)
855 		return got_error_from_errno();
856 
857 	if (imsg_compose(ibuf, GOT_IMSG_PACK, 0, 0, fd, &ipack, sizeof(ipack))
858 	    == -1)
859 		return got_error_from_errno();
860 
861 	return flush_imsg(ibuf);
862 }
863 
864 const struct got_error *
865 got_privsep_send_packed_obj_req(struct imsgbuf *ibuf, int idx,
866     struct got_object_id *id)
867 {
868 	struct got_imsg_packed_object iobj;
869 
870 	iobj.idx = idx;
871 	memcpy(iobj.id, id->sha1, sizeof(iobj.id));
872 
873 	if (imsg_compose(ibuf, GOT_IMSG_PACKED_OBJECT_REQUEST, 0, 0, -1,
874 	    &iobj, sizeof(iobj)) == -1)
875 		return got_error_from_errno();
876 
877 	return flush_imsg(ibuf);
878 }