1 /*
2  * Copyright (c) 2018, 2019, 2020 Stefan Sperling <stsp@openbsd.org>
3  * Copyright (c) 2020 Ori Bernstein <ori@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include <sys/types.h>
19 #include <sys/queue.h>
20 #include <sys/uio.h>
21 #include <sys/wait.h>
22 
23 #include <ctype.h>
24 #include <limits.h>
25 #include <signal.h>
26 #include <stdio.h>
27 #include <stdlib.h>
28 #include <string.h>
29 #include <errno.h>
30 #include <stdint.h>
31 #include <poll.h>
32 #include <imsg.h>
33 #include <sha1.h>
34 #include <unistd.h>
35 #include <zlib.h>
36 #include <time.h>
37 
38 #include "got_object.h"
39 #include "got_error.h"
40 #include "got_path.h"
41 #include "got_repository.h"
42 
43 #include "got_lib_sha1.h"
44 #include "got_lib_delta.h"
45 #include "got_lib_inflate.h"
46 #include "got_lib_object.h"
47 #include "got_lib_object_parse.h"
48 #include "got_lib_privsep.h"
49 #include "got_lib_pack.h"
50 
51 #include "got_privsep.h"
52 
53 #ifndef MIN
54 #define	MIN(_a,_b) ((_a) < (_b) ? (_a) : (_b))
55 #endif
56 
57 #ifndef nitems
58 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
59 #endif
60 
61 static const struct got_error *
62 poll_fd(int fd, int events, int timeout)
63 {
64 	struct pollfd pfd[1];
65 	struct timespec ts;
66 	sigset_t sigset;
67 	int n;
68 
69 	pfd[0].fd = fd;
70 	pfd[0].events = events;
71 
72 	ts.tv_sec = timeout;
73 	ts.tv_nsec = 0;
74 
75 	if (sigemptyset(&sigset) == -1)
76 		return got_error_from_errno("sigemptyset");
77 	if (sigaddset(&sigset, SIGWINCH) == -1)
78 		return got_error_from_errno("sigaddset");
79 
80 	n = ppoll(pfd, 1, timeout == INFTIM ? NULL : &ts, &sigset);
81 	if (n == -1)
82 		return got_error_from_errno("ppoll");
83 	if (n == 0)
84 		return got_error(GOT_ERR_TIMEOUT);
85 	if (pfd[0].revents & (POLLERR | POLLNVAL))
86 		return got_error_from_errno("poll error");
87 	if (pfd[0].revents & (events | POLLHUP))
88 		return NULL;
89 
90 	return got_error(GOT_ERR_INTERRUPT);
91 }
92 
93 static const struct got_error *
94 read_imsg(struct imsgbuf *ibuf)
95 {
96 	const struct got_error *err;
97 	size_t n;
98 
99 	err = poll_fd(ibuf->fd, POLLIN, INFTIM);
100 	if (err)
101 		return err;
102 
103 	n = imsg_read(ibuf);
104 	if (n == -1) {
105 		if (errno == EAGAIN) /* Could be a file-descriptor leak. */
106 			return got_error(GOT_ERR_PRIVSEP_NO_FD);
107 		return got_error(GOT_ERR_PRIVSEP_READ);
108 	}
109 	if (n == 0)
110 		return got_error(GOT_ERR_PRIVSEP_PIPE);
111 
112 	return NULL;
113 }
114 
115 const struct got_error *
116 got_privsep_wait_for_child(pid_t pid)
117 {
118 	int child_status;
119 
120 	if (waitpid(pid, &child_status, 0) == -1)
121 		return got_error_from_errno("waitpid");
122 
123 	if (!WIFEXITED(child_status))
124 		return got_error(GOT_ERR_PRIVSEP_DIED);
125 
126 	if (WEXITSTATUS(child_status) != 0)
127 		return got_error(GOT_ERR_PRIVSEP_EXIT);
128 
129 	return NULL;
130 }
131 
132 static const struct got_error *
133 recv_imsg_error(struct imsg *imsg, size_t datalen)
134 {
135 	struct got_imsg_error *ierr;
136 
137 	if (datalen != sizeof(*ierr))
138 		return got_error(GOT_ERR_PRIVSEP_LEN);
139 
140 	ierr = imsg->data;
141 	if (ierr->code == GOT_ERR_ERRNO) {
142 		static struct got_error serr;
143 		serr.code = GOT_ERR_ERRNO;
144 		serr.msg = strerror(ierr->errno_code);
145 		return &serr;
146 	}
147 
148 	return got_error(ierr->code);
149 }
150 
151 const struct got_error *
152 got_privsep_recv_imsg(struct imsg *imsg, struct imsgbuf *ibuf,
153     size_t min_datalen)
154 {
155 	const struct got_error *err;
156 	ssize_t n;
157 
158 	n = imsg_get(ibuf, imsg);
159 	if (n == -1)
160 		return got_error_from_errno("imsg_get");
161 
162 	while (n == 0) {
163 		err = read_imsg(ibuf);
164 		if (err)
165 			return err;
166 		n = imsg_get(ibuf, imsg);
167 		if (n == -1)
168 			return got_error_from_errno("imsg_get");
169 	}
170 
171 	if (imsg->hdr.len < IMSG_HEADER_SIZE + min_datalen)
172 		return got_error(GOT_ERR_PRIVSEP_LEN);
173 
174 	if (imsg->hdr.type == GOT_IMSG_ERROR) {
175 		size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
176 		return recv_imsg_error(imsg, datalen);
177 	}
178 
179 	return NULL;
180 }
181 
182 /* Attempt to send an error in an imsg. Complain on stderr as a last resort. */
183 void
184 got_privsep_send_error(struct imsgbuf *ibuf, const struct got_error *err)
185 {
186 	const struct got_error *poll_err;
187 	struct got_imsg_error ierr;
188 	int ret;
189 
190 	ierr.code = err->code;
191 	if (err->code == GOT_ERR_ERRNO)
192 		ierr.errno_code = errno;
193 	else
194 		ierr.errno_code = 0;
195 	ret = imsg_compose(ibuf, GOT_IMSG_ERROR, 0, 0, -1, &ierr, sizeof(ierr));
196 	if (ret == -1) {
197 		fprintf(stderr, "%s: error %d \"%s\": imsg_compose: %s\n",
198 		    getprogname(), err->code, err->msg, strerror(errno));
199 		return;
200 	}
201 
202 	poll_err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
203 	if (poll_err) {
204 		fprintf(stderr, "%s: error %d \"%s\": poll: %s\n",
205 		    getprogname(), err->code, err->msg, poll_err->msg);
206 		return;
207 	}
208 
209 	ret = imsg_flush(ibuf);
210 	if (ret == -1) {
211 		fprintf(stderr, "%s: error %d \"%s\": imsg_flush: %s\n",
212 		    getprogname(), err->code, err->msg, strerror(errno));
213 		imsg_clear(ibuf);
214 		return;
215 	}
216 }
217 
218 static const struct got_error *
219 flush_imsg(struct imsgbuf *ibuf)
220 {
221 	const struct got_error *err;
222 
223 	err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
224 	if (err)
225 		return err;
226 
227 	if (imsg_flush(ibuf) == -1) {
228 		imsg_clear(ibuf);
229 		return got_error_from_errno("imsg_flush");
230 	}
231 
232 	return NULL;
233 }
234 
235 const struct got_error *
236 got_privsep_flush_imsg(struct imsgbuf *ibuf)
237 {
238 	return flush_imsg(ibuf);
239 }
240 
241 const struct got_error *
242 got_privsep_send_stop(int fd)
243 {
244 	const struct got_error *err = NULL;
245 	struct imsgbuf ibuf;
246 
247 	imsg_init(&ibuf, fd);
248 
249 	if (imsg_compose(&ibuf, GOT_IMSG_STOP, 0, 0, -1, NULL, 0) == -1)
250 		return got_error_from_errno("imsg_compose STOP");
251 
252 	err = flush_imsg(&ibuf);
253 	return err;
254 }
255 
256 const struct got_error *
257 got_privsep_send_obj_req(struct imsgbuf *ibuf, int fd,
258     struct got_object_id *id)
259 {
260 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT_REQUEST, 0, 0, fd,
261 	    id, sizeof(*id)) == -1)
262 		return got_error_from_errno("imsg_compose OBJECT_REQUEST");
263 
264 	return flush_imsg(ibuf);
265 }
266 
267 const struct got_error *
268 got_privsep_send_raw_obj_req(struct imsgbuf *ibuf, int fd,
269     struct got_object_id *id)
270 {
271 	if (imsg_compose(ibuf, GOT_IMSG_RAW_OBJECT_REQUEST, 0, 0, fd,
272 	    id, sizeof(*id)) == -1)
273 		return got_error_from_errno("imsg_compose RAW_OBJECT_REQUEST");
274 
275 	return flush_imsg(ibuf);
276 }
277 
278 const struct got_error *
279 got_privsep_send_raw_obj_outfd(struct imsgbuf *ibuf, int outfd)
280 {
281 	const struct got_error *err = NULL;
282 
283 	if (imsg_compose(ibuf, GOT_IMSG_RAW_OBJECT_OUTFD, 0, 0, outfd, NULL, 0)
284 	    == -1) {
285 		err = got_error_from_errno("imsg_compose RAW_OBJECT_OUTFD");
286 		close(outfd);
287 		return err;
288 	}
289 
290 	return flush_imsg(ibuf);
291 }
292 
293 const struct got_error *
294 got_privsep_send_raw_obj(struct imsgbuf *ibuf, off_t size, size_t hdrlen,
295     uint8_t *data)
296 {
297 	const struct got_error *err = NULL;
298 	struct got_imsg_raw_obj iobj;
299 	size_t len = sizeof(iobj);
300 	struct ibuf *wbuf;
301 
302 	memset(&iobj, 0, sizeof(iobj));
303 	iobj.hdrlen = hdrlen;
304 	iobj.size = size;
305 
306 	if (data && size + hdrlen <= GOT_PRIVSEP_INLINE_OBJECT_DATA_MAX)
307 		len += (size_t)size + hdrlen;
308 
309 	wbuf = imsg_create(ibuf, GOT_IMSG_RAW_OBJECT, 0, 0, len);
310 	if (wbuf == NULL) {
311 		err = got_error_from_errno("imsg_create RAW_OBJECT");
312 		return err;
313 	}
314 
315 	if (imsg_add(wbuf, &iobj, sizeof(iobj)) == -1)
316 		return got_error_from_errno("imsg_add RAW_OBJECT");
317 
318 	if (data && size + hdrlen <= GOT_PRIVSEP_INLINE_OBJECT_DATA_MAX) {
319 		if (imsg_add(wbuf, data, size + hdrlen) == -1)
320 			return got_error_from_errno("imsg_add RAW_OBJECT");
321 	}
322 
323 	wbuf->fd = -1;
324 	imsg_close(ibuf, wbuf);
325 
326 	return flush_imsg(ibuf);
327 }
328 
329 const struct got_error *
330 got_privsep_recv_raw_obj(uint8_t **outbuf, off_t *size, size_t *hdrlen,
331     struct imsgbuf *ibuf)
332 {
333 	const struct got_error *err = NULL;
334 	struct imsg imsg;
335 	struct got_imsg_raw_obj *iobj;
336 	size_t datalen;
337 
338 	*outbuf = NULL;
339 
340 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
341 	if (err)
342 		return err;
343 
344 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
345 
346 	switch (imsg.hdr.type) {
347 	case GOT_IMSG_RAW_OBJECT:
348 		if (datalen < sizeof(*iobj)) {
349 			err = got_error(GOT_ERR_PRIVSEP_LEN);
350 			break;
351 		}
352 		iobj = imsg.data;
353 		*size = iobj->size;
354 		*hdrlen = iobj->hdrlen;
355 
356 		if (datalen == sizeof(*iobj)) {
357 			/* Data has been written to file descriptor. */
358 			break;
359 		}
360 
361 		if (*size < 0 ||
362 		    *size + *hdrlen > GOT_PRIVSEP_INLINE_OBJECT_DATA_MAX) {
363 			err = got_error(GOT_ERR_PRIVSEP_LEN);
364 			break;
365 		}
366 
367 		*outbuf = malloc(*size + *hdrlen);
368 		if (*outbuf == NULL) {
369 			err = got_error_from_errno("malloc");
370 			break;
371 		}
372 		memcpy(*outbuf, imsg.data + sizeof(*iobj), *size + *hdrlen);
373 		break;
374 	default:
375 		err = got_error(GOT_ERR_PRIVSEP_MSG);
376 		break;
377 	}
378 
379 	imsg_free(&imsg);
380 
381 	return err;
382 }
383 
384 const struct got_error *
385 got_privsep_send_commit_req(struct imsgbuf *ibuf, int fd,
386     struct got_object_id *id, int pack_idx)
387 {
388 	const struct got_error *err = NULL;
389 	struct got_imsg_packed_object iobj;
390 	void *data;
391 	size_t len;
392 
393 	memset(&iobj, 0, sizeof(iobj));
394 	if (pack_idx != -1) { /* commit is packed */
395 		iobj.idx = pack_idx;
396 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
397 		data = &iobj;
398 		len = sizeof(iobj);
399 	} else {
400 		data = id;
401 		len = sizeof(*id);
402 	}
403 
404 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_REQUEST, 0, 0, fd, data, len)
405 	    == -1) {
406 		err = got_error_from_errno("imsg_compose COMMIT_REQUEST");
407 		close(fd);
408 		return err;
409 	}
410 
411 	return flush_imsg(ibuf);
412 }
413 
414 const struct got_error *
415 got_privsep_send_tree_req(struct imsgbuf *ibuf, int fd,
416     struct got_object_id *id, int pack_idx)
417 {
418 	struct ibuf *wbuf;
419 	size_t len;
420 
421 	if (pack_idx != -1)
422 		len = sizeof(struct got_imsg_packed_object);
423 	else
424 		len = sizeof(*id);
425 
426 	wbuf = imsg_create(ibuf, GOT_IMSG_TREE_REQUEST, 0, 0, len);
427 	if (wbuf == NULL)
428 		return got_error_from_errno("imsg_create TREE_REQUEST");
429 
430 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1)
431 		return got_error_from_errno("imsg_add TREE_REQUEST");
432 
433 	if (pack_idx != -1) { /* tree is packed */
434 		if (imsg_add(wbuf, &pack_idx, sizeof(pack_idx)) == -1)
435 			return got_error_from_errno("imsg_add TREE_REQUEST");
436 	}
437 
438 	wbuf->fd = fd;
439 	imsg_close(ibuf, wbuf);
440 
441 	return flush_imsg(ibuf);
442 }
443 
444 const struct got_error *
445 got_privsep_send_tag_req(struct imsgbuf *ibuf, int fd,
446     struct got_object_id *id, int pack_idx)
447 {
448 	struct got_imsg_packed_object iobj;
449 	void *data;
450 	size_t len;
451 
452 	memset(&iobj, 0, sizeof(iobj));
453 	if (pack_idx != -1) { /* tag is packed */
454 		iobj.idx = pack_idx;
455 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
456 		data = &iobj;
457 		len = sizeof(iobj);
458 	} else {
459 		data = id;
460 		len = sizeof(*id);
461 	}
462 
463 	if (imsg_compose(ibuf, GOT_IMSG_TAG_REQUEST, 0, 0, fd, data, len)
464 	    == -1)
465 		return got_error_from_errno("imsg_compose TAG_REQUEST");
466 
467 	return flush_imsg(ibuf);
468 }
469 
470 const struct got_error *
471 got_privsep_send_blob_req(struct imsgbuf *ibuf, int infd,
472     struct got_object_id *id, int pack_idx)
473 {
474 	const struct got_error *err = NULL;
475 	struct got_imsg_packed_object iobj;
476 	void *data;
477 	size_t len;
478 
479 	memset(&iobj, 0, sizeof(iobj));
480 	if (pack_idx != -1) { /* blob is packed */
481 		iobj.idx = pack_idx;
482 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
483 		data = &iobj;
484 		len = sizeof(iobj);
485 	} else {
486 		data = id;
487 		len = sizeof(*id);
488 	}
489 
490 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_REQUEST, 0, 0, infd, data, len)
491 	    == -1) {
492 		err = got_error_from_errno("imsg_compose BLOB_REQUEST");
493 		close(infd);
494 		return err;
495 	}
496 
497 	return flush_imsg(ibuf);
498 }
499 
500 const struct got_error *
501 got_privsep_send_blob_outfd(struct imsgbuf *ibuf, int outfd)
502 {
503 	const struct got_error *err = NULL;
504 
505 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_OUTFD, 0, 0, outfd, NULL, 0)
506 	    == -1) {
507 		err = got_error_from_errno("imsg_compose BLOB_OUTFD");
508 		close(outfd);
509 		return err;
510 	}
511 
