Game of Trees Repos

Blob

Date:: Tue Jul 5 17:21:44 2022 UTC
Message:: add signer_id option to got.conf(5) Setting this option will cause 'got tag' to sign all created tags using the SSH key, unless overridden by the -s flag. ok stsp@
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2018, 2019, 2020 Stefan Sperling <stsp@openbsd.org>
3  * Copyright (c) 2020 Ori Bernstein <ori@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include <sys/types.h>
19 #include <sys/queue.h>
20 #include <sys/uio.h>
21 #include <sys/wait.h>
22 
23 #include <ctype.h>
24 #include <limits.h>
25 #include <signal.h>
26 #include <stdio.h>
27 #include <stdlib.h>
28 #include <string.h>
29 #include <errno.h>
30 #include <stdint.h>
31 #include <poll.h>
32 #include <imsg.h>
33 #include <sha1.h>
34 #include <unistd.h>
35 #include <zlib.h>
36 #include <time.h>
37 
38 #include "got_object.h"
39 #include "got_error.h"
40 #include "got_path.h"
41 #include "got_repository.h"
42 
43 #include "got_lib_sha1.h"
44 #include "got_lib_delta.h"
45 #include "got_lib_inflate.h"
46 #include "got_lib_object.h"
47 #include "got_lib_object_parse.h"
48 #include "got_lib_privsep.h"
49 #include "got_lib_pack.h"
50 
51 #include "got_privsep.h"
52 
53 #ifndef MIN
54 #define	MIN(_a,_b) ((_a) < (_b) ? (_a) : (_b))
55 #endif
56 
57 #ifndef nitems
58 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
59 #endif
60 
61 static const struct got_error *
62 poll_fd(int fd, int events, int timeout)
63 {
64 	struct pollfd pfd[1];
65 	struct timespec ts;
66 	sigset_t sigset;
67 	int n;
68 
69 	pfd[0].fd = fd;
70 	pfd[0].events = events;
71 
72 	ts.tv_sec = timeout;
73 	ts.tv_nsec = 0;
74 
75 	if (sigemptyset(&sigset) == -1)
76 		return got_error_from_errno("sigemptyset");
77 	if (sigaddset(&sigset, SIGWINCH) == -1)
78 		return got_error_from_errno("sigaddset");
79 
80 	n = ppoll(pfd, 1, timeout == INFTIM ? NULL : &ts, &sigset);
81 	if (n == -1)
82 		return got_error_from_errno("ppoll");
83 	if (n == 0)
84 		return got_error(GOT_ERR_TIMEOUT);
85 	if (pfd[0].revents & (POLLERR | POLLNVAL))
86 		return got_error_from_errno("poll error");
87 	if (pfd[0].revents & (events | POLLHUP))
88 		return NULL;
89 
90 	return got_error(GOT_ERR_INTERRUPT);
91 }
92 
93 static const struct got_error *
94 read_imsg(struct imsgbuf *ibuf)
95 {
96 	const struct got_error *err;
97 	size_t n;
98 
99 	err = poll_fd(ibuf->fd, POLLIN, INFTIM);
100 	if (err)
101 		return err;
102 
103 	n = imsg_read(ibuf);
104 	if (n == -1) {
105 		if (errno == EAGAIN) /* Could be a file-descriptor leak. */
106 			return got_error(GOT_ERR_PRIVSEP_NO_FD);
107 		return got_error(GOT_ERR_PRIVSEP_READ);
108 	}
109 	if (n == 0)
110 		return got_error(GOT_ERR_PRIVSEP_PIPE);
111 
112 	return NULL;
113 }
114 
115 const struct got_error *
116 got_privsep_wait_for_child(pid_t pid)
117 {
118 	int child_status;
119 
120 	if (waitpid(pid, &child_status, 0) == -1)
121 		return got_error_from_errno("waitpid");
122 
123 	if (!WIFEXITED(child_status))
124 		return got_error(GOT_ERR_PRIVSEP_DIED);
125 
126 	if (WEXITSTATUS(child_status) != 0)
127 		return got_error(GOT_ERR_PRIVSEP_EXIT);
128 
129 	return NULL;
130 }
131 
132 static const struct got_error *
133 recv_imsg_error(struct imsg *imsg, size_t datalen)
134 {
135 	struct got_imsg_error *ierr;
136 
137 	if (datalen != sizeof(*ierr))
138 		return got_error(GOT_ERR_PRIVSEP_LEN);
139 
140 	ierr = imsg->data;
141 	if (ierr->code == GOT_ERR_ERRNO) {
142 		static struct got_error serr;
143 		serr.code = GOT_ERR_ERRNO;
144 		serr.msg = strerror(ierr->errno_code);
145 		return &serr;
146 	}
147 
148 	return got_error(ierr->code);
149 }
150 
151 const struct got_error *
152 got_privsep_recv_imsg(struct imsg *imsg, struct imsgbuf *ibuf,
153     size_t min_datalen)
154 {
155 	const struct got_error *err;
156 	ssize_t n;
157 
158 	n = imsg_get(ibuf, imsg);
159 	if (n == -1)
160 		return got_error_from_errno("imsg_get");
161 
162 	while (n == 0) {
163 		err = read_imsg(ibuf);
164 		if (err)
165 			return err;
166 		n = imsg_get(ibuf, imsg);
167 		if (n == -1)
168 			return got_error_from_errno("imsg_get");
169 	}
170 
171 	if (imsg->hdr.len < IMSG_HEADER_SIZE + min_datalen)
172 		return got_error(GOT_ERR_PRIVSEP_LEN);
173 
174 	if (imsg->hdr.type == GOT_IMSG_ERROR) {
175 		size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
176 		return recv_imsg_error(imsg, datalen);
177 	}
178 
179 	return NULL;
180 }
181 
182 /* Attempt to send an error in an imsg. Complain on stderr as a last resort. */
183 void
184 got_privsep_send_error(struct imsgbuf *ibuf, const struct got_error *err)
185 {
186 	const struct got_error *poll_err;
187 	struct got_imsg_error ierr;
188 	int ret;
189 
190 	ierr.code = err->code;
191 	if (err->code == GOT_ERR_ERRNO)
192 		ierr.errno_code = errno;
193 	else
194 		ierr.errno_code = 0;
195 	ret = imsg_compose(ibuf, GOT_IMSG_ERROR, 0, 0, -1, &ierr, sizeof(ierr));
196 	if (ret == -1) {
197 		fprintf(stderr, "%s: error %d \"%s\": imsg_compose: %s\n",
198 		    getprogname(), err->code, err->msg, strerror(errno));
199 		return;
200 	}
201 
202 	poll_err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
203 	if (poll_err) {
204 		fprintf(stderr, "%s: error %d \"%s\": poll: %s\n",
205 		    getprogname(), err->code, err->msg, poll_err->msg);
206 		return;
207 	}
208 
209 	ret = imsg_flush(ibuf);
210 	if (ret == -1) {
211 		fprintf(stderr, "%s: error %d \"%s\": imsg_flush: %s\n",
212 		    getprogname(), err->code, err->msg, strerror(errno));
213 		imsg_clear(ibuf);
214 		return;
215 	}
216 }
217 
218 static const struct got_error *
219 flush_imsg(struct imsgbuf *ibuf)
220 {
221 	const struct got_error *err;
222 
223 	err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
224 	if (err)
225 		return err;
226 
227 	if (imsg_flush(ibuf) == -1) {
228 		imsg_clear(ibuf);
229 		return got_error_from_errno("imsg_flush");
230 	}
231 
232 	return NULL;
233 }
234 
235 const struct got_error *
236 got_privsep_flush_imsg(struct imsgbuf *ibuf)
237 {
238 	return flush_imsg(ibuf);
239 }
240 
241 const struct got_error *
242 got_privsep_send_stop(int fd)
243 {
244 	const struct got_error *err = NULL;
245 	struct imsgbuf ibuf;
246 
247 	imsg_init(&ibuf, fd);
248 
249 	if (imsg_compose(&ibuf, GOT_IMSG_STOP, 0, 0, -1, NULL, 0) == -1)
250 		return got_error_from_errno("imsg_compose STOP");
251 
252 	err = flush_imsg(&ibuf);
253 	return err;
254 }
255 
256 const struct got_error *
257 got_privsep_send_obj_req(struct imsgbuf *ibuf, int fd,
258     struct got_object_id *id)
259 {
260 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT_REQUEST, 0, 0, fd,
261 	    id, sizeof(*id)) == -1)
262 		return got_error_from_errno("imsg_compose OBJECT_REQUEST");
263 
264 	return flush_imsg(ibuf);
265 }
266 
267 const struct got_error *
268 got_privsep_send_raw_obj_req(struct imsgbuf *ibuf, int fd,
269     struct got_object_id *id)
270 {
271 	if (imsg_compose(ibuf, GOT_IMSG_RAW_OBJECT_REQUEST, 0, 0, fd,
272 	    id, sizeof(*id)) == -1)
273 		return got_error_from_errno("imsg_compose RAW_OBJECT_REQUEST");
274 
275 	return flush_imsg(ibuf);
276 }
277 
278 const struct got_error *
279 got_privsep_send_raw_obj_outfd(struct imsgbuf *ibuf, int outfd)
280 {
281 	const struct got_error *err = NULL;
282 
283 	if (imsg_compose(ibuf, GOT_IMSG_RAW_OBJECT_OUTFD, 0, 0, outfd, NULL, 0)
284 	    == -1) {
285 		err = got_error_from_errno("imsg_compose RAW_OBJECT_OUTFD");
286 		close(outfd);
287 		return err;
288 	}
289 
290 	return flush_imsg(ibuf);
291 }
292 
293 const struct got_error *
294 got_privsep_send_raw_obj(struct imsgbuf *ibuf, off_t size, size_t hdrlen,
295     uint8_t *data)
296 {
297 	const struct got_error *err = NULL;
298 	struct got_imsg_raw_obj iobj;
299 	size_t len = sizeof(iobj);
300 	struct ibuf *wbuf;
301 
302 	memset(&iobj, 0, sizeof(iobj));
303 	iobj.hdrlen = hdrlen;
304 	iobj.size = size;
305 
306 	if (data && size + hdrlen <= GOT_PRIVSEP_INLINE_OBJECT_DATA_MAX)
307 		len += (size_t)size + hdrlen;
308 
309 	wbuf = imsg_create(ibuf, GOT_IMSG_RAW_OBJECT, 0, 0, len);
310 	if (wbuf == NULL) {
311 		err = got_error_from_errno("imsg_create RAW_OBJECT");
312 		return err;
313 	}
314 
315 	if (imsg_add(wbuf, &iobj, sizeof(iobj)) == -1)
316 		return got_error_from_errno("imsg_add RAW_OBJECT");
317 
318 	if (data && size + hdrlen <= GOT_PRIVSEP_INLINE_OBJECT_DATA_MAX) {
319 		if (imsg_add(wbuf, data, size + hdrlen) == -1)
320 			return got_error_from_errno("imsg_add RAW_OBJECT");
321 	}
322 
323 	wbuf->fd = -1;
324 	imsg_close(ibuf, wbuf);
325 
326 	return flush_imsg(ibuf);
327 }
328 
329 const struct got_error *
330 got_privsep_recv_raw_obj(uint8_t **outbuf, off_t *size, size_t *hdrlen,
331     struct imsgbuf *ibuf)
332 {
333 	const struct got_error *err = NULL;
334 	struct imsg imsg;
335 	struct got_imsg_raw_obj *iobj;
336 	size_t datalen;
337 
338 	*outbuf = NULL;
339 
340 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
341 	if (err)
342 		return err;
343 
344 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
345 
346 	switch (imsg.hdr.type) {
347 	case GOT_IMSG_RAW_OBJECT:
348 		if (datalen < sizeof(*iobj)) {
349 			err = got_error(GOT_ERR_PRIVSEP_LEN);
350 			break;
351 		}
352 		iobj = imsg.data;
353 		*size = iobj->size;
354 		*hdrlen = iobj->hdrlen;
355 
356 		if (datalen == sizeof(*iobj)) {
357 			/* Data has been written to file descriptor. */
358 			break;
359 		}
360 
361 		if (*size < 0 ||
362 		    *size + *hdrlen > GOT_PRIVSEP_INLINE_OBJECT_DATA_MAX) {
363 			err = got_error(GOT_ERR_PRIVSEP_LEN);
364 			break;
365 		}
366 
367 		*outbuf = malloc(*size + *hdrlen);
368 		if (*outbuf == NULL) {
369 			err = got_error_from_errno("malloc");
370 			break;
371 		}
372 		memcpy(*outbuf, imsg.data + sizeof(*iobj), *size + *hdrlen);
373 		break;
374 	default:
375 		err = got_error(GOT_ERR_PRIVSEP_MSG);
376 		break;
377 	}
378 
379 	imsg_free(&imsg);
380 
381 	return err;
382 }
383 
384 const struct got_error *
385 got_privsep_send_commit_req(struct imsgbuf *ibuf, int fd,
386     struct got_object_id *id, int pack_idx)
387 {
388 	const struct got_error *err = NULL;
389 	struct got_imsg_packed_object iobj;
390 	void *data;
391 	size_t len;
392 
393 	memset(&iobj, 0, sizeof(iobj));
394 	if (pack_idx != -1) { /* commit is packed */
395 		iobj.idx = pack_idx;
396 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
397 		data = &iobj;
398 		len = sizeof(iobj);
399 	} else {
400 		data = id;
401 		len = sizeof(*id);
402 	}
403 
404 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_REQUEST, 0, 0, fd, data, len)
405 	    == -1) {
406 		err = got_error_from_errno("imsg_compose COMMIT_REQUEST");
407 		close(fd);
408 		return err;
409 	}
410 
411 	return flush_imsg(ibuf);
412 }
413 
414 const struct got_error *
415 got_privsep_send_tree_req(struct imsgbuf *ibuf, int fd,
416     struct got_object_id *id, int pack_idx)
417 {
418 	struct ibuf *wbuf;
419 	size_t len;
420 
421 	if (pack_idx != -1)
422 		len = sizeof(struct got_imsg_packed_object);
423 	else
424 		len = sizeof(*id);
425 
426 	wbuf = imsg_create(ibuf, GOT_IMSG_TREE_REQUEST, 0, 0, len);
427 	if (wbuf == NULL)
428 		return got_error_from_errno("imsg_create TREE_REQUEST");
429 
430 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1)
431 		return got_error_from_errno("imsg_add TREE_REQUEST");
432 
433 	if (pack_idx != -1) { /* tree is packed */
434 		if (imsg_add(wbuf, &pack_idx, sizeof(pack_idx)) == -1)
435 			return got_error_from_errno("imsg_add TREE_REQUEST");
436 	}
437 
438 	wbuf->fd = fd;
439 	imsg_close(ibuf, wbuf);
440 
441 	return flush_imsg(ibuf);
442 }
443 
444 const struct got_error *
445 got_privsep_send_tag_req(struct imsgbuf *ibuf, int fd,
446     struct got_object_id *id, int pack_idx)
447 {
448 	struct got_imsg_packed_object iobj;
449 	void *data;
450 	size_t len;
451 
452 	memset(&iobj, 0, sizeof(iobj));
453 	if (pack_idx != -1) { /* tag is packed */
454 		iobj.idx = pack_idx;
455 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
456 		data = &iobj;
457 		len = sizeof(iobj);
458 	} else {
459 		data = id;
460 		len = sizeof(*id);
461 	}
462 
463 	if (imsg_compose(ibuf, GOT_IMSG_TAG_REQUEST, 0, 0, fd, data, len)
464 	    == -1)
465 		return got_error_from_errno("imsg_compose TAG_REQUEST");
466 
467 	return flush_imsg(ibuf);
468 }
469 
470 const struct got_error *
471 got_privsep_send_blob_req(struct imsgbuf *ibuf, int infd,
472     struct got_object_id *id, int pack_idx)
473 {
474 	const struct got_error *err = NULL;
475 	struct got_imsg_packed_object iobj;
476 	void *data;
477 	size_t len;
478 
479 	memset(&iobj, 0, sizeof(iobj));
480 	if (pack_idx != -1) { /* blob is packed */
481 		iobj.idx = pack_idx;
482 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
483 		data = &iobj;
484 		len = sizeof(iobj);
485 	} else {
486 		data = id;
487 		len = sizeof(*id);
488 	}
489 
490 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_REQUEST, 0, 0, infd, data, len)
491 	    == -1) {
492 		err = got_error_from_errno("imsg_compose BLOB_REQUEST");
493 		close(infd);
494 		return err;
495 	}
496 
497 	return flush_imsg(ibuf);
498 }
499 
500 const struct got_error *
501 got_privsep_send_blob_outfd(struct imsgbuf *ibuf, int outfd)
502 {
503 	const struct got_error *err = NULL;
504 