512 	return flush_imsg(ibuf);
513 }
514 
515 static const struct got_error *
516 send_fd(struct imsgbuf *ibuf, int imsg_code, int fd)
517 {
518 	const struct got_error *err = NULL;
519 
520 	if (imsg_compose(ibuf, imsg_code, 0, 0, fd, NULL, 0) == -1) {
521 		err = got_error_from_errno("imsg_compose TMPFD");
522 		close(fd);
523 		return err;
524 	}
525 
526 	return flush_imsg(ibuf);
527 }
528 
529 const struct got_error *
530 got_privsep_send_tmpfd(struct imsgbuf *ibuf, int fd)
531 {
532 	return send_fd(ibuf, GOT_IMSG_TMPFD, fd);
533 }
534 
535 const struct got_error *
536 got_privsep_send_obj(struct imsgbuf *ibuf, struct got_object *obj)
537 {
538 	struct got_imsg_object iobj;
539 
540 	memset(&iobj, 0, sizeof(iobj));
541 
542 	memcpy(iobj.id, obj->id.sha1, sizeof(iobj.id));
543 	iobj.type = obj->type;
544 	iobj.flags = obj->flags;
545 	iobj.hdrlen = obj->hdrlen;
546 	iobj.size = obj->size;
547 	if (iobj.flags & GOT_OBJ_FLAG_PACKED) {
548 		iobj.pack_offset = obj->pack_offset;
549 		iobj.pack_idx = obj->pack_idx;
550 	}
551 
552 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT, 0, 0, -1, &iobj, sizeof(iobj))
553 	    == -1)
554 		return got_error_from_errno("imsg_compose OBJECT");
555 
556 	return flush_imsg(ibuf);
557 }
558 
559 const struct got_error *
560 got_privsep_send_fetch_req(struct imsgbuf *ibuf, int fd,
561     struct got_pathlist_head *have_refs, int fetch_all_branches,
562     struct got_pathlist_head *wanted_branches,
563     struct got_pathlist_head *wanted_refs, int list_refs_only, int verbosity)
564 {
565 	const struct got_error *err = NULL;
566 	struct ibuf *wbuf;
567 	size_t len;
568 	struct got_pathlist_entry *pe;
569 	struct got_imsg_fetch_request fetchreq;
570 
571 	memset(&fetchreq, 0, sizeof(fetchreq));
572 	fetchreq.fetch_all_branches = fetch_all_branches;
573 	fetchreq.list_refs_only = list_refs_only;
574 	fetchreq.verbosity = verbosity;
575 	TAILQ_FOREACH(pe, have_refs, entry)
576 		fetchreq.n_have_refs++;
577 	TAILQ_FOREACH(pe, wanted_branches, entry)
578 		fetchreq.n_wanted_branches++;
579 	TAILQ_FOREACH(pe, wanted_refs, entry)
580 		fetchreq.n_wanted_refs++;
581 	len = sizeof(struct got_imsg_fetch_request);
582 	if (len >= MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
583 		close(fd);
584 		return got_error(GOT_ERR_NO_SPACE);
585 	}
586 
587 	if (imsg_compose(ibuf, GOT_IMSG_FETCH_REQUEST, 0, 0, fd,
588 	    &fetchreq, sizeof(fetchreq)) == -1)
589 		return got_error_from_errno(
590 		    "imsg_compose FETCH_SERVER_PROGRESS");
591 
592 	err = flush_imsg(ibuf);
593 	if (err) {
594 		close(fd);
595 		return err;
596 	}
597 	fd = -1;
598 
599 	TAILQ_FOREACH(pe, have_refs, entry) {
600 		const char *name = pe->path;
601 		size_t name_len = pe->path_len;
602 		struct got_object_id *id = pe->data;
603 
604 		len = sizeof(struct got_imsg_fetch_have_ref) + name_len;
605 		wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_HAVE_REF, 0, 0, len);
606 		if (wbuf == NULL)
607 			return got_error_from_errno("imsg_create FETCH_HAVE_REF");
608 
609 		/* Keep in sync with struct got_imsg_fetch_have_ref! */
610 		if (imsg_add(wbuf, id->sha1, sizeof(id->sha1)) == -1)
611 			return got_error_from_errno("imsg_add FETCH_HAVE_REF");
612 		if (imsg_add(wbuf, &name_len, sizeof(name_len)) == -1)
613 			return got_error_from_errno("imsg_add FETCH_HAVE_REF");
614 		if (imsg_add(wbuf, name, name_len) == -1)
615 			return got_error_from_errno("imsg_add FETCH_HAVE_REF");
616 
617 		wbuf->fd = -1;
618 		imsg_close(ibuf, wbuf);
619 		err = flush_imsg(ibuf);
620 		if (err)
621 			return err;
622 	}
623 
624 	TAILQ_FOREACH(pe, wanted_branches, entry) {
625 		const char *name = pe->path;
626 		size_t name_len = pe->path_len;
627 
628 		len = sizeof(struct got_imsg_fetch_wanted_branch) + name_len;
629 		wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_WANTED_BRANCH, 0, 0,
630 		    len);
631 		if (wbuf == NULL)
632 			return got_error_from_errno(
633 			    "imsg_create FETCH_WANTED_BRANCH");
634 
635 		/* Keep in sync with struct got_imsg_fetch_wanted_branch! */
636 		if (imsg_add(wbuf, &name_len, sizeof(name_len)) == -1)
637 			return got_error_from_errno(
638 			    "imsg_add FETCH_WANTED_BRANCH");
639 		if (imsg_add(wbuf, name, name_len) == -1)
640 			return got_error_from_errno(
641 			    "imsg_add FETCH_WANTED_BRANCH");
642 
643 		wbuf->fd = -1;
644 		imsg_close(ibuf, wbuf);
645 		err = flush_imsg(ibuf);
646 		if (err)
647 			return err;
648 	}
649 
650 	TAILQ_FOREACH(pe, wanted_refs, entry) {
651 		const char *name = pe->path;
652 		size_t name_len = pe->path_len;
653 
654 		len = sizeof(struct got_imsg_fetch_wanted_ref) + name_len;
655 		wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_WANTED_REF, 0, 0,
656 		    len);
657 		if (wbuf == NULL)
658 			return got_error_from_errno(
659 			    "imsg_create FETCH_WANTED_REF");
660 
661 		/* Keep in sync with struct got_imsg_fetch_wanted_ref! */
662 		if (imsg_add(wbuf, &name_len, sizeof(name_len)) == -1)
663 			return got_error_from_errno(
664 			    "imsg_add FETCH_WANTED_REF");
665 		if (imsg_add(wbuf, name, name_len) == -1)
666 			return got_error_from_errno(
667 			    "imsg_add FETCH_WANTED_REF");
668 
669 		wbuf->fd = -1;
670 		imsg_close(ibuf, wbuf);
671 		err = flush_imsg(ibuf);
672 		if (err)
673 			return err;
674 	}
675 
676 
677 	return NULL;
678 
679 }
680 
681 const struct got_error *
682 got_privsep_send_fetch_outfd(struct imsgbuf *ibuf, int fd)
683 {
684 	return send_fd(ibuf, GOT_IMSG_FETCH_OUTFD, fd);
685 }
686 
687 const struct got_error *
688 got_privsep_recv_fetch_progress(int *done, struct got_object_id **id,
689     char **refname, struct got_pathlist_head *symrefs, char **server_progress,
690     off_t *packfile_size, uint8_t *pack_sha1, struct imsgbuf *ibuf)
691 {
692 	const struct got_error *err = NULL;
693 	struct imsg imsg;
694 	size_t datalen;
695 	struct got_imsg_fetch_symrefs *isymrefs = NULL;
696 	size_t n, remain;
697 	off_t off;
698 	int i;
699 
700 	*done = 0;
701 	*id = NULL;
702 	*refname = NULL;
703 	*server_progress = NULL;
704 	*packfile_size = 0;
705 	memset(pack_sha1, 0, SHA1_DIGEST_LENGTH);
706 
707 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
708 	if (err)
709 		return err;
710 
711 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
712 	switch (imsg.hdr.type) {
713 	case GOT_IMSG_ERROR:
714 		err = recv_imsg_error(&imsg, datalen);
715 		break;
716 	case GOT_IMSG_FETCH_SYMREFS:
717 		if (datalen < sizeof(*isymrefs)) {
718 			err = got_error(GOT_ERR_PRIVSEP_LEN);
719 			break;
720 		}
721 		if (isymrefs != NULL) {
722 			err = got_error(GOT_ERR_PRIVSEP_MSG);
723 			break;
724 		}
725 		isymrefs = (struct got_imsg_fetch_symrefs *)imsg.data;
726 		off = sizeof(*isymrefs);
727 		remain = datalen - off;
728 		for (n = 0; n < isymrefs->nsymrefs; n++) {
729 			struct got_imsg_fetch_symref *s;
730 			char *name, *target;
731 			if (remain < sizeof(struct got_imsg_fetch_symref)) {
732 				err = got_error(GOT_ERR_PRIVSEP_LEN);
733 				goto done;
734 			}
735 			s = (struct got_imsg_fetch_symref *)(imsg.data + off);
736 			off += sizeof(*s);
737 			remain -= sizeof(*s);
738 			if (remain < s->name_len) {
739 				err = got_error(GOT_ERR_PRIVSEP_LEN);
740 				goto done;
741 			}
742 			name = strndup(imsg.data + off, s->name_len);
743 			if (name == NULL) {
744 				err = got_error_from_errno("strndup");
745 				goto done;
746 			}
747 			off += s->name_len;
748 			remain -= s->name_len;
749 			if (remain < s->target_len) {
750 				err = got_error(GOT_ERR_PRIVSEP_LEN);
751 				free(name);
752 				goto done;
753 			}
754 			target = strndup(imsg.data + off, s->target_len);
755 			if (target == NULL) {
756 				err = got_error_from_errno("strndup");
757 				free(name);
758 				goto done;
759 			}
760 			off += s->target_len;
761 			remain -= s->target_len;
762 			err = got_pathlist_append(symrefs, name, target);
763 			if (err) {
764 				free(name);
765 				free(target);
766 				goto done;
767 			}
768 		}
769 		break;
770 	case GOT_IMSG_FETCH_REF:
771 		if (datalen <= SHA1_DIGEST_LENGTH) {
772 			err = got_error(GOT_ERR_PRIVSEP_MSG);
773 			break;
774 		}
775 		*id = malloc(sizeof(**id));
776 		if (*id == NULL) {
777 			err = got_error_from_errno("malloc");
778 			break;
779 		}
780 		memcpy((*id)->sha1, imsg.data, SHA1_DIGEST_LENGTH);
781 		*refname = strndup(imsg.data + SHA1_DIGEST_LENGTH,
782 		    datalen - SHA1_DIGEST_LENGTH);
783 		if (*refname == NULL) {
784 			err = got_error_from_errno("strndup");
785 			break;
786 		}
787 		break;
788 	case GOT_IMSG_FETCH_SERVER_PROGRESS:
789 		if (datalen == 0) {
790 			err = got_error(GOT_ERR_PRIVSEP_LEN);
791 			break;
792 		}
793 		*server_progress = strndup(imsg.data, datalen);
794 		if (*server_progress == NULL) {
795 			err = got_error_from_errno("strndup");
796 			break;
797 		}
798 		for (i = 0; i < datalen; i++) {
799 			if (!isprint((unsigned char)(*server_progress)[i]) &&
800 			    !isspace((unsigned char)(*server_progress)[i])) {
801 				err = got_error(GOT_ERR_PRIVSEP_MSG);
802 				free(*server_progress);
803 				*server_progress = NULL;
804 				goto done;
805 			}
806 		}
807 		break;
808 	case GOT_IMSG_FETCH_DOWNLOAD_PROGRESS:
809 		if (datalen < sizeof(*packfile_size)) {
810 			err = got_error(GOT_ERR_PRIVSEP_MSG);
811 			break;
812 		}
813 		memcpy(packfile_size, imsg.data, sizeof(*packfile_size));
814 		break;
815 	case GOT_IMSG_FETCH_DONE:
816 		if (datalen != SHA1_DIGEST_LENGTH) {
817 			err = got_error(GOT_ERR_PRIVSEP_MSG);
818 			break;
819 		}
820 		memcpy(pack_sha1, imsg.data, SHA1_DIGEST_LENGTH);
821 		*done = 1;
822 		break;
823 	default:
824 		err = got_error(GOT_ERR_PRIVSEP_MSG);
825 		break;
826 	}
827 done:
828 	if (err) {
829 		free(*id);
830 		*id = NULL;
831 		free(*refname);
832 		*refname = NULL;
833 	}
834 	imsg_free(&imsg);
835 	return err;
836 }
837 
838 static const struct got_error *
839 send_send_ref(const char *name, size_t name_len, struct got_object_id *id,
840     int delete, struct imsgbuf *ibuf)
841 {
842 	size_t len;
843 	struct ibuf *wbuf;
844 
845 	len = sizeof(struct got_imsg_send_ref) + name_len;
846 	wbuf = imsg_create(ibuf, GOT_IMSG_SEND_REF, 0, 0, len);
847 	if (wbuf == NULL)
848 		return got_error_from_errno("imsg_create SEND_REF");
849 
850 	/* Keep in sync with struct got_imsg_send_ref! */
851 	if (imsg_add(wbuf, id->sha1, sizeof(id->sha1)) == -1)
852 		return got_error_from_errno("imsg_add SEND_REF");
853 	if (imsg_add(wbuf, &delete, sizeof(delete)) == -1)
854 		return got_error_from_errno("imsg_add SEND_REF");
855 	if (imsg_add(wbuf, &name_len, sizeof(name_len)) == -1)
856 		return got_error_from_errno("imsg_add SEND_REF");
857 	if (imsg_add(wbuf, name, name_len) == -1)
858 		return got_error_from_errno("imsg_add SEND_REF");
859 
860 	wbuf->fd = -1;
861 	imsg_close(ibuf, wbuf);
862 	return flush_imsg(ibuf);
863 }
864 
865 const struct got_error *
866 got_privsep_send_send_req(struct imsgbuf *ibuf, int fd,
867     struct got_pathlist_head *have_refs,
868     struct got_pathlist_head *delete_refs,
869     int verbosity)
870 {
871 	const struct got_error *err = NULL;
872 	struct got_pathlist_entry *pe;
873 	struct got_imsg_send_request sendreq;
874 	struct got_object_id zero_id;
875 
876 	memset(&zero_id, 0, sizeof(zero_id));
877 	memset(&sendreq, 0, sizeof(sendreq));
878 	sendreq.verbosity = verbosity;
879 	TAILQ_FOREACH(pe, have_refs, entry)
880 		sendreq.nrefs++;
881 	TAILQ_FOREACH(pe, delete_refs, entry)
882 		sendreq.nrefs++;
883 	if (imsg_compose(ibuf, GOT_IMSG_SEND_REQUEST, 0, 0, fd,
884 	    &sendreq, sizeof(sendreq)) == -1) {
885 		err = got_error_from_errno(
886 		    "imsg_compose FETCH_SERVER_PROGRESS");
887 		goto done;
888 	}
889 
890 	err = flush_imsg(ibuf);
891 	if (err)
892 		goto done;
893 	fd = -1;
894 
895 	TAILQ_FOREACH(pe, have_refs, entry) {
896 		const char *name = pe->path;
897 		size_t name_len = pe->path_len;
898 		struct got_object_id *id = pe->data;
899 		err = send_send_ref(name, name_len, id, 0, ibuf);
900 		if (err)
901 			goto done;
902 	}
903 
904 	TAILQ_FOREACH(pe, delete_refs, entry) {
905 		const char *name = pe->path;
906 		size_t name_len = pe->path_len;
907 		err = send_send_ref(name, name_len, &zero_id, 1, ibuf);
908 		if (err)
909 			goto done;
910 	}
911 done:
912 	if (fd != -1 && close(fd) == -1 && err == NULL)
913 		err = got_error_from_errno("close");
914 	return err;
915 
916 }
917 
918 const struct got_error *
919 got_privsep_recv_send_remote_refs(struct got_pathlist_head *remote_refs,
920     struct imsgbuf *ibuf)
921 {
922 	const struct got_error *err = NULL;
923 	struct imsg imsg;
924 	size_t datalen;
925 	int done = 0;
926 	struct got_imsg_send_remote_ref iremote_ref;
927 	struct got_object_id *id = NULL;
928 	char *refname = NULL;
929 	struct got_pathlist_entry *new;
930 
931 	while (!done) {
932 		err = got_privsep_recv_imsg(&imsg, ibuf, 0);
933 		if (err)
934 			return err;
935 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
936 		switch (imsg.hdr.type) {
937 		case GOT_IMSG_ERROR:
938 			err = recv_imsg_error(&imsg, datalen);
939 			goto done;
940 		case GOT_IMSG_SEND_REMOTE_REF:
941 			if (datalen < sizeof(iremote_ref)) {
942 				err = got_error(GOT_ERR_PRIVSEP_MSG);