505 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_OUTFD, 0, 0, outfd, NULL, 0)
506 	    == -1) {
507 		err = got_error_from_errno("imsg_compose BLOB_OUTFD");
508 		close(outfd);
509 		return err;
510 	}
511 
512 	return flush_imsg(ibuf);
513 }
514 
515 static const struct got_error *
516 send_fd(struct imsgbuf *ibuf, int imsg_code, int fd)
517 {
518 	const struct got_error *err = NULL;
519 
520 	if (imsg_compose(ibuf, imsg_code, 0, 0, fd, NULL, 0) == -1) {
521 		err = got_error_from_errno("imsg_compose TMPFD");
522 		close(fd);
523 		return err;
524 	}
525 
526 	return flush_imsg(ibuf);
527 }
528 
529 const struct got_error *
530 got_privsep_send_tmpfd(struct imsgbuf *ibuf, int fd)
531 {
532 	return send_fd(ibuf, GOT_IMSG_TMPFD, fd);
533 }
534 
535 const struct got_error *
536 got_privsep_send_obj(struct imsgbuf *ibuf, struct got_object *obj)
537 {
538 	struct got_imsg_object iobj;
539 
540 	memset(&iobj, 0, sizeof(iobj));
541 
542 	memcpy(iobj.id, obj->id.sha1, sizeof(iobj.id));
543 	iobj.type = obj->type;
544 	iobj.flags = obj->flags;
545 	iobj.hdrlen = obj->hdrlen;
546 	iobj.size = obj->size;
547 	if (iobj.flags & GOT_OBJ_FLAG_PACKED) {
548 		iobj.pack_offset = obj->pack_offset;
549 		iobj.pack_idx = obj->pack_idx;
550 	}
551 
552 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT, 0, 0, -1, &iobj, sizeof(iobj))
553 	    == -1)
554 		return got_error_from_errno("imsg_compose OBJECT");
555 
556 	return flush_imsg(ibuf);
557 }
558 
559 const struct got_error *
560 got_privsep_send_fetch_req(struct imsgbuf *ibuf, int fd,
561     struct got_pathlist_head *have_refs, int fetch_all_branches,
562     struct got_pathlist_head *wanted_branches,
563     struct got_pathlist_head *wanted_refs, int list_refs_only, int verbosity)
564 {
565 	const struct got_error *err = NULL;
566 	struct ibuf *wbuf;
567 	size_t len;
568 	struct got_pathlist_entry *pe;
569 	struct got_imsg_fetch_request fetchreq;
570 
571 	memset(&fetchreq, 0, sizeof(fetchreq));
572 	fetchreq.fetch_all_branches = fetch_all_branches;
573 	fetchreq.list_refs_only = list_refs_only;
574 	fetchreq.verbosity = verbosity;
575 	TAILQ_FOREACH(pe, have_refs, entry)
576 		fetchreq.n_have_refs++;
577 	TAILQ_FOREACH(pe, wanted_branches, entry)
578 		fetchreq.n_wanted_branches++;
579 	TAILQ_FOREACH(pe, wanted_refs, entry)
580 		fetchreq.n_wanted_refs++;
581 	len = sizeof(struct got_imsg_fetch_request);
582 	if (len >= MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
583 		close(fd);
584 		return got_error(GOT_ERR_NO_SPACE);
585 	}
586 
587 	if (imsg_compose(ibuf, GOT_IMSG_FETCH_REQUEST, 0, 0, fd,
588 	    &fetchreq, sizeof(fetchreq)) == -1)
589 		return got_error_from_errno(
590 		    "imsg_compose FETCH_SERVER_PROGRESS");
591 
592 	err = flush_imsg(ibuf);
593 	if (err) {
594 		close(fd);
595 		return err;
596 	}
597 	fd = -1;
598 
599 	TAILQ_FOREACH(pe, have_refs, entry) {
600 		const char *name = pe->path;
601 		size_t name_len = pe->path_len;
602 		struct got_object_id *id = pe->data;
603 
604 		len = sizeof(struct got_imsg_fetch_have_ref) + name_len;
605 		wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_HAVE_REF, 0, 0, len);
606 		if (wbuf == NULL)
607 			return got_error_from_errno("imsg_create FETCH_HAVE_REF");
608 
609 		/* Keep in sync with struct got_imsg_fetch_have_ref! */
610 		if (imsg_add(wbuf, id->sha1, sizeof(id->sha1)) == -1)
611 			return got_error_from_errno("imsg_add FETCH_HAVE_REF");
612 		if (imsg_add(wbuf, &name_len, sizeof(name_len)) == -1)
613 			return got_error_from_errno("imsg_add FETCH_HAVE_REF");
614 		if (imsg_add(wbuf, name, name_len) == -1)
615 			return got_error_from_errno("imsg_add FETCH_HAVE_REF");
616 
617 		wbuf->fd = -1;
618 		imsg_close(ibuf, wbuf);
619 		err = flush_imsg(ibuf);
620 		if (err)
621 			return err;
622 	}
623 
624 	TAILQ_FOREACH(pe, wanted_branches, entry) {
625 		const char *name = pe->path;
626 		size_t name_len = pe->path_len;
627 
628 		len = sizeof(struct got_imsg_fetch_wanted_branch) + name_len;
629 		wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_WANTED_BRANCH, 0, 0,
630 		    len);
631 		if (wbuf == NULL)
632 			return got_error_from_errno(
633 			    "imsg_create FETCH_WANTED_BRANCH");
634 
635 		/* Keep in sync with struct got_imsg_fetch_wanted_branch! */
636 		if (imsg_add(wbuf, &name_len, sizeof(name_len)) == -1)
637 			return got_error_from_errno(
638 			    "imsg_add FETCH_WANTED_BRANCH");
639 		if (imsg_add(wbuf, name, name_len) == -1)
640 			return got_error_from_errno(
641 			    "imsg_add FETCH_WANTED_BRANCH");
642 
643 		wbuf->fd = -1;
644 		imsg_close(ibuf, wbuf);
645 		err = flush_imsg(ibuf);
646 		if (err)
647 			return err;
648 	}
649 
650 	TAILQ_FOREACH(pe, wanted_refs, entry) {
651 		const char *name = pe->path;
652 		size_t name_len = pe->path_len;
653 
654 		len = sizeof(struct got_imsg_fetch_wanted_ref) + name_len;
655 		wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_WANTED_REF, 0, 0,
656 		    len);
657 		if (wbuf == NULL)
658 			return got_error_from_errno(
659 			    "imsg_create FETCH_WANTED_REF");
660 
661 		/* Keep in sync with struct got_imsg_fetch_wanted_ref! */
662 		if (imsg_add(wbuf, &name_len, sizeof(name_len)) == -1)
663 			return got_error_from_errno(
664 			    "imsg_add FETCH_WANTED_REF");
665 		if (imsg_add(wbuf, name, name_len) == -1)
666 			return got_error_from_errno(
667 			    "imsg_add FETCH_WANTED_REF");
668 
669 		wbuf->fd = -1;
670 		imsg_close(ibuf, wbuf);
671 		err = flush_imsg(ibuf);
672 		if (err)
673 			return err;
674 	}
675 
676 
677 	return NULL;
678 
679 }
680 
681 const struct got_error *
682 got_privsep_send_fetch_outfd(struct imsgbuf *ibuf, int fd)
683 {
684 	return send_fd(ibuf, GOT_IMSG_FETCH_OUTFD, fd);
685 }
686 
687 const struct got_error *
688 got_privsep_recv_fetch_progress(int *done, struct got_object_id **id,
689     char **refname, struct got_pathlist_head *symrefs, char **server_progress,
690     off_t *packfile_size, uint8_t *pack_sha1, struct imsgbuf *ibuf)
691 {
692 	const struct got_error *err = NULL;
693 	struct imsg imsg;
694 	size_t datalen;
695 	struct got_imsg_fetch_symrefs *isymrefs = NULL;
696 	size_t n, remain;
697 	off_t off;
698 	int i;
699 
700 	*done = 0;
701 	*id = NULL;
702 	*refname = NULL;
703 	*server_progress = NULL;
704 	*packfile_size = 0;
705 	memset(pack_sha1, 0, SHA1_DIGEST_LENGTH);
706 
707 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
708 	if (err)
709 		return err;
710 
711 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
712 	switch (imsg.hdr.type) {
713 	case GOT_IMSG_ERROR:
714 		err = recv_imsg_error(&imsg, datalen);
715 		break;
716 	case GOT_IMSG_FETCH_SYMREFS:
717 		if (datalen < sizeof(*isymrefs)) {
718 			err = got_error(GOT_ERR_PRIVSEP_LEN);
719 			break;
720 		}
721 		if (isymrefs != NULL) {
722 			err = got_error(GOT_ERR_PRIVSEP_MSG);
723 			break;
724 		}
725 		isymrefs = (struct got_imsg_fetch_symrefs *)imsg.data;
726 		off = sizeof(*isymrefs);
727 		remain = datalen - off;
728 		for (n = 0; n < isymrefs->nsymrefs; n++) {
729 			struct got_imsg_fetch_symref *s;
730 			char *name, *target;
731 			if (remain < sizeof(struct got_imsg_fetch_symref)) {
732 				err = got_error(GOT_ERR_PRIVSEP_LEN);
733 				goto done;
734 			}
735 			s = (struct got_imsg_fetch_symref *)(imsg.data + off);
736 			off += sizeof(*s);
737 			remain -= sizeof(*s);
738 			if (remain < s->name_len) {
739 				err = got_error(GOT_ERR_PRIVSEP_LEN);
740 				goto done;
741 			}
742 			name = strndup(imsg.data + off, s->name_len);
743 			if (name == NULL) {
744 				err = got_error_from_errno("strndup");
745 				goto done;
746 			}
747 			off += s->name_len;
748 			remain -= s->name_len;
749 			if (remain < s->target_len) {
750 				err = got_error(GOT_ERR_PRIVSEP_LEN);
751 				free(name);
752 				goto done;
753 			}
754 			target = strndup(imsg.data + off, s->target_len);
755 			if (target == NULL) {
756 				err = got_error_from_errno("strndup");
757 				free(name);
758 				goto done;
759 			}
760 			off += s->target_len;
761 			remain -= s->target_len;
762 			err = got_pathlist_append(symrefs, name, target);
763 			if (err) {
764 				free(name);
765 				free(target);
766 				goto done;
767 			}
768 		}
769 		break;
770 	case GOT_IMSG_FETCH_REF:
771 		if (datalen <= SHA1_DIGEST_LENGTH) {
772 			err = got_error(GOT_ERR_PRIVSEP_MSG);
773 			break;
774 		}
775 		*id = malloc(sizeof(**id));
776 		if (*id == NULL) {
777 			err = got_error_from_errno("malloc");
778 			break;
779 		}
780 		memcpy((*id)->sha1, imsg.data, SHA1_DIGEST_LENGTH);
781 		*refname = strndup(imsg.data + SHA1_DIGEST_LENGTH,
782 		    datalen - SHA1_DIGEST_LENGTH);
783 		if (*refname == NULL) {
784 			err = got_error_from_errno("strndup");
785 			break;
786 		}
787 		break;
788 	case GOT_IMSG_FETCH_SERVER_PROGRESS:
789 		if (datalen == 0) {
790 			err = got_error(GOT_ERR_PRIVSEP_LEN);
791 			break;
792 		}
793 		*server_progress = strndup(imsg.data, datalen);
794 		if (*server_progress == NULL) {
795 			err = got_error_from_errno("strndup");
796 			break;
797 		}
798 		for (i = 0; i < datalen; i++) {
799 			if (!isprint((unsigned char)(*server_progress)[i]) &&
800 			    !isspace((unsigned char)(*server_progress)[i])) {
801 				err = got_error(GOT_ERR_PRIVSEP_MSG);
802 				free(*server_progress);
803 				*server_progress = NULL;
804 				goto done;
805 			}
806 		}
807 		break;
808 	case GOT_IMSG_FETCH_DOWNLOAD_PROGRESS:
809 		if (datalen < sizeof(*packfile_size)) {
810 			err = got_error(GOT_ERR_PRIVSEP_MSG);
811 			break;
812 		}
813 		memcpy(packfile_size, imsg.data, sizeof(*packfile_size));
814 		break;
815 	case GOT_IMSG_FETCH_DONE:
816 		if (datalen != SHA1_DIGEST_LENGTH) {
817 			err = got_error(GOT_ERR_PRIVSEP_MSG);
818 			break;
819 		}
820 		memcpy(pack_sha1, imsg.data, SHA1_DIGEST_LENGTH);
821 		*done = 1;
822 		break;
823 	default:
824 		err = got_error(GOT_ERR_PRIVSEP_MSG);
825 		break;
826 	}
827 done:
828 	if (err) {
829 		free(*id);
830 		*id = NULL;
831 		free(*refname);
832 		*refname = NULL;
833 	}
834 	imsg_free(&imsg);
835 	return err;
836 }
837 
838 static const struct got_error *
839 send_send_ref(const char *name, size_t name_len, struct got_object_id *id,
840     int delete, struct imsgbuf *ibuf)
841 {
842 	size_t len;
843 	struct ibuf *wbuf;
844 
845 	len = sizeof(struct got_imsg_send_ref) + name_len;
846 	wbuf = imsg_create(ibuf, GOT_IMSG_SEND_REF, 0, 0, len);
847 	if (wbuf == NULL)
848 		return got_error_from_errno("imsg_create SEND_REF");
849 
850 	/* Keep in sync with struct got_imsg_send_ref! */
851 	if (imsg_add(wbuf, id->sha1, sizeof(id->sha1)) == -1)
852 		return got_error_from_errno("imsg_add SEND_REF");
853 	if (imsg_add(wbuf, &delete, sizeof(delete)) == -1)
854 		return got_error_from_errno("imsg_add SEND_REF");
855 	if (imsg_add(wbuf, &name_len, sizeof(name_len)) == -1)
856 		return got_error_from_errno("imsg_add SEND_REF");
857 	if (imsg_add(wbuf, name, name_len) == -1)
858 		return got_error_from_errno("imsg_add SEND_REF");
859 
860 	wbuf->fd = -1;
861 	imsg_close(ibuf, wbuf);
862 	return flush_imsg(ibuf);
863 }
864 
865 const struct got_error *
866 got_privsep_send_send_req(struct imsgbuf *ibuf, int fd,
867     struct got_pathlist_head *have_refs,
868     struct got_pathlist_head *delete_refs,
869     int verbosity)
870 {
871 	const struct got_error *err = NULL;
872 	struct got_pathlist_entry *pe;
873 	struct got_imsg_send_request sendreq;
874 	struct got_object_id zero_id;
875 
876 	memset(&zero_id, 0, sizeof(zero_id));
877 	memset(&sendreq, 0, sizeof(sendreq));
878 	sendreq.verbosity = verbosity;
879 	TAILQ_FOREACH(pe, have_refs, entry)
880 		sendreq.nrefs++;
881 	TAILQ_FOREACH(pe, delete_refs, entry)
882 		sendreq.nrefs++;
883 	if (imsg_compose(ibuf, GOT_IMSG_SEND_REQUEST, 0, 0, fd,
884 	    &sendreq, sizeof(sendreq)) == -1) {
885 		err = got_error_from_errno(
886 		    "imsg_compose FETCH_SERVER_PROGRESS");
887 		goto done;
888 	}
889 
890 	err = flush_imsg(ibuf);
891 	if (err)
892 		goto done;
893 	fd = -1;
894 
895 	TAILQ_FOREACH(pe, have_refs, entry) {
896 		const char *name = pe->path;
897 		size_t name_len = pe->path_len;
898 		struct got_object_id *id = pe->data;
899 		err = send_send_ref(name, name_len, id, 0, ibuf);
900 		if (err)
901 			goto done;
902 	}
903 
904 	TAILQ_FOREACH(pe, delete_refs, entry) {
905 		const char *name = pe->path;
906 		size_t name_len = pe->path_len;
907 		err = send_send_ref(name, name_len, &zero_id, 1, ibuf);
908 		if (err)
909 			goto done;
910 	}
911 done:
912 	if (fd != -1 && close(fd) == -1 && err == NULL)
913 		err = got_error_from_errno("close");
914 	return err;
915 
916 }
917 
918 const struct got_error *
919 got_privsep_recv_send_remote_refs(struct got_pathlist_head *remote_refs,
920     struct imsgbuf *ibuf)
921 {
922 	const struct got_error *err = NULL;
923 	struct imsg imsg;
924 	size_t datalen;
925 	int done = 0;
926 	struct got_imsg_send_remote_ref iremote_ref;
927 	struct got_object_id *id = NULL;
928 	char *refname = NULL;
929 	struct got_pathlist_entry *new;
930 
931 	while (!done) {
932 		err = got_privsep_recv_imsg(&imsg, ibuf, 0);
933 		if (err)
934 			return err;
935 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
936 		switch (imsg.hdr.type) {
937 		case GOT_IMSG_ERROR:
938 			err = recv_imsg_error(&imsg, datalen);
939 			goto done;
940 		case GOT_IMSG_SEND_REMOTE_REF:
941 			if (datalen < sizeof(iremote_ref)) {
942 				err = got_error(GOT_ERR_PRIVSEP_MSG);
943 				goto done;
944 			}
945 			memcpy(&iremote_ref, imsg.data, sizeof(iremote_ref));
946 			if (datalen != sizeof(iremote_ref) +
947 			    iremote_ref.name_len) {
948 				err = got_error(GOT_ERR_PRIVSEP_MSG);
949 				goto done;
950 			}
951 			id = malloc(sizeof(*id));
952 			if (id == NULL) {
953 				err = got_error_from_errno("malloc");
954 				goto done;
955 			}
956 			memcpy(id->sha1, iremote_ref.id, SHA1_DIGEST_LENGTH);
957 			refname = strndup(imsg.data + sizeof(iremote_ref),
958 			    datalen - sizeof(iremote_ref));
959 			if (refname == NULL) {
960 				err = got_error_from_errno("strndup");
961 				goto done;
962 			}
963 			err = got_pathlist_insert(&new, remote_refs,
964 			    refname, id);
965 			if (err)
966 				goto done;
967 			if (new == NULL) { /* duplicate which wasn't inserted */
968 				free(id);
969 				free(refname);
970 			}
971 			id = NULL;
972 			refname = NULL;
973 			break;
974 		case GOT_IMSG_SEND_PACK_REQUEST:
975 			if (datalen != 0) {
976 				err = got_error(GOT_ERR_PRIVSEP_MSG);
977 				goto done;
978 			}
979 			/* got-send-pack is now waiting for a pack file. */
980 			done = 1;
981 			break;
982 		default:
983 			err = got_error(GOT_ERR_PRIVSEP_MSG);
984 			break;
985 		}
986 	}
987 done:
988 	free(id);
989 	free(refname);
990 	imsg_free(&imsg);
991 	return err;
992 }
993 
994 const struct got_error *
995 got_privsep_send_packfd(struct imsgbuf *ibuf, int fd)
996 {
997 	return send_fd(ibuf, GOT_IMSG_SEND_PACKFD, fd);
998 }
999 
1000 const struct got_error *
1001 got_privsep_recv_send_progress(int *done, off_t *bytes_sent,
1002     int *success, char **refname, struct imsgbuf *ibuf)
1003 {
1004 	const struct got_error *err = NULL;
1005 	struct imsg imsg;
1006 	size_t datalen;
1007 	struct got_imsg_send_ref_status iref_status;
1008 
1009 	/* Do not reset the current value of 'bytes_sent', it accumulates. */
1010 	*done = 0;
1011 	*success = 0;
1012 	*refname = NULL;
1013 
1014 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
1015 	if (err)
1016 		return err;
1017 
1018 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1019 	switch (imsg.hdr.type) {
1020 	case GOT_IMSG_ERROR:
1021 		err = recv_imsg_error(&imsg, datalen);
1022 		break;
1023 	case GOT_IMSG_SEND_UPLOAD_PROGRESS:
1024 		if (datalen < sizeof(*bytes_sent)) {
1025 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1026 			break;
1027 		}
1028 		memcpy(bytes_sent, imsg.data, sizeof(*bytes_sent));
1029 		break;
1030 	case GOT_IMSG_SEND_REF_STATUS:
1031 		if (datalen < sizeof(iref_status)) {
1032 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1033 			break;
1034 		}
1035 		memcpy(&iref_status, imsg.data, sizeof(iref_status));
1036 		if (datalen != sizeof(iref_status) + iref_status.name_len) {
1037 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1038 			break;
1039 		}
1040 		*success = iref_status.success;
1041 		*refname = strndup(imsg.data + sizeof(iref_status),
1042 		    iref_status.name_len);
1043 		break;
1044 	case GOT_IMSG_SEND_DONE:
1045 		if (datalen != 0) {
1046 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1047 			break;
1048 		}
1049 		*done = 1;
1050 		break;
1051 	default:
1052 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1053 		break;
1054 	}
1055 
1056 	imsg_free(&imsg);
1057 	return err;
1058 }
1059 
1060 const struct got_error *
1061 got_privsep_send_index_pack_req(struct imsgbuf *ibuf, uint8_t *pack_sha1,
1062     int fd)
1063 {
1064 	const struct got_error *err = NULL;
1065 
1066 	/* Keep in sync with struct got_imsg_index_pack_request */
1067 	if (imsg_compose(ibuf, GOT_IMSG_IDXPACK_REQUEST, 0, 0, fd,
1068 	    pack_sha1, SHA1_DIGEST_LENGTH) == -1) {
1069 		err = got_error_from_errno("imsg_compose INDEX_REQUEST");
1070 		close(fd);
1071 		return err;
1072 	}
1073 	return flush_imsg(ibuf);
1074 }
1075 
1076 const struct got_error *
1077 got_privsep_send_index_pack_outfd(struct imsgbuf *ibuf, int fd)
1078 {
1079 	return send_fd(ibuf, GOT_IMSG_IDXPACK_OUTFD, fd);
1080 }
1081 
1082 const struct got_error *
1083 got_privsep_recv_index_progress(int *done, int *nobj_total,
1084     int *nobj_indexed, int *nobj_loose, int *nobj_resolved,
1085     struct imsgbuf *ibuf)
1086 {
1087 	const struct got_error *err = NULL;
1088 	struct imsg imsg;
1089 	struct got_imsg_index_pack_progress *iprogress;
1090 	size_t datalen;
1091 
1092 	*done = 0;
1093 	*nobj_total = 0;
1094 	*nobj_indexed = 0;
1095 	*nobj_resolved = 0;
1096 
1097 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
1098 	if (err)
1099 		return err;
1100 
1101 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1102 	switch (imsg.hdr.type) {
1103 	case GOT_IMSG_ERROR:
1104 		err = recv_imsg_error(&imsg, datalen);
1105 		break;
1106 	case GOT_IMSG_IDXPACK_PROGRESS:
1107 		if (datalen < sizeof(*iprogress)) {
1108 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1109 			break;
1110 		}
1111 		iprogress = (struct got_imsg_index_pack_progress *)imsg.data;
1112 		if (iprogress->nobj_total < 0 || iprogress->nobj_indexed < 0 ||
1113 		    iprogress->nobj_loose < 0 || iprogress->nobj_resolved < 0) {
1114 			err = got_error(GOT_ERR_RANGE);
1115 			break;
1116 		}
1117 		*nobj_total = iprogress->nobj_total;
1118 		*nobj_indexed = iprogress->nobj_indexed;
1119 		*nobj_loose = iprogress->nobj_loose;
1120 		*nobj_resolved = iprogress->nobj_resolved;
1121 		break;
1122 	case GOT_IMSG_IDXPACK_DONE:
1123 		if (datalen != 0) {
1124 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1125 			break;
1126 		}
1127 		*done = 1;
1128 		break;
1129 	default:
1130 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1131 		break;
1132 	}
1133 
1134 	imsg_free(&imsg);
1135 	return err;
1136 }
1137 
1138 const struct got_error *
1139 got_privsep_get_imsg_obj(struct got_object **obj, struct imsg *imsg,
1140     struct imsgbuf *ibuf)
1141 {
1142 	struct got_imsg_object *iobj;
1143 	size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1144 
1145 	if (datalen != sizeof(*iobj))
1146 		return got_error(GOT_ERR_PRIVSEP_LEN);
1147 	iobj = imsg->data;
1148 
1149 	if (iobj->pack_offset < 0)
1150 		return got_error(GOT_ERR_PACK_OFFSET);
1151 
1152 	*obj = calloc(1, sizeof(**obj));
1153 	if (*obj == NULL)
1154 		return got_error_from_errno("calloc");
1155 
1156 	memcpy((*obj)->id.sha1, iobj->id, SHA1_DIGEST_LENGTH);
1157 	(*obj)->type = iobj->type;
1158 	(*obj)->flags = iobj->flags;
1159 	(*obj)->hdrlen = iobj->hdrlen;
1160 	(*obj)->size = iobj->size;
1161 	/* path_packfile is handled by caller */
1162 	if (iobj->flags & GOT_OBJ_FLAG_PACKED) {
1163 		(*obj)->pack_offset = iobj->pack_offset;
1164 		(*obj)->pack_idx = iobj->pack_idx;
1165 	}
1166 	STAILQ_INIT(&(*obj)->deltas.entries);
1167 	return NULL;
1168 }
1169 
1170 const struct got_error *
1171 got_privsep_recv_obj(struct got_object **obj, struct imsgbuf *ibuf)
1172 {
1173 	const struct got_error *err = NULL;
1174 	struct imsg imsg;
1175 	const size_t min_datalen =
1176 	    MIN(sizeof(struct got_imsg_error), sizeof(struct got_imsg_object));
1177 
1178 	*obj = NULL;
1179 
1180 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1181 	if (err)
1182 		return err;
1183 
1184 	switch (imsg.hdr.type) {
1185 	case GOT_IMSG_OBJECT:
1186 		err = got_privsep_get_imsg_obj(obj, &imsg, ibuf);
1187 		break;
1188 	default:
1189 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1190 		break;
1191 	}
1192 
1193 	imsg_free(&imsg);
1194 
1195 	return err;
1196 }
1197 
1198 static const struct got_error *
1199 send_commit_logmsg(struct imsgbuf *ibuf, struct got_commit_object *commit,
1200     size_t logmsg_len)
1201 {
1202 	const struct got_error *err = NULL;
1203 	size_t offset, remain;
1204 
1205 	offset = 0;
1206 	remain = logmsg_len;
1207 	while (remain > 0) {
1208 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
1209 
1210 		if (imsg_compose(ibuf, GOT_IMSG_COMMIT_LOGMSG, 0, 0, -1,
1211 		    commit->logmsg + offset, n) == -1) {
1212 			err = got_error_from_errno("imsg_compose "
1213 			    "COMMIT_LOGMSG");
1214 			break;
1215 		}
1216 
1217 		err = flush_imsg(ibuf);
1218 		if (err)
1219 			break;
1220 
1221 		offset += n;
1222 		remain -= n;
1223 	}
1224 
1225 	return err;
1226 }
1227 
1228 const struct got_error *
1229 got_privsep_send_commit(struct imsgbuf *ibuf, struct got_commit_object *commit)
1230 {
1231 	const struct got_error *err = NULL;
1232 	struct got_imsg_commit_object *icommit;
1233 	uint8_t *buf;
1234 	size_t len, total;
1235 	struct got_object_qid *qid;
1236 	size_t author_len = strlen(commit->author);
1237 	size_t committer_len = strlen(commit->committer);
1238 	size_t logmsg_len = strlen(commit->logmsg);
1239 
1240 	total = sizeof(*icommit) + author_len + committer_len +
1241 	    commit->nparents * SHA1_DIGEST_LENGTH;
1242 
1243 	buf = malloc(total);
1244 	if (buf == NULL)
1245 		return got_error_from_errno("malloc");
1246 
1247 	icommit = (struct got_imsg_commit_object *)buf;
1248 	memcpy(icommit->tree_id, commit->tree_id->sha1,
1249 	    sizeof(icommit->tree_id));
1250 	icommit->author_len = author_len;
1251 	icommit->author_time = commit->author_time;
1252 	icommit->author_gmtoff = commit->author_gmtoff;
1253 	icommit->committer_len = committer_len;
1254 	icommit->committer_time = commit->committer_time;
1255 	icommit->committer_gmtoff = commit->committer_gmtoff;
1256 	icommit->logmsg_len = logmsg_len;
1257 	icommit->nparents = commit->nparents;
1258 
1259 	len = sizeof(*icommit);
1260 	memcpy(buf + len, commit->author, author_len);
1261 	len += author_len;
1262 	memcpy(buf + len, commit->committer, committer_len);
1263 	len += committer_len;
1264 	STAILQ_FOREACH(qid, &commit->parent_ids, entry) {
1265 		memcpy(buf + len, &qid->id, SHA1_DIGEST_LENGTH);
1266 		len += SHA1_DIGEST_LENGTH;
1267 	}
1268 
1269 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT, 0, 0, -1, buf, len) == -1) {
1270 		err = got_error_from_errno("imsg_compose COMMIT");
1271 		goto done;
1272 	}
1273 
1274 	if (logmsg_len == 0 ||
1275 	    logmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
1276 		err = flush_imsg(ibuf);
1277 		if (err)
1278 			goto done;
1279 	}
1280 	err = send_commit_logmsg(ibuf, commit, logmsg_len);
1281 done:
1282 	free(buf);
1283 	return err;
1284 }
1285 
1286 static const struct got_error *
1287 get_commit_from_imsg(struct got_commit_object **commit,
1288     struct imsg *imsg, size_t datalen, struct imsgbuf *ibuf)
1289 {
1290 	const struct got_error *err = NULL;
1291 	struct got_imsg_commit_object *icommit;
1292 	size_t len = 0;
1293 	int i;
1294 
1295 	if (datalen < sizeof(*icommit))
1296 		return got_error(GOT_ERR_PRIVSEP_LEN);
1297 
1298 	icommit = imsg->data;
1299 	if (datalen != sizeof(*icommit) + icommit->author_len +
1300 	    icommit->committer_len +
1301 	    icommit->nparents * SHA1_DIGEST_LENGTH)
1302 		return got_error(GOT_ERR_PRIVSEP_LEN);
1303 
1304 	if (icommit->nparents < 0)
1305 		return got_error(GOT_ERR_PRIVSEP_LEN);
1306 
1307 	len += sizeof(*icommit);
1308 
1309 	*commit = got_object_commit_alloc_partial();
1310 	if (*commit == NULL)
1311 		return got_error_from_errno(
1312 		    "got_object_commit_alloc_partial");
1313 
1314 	memcpy((*commit)->tree_id->sha1, icommit->tree_id,
1315 	    SHA1_DIGEST_LENGTH);
1316 	(*commit)->author_time = icommit->author_time;
1317 	(*commit)->author_gmtoff = icommit->author_gmtoff;
1318 	(*commit)->committer_time = icommit->committer_time;
1319 	(*commit)->committer_gmtoff = icommit->committer_gmtoff;
1320 
1321 	(*commit)->author = strndup(imsg->data + len, icommit->author_len);
1322 	if ((*commit)->author == NULL) {
1323 		err = got_error_from_errno("strndup");
1324 		goto done;
1325 	}
1326 	len += icommit->author_len;
1327 
1328 	(*commit)->committer = strndup(imsg->data + len,
1329 	    icommit->committer_len);
1330 	if ((*commit)->committer == NULL) {
1331 		err = got_error_from_errno("strndup");
1332 		goto done;
1333 	}
1334 	len += icommit->committer_len;
1335 
1336 	if (icommit->logmsg_len == 0) {
1337 		(*commit)->logmsg = strdup("");
1338 		if ((*commit)->logmsg == NULL) {
1339 			err = got_error_from_errno("strdup");
1340 			goto done;
1341 		}
1342 	} else {
1343 		size_t offset = 0, remain = icommit->logmsg_len;
1344 
1345 		(*commit)->logmsg = malloc(icommit->logmsg_len + 1);
1346 		if ((*commit)->logmsg == NULL) {
1347 			err = got_error_from_errno("malloc");
1348 			goto done;
1349 		}
1350 		while (remain > 0) {
1351 			struct imsg imsg_log;
1352 			size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
1353 			    remain);
1354 
1355 			err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
1356 			if (err)
1357 				goto done;
1358 
1359 			if (imsg_log.hdr.type != GOT_IMSG_COMMIT_LOGMSG) {
1360 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1361 				goto done;
1362 			}
1363 
1364 			memcpy((*commit)->logmsg + offset,
1365 			    imsg_log.data, n);
1366 			imsg_free(&imsg_log);
1367 			offset += n;
1368 			remain -= n;
1369 		}
1370 		(*commit)->logmsg[icommit->logmsg_len] = '\0';
1371 	}
1372 
1373 	for (i = 0; i < icommit->nparents; i++) {
1374 		struct got_object_qid *qid;
1375 
1376 		err = got_object_qid_alloc_partial(&qid);
1377 		if (err)
1378 			break;