943 				goto done;
944 			}
945 			memcpy(&iremote_ref, imsg.data, sizeof(iremote_ref));
946 			if (datalen != sizeof(iremote_ref) +
947 			    iremote_ref.name_len) {
948 				err = got_error(GOT_ERR_PRIVSEP_MSG);
949 				goto done;
950 			}
951 			id = malloc(sizeof(*id));
952 			if (id == NULL) {
953 				err = got_error_from_errno("malloc");
954 				goto done;
955 			}
956 			memcpy(id->sha1, iremote_ref.id, SHA1_DIGEST_LENGTH);
957 			refname = strndup(imsg.data + sizeof(iremote_ref),
958 			    datalen - sizeof(iremote_ref));
959 			if (refname == NULL) {
960 				err = got_error_from_errno("strndup");
961 				goto done;
962 			}
963 			err = got_pathlist_insert(&new, remote_refs,
964 			    refname, id);
965 			if (err)
966 				goto done;
967 			if (new == NULL) { /* duplicate which wasn't inserted */
968 				free(id);
969 				free(refname);
970 			}
971 			id = NULL;
972 			refname = NULL;
973 			break;
974 		case GOT_IMSG_SEND_PACK_REQUEST:
975 			if (datalen != 0) {
976 				err = got_error(GOT_ERR_PRIVSEP_MSG);
977 				goto done;
978 			}
979 			/* got-send-pack is now waiting for a pack file. */
980 			done = 1;
981 			break;
982 		default:
983 			err = got_error(GOT_ERR_PRIVSEP_MSG);
984 			break;
985 		}
986 	}
987 done:
988 	free(id);
989 	free(refname);
990 	imsg_free(&imsg);
991 	return err;
992 }
993 
994 const struct got_error *
995 got_privsep_send_packfd(struct imsgbuf *ibuf, int fd)
996 {
997 	return send_fd(ibuf, GOT_IMSG_SEND_PACKFD, fd);
998 }
999 
1000 const struct got_error *
1001 got_privsep_recv_send_progress(int *done, off_t *bytes_sent,
1002     int *success, char **refname, struct imsgbuf *ibuf)
1003 {
1004 	const struct got_error *err = NULL;
1005 	struct imsg imsg;
1006 	size_t datalen;
1007 	struct got_imsg_send_ref_status iref_status;
1008 
1009 	/* Do not reset the current value of 'bytes_sent', it accumulates. */
1010 	*done = 0;
1011 	*success = 0;
1012 	*refname = NULL;
1013 
1014 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
1015 	if (err)
1016 		return err;
1017 
1018 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1019 	switch (imsg.hdr.type) {
1020 	case GOT_IMSG_ERROR:
1021 		err = recv_imsg_error(&imsg, datalen);
1022 		break;
1023 	case GOT_IMSG_SEND_UPLOAD_PROGRESS:
1024 		if (datalen < sizeof(*bytes_sent)) {
1025 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1026 			break;
1027 		}
1028 		memcpy(bytes_sent, imsg.data, sizeof(*bytes_sent));
1029 		break;
1030 	case GOT_IMSG_SEND_REF_STATUS:
1031 		if (datalen < sizeof(iref_status)) {
1032 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1033 			break;
1034 		}
1035 		memcpy(&iref_status, imsg.data, sizeof(iref_status));
1036 		if (datalen != sizeof(iref_status) + iref_status.name_len) {
1037 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1038 			break;
1039 		}
1040 		*success = iref_status.success;
1041 		*refname = strndup(imsg.data + sizeof(iref_status),
1042 		    iref_status.name_len);
1043 		break;
1044 	case GOT_IMSG_SEND_DONE:
1045 		if (datalen != 0) {
1046 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1047 			break;
1048 		}
1049 		*done = 1;
1050 		break;
1051 	default:
1052 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1053 		break;
1054 	}
1055 
1056 	imsg_free(&imsg);
1057 	return err;
1058 }
1059 
1060 const struct got_error *
1061 got_privsep_send_index_pack_req(struct imsgbuf *ibuf, uint8_t *pack_sha1,
1062     int fd)
1063 {
1064 	const struct got_error *err = NULL;
1065 
1066 	/* Keep in sync with struct got_imsg_index_pack_request */
1067 	if (imsg_compose(ibuf, GOT_IMSG_IDXPACK_REQUEST, 0, 0, fd,
1068 	    pack_sha1, SHA1_DIGEST_LENGTH) == -1) {
1069 		err = got_error_from_errno("imsg_compose INDEX_REQUEST");
1070 		close(fd);
1071 		return err;
1072 	}
1073 	return flush_imsg(ibuf);
1074 }
1075 
1076 const struct got_error *
1077 got_privsep_send_index_pack_outfd(struct imsgbuf *ibuf, int fd)
1078 {
1079 	return send_fd(ibuf, GOT_IMSG_IDXPACK_OUTFD, fd);
1080 }
1081 
1082 const struct got_error *
1083 got_privsep_recv_index_progress(int *done, int *nobj_total,
1084     int *nobj_indexed, int *nobj_loose, int *nobj_resolved,
1085     struct imsgbuf *ibuf)
1086 {
1087 	const struct got_error *err = NULL;
1088 	struct imsg imsg;
1089 	struct got_imsg_index_pack_progress *iprogress;
1090 	size_t datalen;
1091 
1092 	*done = 0;
1093 	*nobj_total = 0;
1094 	*nobj_indexed = 0;
1095 	*nobj_resolved = 0;
1096 
1097 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
1098 	if (err)
1099 		return err;
1100 
1101 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1102 	switch (imsg.hdr.type) {
1103 	case GOT_IMSG_ERROR:
1104 		err = recv_imsg_error(&imsg, datalen);
1105 		break;
1106 	case GOT_IMSG_IDXPACK_PROGRESS:
1107 		if (datalen < sizeof(*iprogress)) {
1108 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1109 			break;
1110 		}
1111 		iprogress = (struct got_imsg_index_pack_progress *)imsg.data;
1112 		if (iprogress->nobj_total < 0 || iprogress->nobj_indexed < 0 ||
1113 		    iprogress->nobj_loose < 0 || iprogress->nobj_resolved < 0) {
1114 			err = got_error(GOT_ERR_RANGE);
1115 			break;
1116 		}
1117 		*nobj_total = iprogress->nobj_total;
1118 		*nobj_indexed = iprogress->nobj_indexed;
1119 		*nobj_loose = iprogress->nobj_loose;
1120 		*nobj_resolved = iprogress->nobj_resolved;
1121 		break;
1122 	case GOT_IMSG_IDXPACK_DONE:
1123 		if (datalen != 0) {
1124 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1125 			break;
1126 		}
1127 		*done = 1;
1128 		break;
1129 	default:
1130 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1131 		break;
1132 	}
1133 
1134 	imsg_free(&imsg);
1135 	return err;
1136 }
1137 
1138 const struct got_error *
1139 got_privsep_get_imsg_obj(struct got_object **obj, struct imsg *imsg,
1140     struct imsgbuf *ibuf)
1141 {
1142 	struct got_imsg_object *iobj;
1143 	size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1144 
1145 	if (datalen != sizeof(*iobj))
1146 		return got_error(GOT_ERR_PRIVSEP_LEN);
1147 	iobj = imsg->data;
1148 
1149 	if (iobj->pack_offset < 0)
1150 		return got_error(GOT_ERR_PACK_OFFSET);
1151 
1152 	*obj = calloc(1, sizeof(**obj));
1153 	if (*obj == NULL)
1154 		return got_error_from_errno("calloc");
1155 
1156 	memcpy((*obj)->id.sha1, iobj->id, SHA1_DIGEST_LENGTH);
1157 	(*obj)->type = iobj->type;
1158 	(*obj)->flags = iobj->flags;
1159 	(*obj)->hdrlen = iobj->hdrlen;
1160 	(*obj)->size = iobj->size;
1161 	/* path_packfile is handled by caller */
1162 	if (iobj->flags & GOT_OBJ_FLAG_PACKED) {
1163 		(*obj)->pack_offset = iobj->pack_offset;
1164 		(*obj)->pack_idx = iobj->pack_idx;
1165 	}
1166 	STAILQ_INIT(&(*obj)->deltas.entries);
1167 	return NULL;
1168 }
1169 
1170 const struct got_error *
1171 got_privsep_recv_obj(struct got_object **obj, struct imsgbuf *ibuf)
1172 {
1173 	const struct got_error *err = NULL;
1174 	struct imsg imsg;
1175 	const size_t min_datalen =
1176 	    MIN(sizeof(struct got_imsg_error), sizeof(struct got_imsg_object));
1177 
1178 	*obj = NULL;
1179 
1180 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1181 	if (err)
1182 		return err;
1183 
1184 	switch (imsg.hdr.type) {
1185 	case GOT_IMSG_OBJECT:
1186 		err = got_privsep_get_imsg_obj(obj, &imsg, ibuf);
1187 		break;
1188 	default:
1189 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1190 		break;
1191 	}
1192 
1193 	imsg_free(&imsg);
1194 
1195 	return err;
1196 }
1197 
1198 static const struct got_error *
1199 send_commit_logmsg(struct imsgbuf *ibuf, struct got_commit_object *commit,
1200     size_t logmsg_len)
1201 {
1202 	const struct got_error *err = NULL;
1203 	size_t offset, remain;
1204 
1205 	offset = 0;
1206 	remain = logmsg_len;
1207 	while (remain > 0) {
1208 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
1209 
1210 		if (imsg_compose(ibuf, GOT_IMSG_COMMIT_LOGMSG, 0, 0, -1,
1211 		    commit->logmsg + offset, n) == -1) {
1212 			err = got_error_from_errno("imsg_compose "
1213 			    "COMMIT_LOGMSG");
1214 			break;
1215 		}
1216 
1217 		err = flush_imsg(ibuf);
1218 		if (err)
1219 			break;
1220 
1221 		offset += n;
1222 		remain -= n;
1223 	}
1224 
1225 	return err;
1226 }
1227 
1228 const struct got_error *
1229 got_privsep_send_commit(struct imsgbuf *ibuf, struct got_commit_object *commit)
1230 {
1231 	const struct got_error *err = NULL;
1232 	struct got_imsg_commit_object *icommit;
1233 	uint8_t *buf;
1234 	size_t len, total;
1235 	struct got_object_qid *qid;
1236 	size_t author_len = strlen(commit->author);
1237 	size_t committer_len = strlen(commit->committer);
1238 	size_t logmsg_len = strlen(commit->logmsg);
1239 
1240 	total = sizeof(*icommit) + author_len + committer_len +
1241 	    commit->nparents * SHA1_DIGEST_LENGTH;
1242 
1243 	buf = malloc(total);
1244 	if (buf == NULL)
1245 		return got_error_from_errno("malloc");
1246 
1247 	icommit = (struct got_imsg_commit_object *)buf;
1248 	memcpy(icommit->tree_id, commit->tree_id->sha1,
1249 	    sizeof(icommit->tree_id));
1250 	icommit->author_len = author_len;
1251 	icommit->author_time = commit->author_time;
1252 	icommit->author_gmtoff = commit->author_gmtoff;
1253 	icommit->committer_len = committer_len;
1254 	icommit->committer_time = commit->committer_time;
1255 	icommit->committer_gmtoff = commit->committer_gmtoff;
1256 	icommit->logmsg_len = logmsg_len;
1257 	icommit->nparents = commit->nparents;
1258 
1259 	len = sizeof(*icommit);
1260 	memcpy(buf + len, commit->author, author_len);
1261 	len += author_len;
1262 	memcpy(buf + len, commit->committer, committer_len);
1263 	len += committer_len;
1264 	STAILQ_FOREACH(qid, &commit->parent_ids, entry) {
1265 		memcpy(buf + len, &qid->id, SHA1_DIGEST_LENGTH);
1266 		len += SHA1_DIGEST_LENGTH;
1267 	}
1268 
1269 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT, 0, 0, -1, buf, len) == -1) {
1270 		err = got_error_from_errno("imsg_compose COMMIT");
1271 		goto done;
1272 	}
1273 
1274 	if (logmsg_len == 0 ||
1275 	    logmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
1276 		err = flush_imsg(ibuf);
1277 		if (err)
1278 			goto done;
1279 	}
1280 	err = send_commit_logmsg(ibuf, commit, logmsg_len);
1281 done:
1282 	free(buf);
1283 	return err;
1284 }
1285 
1286 static const struct got_error *
1287 get_commit_from_imsg(struct got_commit_object **commit,
1288     struct imsg *imsg, size_t datalen, struct imsgbuf *ibuf)
1289 {
1290 	const struct got_error *err = NULL;
1291 	struct got_imsg_commit_object *icommit;
1292 	size_t len = 0;
1293 	int i;
1294 
1295 	if (datalen < sizeof(*icommit))
1296 		return got_error(GOT_ERR_PRIVSEP_LEN);
1297 
1298 	icommit = imsg->data;
1299 	if (datalen != sizeof(*icommit) + icommit->author_len +
1300 	    icommit->committer_len +
1301 	    icommit->nparents * SHA1_DIGEST_LENGTH)
1302 		return got_error(GOT_ERR_PRIVSEP_LEN);
1303 
1304 	if (icommit->nparents < 0)
1305 		return got_error(GOT_ERR_PRIVSEP_LEN);
1306 
1307 	len += sizeof(*icommit);
1308 
1309 	*commit = got_object_commit_alloc_partial();
1310 	if (*commit == NULL)
1311 		return got_error_from_errno(
1312 		    "got_object_commit_alloc_partial");
1313 
1314 	memcpy((*commit)->tree_id->sha1, icommit->tree_id,
1315 	    SHA1_DIGEST_LENGTH);
1316 	(*commit)->author_time = icommit->author_time;
1317 	(*commit)->author_gmtoff = icommit->author_gmtoff;
1318 	(*commit)->committer_time = icommit->committer_time;
1319 	(*commit)->committer_gmtoff = icommit->committer_gmtoff;
1320 
1321 	(*commit)->author = strndup(imsg->data + len, icommit->author_len);
1322 	if ((*commit)->author == NULL) {
1323 		err = got_error_from_errno("strndup");
1324 		goto done;
1325 	}
1326 	len += icommit->author_len;
1327 
1328 	(*commit)->committer = strndup(imsg->data + len,
1329 	    icommit->committer_len);
1330 	if ((*commit)->committer == NULL) {
1331 		err = got_error_from_errno("strndup");
1332 		goto done;
1333 	}
1334 	len += icommit->committer_len;
1335 
1336 	if (icommit->logmsg_len == 0) {
1337 		(*commit)->logmsg = strdup("");
1338 		if ((*commit)->logmsg == NULL) {
1339 			err = got_error_from_errno("strdup");
1340 			goto done;
1341 		}
1342 	} else {
1343 		size_t offset = 0, remain = icommit->logmsg_len;
1344 
1345 		(*commit)->logmsg = malloc(icommit->logmsg_len + 1);
1346 		if ((*commit)->logmsg == NULL) {
1347 			err = got_error_from_errno("malloc");
1348 			goto done;
1349 		}
1350 		while (remain > 0) {
1351 			struct imsg imsg_log;
1352 			size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
1353 			    remain);
1354 
1355 			err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
1356 			if (err)
1357 				goto done;
1358 
1359 			if (imsg_log.hdr.type != GOT_IMSG_COMMIT_LOGMSG) {
1360 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1361 				goto done;
1362 			}
1363 
1364 			memcpy((*commit)->logmsg + offset,
1365 			    imsg_log.data, n);
1366 			imsg_free(&imsg_log);
1367 			offset += n;
1368 			remain -= n;
1369 		}
1370 		(*commit)->logmsg[icommit->logmsg_len] = '\0';
1371 	}
1372 
1373 	for (i = 0; i < icommit->nparents; i++) {
1374 		struct got_object_qid *qid;
1375 
1376 		err = got_object_qid_alloc_partial(&qid);
1377 		if (err)
1378 			break;
1379 		memcpy(&qid->id, imsg->data + len +
1380 		    i * SHA1_DIGEST_LENGTH, sizeof(qid->id));
1381 		STAILQ_INSERT_TAIL(&(*commit)->parent_ids, qid, entry);
1382 		(*commit)->nparents++;
1383 	}
1384 done:
1385 	if (err) {
1386 		got_object_commit_close(*commit);
1387 		*commit = NULL;
1388 	}
1389 	return err;
1390 }
1391 
1392 const struct got_error *
1393 got_privsep_recv_commit(struct got_commit_object **commit, struct imsgbuf *ibuf)
1394 {
1395 	const struct got_error *err = NULL;
1396 	struct imsg imsg;
1397 	size_t datalen;
1398 	const size_t min_datalen =
1399 	    MIN(sizeof(struct got_imsg_error),
1400 	    sizeof(struct got_imsg_commit_object));
1401 
1402 	*commit = NULL;
1403 
1404 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1405 	if (err)
1406 		return err;
1407 
1408 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1409 
1410 	switch (imsg.hdr.type) {
1411 	case GOT_IMSG_COMMIT:
1412 		err = get_commit_from_imsg(commit, &imsg, datalen, ibuf);
1413 		break;
1414 	default:
1415 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1416 		break;
1417 	}
1418 
1419 	imsg_free(&imsg);
1420 
1421 	return err;
1422 }
1423 
1424 static const struct got_error *
1425 send_tree_entries_batch(struct imsgbuf *ibuf,
1426     struct got_parsed_tree_entry *entries, int idx0, int idxN, size_t len)
1427 {
1428 	struct ibuf *wbuf;
1429 	struct got_imsg_tree_entries ientries;
1430 	int i;
1431 
1432 	memset(&ientries, 0, sizeof(ientries));
1433 
1434 	wbuf = imsg_create(ibuf, GOT_IMSG_TREE_ENTRIES, 0, 0, len);
1435 	if (wbuf == NULL)
1436 		return got_error_from_errno("imsg_create TREE_ENTRY");
1437 
1438 	ientries.nentries = idxN - idx0 + 1;
1439 	if (imsg_add(wbuf, &ientries, sizeof(ientries)) == -1)
1440 		return got_error_from_errno("imsg_add TREE_ENTRY");
1441 
1442 	for (i = idx0; i <= idxN; i++) {
1443 		struct got_parsed_tree_entry *pte = &entries[i];
1444 
1445 		/* Keep in sync with struct got_imsg_tree_object definition! */
1446 		if (imsg_add(wbuf, pte->id, SHA1_DIGEST_LENGTH) == -1)
1447 			return got_error_from_errno("imsg_add TREE_ENTRY");
1448 		if (imsg_add(wbuf, &pte->mode, sizeof(pte->mode)) == -1)
1449 			return got_error_from_errno("imsg_add TREE_ENTRY");
1450 		if (imsg_add(wbuf, &pte->namelen, sizeof(pte->namelen)) == -1)
1451 			return got_error_from_errno("imsg_add TREE_ENTRY");
1452 
1453 		/* Remaining bytes are the entry's name. */
1454 		if (imsg_add(wbuf, pte->name, pte->namelen) == -1)
1455 			return got_error_from_errno("imsg_add TREE_ENTRY");
1456 	}
1457 
1458 	wbuf->fd = -1;
1459 	imsg_close(ibuf, wbuf);
1460 	return NULL;
1461 }
1462 
1463 static const struct got_error *
1464 send_tree_entries(struct imsgbuf *ibuf, struct got_parsed_tree_entry *entries,
1465     int nentries)
1466 {
1467 	const struct got_error *err = NULL;
1468 	int i, j;
1469 	size_t entries_len = sizeof(struct got_imsg_tree_entries);
1470 
1471 	i = 0;
1472 	for (j = 0; j < nentries; j++) {
1473 		struct got_parsed_tree_entry *pte = &entries[j];
1474 		size_t len = SHA1_DIGEST_LENGTH + sizeof(pte->mode) +
1475 		    sizeof(pte->namelen) + pte->namelen;
1476 
1477 		if (j > 0 &&
1478 		    entries_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
1479 			err = send_tree_entries_batch(ibuf, entries,
1480 			    i, j - 1, entries_len);
1481 			if (err)
1482 				return err;
1483 			i = j;
1484 			entries_len = sizeof(struct got_imsg_tree_entries);
1485 		}
1486 
1487 		entries_len += len;
1488 	}
1489 
1490 	if (j > 0) {
1491 		err = send_tree_entries_batch(ibuf, entries, i, j - 1,
1492 		    entries_len);
1493 		if (err)
1494 			return err;
1495 	}
1496 
1497 	return NULL;
1498 }
1499 
1500 const struct got_error *
1501 got_privsep_send_tree(struct imsgbuf *ibuf,
1502     struct got_parsed_tree_entry *entries, int nentries)
1503 {
1504 	const struct got_error *err = NULL;
1505 	struct got_imsg_tree_object itree;
1506 
1507 	memset(&itree, 0, sizeof(itree));
1508 	itree.nentries = nentries;
1509 	if (imsg_compose(ibuf, GOT_IMSG_TREE, 0, 0, -1, &itree, sizeof(itree))
1510 	    == -1)
1511 		return got_error_from_errno("imsg_compose TREE");
1512 
1513 	err = send_tree_entries(ibuf, entries, nentries);
1514 	if (err)
1515 		return err;
1516 
1517 	return flush_imsg(ibuf);
1518 }
1519 
1520 
1521 static const struct got_error *
1522 recv_tree_entries(void *data, size_t datalen, struct got_tree_object *tree,
1523     int *nentries)
1524 {
1525 	const struct got_error *err = NULL;
1526 	struct got_imsg_tree_entries *ientries;
1527 	struct got_tree_entry *te;
1528 	size_t te_offset;
1529 	size_t i;
1530 
1531 	if (datalen <= sizeof(*ientries) ||
1532 	    datalen > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
1533 		return got_error(GOT_ERR_PRIVSEP_LEN);
1534 
1535 	ientries = (struct got_imsg_tree_entries *)data;
1536 	if (ientries->nentries > INT_MAX) {
1537 		return got_error_msg(GOT_ERR_NO_SPACE,
1538 		    "too many tree entries");
1539 	}
1540 
1541 	te_offset = sizeof(*ientries);
1542 	for (i = 0; i < ientries->nentries; i++) {
1543 		struct got_imsg_tree_entry ite;
1544 		const char *te_name;
1545 		uint8_t *buf = (uint8_t *)data + te_offset;
1546 
1547 		if (te_offset >= datalen) {
1548 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1549 			break;
1550 		}
1551 
1552 		/* Might not be aligned, size is ~32 bytes. */
1553 		memcpy(&ite, buf, sizeof(ite));
1554 
1555 		if (ite.namelen >= sizeof(te->name)) {
1556 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1557 			break;
1558 		}
1559 		if (te_offset + sizeof(ite) + ite.namelen > datalen) {
1560 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1561 			break;
1562 		}
1563 
1564 		if (*nentries >= tree->nentries) {
1565 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1566 			break;
1567 		}
1568 		te = &tree->entries[*nentries];
1569 		te_name = buf + sizeof(ite);
1570 		memcpy(te->name, te_name, ite.namelen);
1571 		te->name[ite.namelen] = '\0';
1572 		memcpy(te->id.sha1, ite.id, SHA1_DIGEST_LENGTH);
1573 		te->mode = ite.mode;
1574 		te->idx = *nentries;
1575 		(*nentries)++;
1576 
1577 		te_offset += sizeof(ite) + ite.namelen;
1578 	}
1579 
1580 	return err;
1581 }
1582 
1583 const struct got_error *
1584 got_privsep_recv_tree(struct got_tree_object **tree, struct imsgbuf *ibuf)
1585 {
1586 	const struct got_error *err = NULL;
1587 	const size_t min_datalen =
1588 	    MIN(sizeof(struct got_imsg_error),
1589 	    sizeof(struct got_imsg_tree_object));
1590 	struct got_imsg_tree_object *itree;
1591 	int nentries = 0;
1592 
1593 	*tree = NULL;
1594 
1595 	err = read_imsg(ibuf);
1596 	if (err)
1597 		goto done;
1598 
1599 	for (;;) {
1600 		struct imsg imsg;
1601 		size_t n;
1602 		size_t datalen;
1603 
1604 		n = imsg_get(ibuf, &imsg);
1605 		if (n == 0) {
1606 			if ((*tree)) {
1607 				if (nentries < (*tree)->nentries) {
1608 					err = read_imsg(ibuf);
1609 					if (err)
1610 						break;
1611 					continue;
1612 				} else
1613 					break;
1614 			} else {
1615 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1616 				break;
1617 			}
1618 		}
1619 
1620 		if (imsg.hdr.len < IMSG_HEADER_SIZE + min_datalen) {
1621 			imsg_free(&imsg);
1622 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1623 			break;
1624 		}
1625 
1626 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1627 
1628 		switch (imsg.hdr.type) {
1629 		case GOT_IMSG_ERROR:
1630 			err = recv_imsg_error(&imsg, datalen);
1631 			break;
1632 		case GOT_IMSG_TREE:
1633 			/* This message should only appear once. */
1634 			if (*tree != NULL) {
1635 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1636 				break;
1637 			}
1638 			if (datalen != sizeof(*itree)) {
1639 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1640 				break;
1641 			}
1642 			itree = imsg.data;
1643 			if (itree->nentries < 0) {
1644 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1645 				break;
1646 			}
1647 			*tree = malloc(sizeof(**tree));
1648 			if (*tree == NULL) {
1649 				err = got_error_from_errno("malloc");
1650 				break;
1651 			}
1652 			(*tree)->entries = calloc(itree->nentries,
1653 			    sizeof(struct got_tree_entry));
1654 			if ((*tree)->entries == NULL) {
1655 				err = got_error_from_errno("malloc");
1656 				free(*tree);
1657 				*tree = NULL;
1658 				break;
1659 			}
1660 			(*tree)->nentries = itree->nentries;
1661 			(*tree)->refcnt = 0;
1662 			break;
1663 		case GOT_IMSG_TREE_ENTRIES:
1664 			/* This message should be preceeded by GOT_IMSG_TREE. */
1665 			if (*tree == NULL) {
1666 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1667 				break;
1668 			}
1669 			err = recv_tree_entries(imsg.data, datalen,
1670 			    *tree, &nentries);
1671 			break;
1672 		default:
1673 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1674 			break;
1675 		}
1676 
1677 		imsg_free(&imsg);
1678 		if (err)
1679 			break;
1680 	}
1681 done:
1682 	if (*tree && (*tree)->nentries != nentries) {
1683 		if (err == NULL)
1684 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1685 		got_object_tree_close(*tree);
1686 		*tree = NULL;
1687 	}
1688 
1689 	return err;
1690 }
1691 
1692 const struct got_error *
1693 got_privsep_send_blob(struct imsgbuf *ibuf, size_t size, size_t hdrlen,
1694     const uint8_t *data)
1695 {
1696 	struct got_imsg_blob iblob;
1697 
1698 	memset(&iblob, 0, sizeof(iblob));
1699 	iblob.size = size;
1700 	iblob.hdrlen = hdrlen;
1701 
1702 	if (data) {
1703 		uint8_t *buf;
1704 
1705 		if (size > GOT_PRIVSEP_INLINE_BLOB_DATA_MAX)
1706 			return got_error(GOT_ERR_NO_SPACE);
1707 
1708 		buf = malloc(sizeof(iblob) + size);
1709 		if (buf == NULL)
1710 			return got_error_from_errno("malloc");
1711 
1712 		memcpy(buf, &iblob, sizeof(iblob));
1713 		memcpy(buf + sizeof(iblob), data, size);
1714 		if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, buf,
1715 		    sizeof(iblob) + size) == -1) {
1716 			free(buf);
1717 			return got_error_from_errno("imsg_compose BLOB");
1718 		}
1719 		free(buf);
1720 	} else {
1721 		/* Data has already been written to file descriptor. */
1722 		if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, &iblob,
1723 		    sizeof(iblob)) == -1)
1724 			return got_error_from_errno("imsg_compose BLOB");
1725 	}
1726 
1727 
1728 	return flush_imsg(ibuf);
1729 }
1730 
1731 const struct got_error *
1732 got_privsep_recv_blob(uint8_t **outbuf, size_t *size, size_t *hdrlen,
1733     struct imsgbuf *ibuf)
1734 {
1735 	const struct got_error *err = NULL;
1736 	struct imsg imsg;
1737 	struct got_imsg_blob *iblob;
1738 	size_t datalen;
1739 
1740 	*outbuf = NULL;
1741 
1742 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
1743 	if (err)
1744 		return err;
1745 
1746 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1747 
1748 	switch (imsg.hdr.type) {
1749 	case GOT_IMSG_BLOB:
1750 		if (datalen < sizeof(*iblob)) {
1751 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1752 			break;
1753 		}
1754 		iblob = imsg.data;
1755 		*size = iblob->size;
1756 		*hdrlen = iblob->hdrlen;
1757 
1758 		if (datalen == sizeof(*iblob)) {
1759 			/* Data has been written to file descriptor. */
1760 			break;
1761 		}
1762 
1763 		if (*size > GOT_PRIVSEP_INLINE_BLOB_DATA_MAX ||
1764 		    *size > datalen + sizeof(*iblob)) {
1765 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1766 			break;
1767 		}
1768 
1769 		*outbuf = malloc(*size);
1770 		if (*outbuf == NULL) {
1771 			err = got_error_from_errno("malloc");
1772 			break;
1773 		}
1774 		memcpy(*outbuf, imsg.data + sizeof(*iblob), *size);
1775 		break;
1776 	default:
1777 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1778 		break;
1779 	}
1780 
1781 	imsg_free(&imsg);
1782 
1783 	return err;
1784 }
1785 
1786 static const struct got_error *
1787 send_tagmsg(struct imsgbuf *ibuf, struct got_tag_object *tag, size_t tagmsg_len)
1788 {
1789 	const struct got_error *err = NULL;
1790 	size_t offset, remain;
1791 
1792 	offset = 0;
1793 	remain = tagmsg_len;
1794 	while (remain > 0) {
1795 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
1796 
1797 		if (imsg_compose(ibuf, GOT_IMSG_TAG_TAGMSG, 0, 0, -1,
1798 		    tag->tagmsg + offset, n) == -1) {
1799 			err = got_error_from_errno("imsg_compose TAG_TAGMSG");
1800 			break;
1801 		}
1802 
1803 		err = flush_imsg(ibuf);
1804 		if (err)
1805 			break;
1806 
1807 		offset += n;
1808 		remain -= n;
1809 	}
1810 
1811 	return err;
1812 }
1813 
1814 const struct got_error *
1815 got_privsep_send_tag(struct imsgbuf *ibuf, struct got_tag_object *tag)
1816 {
1817 	const struct got_error *err = NULL;
1818 	struct got_imsg_tag_object *itag;
1819 	uint8_t *buf;
1820 	size_t len, total;
1821 	size_t tag_len = strlen(tag->tag);
1822 	size_t tagger_len = strlen(tag->tagger);
1823 	size_t tagmsg_len = strlen(tag->tagmsg);
1824 
1825 	total = sizeof(*itag) + tag_len + tagger_len + tagmsg_len;
1826 
1827 	buf = malloc(total);
1828 	if (buf == NULL)
1829 		return got_error_from_errno("malloc");
1830 
1831 	itag = (struct got_imsg_tag_object *)buf;
1832 	memcpy(itag->id, tag->id.sha1, sizeof(itag->id));
1833 	itag->obj_type = tag->obj_type;
1834 	itag->tag_len = tag_len;
1835 	itag->tagger_len = tagger_len;
1836 	itag->tagger_time = tag->tagger_time;
1837 	itag->tagger_gmtoff = tag->tagger_gmtoff;