1379 		memcpy(&qid->id, imsg->data + len +
1380 		    i * SHA1_DIGEST_LENGTH, sizeof(qid->id));
1381 		STAILQ_INSERT_TAIL(&(*commit)->parent_ids, qid, entry);
1382 		(*commit)->nparents++;
1383 	}
1384 done:
1385 	if (err) {
1386 		got_object_commit_close(*commit);
1387 		*commit = NULL;
1388 	}
1389 	return err;
1390 }
1391 
1392 const struct got_error *
1393 got_privsep_recv_commit(struct got_commit_object **commit, struct imsgbuf *ibuf)
1394 {
1395 	const struct got_error *err = NULL;
1396 	struct imsg imsg;
1397 	size_t datalen;
1398 	const size_t min_datalen =
1399 	    MIN(sizeof(struct got_imsg_error),
1400 	    sizeof(struct got_imsg_commit_object));
1401 
1402 	*commit = NULL;
1403 
1404 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1405 	if (err)
1406 		return err;
1407 
1408 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1409 
1410 	switch (imsg.hdr.type) {
1411 	case GOT_IMSG_COMMIT:
1412 		err = get_commit_from_imsg(commit, &imsg, datalen, ibuf);
1413 		break;
1414 	default:
1415 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1416 		break;
1417 	}
1418 
1419 	imsg_free(&imsg);
1420 
1421 	return err;
1422 }
1423 
1424 static const struct got_error *
1425 send_tree_entries_batch(struct imsgbuf *ibuf,
1426     struct got_parsed_tree_entry *entries, int idx0, int idxN, size_t len)
1427 {
1428 	struct ibuf *wbuf;
1429 	struct got_imsg_tree_entries ientries;
1430 	int i;
1431 
1432 	memset(&ientries, 0, sizeof(ientries));
1433 
1434 	wbuf = imsg_create(ibuf, GOT_IMSG_TREE_ENTRIES, 0, 0, len);
1435 	if (wbuf == NULL)
1436 		return got_error_from_errno("imsg_create TREE_ENTRY");
1437 
1438 	ientries.nentries = idxN - idx0 + 1;
1439 	if (imsg_add(wbuf, &ientries, sizeof(ientries)) == -1)
1440 		return got_error_from_errno("imsg_add TREE_ENTRY");
1441 
1442 	for (i = idx0; i <= idxN; i++) {
1443 		struct got_parsed_tree_entry *pte = &entries[i];
1444 
1445 		/* Keep in sync with struct got_imsg_tree_object definition! */
1446 		if (imsg_add(wbuf, pte->id, SHA1_DIGEST_LENGTH) == -1)
1447 			return got_error_from_errno("imsg_add TREE_ENTRY");
1448 		if (imsg_add(wbuf, &pte->mode, sizeof(pte->mode)) == -1)
1449 			return got_error_from_errno("imsg_add TREE_ENTRY");
1450 		if (imsg_add(wbuf, &pte->namelen, sizeof(pte->namelen)) == -1)
1451 			return got_error_from_errno("imsg_add TREE_ENTRY");
1452 
1453 		/* Remaining bytes are the entry's name. */
1454 		if (imsg_add(wbuf, pte->name, pte->namelen) == -1)
1455 			return got_error_from_errno("imsg_add TREE_ENTRY");
1456 	}
1457 
1458 	wbuf->fd = -1;
1459 	imsg_close(ibuf, wbuf);
1460 	return NULL;
1461 }
1462 
1463 static const struct got_error *
1464 send_tree_entries(struct imsgbuf *ibuf, struct got_parsed_tree_entry *entries,
1465     int nentries)
1466 {
1467 	const struct got_error *err = NULL;
1468 	int i, j;
1469 	size_t entries_len = sizeof(struct got_imsg_tree_entries);
1470 
1471 	i = 0;
1472 	for (j = 0; j < nentries; j++) {
1473 		struct got_parsed_tree_entry *pte = &entries[j];
1474 		size_t len = SHA1_DIGEST_LENGTH + sizeof(pte->mode) +
1475 		    sizeof(pte->namelen) + pte->namelen;
1476 
1477 		if (j > 0 &&
1478 		    entries_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
1479 			err = send_tree_entries_batch(ibuf, entries,
1480 			    i, j - 1, entries_len);
1481 			if (err)
1482 				return err;
1483 			i = j;
1484 			entries_len = sizeof(struct got_imsg_tree_entries);
1485 		}
1486 
1487 		entries_len += len;
1488 	}
1489 
1490 	if (j > 0) {
1491 		err = send_tree_entries_batch(ibuf, entries, i, j - 1,
1492 		    entries_len);
1493 		if (err)
1494 			return err;
1495 	}
1496 
1497 	return NULL;
1498 }
1499 
1500 const struct got_error *
1501 got_privsep_send_tree(struct imsgbuf *ibuf,
1502     struct got_parsed_tree_entry *entries, int nentries)
1503 {
1504 	const struct got_error *err = NULL;
1505 	struct got_imsg_tree_object itree;
1506 
1507 	memset(&itree, 0, sizeof(itree));
1508 	itree.nentries = nentries;
1509 	if (imsg_compose(ibuf, GOT_IMSG_TREE, 0, 0, -1, &itree, sizeof(itree))
1510 	    == -1)
1511 		return got_error_from_errno("imsg_compose TREE");
1512 
1513 	err = send_tree_entries(ibuf, entries, nentries);
1514 	if (err)
1515 		return err;
1516 
1517 	return flush_imsg(ibuf);
1518 }
1519 
1520 
1521 static const struct got_error *
1522 recv_tree_entries(void *data, size_t datalen, struct got_tree_object *tree,
1523     int *nentries)
1524 {
1525 	const struct got_error *err = NULL;
1526 	struct got_imsg_tree_entries *ientries;
1527 	struct got_tree_entry *te;
1528 	size_t te_offset;
1529 	size_t i;
1530 
1531 	if (datalen <= sizeof(*ientries) ||
1532 	    datalen > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
1533 		return got_error(GOT_ERR_PRIVSEP_LEN);
1534 
1535 	ientries = (struct got_imsg_tree_entries *)data;
1536 	if (ientries->nentries > INT_MAX) {
1537 		return got_error_msg(GOT_ERR_NO_SPACE,
1538 		    "too many tree entries");
1539 	}
1540 
1541 	te_offset = sizeof(*ientries);
1542 	for (i = 0; i < ientries->nentries; i++) {
1543 		struct got_imsg_tree_entry ite;
1544 		const char *te_name;
1545 		uint8_t *buf = (uint8_t *)data + te_offset;
1546 
1547 		if (te_offset >= datalen) {
1548 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1549 			break;
1550 		}
1551 
1552 		/* Might not be aligned, size is ~32 bytes. */
1553 		memcpy(&ite, buf, sizeof(ite));
1554 
1555 		if (ite.namelen >= sizeof(te->name)) {
1556 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1557 			break;
1558 		}
1559 		if (te_offset + sizeof(ite) + ite.namelen > datalen) {
1560 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1561 			break;
1562 		}
1563 
1564 		if (*nentries >= tree->nentries) {
1565 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1566 			break;
1567 		}
1568 		te = &tree->entries[*nentries];
1569 		te_name = buf + sizeof(ite);
1570 		memcpy(te->name, te_name, ite.namelen);
1571 		te->name[ite.namelen] = '\0';
1572 		memcpy(te->id.sha1, ite.id, SHA1_DIGEST_LENGTH);
1573 		te->mode = ite.mode;
1574 		te->idx = *nentries;
1575 		(*nentries)++;
1576 
1577 		te_offset += sizeof(ite) + ite.namelen;
1578 	}
1579 
1580 	return err;
1581 }
1582 
1583 const struct got_error *
1584 got_privsep_recv_tree(struct got_tree_object **tree, struct imsgbuf *ibuf)
1585 {
1586 	const struct got_error *err = NULL;
1587 	const size_t min_datalen =
1588 	    MIN(sizeof(struct got_imsg_error),
1589 	    sizeof(struct got_imsg_tree_object));
1590 	struct got_imsg_tree_object *itree;
1591 	int nentries = 0;
1592 
1593 	*tree = NULL;
1594 
1595 	err = read_imsg(ibuf);
1596 	if (err)
1597 		goto done;
1598 
1599 	for (;;) {
1600 		struct imsg imsg;
1601 		size_t n;
1602 		size_t datalen;
1603 
1604 		n = imsg_get(ibuf, &imsg);
1605 		if (n == 0) {
1606 			if ((*tree)) {
1607 				if (nentries < (*tree)->nentries) {
1608 					err = read_imsg(ibuf);
1609 					if (err)
1610 						break;
1611 					continue;
1612 				} else
1613 					break;
1614 			} else {
1615 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1616 				break;
1617 			}
1618 		}
1619 
1620 		if (imsg.hdr.len < IMSG_HEADER_SIZE + min_datalen) {
1621 			imsg_free(&imsg);
1622 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1623 			break;
1624 		}
1625 
1626 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1627 
1628 		switch (imsg.hdr.type) {
1629 		case GOT_IMSG_ERROR:
1630 			err = recv_imsg_error(&imsg, datalen);
1631 			break;
1632 		case GOT_IMSG_TREE:
1633 			/* This message should only appear once. */
1634 			if (*tree != NULL) {
1635 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1636 				break;
1637 			}
1638 			if (datalen != sizeof(*itree)) {
1639 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1640 				break;
1641 			}
1642 			itree = imsg.data;
1643 			if (itree->nentries < 0) {
1644 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1645 				break;
1646 			}
1647 			*tree = malloc(sizeof(**tree));
1648 			if (*tree == NULL) {
1649 				err = got_error_from_errno("malloc");
1650 				break;
1651 			}
1652 			(*tree)->entries = calloc(itree->nentries,
1653 			    sizeof(struct got_tree_entry));
1654 			if ((*tree)->entries == NULL) {
1655 				err = got_error_from_errno("malloc");
1656 				free(*tree);
1657 				*tree = NULL;
1658 				break;
1659 			}
1660 			(*tree)->nentries = itree->nentries;
1661 			(*tree)->refcnt = 0;
1662 			break;
1663 		case GOT_IMSG_TREE_ENTRIES:
1664 			/* This message should be preceeded by GOT_IMSG_TREE. */
1665 			if (*tree == NULL) {
1666 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1667 				break;
1668 			}
1669 			err = recv_tree_entries(imsg.data, datalen,
1670 			    *tree, &nentries);
1671 			break;
1672 		default:
1673 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1674 			break;
1675 		}
1676 
1677 		imsg_free(&imsg);
1678 		if (err)
1679 			break;
1680 	}
1681 done:
1682 	if (*tree && (*tree)->nentries != nentries) {
1683 		if (err == NULL)
1684 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1685 		got_object_tree_close(*tree);
1686 		*tree = NULL;
1687 	}
1688 
1689 	return err;
1690 }
1691 
1692 const struct got_error *
1693 got_privsep_send_blob(struct imsgbuf *ibuf, size_t size, size_t hdrlen,
1694     const uint8_t *data)
1695 {
1696 	struct got_imsg_blob iblob;
1697 
1698 	memset(&iblob, 0, sizeof(iblob));
1699 	iblob.size = size;
1700 	iblob.hdrlen = hdrlen;
1701 
1702 	if (data) {
1703 		uint8_t *buf;
1704 
1705 		if (size > GOT_PRIVSEP_INLINE_BLOB_DATA_MAX)
1706 			return got_error(GOT_ERR_NO_SPACE);
1707 
1708 		buf = malloc(sizeof(iblob) + size);
1709 		if (buf == NULL)
1710 			return got_error_from_errno("malloc");
1711 
1712 		memcpy(buf, &iblob, sizeof(iblob));
1713 		memcpy(buf + sizeof(iblob), data, size);
1714 		if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, buf,
1715 		    sizeof(iblob) + size) == -1) {
1716 			free(buf);
1717 			return got_error_from_errno("imsg_compose BLOB");
1718 		}
1719 		free(buf);
1720 	} else {
1721 		/* Data has already been written to file descriptor. */
1722 		if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, &iblob,
1723 		    sizeof(iblob)) == -1)
1724 			return got_error_from_errno("imsg_compose BLOB");
1725 	}
1726 
1727 
1728 	return flush_imsg(ibuf);
1729 }
1730 
1731 const struct got_error *
1732 got_privsep_recv_blob(uint8_t **outbuf, size_t *size, size_t *hdrlen,
1733     struct imsgbuf *ibuf)
1734 {
1735 	const struct got_error *err = NULL;
1736 	struct imsg imsg;
1737 	struct got_imsg_blob *iblob;
1738 	size_t datalen;
1739 
1740 	*outbuf = NULL;
1741 
1742 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
1743 	if (err)
1744 		return err;
1745 
1746 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1747 
1748 	switch (imsg.hdr.type) {
1749 	case GOT_IMSG_BLOB:
1750 		if (datalen < sizeof(*iblob)) {
1751 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1752 			break;
1753 		}
1754 		iblob = imsg.data;
1755 		*size = iblob->size;
1756 		*hdrlen = iblob->hdrlen;
1757 
1758 		if (datalen == sizeof(*iblob)) {
1759 			/* Data has been written to file descriptor. */
1760 			break;
1761 		}
1762 
1763 		if (*size > GOT_PRIVSEP_INLINE_BLOB_DATA_MAX ||
1764 		    *size > datalen + sizeof(*iblob)) {
1765 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1766 			break;
1767 		}
1768 
1769 		*outbuf = malloc(*size);
1770 		if (*outbuf == NULL) {
1771 			err = got_error_from_errno("malloc");
1772 			break;
1773 		}
1774 		memcpy(*outbuf, imsg.data + sizeof(*iblob), *size);
1775 		break;
1776 	default:
1777 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1778 		break;
1779 	}
1780 
1781 	imsg_free(&imsg);
1782 
1783 	return err;
1784 }
1785 
1786 static const struct got_error *
1787 send_tagmsg(struct imsgbuf *ibuf, struct got_tag_object *tag, size_t tagmsg_len)
1788 {
1789 	const struct got_error *err = NULL;
1790 	size_t offset, remain;
1791 
1792 	offset = 0;
1793 	remain = tagmsg_len;
1794 	while (remain > 0) {
1795 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
1796 
1797 		if (imsg_compose(ibuf, GOT_IMSG_TAG_TAGMSG, 0, 0, -1,
1798 		    tag->tagmsg + offset, n) == -1) {
1799 			err = got_error_from_errno("imsg_compose TAG_TAGMSG");
1800 			break;
1801 		}
1802 
1803 		err = flush_imsg(ibuf);
1804 		if (err)
1805 			break;
1806 
1807 		offset += n;
1808 		remain -= n;
1809 	}
1810 
1811 	return err;
1812 }
1813 
1814 const struct got_error *
1815 got_privsep_send_tag(struct imsgbuf *ibuf, struct got_tag_object *tag)
1816 {
1817 	const struct got_error *err = NULL;
1818 	struct got_imsg_tag_object *itag;
1819 	uint8_t *buf;
1820 	size_t len, total;
1821 	size_t tag_len = strlen(tag->tag);
1822 	size_t tagger_len = strlen(tag->tagger);
1823 	size_t tagmsg_len = strlen(tag->tagmsg);
1824 
1825 	total = sizeof(*itag) + tag_len + tagger_len + tagmsg_len;
1826 
1827 	buf = malloc(total);
1828 	if (buf == NULL)
1829 		return got_error_from_errno("malloc");
1830 
1831 	itag = (struct got_imsg_tag_object *)buf;
1832 	memcpy(itag->id, tag->id.sha1, sizeof(itag->id));
1833 	itag->obj_type = tag->obj_type;
1834 	itag->tag_len = tag_len;
1835 	itag->tagger_len = tagger_len;
1836 	itag->tagger_time = tag->tagger_time;
1837 	itag->tagger_gmtoff = tag->tagger_gmtoff;
1838 	itag->tagmsg_len = tagmsg_len;
1839 
1840 	len = sizeof(*itag);
1841 	memcpy(buf + len, tag->tag, tag_len);
1842 	len += tag_len;
1843 	memcpy(buf + len, tag->tagger, tagger_len);
1844 	len += tagger_len;
1845 
1846 	if (imsg_compose(ibuf, GOT_IMSG_TAG, 0, 0, -1, buf, len) == -1) {
1847 		err = got_error_from_errno("imsg_compose TAG");
1848 		goto done;
1849 	}
1850 
1851 	if (tagmsg_len == 0 ||
1852 	    tagmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
1853 		err = flush_imsg(ibuf);
1854 		if (err)
1855 			goto done;
1856 	}
1857 	err = send_tagmsg(ibuf, tag, tagmsg_len);
1858 done:
1859 	free(buf);
1860 	return err;
1861 }
1862 
1863 const struct got_error *
1864 got_privsep_recv_tag(struct got_tag_object **tag, struct imsgbuf *ibuf)
1865 {
1866 	const struct got_error *err = NULL;
1867 	struct imsg imsg;
1868 	struct got_imsg_tag_object *itag;
1869 	size_t len, datalen;
1870 	const size_t min_datalen =
1871 	    MIN(sizeof(struct got_imsg_error),
1872 	    sizeof(struct got_imsg_tag_object));
1873 
1874 	*tag = NULL;
1875 
1876 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1877 	if (err)
1878 		return err;
1879 
1880 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1881 	len = 0;
1882 
1883 	switch (imsg.hdr.type) {
1884 	case GOT_IMSG_TAG:
1885 		if (datalen < sizeof(*itag)) {
1886 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1887 			break;
1888 		}
1889 		itag = imsg.data;
1890 		if (datalen != sizeof(*itag) + itag->tag_len +
1891 		    itag->tagger_len) {
1892 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1893 			break;
1894 		}
1895 		len += sizeof(*itag);
1896 
1897 		*tag = calloc(1, sizeof(**tag));
1898 		if (*tag == NULL) {
1899 			err = got_error_from_errno("calloc");
1900 			break;
1901 		}
1902 
1903 		memcpy((*tag)->id.sha1, itag->id, SHA1_DIGEST_LENGTH);
1904 
1905 		(*tag)->tag = strndup(imsg.data + len, itag->tag_len);
1906 		if ((*tag)->tag == NULL) {
1907 			err = got_error_from_errno("strndup");
1908 			break;
1909 		}
1910 		len += itag->tag_len;
1911 
1912 		(*tag)->obj_type = itag->obj_type;
1913 		(*tag)->tagger_time = itag->tagger_time;
1914 		(*tag)->tagger_gmtoff = itag->tagger_gmtoff;
1915 
1916 		(*tag)->tagger = strndup(imsg.data + len, itag->tagger_len);
1917 		if ((*tag)->tagger == NULL) {
1918 			err = got_error_from_errno("strndup");
1919 			break;
1920 		}
1921 		len += itag->tagger_len;
1922 
1923 		if (itag->tagmsg_len == 0) {
1924 			(*tag)->tagmsg = strdup("");
1925 			if ((*tag)->tagmsg == NULL) {
1926 				err = got_error_from_errno("strdup");
1927 				break;
1928 			}
1929 		} else {
1930 			size_t offset = 0, remain = itag->tagmsg_len;
1931 
1932 			(*tag)->tagmsg = malloc(itag->tagmsg_len + 1);
1933 			if ((*tag)->tagmsg == NULL) {
1934 				err = got_error_from_errno("malloc");
1935 				break;
1936 			}
1937 			while (remain > 0) {
1938 				struct imsg imsg_log;
1939 				size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
1940 				    remain);
1941 
1942 				err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
1943 				if (err)
1944 					return err;
1945 
1946 				if (imsg_log.hdr.type != GOT_IMSG_TAG_TAGMSG)
1947 					return got_error(GOT_ERR_PRIVSEP_MSG);
1948 
1949 				memcpy((*tag)->tagmsg + offset, imsg_log.data,
1950 				    n);
1951 				imsg_free(&imsg_log);
1952 				offset += n;
1953 				remain -= n;
1954 			}
1955 			(*tag)->tagmsg[itag->tagmsg_len] = '\0';
1956 		}
1957 
1958 		break;
1959 	default:
1960 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1961 		break;
1962 	}
1963 
1964 	imsg_free(&imsg);
1965 
1966 	return err;
1967 }
1968 
1969 const struct got_error *
1970 got_privsep_init_pack_child(struct imsgbuf *ibuf, struct got_pack *pack,
1971     struct got_packidx *packidx)
1972 {
1973 	const struct got_error *err = NULL;
1974 	struct got_imsg_packidx ipackidx;
1975 	struct got_imsg_pack ipack;
1976 	int fd;
1977 
1978 	memset(&ipackidx, 0, sizeof(ipackidx));
1979 	memset(&ipack, 0, sizeof(ipack));
1980 
1981 	ipackidx.len = packidx->len;
1982 	ipackidx.packfile_size = pack->filesize;
1983 	fd = dup(packidx->fd);
1984 	if (fd == -1)
1985 		return got_error_from_errno("dup");
1986 
1987 	if (imsg_compose(ibuf, GOT_IMSG_PACKIDX, 0, 0, fd, &ipackidx,
1988 	    sizeof(ipackidx)) == -1) {
1989 		err = got_error_from_errno("imsg_compose PACKIDX");
1990 		close(fd);
1991 		return err;
1992 	}
1993 
1994 	if (strlcpy(ipack.path_packfile, pack->path_packfile,
1995 	    sizeof(ipack.path_packfile)) >= sizeof(ipack.path_packfile))
1996 		return got_error(GOT_ERR_NO_SPACE);
1997 	ipack.filesize = pack->filesize;
1998 
1999 	fd = dup(pack->fd);
2000 	if (fd == -1)
2001 		return got_error_from_errno("dup");
2002 
2003 	if (imsg_compose(ibuf, GOT_IMSG_PACK, 0, 0, fd, &ipack, sizeof(ipack))
2004 	    == -1) {
2005 		err = got_error_from_errno("imsg_compose PACK");
2006 		close(fd);
2007 		return err;
2008 	}
2009 
2010 	return flush_imsg(ibuf);
2011 }
2012 
2013 const struct got_error *
2014 got_privsep_send_packed_obj_req(struct imsgbuf *ibuf, int idx,
2015     struct got_object_id *id)
2016 {
2017 	struct got_imsg_packed_object iobj;
2018 
2019 	memset(&iobj, 0, sizeof(iobj));
2020 	iobj.idx = idx;
2021 	memcpy(iobj.id, id->sha1, sizeof(iobj.id));
2022 
2023 	if (imsg_compose(ibuf, GOT_IMSG_PACKED_OBJECT_REQUEST, 0, 0, -1,
2024 	    &iobj, sizeof(iobj)) == -1)
2025 		return got_error_from_errno("imsg_compose "
2026 		    "PACKED_OBJECT_REQUEST");
2027 
2028 	return flush_imsg(ibuf);
2029 }
2030 
2031 const struct got_error *
2032 got_privsep_send_packed_raw_obj_req(struct imsgbuf *ibuf, int idx,
2033     struct got_object_id *id)
2034 {
2035 	struct got_imsg_packed_object iobj;
2036 
2037 	memset(&iobj, 0, sizeof(iobj));
2038 	iobj.idx = idx;
2039 	memcpy(iobj.id, id->sha1, sizeof(iobj.id));
2040 
2041 	if (imsg_compose(ibuf, GOT_IMSG_PACKED_RAW_OBJECT_REQUEST, 0, 0, -1,
2042 	    &iobj, sizeof(iobj)) == -1)
2043 		return got_error_from_errno("imsg_compose "
2044 		    "PACKED_OBJECT_REQUEST");
2045 
2046 	return flush_imsg(ibuf);
2047 }
2048 
2049 const struct got_error *
2050 got_privsep_send_gitconfig_parse_req(struct imsgbuf *ibuf, int fd)
2051 {
2052 	const struct got_error *err = NULL;
2053 
2054 	if (imsg_compose(ibuf, GOT_IMSG_GITCONFIG_PARSE_REQUEST, 0, 0, fd,
2055 	    NULL, 0) == -1) {
2056 		err = got_error_from_errno("imsg_compose "
2057 		    "GITCONFIG_PARSE_REQUEST");
2058 		close(fd);
2059 		return err;
2060 	}
2061 
2062 	return flush_imsg(ibuf);
2063 }
2064 
2065 const struct got_error *
2066 got_privsep_send_gitconfig_repository_format_version_req(struct imsgbuf *ibuf)
2067 {
2068 	if (imsg_compose(ibuf,
2069 	    GOT_IMSG_GITCONFIG_REPOSITORY_FORMAT_VERSION_REQUEST, 0, 0, -1,
2070 	    NULL, 0) == -1)
2071 		return got_error_from_errno("imsg_compose "
2072 		    "GITCONFIG_REPOSITORY_FORMAT_VERSION_REQUEST");
2073 
2074 	return flush_imsg(ibuf);
2075 }
2076 
2077 const struct got_error *
2078 got_privsep_send_gitconfig_repository_extensions_req(struct imsgbuf *ibuf)
2079 {
2080 	if (imsg_compose(ibuf,
2081 	    GOT_IMSG_GITCONFIG_REPOSITORY_EXTENSIONS_REQUEST, 0, 0, -1,
2082 	    NULL, 0) == -1)
2083 		return got_error_from_errno("imsg_compose "
2084 		    "GITCONFIG_REPOSITORY_EXTENSIONS_REQUEST");
2085 
2086 	return flush_imsg(ibuf);
2087 }
2088 
2089 
2090 const struct got_error *
2091 got_privsep_send_gitconfig_author_name_req(struct imsgbuf *ibuf)
2092 {
2093 	if (imsg_compose(ibuf,
2094 	    GOT_IMSG_GITCONFIG_AUTHOR_NAME_REQUEST, 0, 0, -1, NULL, 0) == -1)
2095 		return got_error_from_errno("imsg_compose "
2096 		    "GITCONFIG_AUTHOR_NAME_REQUEST");
2097 
2098 	return flush_imsg(ibuf);
2099 }
2100 
2101 const struct got_error *
2102 got_privsep_send_gitconfig_author_email_req(struct imsgbuf *ibuf)
2103 {
2104 	if (imsg_compose(ibuf,
2105 	    GOT_IMSG_GITCONFIG_AUTHOR_EMAIL_REQUEST, 0, 0, -1, NULL, 0) == -1)
2106 		return got_error_from_errno("imsg_compose "
2107 		    "GITCONFIG_AUTHOR_EMAIL_REQUEST");
2108 
2109 	return flush_imsg(ibuf);
2110 }
2111 
2112 const struct got_error *
2113 got_privsep_send_gitconfig_remotes_req(struct imsgbuf *ibuf)
2114 {
2115 	if (imsg_compose(ibuf,
2116 	    GOT_IMSG_GITCONFIG_REMOTES_REQUEST, 0, 0, -1, NULL, 0) == -1)
2117 		return got_error_from_errno("imsg_compose "
2118 		    "GITCONFIG_REMOTE_REQUEST");
2119 
2120 	return flush_imsg(ibuf);
2121 }
2122 
2123 const struct got_error *
2124 got_privsep_send_gitconfig_owner_req(struct imsgbuf *ibuf)
2125 {
2126 	if (imsg_compose(ibuf,
2127 	    GOT_IMSG_GITCONFIG_OWNER_REQUEST, 0, 0, -1, NULL, 0) == -1)
2128 		return got_error_from_errno("imsg_compose "
2129 		    "GITCONFIG_OWNER_REQUEST");
2130 
2131 	return flush_imsg(ibuf);
2132 }
2133 
2134 const struct got_error *
2135 got_privsep_recv_gitconfig_str(char **str, struct imsgbuf *ibuf)
2136 {
2137 	const struct got_error *err = NULL;
2138 	struct imsg imsg;
2139 	size_t datalen;
2140 
2141 	*str = NULL;
2142 
2143 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
2144 	if (err)
2145 		return err;
2146 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2147 
2148 	switch (imsg.hdr.type) {
2149 	case GOT_IMSG_GITCONFIG_STR_VAL:
2150 		if (datalen == 0)
2151 			break;
2152 		/* datalen does not include terminating \0 */
2153 		*str = malloc(datalen + 1);
2154 		if (*str == NULL) {
2155 			err = got_error_from_errno("malloc");
2156 			break;
2157 		}
2158 		memcpy(*str, imsg.data, datalen);
2159 		(*str)[datalen] = '\0';
2160 		break;
2161 	default:
2162 		err = got_error(GOT_ERR_PRIVSEP_MSG);
2163 		break;
2164 	}
2165 
2166 	imsg_free(&imsg);
2167 	return err;
2168 }
2169 
2170 const struct got_error *
2171 got_privsep_recv_gitconfig_int(int *val, struct imsgbuf *ibuf)
2172 {
2173 	const struct got_error *err = NULL;
2174 	struct imsg imsg;
2175 	size_t datalen;
2176 	const size_t min_datalen =
2177 	    MIN(sizeof(struct got_imsg_error), sizeof(int));
2178 
2179 	*val = 0;
2180 
2181 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
2182 	if (err)
2183 		return err;
2184 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2185 
2186 	switch (imsg.hdr.type) {
2187 	case GOT_IMSG_GITCONFIG_INT_VAL:
2188 		if (datalen != sizeof(*val)) {
2189 			err = got_error(GOT_ERR_PRIVSEP_LEN);
2190 			break;
2191 		}
2192 		memcpy(val, imsg.data, sizeof(*val));
2193 		break;
2194 	default:
2195 		err = got_error(GOT_ERR_PRIVSEP_MSG);
2196 		break;
2197 	}
2198 
2199 	imsg_free(&imsg);
2200 	return err;
2201 }
2202 
2203 static void
2204 free_remote_data(struct got_remote_repo *remote)
2205 {
2206 	int i;
2207 
2208 	free(remote->name);
2209 	free(remote->fetch_url);
2210 	free(remote->send_url);
2211 	for (i = 0; i < remote->nfetch_branches; i++)
2212 		free(remote->fetch_branches[i]);
2213 	free(remote->fetch_branches);
2214 	for (i = 0; i < remote->nsend_branches; i++)
2215 		free(remote->send_branches[i]);
2216 	free(remote->send_branches);
2217 	for (i = 0; i < remote->nfetch_refs; i++)
2218 		free(remote->fetch_refs[i]);
2219 	free(remote->fetch_refs);
2220 }
2221 
2222 const struct got_error *
2223 got_privsep_recv_gitconfig_remotes(struct got_remote_repo **remotes,
2224     int *nremotes, struct imsgbuf *ibuf)
2225 {
2226 	const struct got_error *err = NULL;
2227 	struct imsg imsg;
2228 	size_t datalen;
2229 	struct got_imsg_remotes iremotes;
2230 	struct got_imsg_remote iremote;
2231 
2232 	*remotes = NULL;
2233 	*nremotes = 0;
2234 	iremotes.nremotes = 0;
2235 
2236 	err = got_privsep_recv_imsg(&imsg, ibuf, sizeof(iremotes));
2237 	if (err)
2238 		return err;
2239 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2240 
2241 	switch (imsg.hdr.type) {
2242 	case GOT_IMSG_GITCONFIG_REMOTES:
2243 		if (datalen != sizeof(iremotes)) {
2244 			err = got_error(GOT_ERR_PRIVSEP_LEN);
2245 			break;
2246 		}
2247 		memcpy(&iremotes, imsg.data, sizeof(iremotes));
2248 		if (iremotes.nremotes == 0) {
2249 			imsg_free(&imsg);
2250 			return NULL;
2251 		}
2252 		break;
2253 	default:
2254 		imsg_free(&imsg);
2255 		return got_error(GOT_ERR_PRIVSEP_MSG);
2256 	}
2257 
2258 	imsg_free(&imsg);
2259 
2260 	*remotes = recallocarray(NULL, 0, iremotes.nremotes, sizeof(**remotes));
2261 	if (*remotes == NULL)
2262 		return got_error_from_errno("recallocarray");
2263 
2264 	while (*nremotes < iremotes.nremotes) {
2265 		struct got_remote_repo *remote;
2266 
2267 		err = got_privsep_recv_imsg(&imsg, ibuf, sizeof(iremote));
2268 		if (err)
2269 			break;
2270 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2271 
2272 		switch (imsg.hdr.type) {
2273 		case GOT_IMSG_GITCONFIG_REMOTE:
2274 			remote = &(*remotes)[*nremotes];
2275 			memset(remote, 0, sizeof(*remote));
2276 			if (datalen < sizeof(iremote)) {
2277 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2278 				break;
2279 			}
2280 			memcpy(&iremote, imsg.data, sizeof(iremote));
2281 			if (iremote.name_len == 0 ||
2282 			    iremote.fetch_url_len == 0 ||
2283 			    iremote.send_url_len == 0 ||
2284 			    (sizeof(iremote) + iremote.name_len +
2285 			    iremote.fetch_url_len + iremote.send_url_len) > datalen) {
2286 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2287 				break;
2288 			}
2289 			remote->name = strndup(imsg.data + sizeof(iremote),
2290 			    iremote.name_len);
2291 			if (remote->name == NULL) {