1838 	itag->tagmsg_len = tagmsg_len;
1839 
1840 	len = sizeof(*itag);
1841 	memcpy(buf + len, tag->tag, tag_len);
1842 	len += tag_len;
1843 	memcpy(buf + len, tag->tagger, tagger_len);
1844 	len += tagger_len;
1845 
1846 	if (imsg_compose(ibuf, GOT_IMSG_TAG, 0, 0, -1, buf, len) == -1) {
1847 		err = got_error_from_errno("imsg_compose TAG");
1848 		goto done;
1849 	}
1850 
1851 	if (tagmsg_len == 0 ||
1852 	    tagmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
1853 		err = flush_imsg(ibuf);
1854 		if (err)
1855 			goto done;
1856 	}
1857 	err = send_tagmsg(ibuf, tag, tagmsg_len);
1858 done:
1859 	free(buf);
1860 	return err;
1861 }
1862 
1863 const struct got_error *
1864 got_privsep_recv_tag(struct got_tag_object **tag, struct imsgbuf *ibuf)
1865 {
1866 	const struct got_error *err = NULL;
1867 	struct imsg imsg;
1868 	struct got_imsg_tag_object *itag;
1869 	size_t len, datalen;
1870 	const size_t min_datalen =
1871 	    MIN(sizeof(struct got_imsg_error),
1872 	    sizeof(struct got_imsg_tag_object));
1873 
1874 	*tag = NULL;
1875 
1876 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1877 	if (err)
1878 		return err;
1879 
1880 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1881 	len = 0;
1882 
1883 	switch (imsg.hdr.type) {
1884 	case GOT_IMSG_TAG:
1885 		if (datalen < sizeof(*itag)) {
1886 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1887 			break;
1888 		}
1889 		itag = imsg.data;
1890 		if (datalen != sizeof(*itag) + itag->tag_len +
1891 		    itag->tagger_len) {
1892 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1893 			break;
1894 		}
1895 		len += sizeof(*itag);
1896 
1897 		*tag = calloc(1, sizeof(**tag));
1898 		if (*tag == NULL) {
1899 			err = got_error_from_errno("calloc");
1900 			break;
1901 		}
1902 
1903 		memcpy((*tag)->id.sha1, itag->id, SHA1_DIGEST_LENGTH);
1904 
1905 		(*tag)->tag = strndup(imsg.data + len, itag->tag_len);
1906 		if ((*tag)->tag == NULL) {
1907 			err = got_error_from_errno("strndup");
1908 			break;
1909 		}
1910 		len += itag->tag_len;
1911 
1912 		(*tag)->obj_type = itag->obj_type;
1913 		(*tag)->tagger_time = itag->tagger_time;
1914 		(*tag)->tagger_gmtoff = itag->tagger_gmtoff;
1915 
1916 		(*tag)->tagger = strndup(imsg.data + len, itag->tagger_len);
1917 		if ((*tag)->tagger == NULL) {
1918 			err = got_error_from_errno("strndup");
1919 			break;
1920 		}
1921 		len += itag->tagger_len;
1922 
1923 		if (itag->tagmsg_len == 0) {
1924 			(*tag)->tagmsg = strdup("");
1925 			if ((*tag)->tagmsg == NULL) {
1926 				err = got_error_from_errno("strdup");
1927 				break;
1928 			}
1929 		} else {
1930 			size_t offset = 0, remain = itag->tagmsg_len;
1931 
1932 			(*tag)->tagmsg = malloc(itag->tagmsg_len + 1);
1933 			if ((*tag)->tagmsg == NULL) {
1934 				err = got_error_from_errno("malloc");
1935 				break;
1936 			}
1937 			while (remain > 0) {
1938 				struct imsg imsg_log;
1939 				size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
1940 				    remain);
1941 
1942 				err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
1943 				if (err)
1944 					return err;
1945 
1946 				if (imsg_log.hdr.type != GOT_IMSG_TAG_TAGMSG)
1947 					return got_error(GOT_ERR_PRIVSEP_MSG);
1948 
1949 				memcpy((*tag)->tagmsg + offset, imsg_log.data,
1950 				    n);
1951 				imsg_free(&imsg_log);
1952 				offset += n;
1953 				remain -= n;
1954 			}
1955 			(*tag)->tagmsg[itag->tagmsg_len] = '\0';
1956 		}
1957 
1958 		break;
1959 	default:
1960 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1961 		break;
1962 	}
1963 
1964 	imsg_free(&imsg);
1965 
1966 	return err;
1967 }
1968 
1969 const struct got_error *
1970 got_privsep_init_pack_child(struct imsgbuf *ibuf, struct got_pack *pack,
1971     struct got_packidx *packidx)
1972 {
1973 	const struct got_error *err = NULL;
1974 	struct got_imsg_packidx ipackidx;
1975 	struct got_imsg_pack ipack;
1976 	int fd;
1977 
1978 	memset(&ipackidx, 0, sizeof(ipackidx));
1979 	memset(&ipack, 0, sizeof(ipack));
1980 
1981 	ipackidx.len = packidx->len;
1982 	ipackidx.packfile_size = pack->filesize;
1983 	fd = dup(packidx->fd);
1984 	if (fd == -1)
1985 		return got_error_from_errno("dup");
1986 
1987 	if (imsg_compose(ibuf, GOT_IMSG_PACKIDX, 0, 0, fd, &ipackidx,
1988 	    sizeof(ipackidx)) == -1) {
1989 		err = got_error_from_errno("imsg_compose PACKIDX");
1990 		close(fd);
1991 		return err;
1992 	}
1993 
1994 	if (strlcpy(ipack.path_packfile, pack->path_packfile,
1995 	    sizeof(ipack.path_packfile)) >= sizeof(ipack.path_packfile))
1996 		return got_error(GOT_ERR_NO_SPACE);
1997 	ipack.filesize = pack->filesize;
1998 
1999 	fd = dup(pack->fd);
2000 	if (fd == -1)
2001 		return got_error_from_errno("dup");
2002 
2003 	if (imsg_compose(ibuf, GOT_IMSG_PACK, 0, 0, fd, &ipack, sizeof(ipack))
2004 	    == -1) {
2005 		err = got_error_from_errno("imsg_compose PACK");
2006 		close(fd);
2007 		return err;
2008 	}
2009 
2010 	return flush_imsg(ibuf);
2011 }
2012 
2013 const struct got_error *
2014 got_privsep_send_packed_obj_req(struct imsgbuf *ibuf, int idx,
2015     struct got_object_id *id)
2016 {
2017 	struct got_imsg_packed_object iobj;
2018 
2019 	memset(&iobj, 0, sizeof(iobj));
2020 	iobj.idx = idx;
2021 	memcpy(iobj.id, id->sha1, sizeof(iobj.id));
2022 
2023 	if (imsg_compose(ibuf, GOT_IMSG_PACKED_OBJECT_REQUEST, 0, 0, -1,
2024 	    &iobj, sizeof(iobj)) == -1)
2025 		return got_error_from_errno("imsg_compose "
2026 		    "PACKED_OBJECT_REQUEST");
2027 
2028 	return flush_imsg(ibuf);
2029 }
2030 
2031 const struct got_error *
2032 got_privsep_send_packed_raw_obj_req(struct imsgbuf *ibuf, int idx,
2033     struct got_object_id *id)
2034 {
2035 	struct got_imsg_packed_object iobj;
2036 
2037 	memset(&iobj, 0, sizeof(iobj));
2038 	iobj.idx = idx;
2039 	memcpy(iobj.id, id->sha1, sizeof(iobj.id));
2040 
2041 	if (imsg_compose(ibuf, GOT_IMSG_PACKED_RAW_OBJECT_REQUEST, 0, 0, -1,
2042 	    &iobj, sizeof(iobj)) == -1)
2043 		return got_error_from_errno("imsg_compose "
2044 		    "PACKED_OBJECT_REQUEST");
2045 
2046 	return flush_imsg(ibuf);
2047 }
2048 
2049 const struct got_error *
2050 got_privsep_send_gitconfig_parse_req(struct imsgbuf *ibuf, int fd)
2051 {
2052 	const struct got_error *err = NULL;
2053 
2054 	if (imsg_compose(ibuf, GOT_IMSG_GITCONFIG_PARSE_REQUEST, 0, 0, fd,
2055 	    NULL, 0) == -1) {
2056 		err = got_error_from_errno("imsg_compose "
2057 		    "GITCONFIG_PARSE_REQUEST");
2058 		close(fd);
2059 		return err;
2060 	}
2061 
2062 	return flush_imsg(ibuf);
2063 }
2064 
2065 const struct got_error *
2066 got_privsep_send_gitconfig_repository_format_version_req(struct imsgbuf *ibuf)
2067 {
2068 	if (imsg_compose(ibuf,
2069 	    GOT_IMSG_GITCONFIG_REPOSITORY_FORMAT_VERSION_REQUEST, 0, 0, -1,
2070 	    NULL, 0) == -1)
2071 		return got_error_from_errno("imsg_compose "
2072 		    "GITCONFIG_REPOSITORY_FORMAT_VERSION_REQUEST");
2073 
2074 	return flush_imsg(ibuf);
2075 }
2076 
2077 const struct got_error *
2078 got_privsep_send_gitconfig_repository_extensions_req(struct imsgbuf *ibuf)
2079 {
2080 	if (imsg_compose(ibuf,
2081 	    GOT_IMSG_GITCONFIG_REPOSITORY_EXTENSIONS_REQUEST, 0, 0, -1,
2082 	    NULL, 0) == -1)
2083 		return got_error_from_errno("imsg_compose "
2084 		    "GITCONFIG_REPOSITORY_EXTENSIONS_REQUEST");
2085 
2086 	return flush_imsg(ibuf);
2087 }
2088 
2089 
2090 const struct got_error *
2091 got_privsep_send_gitconfig_author_name_req(struct imsgbuf *ibuf)
2092 {
2093 	if (imsg_compose(ibuf,
2094 	    GOT_IMSG_GITCONFIG_AUTHOR_NAME_REQUEST, 0, 0, -1, NULL, 0) == -1)
2095 		return got_error_from_errno("imsg_compose "
2096 		    "GITCONFIG_AUTHOR_NAME_REQUEST");
2097 
2098 	return flush_imsg(ibuf);
2099 }
2100 
2101 const struct got_error *
2102 got_privsep_send_gitconfig_author_email_req(struct imsgbuf *ibuf)
2103 {
2104 	if (imsg_compose(ibuf,
2105 	    GOT_IMSG_GITCONFIG_AUTHOR_EMAIL_REQUEST, 0, 0, -1, NULL, 0) == -1)
2106 		return got_error_from_errno("imsg_compose "
2107 		    "GITCONFIG_AUTHOR_EMAIL_REQUEST");
2108 
2109 	return flush_imsg(ibuf);
2110 }
2111 
2112 const struct got_error *
2113 got_privsep_send_gitconfig_remotes_req(struct imsgbuf *ibuf)
2114 {
2115 	if (imsg_compose(ibuf,
2116 	    GOT_IMSG_GITCONFIG_REMOTES_REQUEST, 0, 0, -1, NULL, 0) == -1)
2117 		return got_error_from_errno("imsg_compose "
2118 		    "GITCONFIG_REMOTE_REQUEST");
2119 
2120 	return flush_imsg(ibuf);
2121 }
2122 
2123 const struct got_error *
2124 got_privsep_send_gitconfig_owner_req(struct imsgbuf *ibuf)
2125 {
2126 	if (imsg_compose(ibuf,
2127 	    GOT_IMSG_GITCONFIG_OWNER_REQUEST, 0, 0, -1, NULL, 0) == -1)
2128 		return got_error_from_errno("imsg_compose "
2129 		    "GITCONFIG_OWNER_REQUEST");
2130 
2131 	return flush_imsg(ibuf);
2132 }
2133 
2134 const struct got_error *
2135 got_privsep_recv_gitconfig_str(char **str, struct imsgbuf *ibuf)
2136 {
2137 	const struct got_error *err = NULL;
2138 	struct imsg imsg;
2139 	size_t datalen;
2140 
2141 	*str = NULL;
2142 
2143 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
2144 	if (err)
2145 		return err;
2146 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2147 
2148 	switch (imsg.hdr.type) {
2149 	case GOT_IMSG_GITCONFIG_STR_VAL:
2150 		if (datalen == 0)
2151 			break;
2152 		/* datalen does not include terminating \0 */
2153 		*str = malloc(datalen + 1);
2154 		if (*str == NULL) {
2155 			err = got_error_from_errno("malloc");
2156 			break;
2157 		}
2158 		memcpy(*str, imsg.data, datalen);
2159 		(*str)[datalen] = '\0';
2160 		break;
2161 	default:
2162 		err = got_error(GOT_ERR_PRIVSEP_MSG);
2163 		break;
2164 	}
2165 
2166 	imsg_free(&imsg);
2167 	return err;
2168 }
2169 
2170 const struct got_error *
2171 got_privsep_recv_gitconfig_int(int *val, struct imsgbuf *ibuf)
2172 {
2173 	const struct got_error *err = NULL;
2174 	struct imsg imsg;
2175 	size_t datalen;
2176 	const size_t min_datalen =
2177 	    MIN(sizeof(struct got_imsg_error), sizeof(int));
2178 
2179 	*val = 0;
2180 
2181 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
2182 	if (err)
2183 		return err;
2184 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2185 
2186 	switch (imsg.hdr.type) {
2187 	case GOT_IMSG_GITCONFIG_INT_VAL:
2188 		if (datalen != sizeof(*val)) {
2189 			err = got_error(GOT_ERR_PRIVSEP_LEN);
2190 			break;
2191 		}
2192 		memcpy(val, imsg.data, sizeof(*val));
2193 		break;
2194 	default:
2195 		err = got_error(GOT_ERR_PRIVSEP_MSG);
2196 		break;
2197 	}
2198 
2199 	imsg_free(&imsg);
2200 	return err;
2201 }
2202 
2203 static void
2204 free_remote_data(struct got_remote_repo *remote)
2205 {
2206 	int i;
2207 
2208 	free(remote->name);
2209 	free(remote->fetch_url);
2210 	free(remote->send_url);
2211 	for (i = 0; i < remote->nfetch_branches; i++)
2212 		free(remote->fetch_branches[i]);
2213 	free(remote->fetch_branches);
2214 	for (i = 0; i < remote->nsend_branches; i++)
2215 		free(remote->send_branches[i]);
2216 	free(remote->send_branches);
2217 	for (i = 0; i < remote->nfetch_refs; i++)
2218 		free(remote->fetch_refs[i]);
2219 	free(remote->fetch_refs);
2220 }
2221 
2222 const struct got_error *
2223 got_privsep_recv_gitconfig_remotes(struct got_remote_repo **remotes,
2224     int *nremotes, struct imsgbuf *ibuf)
2225 {
2226 	const struct got_error *err = NULL;
2227 	struct imsg imsg;
2228 	size_t datalen;
2229 	struct got_imsg_remotes iremotes;
2230 	struct got_imsg_remote iremote;
2231 
2232 	*remotes = NULL;
2233 	*nremotes = 0;
2234 	iremotes.nremotes = 0;
2235 
2236 	err = got_privsep_recv_imsg(&imsg, ibuf, sizeof(iremotes));
2237 	if (err)
2238 		return err;
2239 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2240 
2241 	switch (imsg.hdr.type) {
2242 	case GOT_IMSG_GITCONFIG_REMOTES:
2243 		if (datalen != sizeof(iremotes)) {
2244 			err = got_error(GOT_ERR_PRIVSEP_LEN);
2245 			break;
2246 		}
2247 		memcpy(&iremotes, imsg.data, sizeof(iremotes));
2248 		if (iremotes.nremotes == 0) {
2249 			imsg_free(&imsg);
2250 			return NULL;
2251 		}
2252 		break;
2253 	default:
2254 		imsg_free(&imsg);
2255 		return got_error(GOT_ERR_PRIVSEP_MSG);
2256 	}
2257 
2258 	imsg_free(&imsg);
2259 
2260 	*remotes = recallocarray(NULL, 0, iremotes.nremotes, sizeof(**remotes));
2261 	if (*remotes == NULL)
2262 		return got_error_from_errno("recallocarray");
2263 
2264 	while (*nremotes < iremotes.nremotes) {
2265 		struct got_remote_repo *remote;
2266 
2267 		err = got_privsep_recv_imsg(&imsg, ibuf, sizeof(iremote));
2268 		if (err)
2269 			break;
2270 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2271 
2272 		switch (imsg.hdr.type) {
2273 		case GOT_IMSG_GITCONFIG_REMOTE:
2274 			remote = &(*remotes)[*nremotes];
2275 			memset(remote, 0, sizeof(*remote));
2276 			if (datalen < sizeof(iremote)) {
2277 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2278 				break;
2279 			}
2280 			memcpy(&iremote, imsg.data, sizeof(iremote));
2281 			if (iremote.name_len == 0 ||
2282 			    iremote.fetch_url_len == 0 ||
2283 			    iremote.send_url_len == 0 ||
2284 			    (sizeof(iremote) + iremote.name_len +
2285 			    iremote.fetch_url_len + iremote.send_url_len) > datalen) {
2286 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2287 				break;
2288 			}