2292 				err = got_error_from_errno("strndup");
2293 				break;
2294 			}
2295 			remote->fetch_url = strndup(imsg.data + sizeof(iremote) +
2296 			    iremote.name_len, iremote.fetch_url_len);
2297 			if (remote->fetch_url == NULL) {
2298 				err = got_error_from_errno("strndup");
2299 				free_remote_data(remote);
2300 				break;
2301 			}
2302 			remote->send_url = strndup(imsg.data + sizeof(iremote) +
2303 			    iremote.name_len + iremote.fetch_url_len,
2304 			    iremote.send_url_len);
2305 			if (remote->send_url == NULL) {
2306 				err = got_error_from_errno("strndup");
2307 				free_remote_data(remote);
2308 				break;
2309 			}
2310 			remote->mirror_references = iremote.mirror_references;
2311 			remote->fetch_all_branches = iremote.fetch_all_branches;
2312 			remote->nfetch_branches = 0;
2313 			remote->fetch_branches = NULL;
2314 			remote->nsend_branches = 0;
2315 			remote->send_branches = NULL;
2316 			remote->nfetch_refs = 0;
2317 			remote->fetch_refs = NULL;
2318 			(*nremotes)++;
2319 			break;
2320 		default:
2321 			err = got_error(GOT_ERR_PRIVSEP_MSG);
2322 			break;
2323 		}
2324 
2325 		imsg_free(&imsg);
2326 		if (err)
2327 			break;
2328 	}
2329 
2330 	if (err) {
2331 		int i;
2332 		for (i = 0; i < *nremotes; i++)
2333 			free_remote_data(&(*remotes)[i]);
2334 		free(*remotes);
2335 		*remotes = NULL;
2336 		*nremotes = 0;
2337 	}
2338 	return err;
2339 }
2340 
2341 const struct got_error *
2342 got_privsep_send_gotconfig_parse_req(struct imsgbuf *ibuf, int fd)
2343 {
2344 	const struct got_error *err = NULL;
2345 
2346 	if (imsg_compose(ibuf, GOT_IMSG_GOTCONFIG_PARSE_REQUEST, 0, 0, fd,
2347 	    NULL, 0) == -1) {
2348 		err = got_error_from_errno("imsg_compose "
2349 		    "GOTCONFIG_PARSE_REQUEST");
2350 		close(fd);
2351 		return err;
2352 	}
2353 
2354 	return flush_imsg(ibuf);
2355 }
2356 
2357 const struct got_error *
2358 got_privsep_send_gotconfig_author_req(struct imsgbuf *ibuf)
2359 {
2360 	if (imsg_compose(ibuf,
2361 	    GOT_IMSG_GOTCONFIG_AUTHOR_REQUEST, 0, 0, -1, NULL, 0) == -1)
2362 		return got_error_from_errno("imsg_compose "
2363 		    "GOTCONFIG_AUTHOR_REQUEST");
2364 
2365 	return flush_imsg(ibuf);
2366 }
2367 
2368 const struct got_error *
2369 got_privsep_send_gotconfig_allowed_signers_req(struct imsgbuf *ibuf)
2370 {
2371 	if (imsg_compose(ibuf,
2372 	    GOT_IMSG_GOTCONFIG_ALLOWEDSIGNERS_REQUEST, 0, 0, -1, NULL, 0) == -1)
2373 		return got_error_from_errno("imsg_compose "
2374 		    "GOTCONFIG_ALLOWEDSIGNERS_REQUEST");
2375 
2376 	return flush_imsg(ibuf);
2377 }
2378 
2379 const struct got_error *
2380 got_privsep_send_gotconfig_revoked_signers_req(struct imsgbuf *ibuf)
2381 {
2382 	if (imsg_compose(ibuf,
2383 	    GOT_IMSG_GOTCONFIG_REVOKEDSIGNERS_REQUEST, 0, 0, -1, NULL, 0) == -1)
2384 		return got_error_from_errno("imsg_compose "
2385 		    "GOTCONFIG_REVOKEDSIGNERS_REQUEST");
2386 
2387 	return flush_imsg(ibuf);
2388 }
2389 
2390 const struct got_error *
2391 got_privsep_send_gotconfig_signer_id_req(struct imsgbuf *ibuf)
2392 {
2393 	if (imsg_compose(ibuf,
2394 	    GOT_IMSG_GOTCONFIG_SIGNERID_REQUEST, 0, 0, -1, NULL, 0) == -1)
2395 		return got_error_from_errno("imsg_compose "
2396 		    "GOTCONFIG_SIGNERID_REQUEST");
2397 
2398 	return flush_imsg(ibuf);
2399 }
2400 
2401 const struct got_error *
2402 got_privsep_send_gotconfig_remotes_req(struct imsgbuf *ibuf)
2403 {
2404 	if (imsg_compose(ibuf,
2405 	    GOT_IMSG_GOTCONFIG_REMOTES_REQUEST, 0, 0, -1, NULL, 0) == -1)
2406 		return got_error_from_errno("imsg_compose "
2407 		    "GOTCONFIG_REMOTE_REQUEST");
2408 
2409 	return flush_imsg(ibuf);
2410 }
2411 
2412 const struct got_error *
2413 got_privsep_recv_gotconfig_str(char **str, struct imsgbuf *ibuf)
2414 {
2415 	const struct got_error *err = NULL;
2416 	struct imsg imsg;
2417 	size_t datalen;
2418 
2419 	*str = NULL;
2420 
2421 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
2422 	if (err)
2423 		return err;
2424 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2425 
2426 	switch (imsg.hdr.type) {
2427 	case GOT_IMSG_ERROR:
2428 		err = recv_imsg_error(&imsg, datalen);
2429 		break;
2430 	case GOT_IMSG_GOTCONFIG_STR_VAL:
2431 		if (datalen == 0)
2432 			break;
2433 		/* datalen does not include terminating \0 */
2434 		*str = malloc(datalen + 1);
2435 		if (*str == NULL) {
2436 			err = got_error_from_errno("malloc");
2437 			break;
2438 		}
2439 		memcpy(*str, imsg.data, datalen);
2440 		(*str)[datalen] = '\0';
2441 		break;
2442 	default:
2443 		err = got_error(GOT_ERR_PRIVSEP_MSG);
2444 		break;
2445 	}
2446 
2447 	imsg_free(&imsg);
2448 	return err;
2449 }
2450 
2451 const struct got_error *
2452 got_privsep_recv_gotconfig_remotes(struct got_remote_repo **remotes,
2453     int *nremotes, struct imsgbuf *ibuf)
2454 {
2455 	const struct got_error *err = NULL;
2456 	struct imsg imsg;
2457 	size_t datalen;
2458 	struct got_imsg_remotes iremotes;
2459 	struct got_imsg_remote iremote;
2460 	const size_t min_datalen =
2461 	    MIN(sizeof(struct got_imsg_error), sizeof(iremotes));
2462 
2463 	*remotes = NULL;
2464 	*nremotes = 0;
2465 	iremotes.nremotes = 0;
2466 
2467 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
2468 	if (err)
2469 		return err;
2470 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2471 
2472 	switch (imsg.hdr.type) {
2473 	case GOT_IMSG_ERROR:
2474 		err = recv_imsg_error(&imsg, datalen);
2475 		break;
2476 	case GOT_IMSG_GOTCONFIG_REMOTES:
2477 		if (datalen != sizeof(iremotes)) {
2478 			err = got_error(GOT_ERR_PRIVSEP_LEN);
2479 			break;
2480 		}
2481 		memcpy(&iremotes, imsg.data, sizeof(iremotes));
2482 		if (iremotes.nremotes < 0) {
2483 			err = got_error(GOT_ERR_PRIVSEP_LEN);
2484 			break;
2485 		}
2486 		if (iremotes.nremotes == 0) {
2487 			imsg_free(&imsg);
2488 			return NULL;
2489 		}
2490 		break;
2491 	default:
2492 		imsg_free(&imsg);
2493 		return got_error(GOT_ERR_PRIVSEP_MSG);
2494 	}
2495 
2496 	imsg_free(&imsg);
2497 
2498 	*remotes = recallocarray(NULL, 0, iremotes.nremotes, sizeof(**remotes));
2499 	if (*remotes == NULL)
2500 		return got_error_from_errno("recallocarray");
2501 
2502 	while (*nremotes < iremotes.nremotes) {
2503 		struct got_remote_repo *remote;
2504 		const size_t min_datalen =
2505 		    MIN(sizeof(struct got_imsg_error), sizeof(iremote));
2506 		int i;
2507 
2508 		err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
2509 		if (err)
2510 			break;
2511 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2512 
2513 		switch (imsg.hdr.type) {
2514 		case GOT_IMSG_ERROR:
2515 			err = recv_imsg_error(&imsg, datalen);
2516 			break;
2517 		case GOT_IMSG_GOTCONFIG_REMOTE:
2518 			remote = &(*remotes)[*nremotes];
2519 			memset(remote, 0, sizeof(*remote));
2520 			if (datalen < sizeof(iremote)) {
2521 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2522 				break;
2523 			}
2524 			memcpy(&iremote, imsg.data, sizeof(iremote));
2525 			if (iremote.name_len == 0 ||
2526 			    (iremote.fetch_url_len == 0 &&
2527 			    iremote.send_url_len == 0) ||
2528 			    (sizeof(iremote) + iremote.name_len +
2529 			    iremote.fetch_url_len + iremote.send_url_len) >
2530 			    datalen) {
2531 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2532 				break;
2533 			}
2534 			remote->name = strndup(imsg.data + sizeof(iremote),
2535 			    iremote.name_len);
2536 			if (remote->name == NULL) {
2537 				err = got_error_from_errno("strndup");
2538 				break;
2539 			}
2540 			remote->fetch_url = strndup(imsg.data +
2541 			    sizeof(iremote) + iremote.name_len,
2542 			    iremote.fetch_url_len);
2543 			if (remote->fetch_url == NULL) {
2544 				err = got_error_from_errno("strndup");
2545 				free_remote_data(remote);
2546 				break;
2547 			}
2548 			remote->send_url = strndup(imsg.data +
2549 			    sizeof(iremote) + iremote.name_len +
2550 			    iremote.fetch_url_len, iremote.send_url_len);
2551 			if (remote->send_url == NULL) {
2552 				err = got_error_from_errno("strndup");
2553 				free_remote_data(remote);
2554 				break;
2555 			}
2556 			remote->mirror_references = iremote.mirror_references;
2557 			remote->fetch_all_branches = iremote.fetch_all_branches;
2558 			if (iremote.nfetch_branches > 0) {
2559 				remote->fetch_branches = recallocarray(NULL, 0,
2560 				    iremote.nfetch_branches, sizeof(char *));
2561 				if (remote->fetch_branches == NULL) {
2562 					err = got_error_from_errno("calloc");
2563 					free_remote_data(remote);
2564 					break;
2565 				}
2566 			}
2567 			remote->nfetch_branches = 0;
2568 			for (i = 0; i < iremote.nfetch_branches; i++) {
2569 				char *branch;
2570 				err = got_privsep_recv_gotconfig_str(&branch,
2571 				    ibuf);
2572 				if (err) {
2573 					free_remote_data(remote);
2574 					goto done;
2575 				}
2576 				remote->fetch_branches[i] = branch;
2577 				remote->nfetch_branches++;
2578 			}
2579 			if (iremote.nsend_branches > 0) {
2580 				remote->send_branches = recallocarray(NULL, 0,
2581 				    iremote.nsend_branches, sizeof(char *));
2582 				if (remote->send_branches == NULL) {
2583 					err = got_error_from_errno("calloc");
2584 					free_remote_data(remote);
2585 					break;
2586 				}
2587 			}
2588 			remote->nsend_branches = 0;
2589 			for (i = 0; i < iremote.nsend_branches; i++) {
2590 				char *branch;
2591 				err = got_privsep_recv_gotconfig_str(&branch,
2592 				    ibuf);
2593 				if (err) {
2594 					free_remote_data(remote);
2595 					goto done;
2596 				}
2597 				remote->send_branches[i] = branch;
2598 				remote->nsend_branches++;
2599 			}
2600 			if (iremote.nfetch_refs > 0) {
2601 				remote->fetch_refs = recallocarray(NULL, 0,
2602 				    iremote.nfetch_refs, sizeof(char *));
2603 				if (remote->fetch_refs == NULL) {
2604 					err = got_error_from_errno("calloc");
2605 					free_remote_data(remote);
2606 					break;
2607 				}
2608 			}
2609 			remote->nfetch_refs = 0;
2610 			for (i = 0; i < iremote.nfetch_refs; i++) {
2611 				char *ref;
2612 				err = got_privsep_recv_gotconfig_str(&ref,
2613 				    ibuf);
2614 				if (err) {
2615 					free_remote_data(remote);
2616 					goto done;
2617 				}
2618 				remote->fetch_refs[i] = ref;
2619 				remote->nfetch_refs++;
2620 			}
2621 			(*nremotes)++;
2622 			break;
2623 		default:
2624 			err = got_error(GOT_ERR_PRIVSEP_MSG);
2625 			break;
2626 		}
2627 
2628 		imsg_free(&imsg);
2629 		if (err)
2630 			break;
2631 	}
2632 done:
2633 	if (err) {
2634 		int i;
2635 		for (i = 0; i < *nremotes; i++)
2636 			free_remote_data(&(*remotes)[i]);
2637 		free(*remotes);
2638 		*remotes = NULL;
2639 		*nremotes = 0;
2640 	}
2641 	return err;
2642 }
2643 
2644 const struct got_error *
2645 got_privsep_send_commit_traversal_request(struct imsgbuf *ibuf,
2646     struct got_object_id *id, int idx, const char *path)
2647 {
2648 	struct ibuf *wbuf;
2649 	size_t path_len = strlen(path) + 1;
2650 
2651 	wbuf = imsg_create(ibuf, GOT_IMSG_COMMIT_TRAVERSAL_REQUEST, 0, 0,
2652 	    sizeof(struct got_imsg_commit_traversal_request) + path_len);
2653 	if (wbuf == NULL)
2654 		return got_error_from_errno(
2655 		    "imsg_create COMMIT_TRAVERSAL_REQUEST");
2656 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1)
2657 		return got_error_from_errno("imsg_add "
2658 		    "COMMIT_TRAVERSAL_REQUEST");
2659 	if (imsg_add(wbuf, &idx, sizeof(idx)) == -1)
2660 		return got_error_from_errno("imsg_add "
2661 		    "COMMIT_TRAVERSAL_REQUEST");
2662 	if (imsg_add(wbuf, path, path_len) == -1)
2663 		return got_error_from_errno("imsg_add "
2664 		    "COMMIT_TRAVERSAL_REQUEST");
2665 
2666 	wbuf->fd = -1;
2667 	imsg_close(ibuf, wbuf);
2668 
2669 	return flush_imsg(ibuf);
2670 }
2671 
2672 const struct got_error *
2673 got_privsep_recv_traversed_commits(struct got_commit_object **changed_commit,
2674     struct got_object_id **changed_commit_id,
2675     struct got_object_id_queue *commit_ids, struct imsgbuf *ibuf)
2676 {
2677 	const struct got_error *err = NULL;
2678 	struct imsg imsg;
2679 	struct got_imsg_traversed_commits *icommits;
2680 	size_t datalen;
2681 	int i, done = 0;
2682 
2683 	*changed_commit = NULL;
2684 	*changed_commit_id = NULL;
2685 
2686 	while (!done) {
2687 		err = got_privsep_recv_imsg(&imsg, ibuf, 0);
2688 		if (err)
2689 			return err;
2690 
2691 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2692 		switch (imsg.hdr.type) {
2693 		case GOT_IMSG_TRAVERSED_COMMITS:
2694 			icommits = imsg.data;
2695 			if (datalen != sizeof(*icommits) +
2696 			    icommits->ncommits * SHA1_DIGEST_LENGTH) {
2697 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2698 				break;
2699 			}
2700 			for (i = 0; i < icommits->ncommits; i++) {
2701 				struct got_object_qid *qid;
2702 				uint8_t *sha1 = (uint8_t *)imsg.data +
2703 				    sizeof(*icommits) + i * SHA1_DIGEST_LENGTH;
2704 				err = got_object_qid_alloc_partial(&qid);
2705 				if (err)
2706 					break;
2707 				memcpy(qid->id.sha1, sha1, SHA1_DIGEST_LENGTH);
2708 				STAILQ_INSERT_TAIL(commit_ids, qid, entry);
2709 
2710 				/* The last commit may contain a change. */
2711 				if (i == icommits->ncommits - 1) {
2712 					*changed_commit_id =
2713 					    got_object_id_dup(&qid->id);
2714 					if (*changed_commit_id == NULL) {
2715 						err = got_error_from_errno(
2716 						    "got_object_id_dup");
2717 						break;