2289 			remote->name = strndup(imsg.data + sizeof(iremote),
2290 			    iremote.name_len);
2291 			if (remote->name == NULL) {
2292 				err = got_error_from_errno("strndup");
2293 				break;
2294 			}
2295 			remote->fetch_url = strndup(imsg.data + sizeof(iremote) +
2296 			    iremote.name_len, iremote.fetch_url_len);
2297 			if (remote->fetch_url == NULL) {
2298 				err = got_error_from_errno("strndup");
2299 				free_remote_data(remote);
2300 				break;
2301 			}
2302 			remote->send_url = strndup(imsg.data + sizeof(iremote) +
2303 			    iremote.name_len + iremote.fetch_url_len,
2304 			    iremote.send_url_len);
2305 			if (remote->send_url == NULL) {
2306 				err = got_error_from_errno("strndup");
2307 				free_remote_data(remote);
2308 				break;
2309 			}
2310 			remote->mirror_references = iremote.mirror_references;
2311 			remote->fetch_all_branches = iremote.fetch_all_branches;
2312 			remote->nfetch_branches = 0;
2313 			remote->fetch_branches = NULL;
2314 			remote->nsend_branches = 0;
2315 			remote->send_branches = NULL;
2316 			remote->nfetch_refs = 0;
2317 			remote->fetch_refs = NULL;
2318 			(*nremotes)++;
2319 			break;
2320 		default:
2321 			err = got_error(GOT_ERR_PRIVSEP_MSG);
2322 			break;
2323 		}
2324 
2325 		imsg_free(&imsg);
2326 		if (err)
2327 			break;
2328 	}
2329 
2330 	if (err) {
2331 		int i;
2332 		for (i = 0; i < *nremotes; i++)
2333 			free_remote_data(&(*remotes)[i]);
2334 		free(*remotes);
2335 		*remotes = NULL;
2336 		*nremotes = 0;
2337 	}
2338 	return err;
2339 }
2340 
2341 const struct got_error *
2342 got_privsep_send_gotconfig_parse_req(struct imsgbuf *ibuf, int fd)
2343 {
2344 	const struct got_error *err = NULL;
2345 
2346 	if (imsg_compose(ibuf, GOT_IMSG_GOTCONFIG_PARSE_REQUEST, 0, 0, fd,
2347 	    NULL, 0) == -1) {
2348 		err = got_error_from_errno("imsg_compose "
2349 		    "GOTCONFIG_PARSE_REQUEST");
2350 		close(fd);
2351 		return err;
2352 	}
2353 
2354 	return flush_imsg(ibuf);
2355 }
2356 
2357 const struct got_error *
2358 got_privsep_send_gotconfig_author_req(struct imsgbuf *ibuf)
2359 {
2360 	if (imsg_compose(ibuf,
2361 	    GOT_IMSG_GOTCONFIG_AUTHOR_REQUEST, 0, 0, -1, NULL, 0) == -1)
2362 		return got_error_from_errno("imsg_compose "
2363 		    "GOTCONFIG_AUTHOR_REQUEST");
2364 
2365 	return flush_imsg(ibuf);
2366 }
2367 
2368 const struct got_error *
2369 got_privsep_send_gotconfig_allowed_signers_req(struct imsgbuf *ibuf)
2370 {
2371 	if (imsg_compose(ibuf,
2372 	    GOT_IMSG_GOTCONFIG_ALLOWEDSIGNERS_REQUEST, 0, 0, -1, NULL, 0) == -1)
2373 		return got_error_from_errno("imsg_compose "
2374 		    "GOTCONFIG_ALLOWEDSIGNERS_REQUEST");
2375 
2376 	return flush_imsg(ibuf);
2377 }
2378 
2379 const struct got_error *
2380 got_privsep_send_gotconfig_revoked_signers_req(struct imsgbuf *ibuf)
2381 {
2382 	if (imsg_compose(ibuf,
2383 	    GOT_IMSG_GOTCONFIG_REVOKEDSIGNERS_REQUEST, 0, 0, -1, NULL, 0) == -1)
2384 		return got_error_from_errno("imsg_compose "
2385 		    "GOTCONFIG_REVOKEDSIGNERS_REQUEST");
2386 
2387 	return flush_imsg(ibuf);
2388 }
2389 
2390 const struct got_error *
2391 got_privsep_send_gotconfig_remotes_req(struct imsgbuf *ibuf)
2392 {
2393 	if (imsg_compose(ibuf,
2394 	    GOT_IMSG_GOTCONFIG_REMOTES_REQUEST, 0, 0, -1, NULL, 0) == -1)
2395 		return got_error_from_errno("imsg_compose "
2396 		    "GOTCONFIG_REMOTE_REQUEST");
2397 
2398 	return flush_imsg(ibuf);
2399 }
2400 
2401 const struct got_error *
2402 got_privsep_recv_gotconfig_str(char **str, struct imsgbuf *ibuf)
2403 {
2404 	const struct got_error *err = NULL;
2405 	struct imsg imsg;
2406 	size_t datalen;
2407 
2408 	*str = NULL;
2409 
2410 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
2411 	if (err)
2412 		return err;
2413 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2414 
2415 	switch (imsg.hdr.type) {
2416 	case GOT_IMSG_ERROR:
2417 		err = recv_imsg_error(&imsg, datalen);
2418 		break;
2419 	case GOT_IMSG_GOTCONFIG_STR_VAL:
2420 		if (datalen == 0)
2421 			break;
2422 		/* datalen does not include terminating \0 */
2423 		*str = malloc(datalen + 1);
2424 		if (*str == NULL) {
2425 			err = got_error_from_errno("malloc");
2426 			break;
2427 		}
2428 		memcpy(*str, imsg.data, datalen);
2429 		(*str)[datalen] = '\0';
2430 		break;
2431 	default:
2432 		err = got_error(GOT_ERR_PRIVSEP_MSG);
2433 		break;
2434 	}
2435 
2436 	imsg_free(&imsg);
2437 	return err;
2438 }
2439 
2440 const struct got_error *
2441 got_privsep_recv_gotconfig_remotes(struct got_remote_repo **remotes,
2442     int *nremotes, struct imsgbuf *ibuf)
2443 {
2444 	const struct got_error *err = NULL;
2445 	struct imsg imsg;
2446 	size_t datalen;
2447 	struct got_imsg_remotes iremotes;
2448 	struct got_imsg_remote iremote;
2449 	const size_t min_datalen =
2450 	    MIN(sizeof(struct got_imsg_error), sizeof(iremotes));
2451 
2452 	*remotes = NULL;
2453 	*nremotes = 0;
2454 	iremotes.nremotes = 0;
2455 
2456 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
2457 	if (err)
2458 		return err;
2459 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2460 
2461 	switch (imsg.hdr.type) {
2462 	case GOT_IMSG_ERROR:
2463 		err = recv_imsg_error(&imsg, datalen);
2464 		break;
2465 	case GOT_IMSG_GOTCONFIG_REMOTES:
2466 		if (datalen != sizeof(iremotes)) {
2467 			err = got_error(GOT_ERR_PRIVSEP_LEN);
2468 			break;
2469 		}
2470 		memcpy(&iremotes, imsg.data, sizeof(iremotes));
2471 		if (iremotes.nremotes < 0) {
2472 			err = got_error(GOT_ERR_PRIVSEP_LEN);
2473 			break;
2474 		}
2475 		if (iremotes.nremotes == 0) {
2476 			imsg_free(&imsg);
2477 			return NULL;
2478 		}
2479 		break;
2480 	default:
2481 		imsg_free(&imsg);
2482 		return got_error(GOT_ERR_PRIVSEP_MSG);
2483 	}
2484 
2485 	imsg_free(&imsg);
2486 
2487 	*remotes = recallocarray(NULL, 0, iremotes.nremotes, sizeof(**remotes));
2488 	if (*remotes == NULL)
2489 		return got_error_from_errno("recallocarray");
2490 
2491 	while (*nremotes < iremotes.nremotes) {
2492 		struct got_remote_repo *remote;
2493 		const size_t min_datalen =
2494 		    MIN(sizeof(struct got_imsg_error), sizeof(iremote));
2495 		int i;
2496 
2497 		err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
2498 		if (err)
2499 			break;
2500 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2501 
2502 		switch (imsg.hdr.type) {
2503 		case GOT_IMSG_ERROR:
2504 			err = recv_imsg_error(&imsg, datalen);
2505 			break;
2506 		case GOT_IMSG_GOTCONFIG_REMOTE:
2507 			remote = &(*remotes)[*nremotes];
2508 			memset(remote, 0, sizeof(*remote));
2509 			if (datalen < sizeof(iremote)) {
2510 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2511 				break;
2512 			}
2513 			memcpy(&iremote, imsg.data, sizeof(iremote));
2514 			if (iremote.name_len == 0 ||
2515 			    (iremote.fetch_url_len == 0 &&
2516 			    iremote.send_url_len == 0) ||
2517 			    (sizeof(iremote) + iremote.name_len +
2518 			    iremote.fetch_url_len + iremote.send_url_len) >
2519 			    datalen) {
2520 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2521 				break;
2522 			}
2523 			remote->name = strndup(imsg.data + sizeof(iremote),
2524 			    iremote.name_len);
2525 			if (remote->name == NULL) {
2526 				err = got_error_from_errno("strndup");
2527 				break;
2528 			}
2529 			remote->fetch_url = strndup(imsg.data +
2530 			    sizeof(iremote) + iremote.name_len,
2531 			    iremote.fetch_url_len);
2532 			if (remote->fetch_url == NULL) {
2533 				err = got_error_from_errno("strndup");
2534 				free_remote_data(remote);
2535 				break;
2536 			}
2537 			remote->send_url = strndup(imsg.data +
2538 			    sizeof(iremote) + iremote.name_len +
2539 			    iremote.fetch_url_len, iremote.send_url_len);
2540 			if (remote->send_url == NULL) {
2541 				err = got_error_from_errno("strndup");
2542 				free_remote_data(remote);
2543 				break;
2544 			}
2545 			remote->mirror_references = iremote.mirror_references;
2546 			remote->fetch_all_branches = iremote.fetch_all_branches;
2547 			if (iremote.nfetch_branches > 0) {
2548 				remote->fetch_branches = recallocarray(NULL, 0,
2549 				    iremote.nfetch_branches, sizeof(char *));
2550 				if (remote->fetch_branches == NULL) {
2551 					err = got_error_from_errno("calloc");
2552 					free_remote_data(remote);
2553 					break;
2554 				}
2555 			}
2556 			remote->nfetch_branches = 0;
2557 			for (i = 0; i < iremote.nfetch_branches; i++) {
2558 				char *branch;
2559 				err = got_privsep_recv_gotconfig_str(&branch,
2560 				    ibuf);
2561 				if (err) {
2562 					free_remote_data(remote);
2563 					goto done;
2564 				}
2565 				remote->fetch_branches[i] = branch;
2566 				remote->nfetch_branches++;
2567 			}
2568 			if (iremote.nsend_branches > 0) {
2569 				remote->send_branches = recallocarray(NULL, 0,
2570 				    iremote.nsend_branches, sizeof(char *));
2571 				if (remote->send_branches == NULL) {
2572 					err = got_error_from_errno("calloc");
2573 					free_remote_data(remote);
2574 					break;
2575 				}
2576 			}
2577 			remote->nsend_branches = 0;
2578 			for (i = 0; i < iremote.nsend_branches; i++) {
2579 				char *branch;
2580 				err = got_privsep_recv_gotconfig_str(&branch,
2581 				    ibuf);
2582 				if (err) {
2583 					free_remote_data(remote);
2584 					goto done;
2585 				}
2586 				remote->send_branches[i] = branch;
2587 				remote->nsend_branches++;
2588 			}
2589 			if (iremote.nfetch_refs > 0) {
2590 				remote->fetch_refs = recallocarray(NULL, 0,
2591 				    iremote.nfetch_refs, sizeof(char *));
2592 				if (remote->fetch_refs == NULL) {
2593 					err = got_error_from_errno("calloc");
2594 					free_remote_data(remote);
2595 					break;
2596 				}
2597 			}
2598 			remote->nfetch_refs = 0;
2599 			for (i = 0; i < iremote.nfetch_refs; i++) {
2600 				char *ref;
2601 				err = got_privsep_recv_gotconfig_str(&ref,
2602 				    ibuf);
2603 				if (err) {
2604 					free_remote_data(remote);
2605 					goto done;
2606 				}
2607 				remote->fetch_refs[i] = ref;
2608 				remote->nfetch_refs++;
2609 			}
2610 			(*nremotes)++;
2611 			break;
2612 		default:
2613 			err = got_error(GOT_ERR_PRIVSEP_MSG);
2614 			break;
2615 		}
2616 
2617 		imsg_free(&imsg);
2618 		if (err)
2619 			break;
2620 	}
2621 done:
2622 	if (err) {
2623 		int i;
2624 		for (i = 0; i < *nremotes; i++)
2625 			free_remote_data(&(*remotes)[i]);
2626 		free(*remotes);
2627 		*remotes = NULL;
2628 		*nremotes = 0;
2629 	}
2630 	return err;
2631 }
2632 
2633 const struct got_error *
2634 got_privsep_send_commit_traversal_request(struct imsgbuf *ibuf,
2635     struct got_object_id *id, int idx, const char *path)
2636 {
2637 	struct ibuf *wbuf;
2638 	size_t path_len = strlen(path) + 1;
2639 
2640 	wbuf = imsg_create(ibuf, GOT_IMSG_COMMIT_TRAVERSAL_REQUEST, 0, 0,
2641 	    sizeof(struct got_imsg_commit_traversal_request) + path_len);
2642 	if (wbuf == NULL)
2643 		return got_error_from_errno(
2644 		    "imsg_create COMMIT_TRAVERSAL_REQUEST");
2645 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1)
2646 		return got_error_from_errno("imsg_add "
2647 		    "COMMIT_TRAVERSAL_REQUEST");
2648 	if (imsg_add(wbuf, &idx, sizeof(idx)) == -1)
2649 		return got_error_from_errno("imsg_add "
2650 		    "COMMIT_TRAVERSAL_REQUEST");
2651 	if (imsg_add(wbuf, path, path_len) == -1)
2652 		return got_error_from_errno("imsg_add "
2653 		    "COMMIT_TRAVERSAL_REQUEST");
2654 
2655 	wbuf->fd = -1;
2656 	imsg_close(ibuf, wbuf);
2657 
2658 	return flush_imsg(ibuf);
2659 }
2660 
2661 const struct got_error *
2662 got_privsep_recv_traversed_commits(struct got_commit_object **changed_commit,
2663     struct got_object_id **changed_commit_id,
2664     struct got_object_id_queue *commit_ids, struct imsgbuf *ibuf)
2665 {
2666 	const struct got_error *err = NULL;
2667 	struct imsg imsg;
2668 	struct got_imsg_traversed_commits *icommits;
2669 	size_t datalen;
2670 	int i, done = 0;
2671 
2672 	*changed_commit = NULL;
2673 	*changed_commit_id = NULL;
2674 
2675 	while (!done) {
2676 		err = got_privsep_recv_imsg(&imsg, ibuf, 0);
2677 		if (err)
2678 			return err;
2679 
2680 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2681 		switch (imsg.hdr.type) {
2682 		case GOT_IMSG_TRAVERSED_COMMITS:
2683 			icommits = imsg.data;
2684 			if (datalen != sizeof(*icommits) +
2685 			    icommits->ncommits * SHA1_DIGEST_LENGTH) {
2686 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2687 				break;
2688 			}
2689 			for (i = 0; i < icommits->ncommits; i++) {
2690 				struct got_object_qid *qid;
2691 				uint8_t *sha1 = (uint8_t *)imsg.data +
2692 				    sizeof(*icommits) + i * SHA1_DIGEST_LENGTH;
2693 				err = got_object_qid_alloc_partial(&qid);
2694 				if (err)
2695 					break;
2696 				memcpy(qid->id.sha1, sha1, SHA1_DIGEST_LENGTH);
2697 				STAILQ_INSERT_TAIL(commit_ids, qid, entry);
2698 
2699 				/* The last commit may contain a change. */
2700 				if (i == icommits->ncommits - 1) {
2701 					*changed_commit_id =
2702 					    got_object_id_dup(&qid->id);
2703 					if (*changed_commit_id == NULL) {
2704 						err = got_error_from_errno(
2705 						    "got_object_id_dup");
2706 						break;
2707 					}
2708 				}
2709 			}
2710 			break;
2711 		case GOT_IMSG_COMMIT:
2712 			if (*changed_commit_id == NULL) {
2713 				err = got_error(GOT_ERR_PRIVSEP_MSG);
2714 				break;
2715 			}
2716 			err = get_commit_from_imsg(changed_commit, &imsg,
2717 			    datalen, ibuf);
2718 			break;
2719 		case GOT_IMSG_COMMIT_TRAVERSAL_DONE:
2720 			done = 1;
2721 			break;
2722 		default:
2723 			err = got_error(GOT_ERR_PRIVSEP_MSG);
2724 			break;
2725 		}
2726 
2727 		imsg_free(&imsg);
2728 		if (err)
2729 			break;
2730 	}
2731 
2732 	if (err)
2733 		got_object_id_queue_free(commit_ids);
2734 	return err;
2735 }
2736 
2737 const struct got_error *
2738 got_privsep_send_enumerated_tree(size_t *totlen, struct imsgbuf *ibuf,
2739     struct got_object_id *tree_id, const char *path,
2740     struct got_parsed_tree_entry *entries, int nentries)
2741 {
2742 	const struct got_error *err = NULL;
2743 	struct ibuf *wbuf;
2744 	size_t path_len = strlen(path);
2745 	size_t msglen;
2746 
2747 	msglen = sizeof(struct got_imsg_enumerated_tree) + path_len;
2748 	wbuf = imsg_create(ibuf, GOT_IMSG_ENUMERATED_TREE, 0, 0, msglen);
2749 	if (wbuf == NULL)
2750 		return got_error_from_errno("imsg_create ENUMERATED_TREE");
2751 
2752 	if (imsg_add(wbuf, tree_id->sha1, SHA1_DIGEST_LENGTH) == -1)
2753 		return got_error_from_errno("imsg_add ENUMERATED_TREE");
2754 	if (imsg_add(wbuf, &nentries, sizeof(nentries)) == -1)
2755 		return got_error_from_errno("imsg_add ENUMERATED_TREE");
2756 	if (imsg_add(wbuf, path, path_len) == -1)
2757 		return got_error_from_errno("imsg_add ENUMERATED_TREE");
2758 
2759 	wbuf->fd = -1;
2760 	imsg_close(ibuf, wbuf);
2761 
2762 	if (entries) {
2763 		err = send_tree_entries(ibuf, entries, nentries);
2764 		if (err)
2765 			return err;
2766 	}
2767 
2768 	return flush_imsg(ibuf);
2769 }
2770 
2771 const struct got_error *
2772 got_privsep_send_object_enumeration_request(struct imsgbuf *ibuf)
2773 {
2774 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT_ENUMERATION_REQUEST,
2775 	    0, 0, -1, NULL, 0) == -1)
2776 		return got_error_from_errno("imsg_compose "
2777 		    "OBJECT_ENUMERATION_REQUEST");
2778 
2779 	return flush_imsg(ibuf);
2780 }
2781 
2782 const struct got_error *
2783 got_privsep_send_object_enumeration_done(struct imsgbuf *ibuf)
2784 {
2785 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT_ENUMERATION_DONE,
2786 	    0, 0, -1, NULL, 0) == -1)
2787 		return got_error_from_errno("imsg_compose "
2788 		    "OBJECT_ENUMERATION_DONE");
2789 
2790 	return flush_imsg(ibuf);
2791 }
2792 
2793 const struct got_error *
2794 got_privsep_send_object_enumeration_incomplete(struct imsgbuf *ibuf)
2795 {
2796 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT_ENUMERATION_INCOMPLETE,
2797 	    0, 0, -1, NULL, 0) == -1)
2798 		return got_error_from_errno("imsg_compose "
2799 		    "OBJECT_ENUMERATION_INCOMPLETE");
2800 
2801 	return flush_imsg(ibuf);
2802 }
2803 
2804 const struct got_error *
2805 got_privsep_send_enumerated_commit(struct imsgbuf *ibuf,
2806     struct got_object_id *id, time_t mtime)
2807 {
2808 	struct ibuf *wbuf;
2809 
2810 	wbuf = imsg_create(ibuf, GOT_IMSG_ENUMERATED_COMMIT, 0, 0,
2811 	    sizeof(struct got_imsg_enumerated_commit) + SHA1_DIGEST_LENGTH);
2812 	if (wbuf == NULL)
2813 		return got_error_from_errno("imsg_create ENUMERATED_COMMIT");
2814 
2815 	/* Keep in sync with struct got_imsg_enumerated_commit! */
2816 	if (imsg_add(wbuf, id, SHA1_DIGEST_LENGTH) == -1)
2817 		return got_error_from_errno("imsg_add ENUMERATED_COMMIT");
2818 	if (imsg_add(wbuf, &mtime, sizeof(mtime)) == -1)
2819 		return got_error_from_errno("imsg_add ENUMERATED_COMMIT");
2820 
2821 	wbuf->fd = -1;
2822 	imsg_close(ibuf, wbuf);
2823 	/* Don't flush yet, tree entries or ENUMERATION_DONE will follow. */
2824 	return NULL;
2825 }
2826 
2827 const struct got_error *
2828 got_privsep_recv_enumerated_objects(int *found_all_objects,
2829     struct imsgbuf *ibuf,
2830     got_object_enumerate_commit_cb cb_commit,
2831     got_object_enumerate_tree_cb cb_tree, void *cb_arg,
2832     struct got_repository *repo)
2833 {
2834 	const struct got_error *err = NULL;
2835 	struct imsg imsg;
2836 	struct got_imsg_enumerated_commit *icommit = NULL;
2837 	struct got_object_id commit_id;
2838 	int have_commit = 0;
2839 	time_t mtime = 0;
2840 	struct got_tree_object tree;
2841 	struct got_imsg_enumerated_tree *itree;
2842 	struct got_object_id tree_id;
2843 	char *path = NULL, *canon_path = NULL;
2844 	size_t datalen, path_len;
2845 	int nentries = -1;
2846 	int done = 0;
2847 
2848 	*found_all_objects = 0;
2849 	memset(&tree, 0, sizeof(tree));
2850 
2851 	while (!done) {
2852 		err = got_privsep_recv_imsg(&imsg, ibuf, 0);
2853 		if (err)
2854 			break;
2855 
2856 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2857 		switch (imsg.hdr.type) {
2858 		case GOT_IMSG_ENUMERATED_COMMIT:
2859 			if (have_commit && nentries != -1) {
2860 				err = got_error(GOT_ERR_PRIVSEP_MSG);
2861 				break;
2862 			}
2863 			if (datalen != sizeof(*icommit)) {
2864 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2865 				break;
2866 			}
2867 			icommit = (struct got_imsg_enumerated_commit *)imsg.data;
2868 			memcpy(commit_id.sha1, icommit->id, SHA1_DIGEST_LENGTH);
2869 			mtime = icommit->mtime;
2870 			have_commit = 1;
2871 			break;
2872 		case GOT_IMSG_ENUMERATED_TREE:
2873 			/* Should be preceeded by GOT_IMSG_ENUMERATED_COMMIT. */
2874 			if (!have_commit) {
2875 				err = got_error(GOT_ERR_PRIVSEP_MSG);
2876 				break;
2877 			}
2878 			if (datalen < sizeof(*itree)) {
2879 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2880 				break;
2881 			}
2882 			itree = imsg.data;
2883 			path_len = datalen - sizeof(*itree);
2884 			if (path_len == 0) {
2885 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2886 				break;
2887 			}
2888 			memcpy(tree_id.sha1, itree->id, sizeof(tree_id.sha1));
2889 			free(path);
2890 			path = malloc(path_len + 1);
2891 			if (path == NULL) {
2892 				err = got_error_from_errno("malloc");
2893 				break;
2894 			}
2895 			free(canon_path);
2896 			canon_path = malloc(path_len + 1);
2897 			if (canon_path == NULL) {
2898 				err = got_error_from_errno("malloc");
2899 				break;
2900 			}
2901 			memcpy(path, (uint8_t *)imsg.data + sizeof(*itree),
2902 			    path_len);
2903 			path[path_len] = '\0';
2904 			if (!got_path_is_absolute(path)) {
2905 				err = got_error(GOT_ERR_BAD_PATH);
2906 				break;
2907 			}
2908 			if (got_path_is_root_dir(path)) {
2909 				/* XXX check what got_canonpath() does wrong */
2910 				canon_path[0] = '/';
2911 				canon_path[1] = '\0';
2912 			} else {
2913 				err = got_canonpath(path, canon_path,
2914 				    path_len + 1);
2915 				if (err)
2916 					break;
2917 			}
2918 			if (strcmp(path, canon_path) != 0) {
2919 				err = got_error(GOT_ERR_BAD_PATH);
2920 				break;
2921 			}
2922 			if (nentries != -1) {
2923 				err = got_error(GOT_ERR_PRIVSEP_MSG);
2924 				break;
2925 			}
2926 			if (itree->nentries < -1) {
2927 				err = got_error(GOT_ERR_PRIVSEP_MSG);
2928 				break;
2929 			}
2930 			if (itree->nentries == -1) {
2931 				/* Tree was not found in pack file. */
2932 				err = cb_tree(cb_arg, NULL, mtime, &tree_id,
2933 				    path, repo);
2934 				break;
2935 			}
2936 			if (itree->nentries > INT_MAX) {
2937 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2938 				break;
2939 			}
2940 			tree.entries = calloc(itree->nentries,
2941 			    sizeof(struct got_tree_entry));
2942 			if (tree.entries == NULL) {
2943 				err = got_error_from_errno("calloc");
2944 				break;
2945 			}
2946 			if (itree->nentries == 0) {
2947 				err = cb_tree(cb_arg, &tree, mtime, &tree_id,
2948 				    path, repo);
2949 				if (err)
2950 					break;
2951 
2952 				/* Prepare for next tree. */
2953 				free(tree.entries);
2954 				memset(&tree, 0, sizeof(tree));
2955 				nentries = -1;
2956 			} else {
2957 				tree.nentries = itree->nentries;
2958 				nentries = 0;
2959 			}
2960 			break;
2961 		case GOT_IMSG_TREE_ENTRIES:
2962 			/* Should be preceeded by GOT_IMSG_ENUMERATED_TREE. */
2963 			if (nentries <= -1) {
2964 				err = got_error(GOT_ERR_PRIVSEP_MSG);
2965 				break;
2966 			}
2967 			err = recv_tree_entries(imsg.data, datalen,
2968 			    &tree, &nentries);
2969 			if (err)
2970 				break;
2971 			if (tree.nentries == nentries) {
2972 				err = cb_tree(cb_arg, &tree, mtime, &tree_id,
2973 				    path, repo);
2974 				if (err)
2975 					break;
2976 
2977 				/* Prepare for next tree. */
2978 				free(tree.entries);
2979 				memset(&tree, 0, sizeof(tree));
2980 				nentries = -1;
2981 			}
2982 			break;
2983 		case GOT_IMSG_TREE_ENUMERATION_DONE:
2984 			/* All trees have been found and traversed. */
2985 			if (!have_commit || path == NULL || nentries != -1) {
2986 				err = got_error(GOT_ERR_PRIVSEP_MSG);
2987 				break;
2988 			}
2989 			err = cb_commit(cb_arg, mtime, &commit_id, repo);
2990 			if (err)
2991 				break;
2992 			have_commit = 0;
2993 			break;
2994 		case GOT_IMSG_OBJECT_ENUMERATION_DONE:
2995 			*found_all_objects = 1;
2996 			done = 1;
2997 			break;
2998 		case GOT_IMSG_OBJECT_ENUMERATION_INCOMPLETE:
2999 			done = 1;
3000 			break;
3001 		default:
3002 			err = got_error(GOT_ERR_PRIVSEP_MSG);
3003 			break;
3004 		}
3005 
3006 		imsg_free(&imsg);
3007 		if (err)
3008 			break;
3009 	}
3010 
3011 	free(path);
3012 	free(canon_path);
3013 	free(tree.entries);
3014 	return err;
3015 }
3016 
3017 const struct got_error *
3018 got_privsep_send_raw_delta_req(struct imsgbuf *ibuf, int idx,
3019     struct got_object_id *id)
3020 {
3021 	struct got_imsg_raw_delta_request dreq;
3022 
3023 	memset(&dreq, 0, sizeof(dreq));
3024 	dreq.idx = idx;
3025 	memcpy(dreq.id, id->sha1, SHA1_DIGEST_LENGTH);
3026 
3027 	if (imsg_compose(ibuf, GOT_IMSG_RAW_DELTA_REQUEST, 0, 0, -1,
3028 	    &dreq, sizeof(dreq)) == -1)
3029 		return got_error_from_errno("imsg_compose RAW_DELTA_REQUEST");
3030 
3031 	return flush_imsg(ibuf);
3032 }
3033 
3034 const struct got_error *
3035 got_privsep_send_raw_delta_outfd(struct imsgbuf *ibuf, int fd)
3036 {
3037 	return send_fd(ibuf, GOT_IMSG_RAW_DELTA_OUTFD, fd);
3038 }
3039 
3040 const struct got_error *
3041 got_privsep_send_raw_delta(struct imsgbuf *ibuf, uint64_t base_size,
3042     uint64_t result_size,  off_t delta_size, off_t delta_compressed_size,
3043     off_t delta_offset, off_t delta_out_offset, struct got_object_id *base_id)
3044 {
3045 	struct got_imsg_raw_delta idelta;
3046 	int ret;
3047 
3048 	memset(&idelta, 0, sizeof(idelta));
3049 	idelta.base_size = base_size;
3050 	idelta.result_size = result_size;
3051 	idelta.delta_size = delta_size;
3052 	idelta.delta_compressed_size = delta_compressed_size;
3053 	idelta.delta_offset = delta_offset;
3054 	idelta.delta_out_offset = delta_out_offset;
3055 	memcpy(idelta.base_id, base_id->sha1, SHA1_DIGEST_LENGTH);
3056 
3057 	ret = imsg_compose(ibuf, GOT_IMSG_RAW_DELTA, 0, 0, -1,
3058 	    &idelta, sizeof(idelta));
3059 	if (ret == -1)
3060 		return got_error_from_errno("imsg_compose RAW_DELTA");
3061 
3062 	return flush_imsg(ibuf);
3063 }
3064 
3065 const struct got_error *
3066 got_privsep_recv_raw_delta(uint64_t *base_size, uint64_t *result_size,
3067     off_t *delta_size, off_t *delta_compressed_size, off_t *delta_offset,
3068     off_t *delta_out_offset, struct got_object_id **base_id, struct imsgbuf *ibuf)
3069 {
3070 	const struct got_error *err = NULL;
3071 	struct imsg imsg;
3072 	struct got_imsg_raw_delta *delta;
3073 	size_t datalen;
3074 
3075 	*base_size = 0;
3076 	*result_size = 0;
3077 	*delta_size = 0;
3078 	*delta_compressed_size = 0;
3079 	*delta_offset = 0;
3080 	*delta_out_offset = 0;
3081 	*base_id = NULL;
3082 
3083 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
3084 	if (err)
3085 		return err;
3086 
3087 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
3088 
3089 	switch (imsg.hdr.type) {
3090 	case GOT_IMSG_RAW_DELTA:
3091 		if (datalen != sizeof(*delta)) {
3092 			err = got_error(GOT_ERR_PRIVSEP_LEN);
3093 			break;
3094 		}
3095 		delta = imsg.data;
3096 		*base_size = delta->base_size;
3097 		*result_size = delta->result_size;
3098 		*delta_size = delta->delta_size;
3099 		*delta_compressed_size = delta->delta_compressed_size;
3100 		*delta_offset = delta->delta_offset;
3101 		*delta_out_offset = delta->delta_out_offset;
3102 		*base_id = calloc(1, sizeof(**base_id));
3103 		if (*base_id == NULL) {
3104 			err = got_error_from_errno("malloc");
3105 			break;
3106 		}
3107 		memcpy((*base_id)->sha1, delta->base_id, SHA1_DIGEST_LENGTH);
3108 		break;
3109 	default:
3110 		err = got_error(GOT_ERR_PRIVSEP_MSG);
3111 		break;
3112 	}
3113 
3114 	imsg_free(&imsg);
3115 
3116 	if (err) {
3117 		free(*base_id);
3118 		*base_id = NULL;
3119 	}
3120 	return err;
3121 }
3122 
3123 static const struct got_error *
3124 send_idlist(struct imsgbuf *ibuf, struct got_object_id **ids, size_t nids)
3125 {
3126 	const struct got_error *err = NULL;
3127 	struct got_imsg_object_idlist idlist;
3128 	struct ibuf *wbuf;
3129 	size_t i;
3130 
3131 	memset(&idlist, 0, sizeof(idlist));
3132 
3133 	if (nids > GOT_IMSG_OBJ_ID_LIST_MAX_NIDS)
3134 		return got_error(GOT_ERR_NO_SPACE);
3135 
3136 	wbuf = imsg_create(ibuf, GOT_IMSG_OBJ_ID_LIST, 0, 0,
3137 	    sizeof(idlist) + nids * sizeof(**ids));
3138 	if (wbuf == NULL) {