2718 					}
2719 				}
2720 			}
2721 			break;
2722 		case GOT_IMSG_COMMIT:
2723 			if (*changed_commit_id == NULL) {
2724 				err = got_error(GOT_ERR_PRIVSEP_MSG);
2725 				break;
2726 			}
2727 			err = get_commit_from_imsg(changed_commit, &imsg,
2728 			    datalen, ibuf);
2729 			break;
2730 		case GOT_IMSG_COMMIT_TRAVERSAL_DONE:
2731 			done = 1;
2732 			break;
2733 		default:
2734 			err = got_error(GOT_ERR_PRIVSEP_MSG);
2735 			break;
2736 		}
2737 
2738 		imsg_free(&imsg);
2739 		if (err)
2740 			break;
2741 	}
2742 
2743 	if (err)
2744 		got_object_id_queue_free(commit_ids);
2745 	return err;
2746 }
2747 
2748 const struct got_error *
2749 got_privsep_send_enumerated_tree(size_t *totlen, struct imsgbuf *ibuf,
2750     struct got_object_id *tree_id, const char *path,
2751     struct got_parsed_tree_entry *entries, int nentries)
2752 {
2753 	const struct got_error *err = NULL;
2754 	struct ibuf *wbuf;
2755 	size_t path_len = strlen(path);
2756 	size_t msglen;
2757 
2758 	msglen = sizeof(struct got_imsg_enumerated_tree) + path_len;
2759 	wbuf = imsg_create(ibuf, GOT_IMSG_ENUMERATED_TREE, 0, 0, msglen);
2760 	if (wbuf == NULL)
2761 		return got_error_from_errno("imsg_create ENUMERATED_TREE");
2762 
2763 	if (imsg_add(wbuf, tree_id->sha1, SHA1_DIGEST_LENGTH) == -1)
2764 		return got_error_from_errno("imsg_add ENUMERATED_TREE");
2765 	if (imsg_add(wbuf, &nentries, sizeof(nentries)) == -1)
2766 		return got_error_from_errno("imsg_add ENUMERATED_TREE");
2767 	if (imsg_add(wbuf, path, path_len) == -1)
2768 		return got_error_from_errno("imsg_add ENUMERATED_TREE");
2769 
2770 	wbuf->fd = -1;
2771 	imsg_close(ibuf, wbuf);
2772 
2773 	if (entries) {
2774 		err = send_tree_entries(ibuf, entries, nentries);
2775 		if (err)
2776 			return err;
2777 	}
2778 
2779 	return flush_imsg(ibuf);
2780 }
2781 
2782 const struct got_error *
2783 got_privsep_send_object_enumeration_request(struct imsgbuf *ibuf)
2784 {
2785 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT_ENUMERATION_REQUEST,
2786 	    0, 0, -1, NULL, 0) == -1)
2787 		return got_error_from_errno("imsg_compose "
2788 		    "OBJECT_ENUMERATION_REQUEST");
2789 
2790 	return flush_imsg(ibuf);
2791 }
2792 
2793 const struct got_error *
2794 got_privsep_send_object_enumeration_done(struct imsgbuf *ibuf)
2795 {
2796 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT_ENUMERATION_DONE,
2797 	    0, 0, -1, NULL, 0) == -1)
2798 		return got_error_from_errno("imsg_compose "
2799 		    "OBJECT_ENUMERATION_DONE");
2800 
2801 	return flush_imsg(ibuf);
2802 }
2803 
2804 const struct got_error *
2805 got_privsep_send_object_enumeration_incomplete(struct imsgbuf *ibuf)
2806 {
2807 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT_ENUMERATION_INCOMPLETE,
2808 	    0, 0, -1, NULL, 0) == -1)
2809 		return got_error_from_errno("imsg_compose "
2810 		    "OBJECT_ENUMERATION_INCOMPLETE");
2811 
2812 	return flush_imsg(ibuf);
2813 }
2814 
2815 const struct got_error *
2816 got_privsep_send_enumerated_commit(struct imsgbuf *ibuf,
2817     struct got_object_id *id, time_t mtime)
2818 {
2819 	struct ibuf *wbuf;
2820 
2821 	wbuf = imsg_create(ibuf, GOT_IMSG_ENUMERATED_COMMIT, 0, 0,
2822 	    sizeof(struct got_imsg_enumerated_commit) + SHA1_DIGEST_LENGTH);
2823 	if (wbuf == NULL)
2824 		return got_error_from_errno("imsg_create ENUMERATED_COMMIT");
2825 
2826 	/* Keep in sync with struct got_imsg_enumerated_commit! */
2827 	if (imsg_add(wbuf, id, SHA1_DIGEST_LENGTH) == -1)
2828 		return got_error_from_errno("imsg_add ENUMERATED_COMMIT");
2829 	if (imsg_add(wbuf, &mtime, sizeof(mtime)) == -1)
2830 		return got_error_from_errno("imsg_add ENUMERATED_COMMIT");
2831 
2832 	wbuf->fd = -1;
2833 	imsg_close(ibuf, wbuf);
2834 	/* Don't flush yet, tree entries or ENUMERATION_DONE will follow. */
2835 	return NULL;
2836 }
2837 
2838 const struct got_error *
2839 got_privsep_recv_enumerated_objects(int *found_all_objects,
2840     struct imsgbuf *ibuf,
2841     got_object_enumerate_commit_cb cb_commit,
2842     got_object_enumerate_tree_cb cb_tree, void *cb_arg,
2843     struct got_repository *repo)
2844 {
2845 	const struct got_error *err = NULL;
2846 	struct imsg imsg;
2847 	struct got_imsg_enumerated_commit *icommit = NULL;
2848 	struct got_object_id commit_id;
2849 	int have_commit = 0;
2850 	time_t mtime = 0;
2851 	struct got_tree_object tree;
2852 	struct got_imsg_enumerated_tree *itree;
2853 	struct got_object_id tree_id;
2854 	char *path = NULL, *canon_path = NULL;
2855 	size_t datalen, path_len;
2856 	int nentries = -1;
2857 	int done = 0;
2858 
2859 	*found_all_objects = 0;
2860 	memset(&tree, 0, sizeof(tree));
2861 
2862 	while (!done) {
2863 		err = got_privsep_recv_imsg(&imsg, ibuf, 0);
2864 		if (err)
2865 			break;
2866 
2867 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2868 		switch (imsg.hdr.type) {
2869 		case GOT_IMSG_ENUMERATED_COMMIT:
2870 			if (have_commit && nentries != -1) {
2871 				err = got_error(GOT_ERR_PRIVSEP_MSG);
2872 				break;
2873 			}
2874 			if (datalen != sizeof(*icommit)) {
2875 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2876 				break;
2877 			}
2878 			icommit = (struct got_imsg_enumerated_commit *)imsg.data;
2879 			memcpy(commit_id.sha1, icommit->id, SHA1_DIGEST_LENGTH);
2880 			mtime = icommit->mtime;
2881 			have_commit = 1;
2882 			break;
2883 		case GOT_IMSG_ENUMERATED_TREE:
2884 			/* Should be preceeded by GOT_IMSG_ENUMERATED_COMMIT. */
2885 			if (!have_commit) {
2886 				err = got_error(GOT_ERR_PRIVSEP_MSG);
2887 				break;
2888 			}
2889 			if (datalen < sizeof(*itree)) {
2890 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2891 				break;
2892 			}
2893 			itree = imsg.data;
2894 			path_len = datalen - sizeof(*itree);
2895 			if (path_len == 0) {
2896 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2897 				break;
2898 			}
2899 			memcpy(tree_id.sha1, itree->id, sizeof(tree_id.sha1));
2900 			free(path);
2901 			path = malloc(path_len + 1);
2902 			if (path == NULL) {
2903 				err = got_error_from_errno("malloc");
2904 				break;
2905 			}
2906 			free(canon_path);
2907 			canon_path = malloc(path_len + 1);
2908 			if (canon_path == NULL) {
2909 				err = got_error_from_errno("malloc");
2910 				break;
2911 			}
2912 			memcpy(path, (uint8_t *)imsg.data + sizeof(*itree),
2913 			    path_len);
2914 			path[path_len] = '\0';
2915 			if (!got_path_is_absolute(path)) {
2916 				err = got_error(GOT_ERR_BAD_PATH);
2917 				break;
2918 			}
2919 			if (got_path_is_root_dir(path)) {
2920 				/* XXX check what got_canonpath() does wrong */
2921 				canon_path[0] = '/';
2922 				canon_path[1] = '\0';
2923 			} else {
2924 				err = got_canonpath(path, canon_path,
2925 				    path_len + 1);
2926 				if (err)
2927 					break;
2928 			}
2929 			if (strcmp(path, canon_path) != 0) {
2930 				err = got_error(GOT_ERR_BAD_PATH);
2931 				break;
2932 			}
2933 			if (nentries != -1) {
2934 				err = got_error(GOT_ERR_PRIVSEP_MSG);
2935 				break;
2936 			}
2937 			if (itree->nentries < -1) {
2938 				err = got_error(GOT_ERR_PRIVSEP_MSG);
2939 				break;
2940 			}
2941 			if (itree->nentries == -1) {
2942 				/* Tree was not found in pack file. */
2943 				err = cb_tree(cb_arg, NULL, mtime, &tree_id,
2944 				    path, repo);
2945 				break;
2946 			}
2947 			if (itree->nentries > INT_MAX) {
2948 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2949 				break;
2950 			}
2951 			tree.entries = calloc(itree->nentries,
2952 			    sizeof(struct got_tree_entry));
2953 			if (tree.entries == NULL) {
2954 				err = got_error_from_errno("calloc");
2955 				break;
2956 			}
2957 			if (itree->nentries == 0) {
2958 				err = cb_tree(cb_arg, &tree, mtime, &tree_id,
2959 				    path, repo);
2960 				if (err)
2961 					break;
2962 
2963 				/* Prepare for next tree. */
2964 				free(tree.entries);
2965 				memset(&tree, 0, sizeof(tree));
2966 				nentries = -1;
2967 			} else {
2968 				tree.nentries = itree->nentries;
2969 				nentries = 0;
2970 			}
2971 			break;
2972 		case GOT_IMSG_TREE_ENTRIES:
2973 			/* Should be preceeded by GOT_IMSG_ENUMERATED_TREE. */
2974 			if (nentries <= -1) {
2975 				err = got_error(GOT_ERR_PRIVSEP_MSG);
2976 				break;
2977 			}
2978 			err = recv_tree_entries(imsg.data, datalen,
2979 			    &tree, &nentries);
2980 			if (err)
2981 				break;
2982 			if (tree.nentries == nentries) {
2983 				err = cb_tree(cb_arg, &tree, mtime, &tree_id,
2984 				    path, repo);
2985 				if (err)
2986 					break;
2987 
2988 				/* Prepare for next tree. */
2989 				free(tree.entries);
2990 				memset(&tree, 0, sizeof(tree));
2991 				nentries = -1;
2992 			}
2993 			break;
2994 		case GOT_IMSG_TREE_ENUMERATION_DONE:
2995 			/* All trees have been found and traversed. */
2996 			if (!have_commit || path == NULL || nentries != -1) {
2997 				err = got_error(GOT_ERR_PRIVSEP_MSG);
2998 				break;
2999 			}
3000 			err = cb_commit(cb_arg, mtime, &commit_id, repo);
3001 			if (err)
3002 				break;
3003 			have_commit = 0;
3004 			break;
3005 		case GOT_IMSG_OBJECT_ENUMERATION_DONE:
3006 			*found_all_objects = 1;
3007 			done = 1;
3008 			break;
3009 		case GOT_IMSG_OBJECT_ENUMERATION_INCOMPLETE:
3010 			done = 1;
3011 			break;
3012 		default:
3013 			err = got_error(GOT_ERR_PRIVSEP_MSG);
3014 			break;
3015 		}
3016 
3017 		imsg_free(&imsg);
3018 		if (err)
3019 			break;
3020 	}
3021 
3022 	free(path);
3023 	free(canon_path);
3024 	free(tree.entries);
3025 	return err;
3026 }
3027 
3028 const struct got_error *
3029 got_privsep_send_raw_delta_req(struct imsgbuf *ibuf, int idx,
3030     struct got_object_id *id)
3031 {
3032 	struct got_imsg_raw_delta_request dreq;
3033 
3034 	memset(&dreq, 0, sizeof(dreq));
3035 	dreq.idx = idx;
3036 	memcpy(dreq.id, id->sha1, SHA1_DIGEST_LENGTH);
3037 
3038 	if (imsg_compose(ibuf, GOT_IMSG_RAW_DELTA_REQUEST, 0, 0, -1,
3039 	    &dreq, sizeof(dreq)) == -1)
3040 		return got_error_from_errno("imsg_compose RAW_DELTA_REQUEST");
3041 
3042 	return flush_imsg(ibuf);
3043 }
3044 
3045 const struct got_error *
3046 got_privsep_send_raw_delta_outfd(struct imsgbuf *ibuf, int fd)
3047 {
3048 	return send_fd(ibuf, GOT_IMSG_RAW_DELTA_OUTFD, fd);
3049 }
3050 
3051 const struct got_error *
3052 got_privsep_send_raw_delta(struct imsgbuf *ibuf, uint64_t base_size,
3053     uint64_t result_size,  off_t delta_size, off_t delta_compressed_size,
3054     off_t delta_offset, off_t delta_out_offset, struct got_object_id *base_id)
3055 {
3056 	struct got_imsg_raw_delta idelta;
3057 	int ret;
3058 
3059 	memset(&idelta, 0, sizeof(idelta));
3060 	idelta.base_size = base_size;
3061 	idelta.result_size = result_size;
3062 	idelta.delta_size = delta_size;
3063 	idelta.delta_compressed_size = delta_compressed_size;
3064 	idelta.delta_offset = delta_offset;
3065 	idelta.delta_out_offset = delta_out_offset;
3066 	memcpy(idelta.base_id, base_id->sha1, SHA1_DIGEST_LENGTH);
3067 
3068 	ret = imsg_compose(ibuf, GOT_IMSG_RAW_DELTA, 0, 0, -1,
3069 	    &idelta, sizeof(idelta));
3070 	if (ret == -1)
3071 		return got_error_from_errno("imsg_compose RAW_DELTA");
3072 
3073 	return flush_imsg(ibuf);
3074 }
3075 
3076 const struct got_error *
3077 got_privsep_recv_raw_delta(uint64_t *base_size, uint64_t *result_size,
3078     off_t *delta_size, off_t *delta_compressed_size, off_t *delta_offset,
3079     off_t *delta_out_offset, struct got_object_id **base_id, struct imsgbuf *ibuf)
3080 {
3081 	const struct got_error *err = NULL;
3082 	struct imsg imsg;
3083 	struct got_imsg_raw_delta *delta;
3084 	size_t datalen;
3085 
3086 	*base_size = 0;
3087 	*result_size = 0;
3088 	*delta_size = 0;
3089 	*delta_compressed_size = 0;
3090 	*delta_offset = 0;
3091 	*delta_out_offset = 0;
3092 	*base_id = NULL;
3093 
3094 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
3095 	if (err)
3096 		return err;
3097 
3098 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
3099 
3100 	switch (imsg.hdr.type) {
3101 	case GOT_IMSG_RAW_DELTA:
3102 		if (datalen != sizeof(*delta)) {
3103 			err = got_error(GOT_ERR_PRIVSEP_LEN);
3104 			break;
3105 		}
3106 		delta = imsg.data;
3107 		*base_size = delta->base_size;
3108 		*result_size = delta->result_size;
3109 		*delta_size = delta->delta_size;
3110 		*delta_compressed_size = delta->delta_compressed_size;
3111 		*delta_offset = delta->delta_offset;
3112 		*delta_out_offset = delta->delta_out_offset;
3113 		*base_id = calloc(1, sizeof(**base_id));
3114 		if (*base_id == NULL) {
3115 			err = got_error_from_errno("malloc");
3116 			break;
3117 		}
3118 		memcpy((*base_id)->sha1, delta->base_id, SHA1_DIGEST_LENGTH);
3119 		break;
3120 	default:
3121 		err = got_error(GOT_ERR_PRIVSEP_MSG);
3122 		break;
3123 	}
3124 
3125 	imsg_free(&imsg);
3126 
3127 	if (err) {
3128 		free(*base_id);
3129 		*base_id = NULL;
3130 	}
3131 	return err;
3132 }
3133 
3134 static const struct got_error *
3135 send_idlist(struct imsgbuf *ibuf, struct got_object_id **ids, size_t nids)
3136 {
3137 	const struct got_error *err = NULL;
3138 	struct got_imsg_object_idlist idlist;
3139 	struct ibuf *wbuf;
3140 	size_t i;
3141 
3142 	memset(&idlist, 0, sizeof(idlist));
3143 
3144 	if (nids > GOT_IMSG_OBJ_ID_LIST_MAX_NIDS)
3145 		return got_error(GOT_ERR_NO_SPACE);
3146 
3147 	wbuf = imsg_create(ibuf, GOT_IMSG_OBJ_ID_LIST, 0, 0,
3148 	    sizeof(idlist) + nids * sizeof(**ids));
3149 	if (wbuf == NULL) {
3150 		err = got_error_from_errno("imsg_create OBJ_ID_LIST");
3151 		return err;
3152 	}
3153 
3154 	idlist.nids = nids;
3155 	if (imsg_add(wbuf, &idlist, sizeof(idlist)) == -1)
3156 		return got_error_from_errno("imsg_add OBJ_ID_LIST");
3157 
3158 	for (i = 0; i < nids; i++) {
3159 		struct got_object_id *id = ids[i];
3160 		if (imsg_add(wbuf, id, sizeof(*id)) == -1)
3161 			return got_error_from_errno("imsg_add OBJ_ID_LIST");
3162 	}
3163 
3164 	wbuf->fd = -1;
3165 	imsg_close(ibuf, wbuf);
3166 
3167 	return flush_imsg(ibuf);
3168 }
3169 
3170 const struct got_error *
3171 got_privsep_send_object_idlist(struct imsgbuf *ibuf,
3172     struct got_object_id **ids, size_t nids)
3173 {
3174 	const struct got_error *err = NULL;
3175 	struct got_object_id *idlist[GOT_IMSG_OBJ_ID_LIST_MAX_NIDS];
3176 	int i, queued = 0;
3177 
3178 	for (i = 0; i < nids; i++) {
3179 		idlist[i % nitems(idlist)] = ids[i];
3180 		queued++;
3181 		if (queued >= nitems(idlist)) {
3182 			err = send_idlist(ibuf, idlist, queued);
3183 			if (err)
3184 				return err;
3185 			queued = 0;
3186 		}
3187 	}
3188 
3189 	if (queued > 0) {
3190 		err = send_idlist(ibuf, idlist, queued);
3191 		if (err)
3192 			return err;
3193 	}
3194 
3195 	return NULL;
3196 }
3197 
3198 const struct got_error *
3199 got_privsep_send_object_idlist_done(struct imsgbuf *ibuf)
3200 {
3201 	if (imsg_compose(ibuf, GOT_IMSG_OBJ_ID_LIST_DONE, 0, 0, -1, NULL, 0)
3202 	    == -1)
3203 		return got_error_from_errno("imsg_compose OBJ_ID_LIST_DONE");
3204 
3205 	return flush_imsg(ibuf);
3206 }
3207 
3208 const struct got_error *
3209 got_privsep_recv_object_idlist(int *done, struct got_object_id **ids,
3210     size_t *nids, struct imsgbuf *ibuf)
3211 {
3212 	const struct got_error *err = NULL;
3213 	struct imsg imsg;
3214 	struct got_imsg_object_idlist *idlist;
3215 	size_t datalen;
3216 
3217 	*ids = NULL;
3218 	*done = 0;
3219 	*nids = 0;
3220 
3221 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
3222 	if (err)
3223 		return err;
3224 
3225 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
3226 	switch (imsg.hdr.type) {
3227 	case GOT_IMSG_OBJ_ID_LIST:
3228 		if (datalen < sizeof(*idlist)) {
3229 			err = got_error(GOT_ERR_PRIVSEP_LEN);
3230 			break;
3231 		}
3232 		idlist = imsg.data;
3233 		if (idlist->nids > GOT_IMSG_OBJ_ID_LIST_MAX_NIDS ||
3234 		    idlist->nids * sizeof(**ids) > datalen - sizeof(*idlist)) {
3235 			err = got_error(GOT_ERR_PRIVSEP_LEN);
3236 			break;
3237 		}
3238 		*nids = idlist->nids;
3239 		*ids = calloc(*nids, sizeof(**ids));
3240 		if (*ids == NULL) {
3241 			err = got_error_from_errno("calloc");
3242 			break;
3243 		}
3244 		memcpy(*ids, (uint8_t *)imsg.data + sizeof(*idlist),
3245 		    *nids * sizeof(**ids));
3246 		break;
3247 	case GOT_IMSG_OBJ_ID_LIST_DONE:
3248 		*done = 1;
3249 		break;
3250 	default:
3251 		err = got_error(GOT_ERR_PRIVSEP_MSG);
3252 		break;
3253 	}
3254 
3255 	imsg_free(&imsg);
3256 
3257 	return err;
3258 }
3259 
3260 const struct got_error *
3261 got_privsep_send_delta_reuse_req(struct imsgbuf *ibuf)
3262 {
3263 	if (imsg_compose(ibuf, GOT_IMSG_DELTA_REUSE_REQUEST, 0, 0, -1, NULL, 0)
3264 	    == -1)
3265 		return got_error_from_errno("imsg_compose DELTA_REUSE_REQUEST");
3266 
3267 	return flush_imsg(ibuf);
3268 }
3269 
3270 const struct got_error *
3271 got_privsep_send_reused_deltas(struct imsgbuf *ibuf,
3272     struct got_imsg_reused_delta *deltas, size_t ndeltas)
3273 {
3274 	const struct got_error *err = NULL;
3275 	struct ibuf *wbuf;
3276 	struct got_imsg_reused_deltas ideltas;
3277 	size_t i;
3278 
3279 	memset(&ideltas, 0, sizeof(ideltas));
3280 
3281 	if (ndeltas > GOT_IMSG_REUSED_DELTAS_MAX_NDELTAS)
3282 		return got_error(GOT_ERR_NO_SPACE);
3283 
3284 	wbuf = imsg_create(ibuf, GOT_IMSG_REUSED_DELTAS, 0, 0,
3285 	    sizeof(ideltas) + ndeltas * sizeof(*deltas));
3286 	if (wbuf == NULL) {
3287 		err = got_error_from_errno("imsg_create REUSED_DELTAS");
3288 		return err;
3289 	}
3290 
3291 	ideltas.ndeltas = ndeltas;
3292 	if (imsg_add(wbuf, &ideltas, sizeof(ideltas)) == -1)
3293 		return got_error_from_errno("imsg_add REUSED_DELTAS");
3294 
3295 	for (i = 0; i < ndeltas; i++) {
3296 		struct got_imsg_reused_delta *delta = &deltas[i];
3297 		if (imsg_add(wbuf, delta, sizeof(*delta)) == -1)
3298 			return got_error_from_errno("imsg_add REUSED_DELTAS");
3299 	}
3300 
3301 	wbuf->fd = -1;
3302 	imsg_close(ibuf, wbuf);
3303 
3304 	return flush_imsg(ibuf);
3305 }
3306 
3307 const struct got_error *
3308 got_privsep_send_reused_deltas_done(struct imsgbuf *ibuf)
3309 {
3310 	if (imsg_compose(ibuf, GOT_IMSG_DELTA_REUSE_DONE, 0, 0, -1, NULL, 0)
3311 	    == -1)
3312 		return got_error_from_errno("imsg_compose DELTA_REUSE_DONE");
3313 
3314 	return flush_imsg(ibuf);
3315 }
3316 
3317 const struct got_error *
3318 got_privsep_recv_reused_deltas(int *done, struct got_imsg_reused_delta *deltas,
3319     size_t *ndeltas, struct imsgbuf *ibuf)
3320 {
3321 	const struct got_error *err = NULL;
3322 	struct imsg imsg;
3323 	struct got_imsg_reused_deltas *ideltas;
3324 	size_t datalen;
3325 
3326 	*done = 0;
3327 	*ndeltas = 0;
3328 
3329 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
3330 	if (err)
3331 		return err;
3332 
3333 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
3334 	switch (imsg.hdr.type) {
3335 	case GOT_IMSG_REUSED_DELTAS:
3336 		if (datalen < sizeof(*ideltas)) {
3337 			err = got_error(GOT_ERR_PRIVSEP_LEN);
3338 			break;
3339 		}
3340 		ideltas = imsg.data;
3341 		if (ideltas->ndeltas > GOT_IMSG_OBJ_ID_LIST_MAX_NIDS ||
3342 		    ideltas->ndeltas * sizeof(*deltas) >
3343 		    datalen - sizeof(*ideltas)) {
3344 			err = got_error(GOT_ERR_PRIVSEP_LEN);
3345 			break;
3346 		}
3347 		*ndeltas = ideltas->ndeltas;
3348 		memcpy(deltas, (uint8_t *)imsg.data + sizeof(*ideltas),
3349 		    *ndeltas * sizeof(*deltas));
3350 		break;
3351 	case GOT_IMSG_DELTA_REUSE_DONE:
3352 		*done = 1;
3353 		break;
3354 	default:
3355 		err = got_error(GOT_ERR_PRIVSEP_MSG);
3356 		break;
3357 	}
3358 
3359 	imsg_free(&imsg);
3360 
3361 	return err;
3362 }
3363 
3364 const struct got_error *
3365 got_privsep_init_commit_painting(struct imsgbuf *ibuf)
3366 {
3367 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_PAINTING_INIT,
3368 	    0, 0, -1, NULL, 0)
3369 	    == -1)
3370 		return got_error_from_errno("imsg_compose "
3371 		    "COMMIT_PAINTING_INIT");
3372 
3373 	return flush_imsg(ibuf);
3374 }
3375 
3376 const struct got_error *
3377 got_privsep_send_painting_request(struct imsgbuf *ibuf, int idx,
3378     struct got_object_id *id, intptr_t color)
3379 {
3380 	struct got_imsg_commit_painting_request ireq;
3381 
3382 	memset(&ireq, 0, sizeof(ireq));
3383 	memcpy(ireq.id, id->sha1, sizeof(ireq.id));
3384 	ireq.idx = idx;
3385 	ireq.color = color;
3386 
3387 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_PAINTING_REQUEST, 0, 0, -1,
3388 	    &ireq, sizeof(ireq)) == -1)
3389 		return got_error_from_errno("imsg_compose "
3390 		    "COMMIT_PAINTING_REQUEST");
3391 
3392 	return flush_imsg(ibuf);
3393 }
3394 
3395 static const struct got_error *
3396 send_painted_commits(struct got_object_id_queue *ids, int *nids,
3397     size_t remain, int present_in_pack, struct imsgbuf *ibuf)
3398 {
3399 	const struct got_error *err = NULL;
3400 	struct ibuf *wbuf = NULL;
3401 	struct got_object_qid *qid;
3402 	size_t msglen;
3403 	int ncommits;
3404 	intptr_t color;
3405 
3406 	msglen = MIN(remain, MAX_IMSGSIZE - IMSG_HEADER_SIZE);
3407 	ncommits = (msglen - sizeof(struct got_imsg_painted_commits)) /
3408 	    sizeof(struct got_imsg_painted_commit);
3409 
3410 	wbuf = imsg_create(ibuf, GOT_IMSG_PAINTED_COMMITS, 0, 0, msglen);
3411 	if (wbuf == NULL) {
3412 		err = got_error_from_errno("imsg_create PAINTED_COMMITS");
3413 		return err;
3414 	}
3415 
3416 	/* Keep in sync with struct got_imsg_painted_commits! */
3417 	if (imsg_add(wbuf, &ncommits, sizeof(ncommits)) == -1)
3418 		return got_error_from_errno("imsg_add PAINTED_COMMITS");
3419 	if (imsg_add(wbuf, &present_in_pack, sizeof(present_in_pack)) == -1)
3420 		return got_error_from_errno("imsg_add PAINTED_COMMITS");
3421 
3422 	while (ncommits > 0) {
3423 		qid = STAILQ_FIRST(ids);
3424 		STAILQ_REMOVE_HEAD(ids, entry);
3425 		ncommits--;
3426 		(*nids)--;
3427 		color = (intptr_t)qid->data;
3428 
3429 		/* Keep in sync with struct got_imsg_painted_commit! */
3430 		if (imsg_add(wbuf, qid->id.sha1, SHA1_DIGEST_LENGTH) == -1)
3431 			return got_error_from_errno("imsg_add PAINTED_COMMITS");
3432 		if (imsg_add(wbuf, &color, sizeof(color)) == -1)
3433 			return got_error_from_errno("imsg_add PAINTED_COMMITS");
3434 
3435 		got_object_qid_free(qid);
3436 	}
3437 
3438 	wbuf->fd = -1;
3439 	imsg_close(ibuf, wbuf);
3440 
3441 	return flush_imsg(ibuf);
3442 }
3443 
3444 const struct got_error *
3445 got_privsep_send_painted_commits(struct imsgbuf *ibuf,
3446     struct got_object_id_queue *ids, int *nids,
3447     int present_in_pack, int flush)
3448 {
3449 	const struct got_error *err;
3450 	size_t remain;
3451 
3452 	if (*nids <= 0)
3453 		return NULL;
3454 
3455 	do {
3456 		remain = (sizeof(struct got_imsg_painted_commits)) +
3457 		    *nids * sizeof(struct got_imsg_painted_commit);
3458 		if (flush || remain >= MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
3459 			err = send_painted_commits(ids, nids, remain,
3460 			    present_in_pack, ibuf);
3461 			if (err)
3462 				return err;
3463 		}
3464 	} while (flush && *nids > 0);
3465 
3466 	return NULL;
3467 }
3468 
3469 const struct got_error *
3470 got_privsep_send_painting_commits_done(struct imsgbuf *ibuf)
3471 {
3472 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_PAINTING_DONE,
3473 	    0, 0, -1, NULL, 0)
3474 	    == -1)
3475 		return got_error_from_errno("imsg_compose "
3476 		    "COMMIT_PAINTING_DONE");
3477 
3478 	return flush_imsg(ibuf);
3479 }
3480 
3481 const struct got_error *
3482 got_privsep_recv_painted_commits(struct got_object_id_queue *new_ids,
3483     got_privsep_recv_painted_commit_cb cb, void *cb_arg, struct imsgbuf *ibuf)
3484 {
3485 	const struct got_error *err = NULL;
3486 	struct imsg imsg;
3487 	struct got_imsg_painted_commits icommits;
3488 	struct got_imsg_painted_commit icommit;
3489 	size_t datalen;
3490 	int i;
3491 
3492 	for (;;) {
3493 		err = got_privsep_recv_imsg(&imsg, ibuf, 0);
3494 		if (err)
3495 			return err;
3496 
3497 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
3498 		if (imsg.hdr.type == GOT_IMSG_COMMIT_PAINTING_DONE)
3499 			break;
3500 		if (imsg.hdr.type != GOT_IMSG_PAINTED_COMMITS)
3501 			return got_error(GOT_ERR_PRIVSEP_MSG);
3502 
3503 		if (datalen < sizeof(icommits))
3504 			return got_error(GOT_ERR_PRIVSEP_LEN);
3505 		memcpy(&icommits, imsg.data, sizeof(icommits));
3506 		if (icommits.ncommits * sizeof(icommit) < icommits.ncommits ||
3507 		    datalen < sizeof(icommits) +
3508 		    icommits.ncommits * sizeof(icommit))
3509 			return got_error(GOT_ERR_PRIVSEP_LEN);
3510 
3511 		for (i = 0; i < icommits.ncommits; i++) {
3512 			memcpy(&icommit,
3513 			    (uint8_t *)imsg.data + sizeof(icommits) + i * sizeof(icommit),
3514 			    sizeof(icommit));
3515 
3516 			if (icommits.present_in_pack) {
3517 				struct got_object_id id;
3518 				memcpy(id.sha1, icommit.id, SHA1_DIGEST_LENGTH);
3519 				err = cb(cb_arg, &id, icommit.color);
3520 				if (err)
3521 					break;
3522 			} else {
3523 				struct got_object_qid *qid;
3524 				err = got_object_qid_alloc_partial(&qid);
3525 				if (err)
3526 					break;
3527 				memcpy(qid->id.sha1, icommit.id,
3528 				    SHA1_DIGEST_LENGTH);
3529 				qid->data = (void *)icommit.color;
3530 				STAILQ_INSERT_TAIL(new_ids, qid, entry);
3531 			}
3532 		}
3533 
3534 		imsg_free(&imsg);
3535 	}
3536 
3537 	return err;
3538 }
3539 
3540 const struct got_error *
3541 got_privsep_unveil_exec_helpers(void)
3542 {
3543 	const char *helpers[] = {
3544 	    GOT_PATH_PROG_READ_PACK,
3545 	    GOT_PATH_PROG_READ_OBJECT,
3546 	    GOT_PATH_PROG_READ_COMMIT,
3547 	    GOT_PATH_PROG_READ_TREE,
3548 	    GOT_PATH_PROG_READ_BLOB,
3549 	    GOT_PATH_PROG_READ_TAG,
3550 	    GOT_PATH_PROG_READ_GITCONFIG,
3551 	    GOT_PATH_PROG_READ_GOTCONFIG,
3552 	    GOT_PATH_PROG_READ_PATCH,
3553 	    GOT_PATH_PROG_FETCH_PACK,
3554 	    GOT_PATH_PROG_INDEX_PACK,
3555 	    GOT_PATH_PROG_SEND_PACK,
3556 	};
3557 	size_t i;
3558 
3559 	for (i = 0; i < nitems(helpers); i++) {
3560 		if (unveil(helpers[i], "x") == 0)
3561 			continue;
3562 		return got_error_from_errno2("unveil", helpers[i]);
3563 	}
3564 
3565 	return NULL;
3566 }
3567 
3568 void
3569 got_privsep_exec_child(int imsg_fds[2], const char *path, const char *repo_path)
3570 {
3571 	if (close(imsg_fds[0]) == -1) {
3572 		fprintf(stderr, "%s: %s\n", getprogname(), strerror(errno));
3573 		_exit(1);
3574 	}
3575 
3576 	if (dup2(imsg_fds[1], GOT_IMSG_FD_CHILD) == -1) {
3577 		fprintf(stderr, "%s: %s\n", getprogname(), strerror(errno));
3578 		_exit(1);
3579 	}
3580 
3581 	closefrom(GOT_IMSG_FD_CHILD + 1);
3582 
3583 	if (execl(path, path, repo_path, (char *)NULL) == -1) {
3584 		fprintf(stderr, "%s: %s: %s\n", getprogname(), path,
3585 		    strerror(errno));
3586 		_exit(1);
3587 	}
3588 }