3139 		err = got_error_from_errno("imsg_create OBJ_ID_LIST");
3140 		return err;
3141 	}
3142 
3143 	idlist.nids = nids;
3144 	if (imsg_add(wbuf, &idlist, sizeof(idlist)) == -1)
3145 		return got_error_from_errno("imsg_add OBJ_ID_LIST");
3146 
3147 	for (i = 0; i < nids; i++) {
3148 		struct got_object_id *id = ids[i];
3149 		if (imsg_add(wbuf, id, sizeof(*id)) == -1)
3150 			return got_error_from_errno("imsg_add OBJ_ID_LIST");
3151 	}
3152 
3153 	wbuf->fd = -1;
3154 	imsg_close(ibuf, wbuf);
3155 
3156 	return flush_imsg(ibuf);
3157 }
3158 
3159 const struct got_error *
3160 got_privsep_send_object_idlist(struct imsgbuf *ibuf,
3161     struct got_object_id **ids, size_t nids)
3162 {
3163 	const struct got_error *err = NULL;
3164 	struct got_object_id *idlist[GOT_IMSG_OBJ_ID_LIST_MAX_NIDS];
3165 	int i, queued = 0;
3166 
3167 	for (i = 0; i < nids; i++) {
3168 		idlist[i % nitems(idlist)] = ids[i];
3169 		queued++;
3170 		if (queued >= nitems(idlist)) {
3171 			err = send_idlist(ibuf, idlist, queued);
3172 			if (err)
3173 				return err;
3174 			queued = 0;
3175 		}
3176 	}
3177 
3178 	if (queued > 0) {
3179 		err = send_idlist(ibuf, idlist, queued);
3180 		if (err)
3181 			return err;
3182 	}
3183 
3184 	return NULL;
3185 }
3186 
3187 const struct got_error *
3188 got_privsep_send_object_idlist_done(struct imsgbuf *ibuf)
3189 {
3190 	if (imsg_compose(ibuf, GOT_IMSG_OBJ_ID_LIST_DONE, 0, 0, -1, NULL, 0)
3191 	    == -1)
3192 		return got_error_from_errno("imsg_compose OBJ_ID_LIST_DONE");
3193 
3194 	return flush_imsg(ibuf);
3195 }
3196 
3197 const struct got_error *
3198 got_privsep_recv_object_idlist(int *done, struct got_object_id **ids,
3199     size_t *nids, struct imsgbuf *ibuf)
3200 {
3201 	const struct got_error *err = NULL;
3202 	struct imsg imsg;
3203 	struct got_imsg_object_idlist *idlist;
3204 	size_t datalen;
3205 
3206 	*ids = NULL;
3207 	*done = 0;
3208 	*nids = 0;
3209 
3210 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
3211 	if (err)
3212 		return err;
3213 
3214 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
3215 	switch (imsg.hdr.type) {
3216 	case GOT_IMSG_OBJ_ID_LIST:
3217 		if (datalen < sizeof(*idlist)) {
3218 			err = got_error(GOT_ERR_PRIVSEP_LEN);
3219 			break;
3220 		}
3221 		idlist = imsg.data;
3222 		if (idlist->nids > GOT_IMSG_OBJ_ID_LIST_MAX_NIDS ||
3223 		    idlist->nids * sizeof(**ids) > datalen - sizeof(*idlist)) {
3224 			err = got_error(GOT_ERR_PRIVSEP_LEN);
3225 			break;
3226 		}
3227 		*nids = idlist->nids;
3228 		*ids = calloc(*nids, sizeof(**ids));
3229 		if (*ids == NULL) {
3230 			err = got_error_from_errno("calloc");
3231 			break;
3232 		}
3233 		memcpy(*ids, (uint8_t *)imsg.data + sizeof(*idlist),
3234 		    *nids * sizeof(**ids));
3235 		break;
3236 	case GOT_IMSG_OBJ_ID_LIST_DONE:
3237 		*done = 1;
3238 		break;
3239 	default:
3240 		err = got_error(GOT_ERR_PRIVSEP_MSG);
3241 		break;
3242 	}
3243 
3244 	imsg_free(&imsg);
3245 
3246 	return err;
3247 }
3248 
3249 const struct got_error *
3250 got_privsep_send_delta_reuse_req(struct imsgbuf *ibuf)
3251 {
3252 	if (imsg_compose(ibuf, GOT_IMSG_DELTA_REUSE_REQUEST, 0, 0, -1, NULL, 0)
3253 	    == -1)
3254 		return got_error_from_errno("imsg_compose DELTA_REUSE_REQUEST");
3255 
3256 	return flush_imsg(ibuf);
3257 }
3258 
3259 const struct got_error *
3260 got_privsep_send_reused_deltas(struct imsgbuf *ibuf,
3261     struct got_imsg_reused_delta *deltas, size_t ndeltas)
3262 {
3263 	const struct got_error *err = NULL;
3264 	struct ibuf *wbuf;
3265 	struct got_imsg_reused_deltas ideltas;
3266 	size_t i;
3267 
3268 	memset(&ideltas, 0, sizeof(ideltas));
3269 
3270 	if (ndeltas > GOT_IMSG_REUSED_DELTAS_MAX_NDELTAS)
3271 		return got_error(GOT_ERR_NO_SPACE);
3272 
3273 	wbuf = imsg_create(ibuf, GOT_IMSG_REUSED_DELTAS, 0, 0,
3274 	    sizeof(ideltas) + ndeltas * sizeof(*deltas));
3275 	if (wbuf == NULL) {
3276 		err = got_error_from_errno("imsg_create REUSED_DELTAS");
3277 		return err;
3278 	}
3279 
3280 	ideltas.ndeltas = ndeltas;
3281 	if (imsg_add(wbuf, &ideltas, sizeof(ideltas)) == -1)
3282 		return got_error_from_errno("imsg_add REUSED_DELTAS");
3283 
3284 	for (i = 0; i < ndeltas; i++) {
3285 		struct got_imsg_reused_delta *delta = &deltas[i];
3286 		if (imsg_add(wbuf, delta, sizeof(*delta)) == -1)
3287 			return got_error_from_errno("imsg_add REUSED_DELTAS");
3288 	}
3289 
3290 	wbuf->fd = -1;
3291 	imsg_close(ibuf, wbuf);
3292 
3293 	return flush_imsg(ibuf);
3294 }
3295 
3296 const struct got_error *
3297 got_privsep_send_reused_deltas_done(struct imsgbuf *ibuf)
3298 {
3299 	if (imsg_compose(ibuf, GOT_IMSG_DELTA_REUSE_DONE, 0, 0, -1, NULL, 0)
3300 	    == -1)
3301 		return got_error_from_errno("imsg_compose DELTA_REUSE_DONE");
3302 
3303 	return flush_imsg(ibuf);
3304 }
3305 
3306 const struct got_error *
3307 got_privsep_recv_reused_deltas(int *done, struct got_imsg_reused_delta *deltas,
3308     size_t *ndeltas, struct imsgbuf *ibuf)
3309 {
3310 	const struct got_error *err = NULL;
3311 	struct imsg imsg;
3312 	struct got_imsg_reused_deltas *ideltas;
3313 	size_t datalen;
3314 
3315 	*done = 0;
3316 	*ndeltas = 0;
3317 
3318 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
3319 	if (err)
3320 		return err;
3321 
3322 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
3323 	switch (imsg.hdr.type) {
3324 	case GOT_IMSG_REUSED_DELTAS:
3325 		if (datalen < sizeof(*ideltas)) {
3326 			err = got_error(GOT_ERR_PRIVSEP_LEN);
3327 			break;
3328 		}
3329 		ideltas = imsg.data;
3330 		if (ideltas->ndeltas > GOT_IMSG_OBJ_ID_LIST_MAX_NIDS ||
3331 		    ideltas->ndeltas * sizeof(*deltas) >
3332 		    datalen - sizeof(*ideltas)) {
3333 			err = got_error(GOT_ERR_PRIVSEP_LEN);
3334 			break;
3335 		}
3336 		*ndeltas = ideltas->ndeltas;
3337 		memcpy(deltas, (uint8_t *)imsg.data + sizeof(*ideltas),
3338 		    *ndeltas * sizeof(*deltas));
3339 		break;
3340 	case GOT_IMSG_DELTA_REUSE_DONE:
3341 		*done = 1;
3342 		break;
3343 	default:
3344 		err = got_error(GOT_ERR_PRIVSEP_MSG);
3345 		break;
3346 	}
3347 
3348 	imsg_free(&imsg);
3349 
3350 	return err;
3351 }
3352 
3353 const struct got_error *
3354 got_privsep_init_commit_painting(struct imsgbuf *ibuf)
3355 {
3356 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_PAINTING_INIT,
3357 	    0, 0, -1, NULL, 0)
3358 	    == -1)
3359 		return got_error_from_errno("imsg_compose "
3360 		    "COMMIT_PAINTING_INIT");
3361 
3362 	return flush_imsg(ibuf);
3363 }
3364 
3365 const struct got_error *
3366 got_privsep_send_painting_request(struct imsgbuf *ibuf, int idx,
3367     struct got_object_id *id, intptr_t color)
3368 {
3369 	struct got_imsg_commit_painting_request ireq;
3370 
3371 	memset(&ireq, 0, sizeof(ireq));
3372 	memcpy(ireq.id, id->sha1, sizeof(ireq.id));
3373 	ireq.idx = idx;
3374 	ireq.color = color;
3375 
3376 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_PAINTING_REQUEST, 0, 0, -1,
3377 	    &ireq, sizeof(ireq)) == -1)
3378 		return got_error_from_errno("imsg_compose "
3379 		    "COMMIT_PAINTING_REQUEST");
3380 
3381 	return flush_imsg(ibuf);
3382 }
3383 
3384 static const struct got_error *
3385 send_painted_commits(struct got_object_id_queue *ids, int *nids,
3386     size_t remain, int present_in_pack, struct imsgbuf *ibuf)
3387 {
3388 	const struct got_error *err = NULL;
3389 	struct ibuf *wbuf = NULL;
3390 	struct got_object_qid *qid;
3391 	size_t msglen;
3392 	int ncommits;
3393 	intptr_t color;
3394 
3395 	msglen = MIN(remain, MAX_IMSGSIZE - IMSG_HEADER_SIZE);
3396 	ncommits = (msglen - sizeof(struct got_imsg_painted_commits)) /
3397 	    sizeof(struct got_imsg_painted_commit);
3398 
3399 	wbuf = imsg_create(ibuf, GOT_IMSG_PAINTED_COMMITS, 0, 0, msglen);
3400 	if (wbuf == NULL) {
3401 		err = got_error_from_errno("imsg_create PAINTED_COMMITS");
3402 		return err;
3403 	}
3404 
3405 	/* Keep in sync with struct got_imsg_painted_commits! */
3406 	if (imsg_add(wbuf, &ncommits, sizeof(ncommits)) == -1)
3407 		return got_error_from_errno("imsg_add PAINTED_COMMITS");
3408 	if (imsg_add(wbuf, &present_in_pack, sizeof(present_in_pack)) == -1)
3409 		return got_error_from_errno("imsg_add PAINTED_COMMITS");
3410 
3411 	while (ncommits > 0) {
3412 		qid = STAILQ_FIRST(ids);
3413 		STAILQ_REMOVE_HEAD(ids, entry);
3414 		ncommits--;
3415 		(*nids)--;
3416 		color = (intptr_t)qid->data;
3417 
3418 		/* Keep in sync with struct got_imsg_painted_commit! */
3419 		if (imsg_add(wbuf, qid->id.sha1, SHA1_DIGEST_LENGTH) == -1)
3420 			return got_error_from_errno("imsg_add PAINTED_COMMITS");
3421 		if (imsg_add(wbuf, &color, sizeof(color)) == -1)
3422 			return got_error_from_errno("imsg_add PAINTED_COMMITS");
3423 
3424 		got_object_qid_free(qid);
3425 	}
3426 
3427 	wbuf->fd = -1;
3428 	imsg_close(ibuf, wbuf);
3429 
3430 	return flush_imsg(ibuf);
3431 }
3432 
3433 const struct got_error *
3434 got_privsep_send_painted_commits(struct imsgbuf *ibuf,
3435     struct got_object_id_queue *ids, int *nids,
3436     int present_in_pack, int flush)
3437 {
3438 	const struct got_error *err;
3439 	size_t remain;
3440 
3441 	if (*nids <= 0)
3442 		return NULL;
3443 
3444 	do {
3445 		remain = (sizeof(struct got_imsg_painted_commits)) +
3446 		    *nids * sizeof(struct got_imsg_painted_commit);
3447 		if (flush || remain >= MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
3448 			err = send_painted_commits(ids, nids, remain,
3449 			    present_in_pack, ibuf);
3450 			if (err)
3451 				return err;
3452 		}
3453 	} while (flush && *nids > 0);
3454 
3455 	return NULL;
3456 }
3457 
3458 const struct got_error *
3459 got_privsep_send_painting_commits_done(struct imsgbuf *ibuf)
3460 {
3461 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_PAINTING_DONE,
3462 	    0, 0, -1, NULL, 0)
3463 	    == -1)
3464 		return got_error_from_errno("imsg_compose "
3465 		    "COMMIT_PAINTING_DONE");
3466 
3467 	return flush_imsg(ibuf);
3468 }
3469 
3470 const struct got_error *
3471 got_privsep_recv_painted_commits(struct got_object_id_queue *new_ids,
3472     got_privsep_recv_painted_commit_cb cb, void *cb_arg, struct imsgbuf *ibuf)
3473 {
3474 	const struct got_error *err = NULL;
3475 	struct imsg imsg;
3476 	struct got_imsg_painted_commits icommits;
3477 	struct got_imsg_painted_commit icommit;
3478 	size_t datalen;
3479 	int i;
3480 
3481 	for (;;) {
3482 		err = got_privsep_recv_imsg(&imsg, ibuf, 0);
3483 		if (err)
3484 			return err;
3485 
3486 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
3487 		if (imsg.hdr.type == GOT_IMSG_COMMIT_PAINTING_DONE)
3488 			break;
3489 		if (imsg.hdr.type != GOT_IMSG_PAINTED_COMMITS)
3490 			return got_error(GOT_ERR_PRIVSEP_MSG);
3491 
3492 		if (datalen < sizeof(icommits))
3493 			return got_error(GOT_ERR_PRIVSEP_LEN);
3494 		memcpy(&icommits, imsg.data, sizeof(icommits));
3495 		if (icommits.ncommits * sizeof(icommit) < icommits.ncommits ||
3496 		    datalen < sizeof(icommits) +
3497 		    icommits.ncommits * sizeof(icommit))
3498 			return got_error(GOT_ERR_PRIVSEP_LEN);
3499 
3500 		for (i = 0; i < icommits.ncommits; i++) {
3501 			memcpy(&icommit,
3502 			    (uint8_t *)imsg.data + sizeof(icommits) + i * sizeof(icommit),
3503 			    sizeof(icommit));
3504 
3505 			if (icommits.present_in_pack) {
3506 				struct got_object_id id;
3507 				memcpy(id.sha1, icommit.id, SHA1_DIGEST_LENGTH);
3508 				err = cb(cb_arg, &id, icommit.color);
3509 				if (err)
3510 					break;
3511 			} else {
3512 				struct got_object_qid *qid;
3513 				err = got_object_qid_alloc_partial(&qid);
3514 				if (err)
3515 					break;
3516 				memcpy(qid->id.sha1, icommit.id,
3517 				    SHA1_DIGEST_LENGTH);
3518 				qid->data = (void *)icommit.color;
3519 				STAILQ_INSERT_TAIL(new_ids, qid, entry);
3520 			}
3521 		}
3522 
3523 		imsg_free(&imsg);
3524 	}
3525 
3526 	return err;
3527 }
3528 
3529 const struct got_error *
3530 got_privsep_unveil_exec_helpers(void)
3531 {
3532 	const char *helpers[] = {
3533 	    GOT_PATH_PROG_READ_PACK,
3534 	    GOT_PATH_PROG_READ_OBJECT,
3535 	    GOT_PATH_PROG_READ_COMMIT,
3536 	    GOT_PATH_PROG_READ_TREE,
3537 	    GOT_PATH_PROG_READ_BLOB,
3538 	    GOT_PATH_PROG_READ_TAG,
3539 	    GOT_PATH_PROG_READ_GITCONFIG,
3540 	    GOT_PATH_PROG_READ_GOTCONFIG,
3541 	    GOT_PATH_PROG_READ_PATCH,
3542 	    GOT_PATH_PROG_FETCH_PACK,
3543 	    GOT_PATH_PROG_INDEX_PACK,
3544 	    GOT_PATH_PROG_SEND_PACK,
3545 	};
3546 	size_t i;
3547 
3548 	for (i = 0; i < nitems(helpers); i++) {
3549 		if (unveil(helpers[i], "x") == 0)
3550 			continue;
3551 		return got_error_from_errno2("unveil", helpers[i]);
3552 	}
3553 
3554 	return NULL;
3555 }
3556 
3557 void
3558 got_privsep_exec_child(int imsg_fds[2], const char *path, const char *repo_path)
3559 {
3560 	if (close(imsg_fds[0]) == -1) {
3561 		fprintf(stderr, "%s: %s\n", getprogname(), strerror(errno));
3562 		_exit(1);
3563 	}
3564 
3565 	if (dup2(imsg_fds[1], GOT_IMSG_FD_CHILD) == -1) {
3566 		fprintf(stderr, "%s: %s\n", getprogname(), strerror(errno));
3567 		_exit(1);
3568 	}
3569 
3570 	closefrom(GOT_IMSG_FD_CHILD + 1);
3571 
3572 	if (execl(path, path, repo_path, (char *)NULL) == -1) {
3573 		fprintf(stderr, "%s: %s: %s\n", getprogname(), path,
3574 		    strerror(errno));
3575 		_exit(1);
3576 	}
3577 }